SoFi Technologies, Inc.

Current report

We have recently issued a proprietary stablecoin named SoFiUSD. The design, issuance, and operation of a stablecoin could expose us to a range of significant risks, including regulatory, operational, liquidity, technological, and reputational risks. The legal and regulatory framework governing stablecoins remains uncertain and is evolving rapidly in the United States and internationally. The Guiding and Establishing National Innovation for U.S. Stablecoins Act (the “GENIUS Act”) was enacted on July 18, 2025, and will become effective on January 18, 2027. In October 2026, the OCC issued a final rule implementing the GENIUS Act for payment stablecoin issuers subject to its jurisdiction, which also takes effect on January 18, 2027. The OCC rule establishes requirements for, among other things, permitted activities, reserve assets, redemption, capital and operational backstops, custody, risk management, reporting, and licensing. Other implementing regulations remain in proposed form. These include rules addressing anti-money laundering and sanctions compliance program requirements proposed by FinCEN, OFAC and the OCC, and rules proposed by the U.S. Department of the Treasury, the Federal Reserve and the FDIC. These proposals may not be finalized before the GENIUS Act's effective date, and they may be adopted in forms that differ materially from their proposed form. The OCC has also indicated that it expects to update its regulations as the industry evolves.

Current report

For example, beginning on January 18, 2027, subject to limited waiver provisions, only a permitted payment stablecoin issuer (“PPSI”) may lawfully issue a payment stablecoin in the United States. Issuing a payment stablecoin without that approval may result in civil and criminal penalties. A PPSI includes a subsidiary of an insured depository institution that has been approved by its primary Federal payment stablecoin regulator to issue payment stablecoins. For the Bank, that regulator is the OCC. Payment stablecoin issuance activities conducted before the effective date are not grandfathered. Accordingly, the Bank's payment stablecoin activities will need to transition to a subsidiary of the Bank that is approved as a PPSI. This will require, among other things, the submission and approval of an application to the OCC.

Current report

The OCC has stated that it will separately announce when it will begin accepting applications and waiver requests. Under the GENIUS Act and the OCC's rule, the OCC may waive certain requirements for up to 12 months after January 18,

Current report

2027 for an issuer with a substantially complete application pending on or before that date. We intend to submit such an application and request a waiver. However, we cannot assure you that the OCC will begin accepting applications in time, that our application will be deemed substantially complete, or that a waiver will be granted, or granted on acceptable terms. We also cannot assure you that the OCC will approve our application within any particular time frame, or at all, or without conditions that restrict our activities, products, or arrangements with distribution partners.

Current report

If we are unable to obtain timely approval or a waiver, we may be required to suspend or cease issuing SoFiUSD, which could adversely affect our business. In addition, the OCC's rule requires PPSIs to maintain minimum capital and operational backstops and submit weekly and quarterly reports to the OCC. It also restricts the payment of interest or yield to holders solely in connection with holding, using, or retaining a payment stablecoin. These requirements may limit how we structure SoFiUSD, related rewards, and our partner arrangements. Violations could result in enforcement action, including civil money penalties, and could ultimately require the orderly wind-down of the PPSI. The issuance and operation of SoFiUSD also presents unique compliance challenges. We are already subject to anti-money laundering, sanctions, and related compliance obligations under the Bank Secrecy Act, the USA PATRIOT Act, and regulations administered by FinCEN and OFAC. The GENIUS Act provides that PPSIs are treated as financial institutions for Bank Secrecy Act purposes. Rules proposed by FinCEN and OFAC, and separately by the OCC, would require PPSIs to maintain specific anti-money laundering and sanctions compliance programs. These programs would include risk assessment processes and independent testing. PPSIs would also need to have the technical capability to comply, and to actually comply, with lawful orders to block, freeze, or reject specific or impermissible transactions. The final form and timing of these rules is uncertain, and complying with them may require significant changes to our systems, smart contract functionality, and controls.

Current report

Our issuance of SoFiUSD also exposes us to counterparty, operational and liquidity risks. We engage a third party sub-servicer to provide technical and operational services, including for reserve management, and a portion of SoFiUSD reserve assets may be held in custodial accounts at other regulated financial institutions. The OCC's rule requires that reserve assets be identifiable and segregated, and that reserves equal or exceed outstanding issuance at all times. It requires that at least 5% of reserve assets be held in highly liquid forms such as demand deposits, and it limits exposure to any single counterparty to 40% of reserves, subject to exceptions. It also requires stress testing and a demonstrated ability to monetize reserve assets under stressed conditions. Where warranted, PPSIs must hold reserves in excess of outstanding issuance. Meeting these requirements may constrain our selection of reserve assets, custodians, and counterparties, and reduce the income we earn on reserves. A PPSI that fails to meet reserve requirements for 15 consecutive business days must begin liquidating reserve assets and redeeming outstanding stablecoins. A failure, insolvency, misappropriation, or other inability to perform by our sub-servicer, a custodian, or another counterparty could limit our access to reserve assets and impair our ability to satisfy redemptions or maintain the value and liquidity of SoFiUSD. We also face risks related to redemption demands and market stress. Under the OCC's rule, a PPSI must generally complete redemptions within two business days of receiving a request from an onboarded customer. It must notify the OCC within 24 hours if redemption requests exceed 10% of outstanding issuance, and only the OCC may approve limits or extensions on redemptions. As a result, we may have limited ability to manage liquidity during periods of extreme stress. Failure to maintain a stable value or to meet redemption requests on time could result in financial losses, customer claims, regulatory action, and reputational harm.

Current report — wording carried from elsewhere

The transition of our stablecoin activities to a PPSI subsidiary may also raise new accounting, consolidation, and regulatory capital considerations. So may the new requirements for segregated reserves, capital and backstops, and regulatory reporting. These matters may affect how we present SoFiUSD liabilities, reserve assets, and related income in our financial statements. Uncertainties in or changes to regulatory or financial accounting standards could result in the need to change our accounting methods and/or restate our financial statements. They could also impair our ability to provide timely and accurate financial information. Any of these outcomes could adversely affect our financial statements, result in a loss of investor confidence, and more generally impact our business, results of operations, financial condition, and prospects.