Bakkt Holdings Inc

Each of our products is architected, deployed, and managed through a common controls environment designed to protect our customers' confidential information using a combination of administrative, physical, and technical controls. We maintain a comprehensive cyber security program, managed by a dedicated team of security professionals, leveraging multiple layers of defenses to protect our loyalty and crypto clients’ consumer data, as well as crypto wallets, including crypto that is kept in custody. Our administrative, technical, and physical controls include the use of separation of duties, physical and logical access controls, biometrics, hardware security modules, advanced cryptographic algorithms, dedicated security monitoring, and other controls to protect our environment and restrict unauthorized access. Additionally, we regularly utilize independent external parties to assess and provide added assurance that our products are designed appropriately and operating effectively. We currently maintain independent SSAE-18 SOC 1 Type II and SOC 2 Type II attestation reports for our crypto platform and SOC 2 Type II attestation reports for our loyalty platform. We also maintain controls aligned to the Payment Card Industry Data Security Standard ("PCI-DSS") for in-scope systems where cardholder

-23- data is stored or processed. We comply with NYDFS cybersecurity requirements which impose strict rules related to establishing a detailed cybersecurity plan, enacting a comprehensive cybersecurity policy, and maintaining an ongoing reporting system for cybersecurity events.

Regulation

International, federal and state laws and regulations apply to many key aspects of our business. Any actual or perceived failure to comply with these requirements may result in, among other things, revocation of required licenses or registrations, loss of approved status, regulatory or governmental investigations, administrative enforcement actions, sanctions, civil and criminal liability, private litigation, reputational harm, or constraints on our ability to continue to operate. We operate in a regulatory environment that is evolving rapidly and increasing in scope. As such, it is possible that current or future laws or regulations could be enacted, interpreted or applied in a manner that would prohibit, alter, or impair our existing or planned products and services, or that could require costly, time-consuming, or otherwise burdensome compliance measures. Further, additional laws and regulations may apply to our businesses as we expand outside of the United States in the future. For more information, please see our risk factors described in“Item 1A. Risk Factors - Risks Related to Regulation, Taxation and Laws”.

Regulation of Our Money Transmission Business. Bakkt Marketplace and Bakkt Crypto maintain a money transmitter license in each jurisdiction in which they operate that requires such a license for our activities. In all other jurisdictions where Bakkt Marketplace and Bakkt Crypto operate, we have established with the applicable licensing body that a money transmitter license is not required at this time. We will comply with new license requirements as they arise. Bakkt Marketplace and Bakkt Crypto are also registered as a "Money Services Business" with the U.S. Department of Treasury’s Financial Crimes Enforcement Network (“FinCEN”). These licenses and registrations subject us to, among other things, record-keeping requirements, reporting requirements, bonding requirements, limitations on the investment of customer funds, and examination by state and federal regulatory agencies. These licensing laws also address matters such as change in control, and regulatory approval of controlling shareholders, directors, and senior management of the licensed entity.

Regulation of Our Virtual Currency Business. We provide crypto custody services through Bakkt Trust, a limited purpose trust company that is chartered under the New York Banking Law and subject to the supervision and oversight of NYDFS. Consequently, we must comply with laws, rules and regulations promulgated pursuant to the New York Banking Law with respect to the crypto custody services we provide through Bakkt Trust, including those related to capitalization, corporate governance, anti-money laundering, disclosure, reporting and examination, as well as supervisory guidance and requirements. Bakkt Trust is also subject to FinCEN requirements as a financial institution.

We are subject in certain jurisdictions to licensing and regulatory requirements as a result of offering our clients the ability to aggregate, buy, sell, convert, and send virtual currency through our platform. Consequently, we must comply with laws, rules and regulations promulgated by federal or state regulators in those jurisdictions in order to provide our services, including requirements related to capitalization, consumer protection, anti-money laundering, disclosure, reporting and examination, as well as supervisory guidance and requirements. Bakkt Marketplace and Bakkt Crypto also have virtual currency licenses (“BitLicenses”) from the NYDFS, which subject them to NYDFS's oversight with respect to business activities conducted in New York State and with New York residents. In October 2023, the governor of California signed into law the Digital Financial Assets Law (“DFAL”), which establishes a required licensing framework administered by the California Department of Financial Protection and Innovation (“DFPI”) for entities engaged in digital financial asset business activity in the state of California. We expect that our business will require licensure under the DFAL and will therefore take steps to obtain necessary licenses prior to the enactment’s effective date of July 1, 2025. The DFAL provides that the DFPI may issue a conditional license to companies, such as our subsidiaries, that maintain licenses to conduct virtual currency business activity in New York or hold a charter as a New York limited purpose trust company with approval to conduct a virtual currency business under New York law. We will continue to monitor and review guidance from the DFPI clarifying the enactment’s scope and interpretation.

-24-

The laws and regulations applicable to crypto are rapidly evolving and subject to interpretation and change. For instance, the Securities and Exchange Commission (the “SEC”) has indicated in various enforcement actions and other contexts that it considers certain crypto assets to constitute securities. The SEC has yet to issue any formal regulation on this point, though it has put forth some guidance on overarching frameworks and relevant factors to consider in this analysis. Therefore, our crypto services offered through our platform may become subject to regulation by other authorities and/or may subject us to additional requirements.

Broker-Dealer Regulation. The Exchange Act requires that any person who is a broker or a dealer and effects or induces securities transactions must register with the SEC. A broker is defined as “any person engaged in the business of effecting transactions in securities for the account of others,” while a dealer is defined as “any person engaged in the business of buying and selling securities for such person’s own account,” in each case, subject to exceptions. In order to be able to act as a broker and advise clients interested in transactions that involve securities, we acquired Bakkt Brokerage, a registered broker-dealer. Broker-dealers are subject to regulation, examination, investigation, and disciplinary action by the SEC, FINRA, and state securities regulators, as well as other governmental authorities and self-regulatory organizations with which they are registered or licensed or of which they are a member. Bakkt Brokerage is registered as a broker-dealer in 52 U.S. states and territories. The regulation of broker-dealers covers all aspects of the broker-dealer business and operations, including, depending the scope of its activities, among other things, sales and trading practices and reporting requirements, client onboarding, advertising and marketing, publication or distribution of research, margin lending, uses and safekeeping of clients’ funds and securities, capital adequacy, recordkeeping, reporting, fee arrangements, disclosures to clients, suitability, acting in client’s best interests when making recommendations to retail customers, customer privacy, data protection, information security and cybersecurity, the safeguarding of customer information, the sharing of customer information, best execution of customer orders, public offerings, customer qualifications for margin and options transactions, registration of personnel, business continuity planning, transactions with affiliates, conflicts, and the conduct of directors, officers and employees. Broker-dealers are also subject to anti-money laundering rules and requirements issued by FinCEN under the U.S. Bank Secrecy Act.

Privacy and Information Cybersecurity Regulations. Aspects of our operations or business are subject to laws and regulation in the United States and in foreign jurisdictions relating to privacy, data protection and cybersecurity. Accordingly, we publish our privacy policies and terms of service, which describe our practices concerning the use, protection, transmission, and disclosure of information. As our business continues to expand in the United States and beyond, and as laws and regulations continue to be passed and their interpretations continue to evolve in numerous jurisdictions, additional laws and regulations may become relevant to us.

Regulatory authorities around the world are considering numerous legislative and regulatory proposals concerning privacy, data protection and cybersecurity. In addition, the interpretation and application of these laws and regulations in the United States and elsewhere are often uncertain and in a state of flux. As our business continues to develop and expand, we continue to monitor the additional rules and regulations that may become relevant. For additional information regarding these laws and regulations and related risks, please see “Risk Factors – Risks Related to Regulation, Taxation, and Laws – Complying with evolving laws and requirements relating to privacy, and other data related laws and requirements may be expensive and force us to make changes to our business, and failure to comply with such laws and requirements could result in substantial harm to our business.”

Consumer Protection Regulation. The Consumer Financial Protection Bureau and other federal and state regulatory agencies, including the Federal Trade Commission, broadly regulate financial products, enforce consumer protection laws applicable to credit, deposit, prepaid products, and payments, and other similar products. Such agencies have broad consumer protection mandates, and they promulgate, interpret, and enforce laws, rules and regulations, including with respect to unfair, deceptive, and abusive acts and practices that may impact or apply to our business.

For example, under federal and state financial privacy laws and regulations, we must provide notice to consumers of our policies on sharing non-public information with third parties, among other requirements. In addition, under the Electronic Fund Transfer Act, we are required to disclose the terms of, and any fees applicable to, our electronic fund

-25- transfer services to consumers prior to their use of the service, among other requirements. We are further required to extend error resolution and limited liability protections to customers who use our card product.

Anti-Money Laundering and Counter-Terrorism Regulation. We are subject to AML laws and regulations in the United States, including the BSA, as amended, and its implemented regulations enforced by FinCEN, as well as laws designed to prevent the use of the financial systems to facilitate terrorist activities. We have implemented a comprehensive AML compliance program designed to prevent our payments network and custody services from being used to facilitate money laundering, terrorist financing, and other illicit activity. Our program is also designed to prevent our network and other services from being used to facilitate business in countries, or with persons or entities, included on designated lists promulgated by OFAC and equivalent authorities in other countries. Our AML compliance program is comprised of policies, procedures, reporting protocols, including reporting requirements for suspicious transactions, and internal controls, including the designation of a compliance officer, training for employees, and a regular independent review of the program. It is designed to address applicable legal and regulatory requirements and to assist in managing risk associated with money laundering and terrorist financing.

Indirect Regulatory Requirements. We maintain relationships with certain clients, including banks and other financial institutions in the United States, that are regulated by state, local and federal agencies. Because of these relationships, we may be subject to indirect regulation or examination by these institutions' regulators. We generally seek to account for these types of indirect regulatory requirements in our commercial agreements. We also have clients that are investments advisors. The SEC has recently proposed changes to its investment adviser custody rule, which could affect the terms upon which we can offer custody services to those clients.

Escheatment and Unclaimed Property Regulations. There is regulatory uncertainty regarding how states and jurisdictions treat virtual currencies and other crypto assets under unclaimed property laws and regulations. Unclaimed property laws, as may be applicable, require us to report and to remit certain government authorities the property of others held by us that has been unclaimed for a specified period of time. We have policies and procedures designed to help us comply with these laws.

Intellectual Property

The protection of our intellectual property and all corresponding rights throughout the world, including our trademarks, service marks, trade dress, logos, trade names, domain names, goodwill, patents, copyrights, works of authorship (whether or not copyrightable), software and trade secrets, know-how, and proprietary and other confidential information, together with all applications, registrations, renewals, extensions, improvements and counterparts in connection with any of the foregoing, is important to the success of our business. We seek to protect our intellectual property rights by filing applications in various patent, trademark and other government offices, and relying on applicable laws and regulations in the U.S. and internationally, as well as a variety of administrative procedures. We have sought to register our core brands as domain names and as trademarks and service marks in the U.S. and a large number of other jurisdictions. We also have in place an active program to continue to secure, police and enforce trademarks, service marks, trade dress, logos, trade names, and domain names that correspond to our brands in markets of interest. We have filed patent applications in the U.S. covering certain aspects of our proprietary technology and new innovations. We also rely on contractual restrictions to protect our proprietary rights where appropriate when offering or procuring products and services. We have routinely entered into confidentiality and invention disclosure and assignment agreements with our employees and contractors, and non-disclosure agreements with external parties with whom we conduct business to control access to, and use and disclosure of, our proprietary information.

Human Capital

Our employees are essential in propelling our success. We hold our employees to high standards, both in work product and ethics, and aim to create a culture of accountability and results. Our performance expectations and attributes empower our company. They reflect how we expect employees to operate, collaborate and make decisions. At Bakkt, we

-26- strive to challenge the status quo with new ideas, have open and honest communications, appreciate our diversity of thought, take ownership and accountability for delivering valuable results and act with integrity, respect and reliability.

In a complex industry, it is critical for employees to act ethically. We provide regular training to help our employees understand and comply with the many regulations in our industry and with our company policies. We expect managers to set the tone for their teams and to lead by example, including by embracing ethical behavior and sharing its importance with their team. Managers are expected to help their teams understand our company policies and encourage them to report any violations of policy or law. As a company, we help ensure Bakkt’s non-retaliation policy is strictly followed.

At Bakkt, we understand that our success is built by operating as a unified company – one culture and team across the crypto landscape, with a focus on growth and innovation. We are committed to diversity throughout our company. It is our policy that employees are treated, and treat each other, with fairness, respect and dignity. We embrace our employees’ differences, while valuing a diverse, inclusive and safe workplace. We aim to promote diversity and inclusion through a number of employee engagement events including internal and external speaker sessions to foster learning on relevant and important topics. Our employees come from a wide variety of backgrounds to work toward a common vision for the Company. Our CEO brings our teams together in bi-weekly all hands calls and sends weekly email updates for transparency regarding our company strategy and goals.

We strive to hold employees accountable for their work performance while providing incentives for excellence in their contributions to the Company. We encourage open collaboration to put out the best ideas and solutions to better adapt to changing markets and other challenges Bakkt faces. Our commitment to our employees is reflected in our ability to attract high-caliber talent, continuously innovate, and provide exceptional service and solutions to our clients.

As of December 31, 2023, we had a total of 747 employees, all of whom were full-time employees, and are located in the United States. We also engage temporary employees, consultants and employers of record as needed to support our operations. Collectively, approximately 16% of our workforce is dedicated to engineering, design, or product roles. Our core locations are Alpharetta, GA, Scottsdale, AZ and New York City, NY. None of our employees are represented by a labor union or covered by a collective bargaining agreement. We have not experienced any work stoppages, and we consider our relations with our employees to be good.

Available Information

Our website is http://www.bakkt.com, and our investor relations website is located at https://investors.bakkt.com, where we make available, free of charge, our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q and Current Reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, as well as proxy statements, as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC.

We use our investor relations website to post important information for investors, including news releases, analyst presentations, and supplemental financial information, and as a means of disclosing material non-public information and for complying with our disclosure obligations under Regulation FD. We use these channels as well as social media to communicate with the public about our company. It is possible that the information we post on social media could be deemed to be material information. Accordingly, investors should monitor our investor relations website as well as the social media channels listed on our investor relations website. The information on our website or any other website is not incorporated by reference into this Annual Report on Form 10-K.