Circle Internet Group, Inc. Class A (CRCL) Risk Analysis

Various local, state, federal, and foreign laws, directives, and regulations apply to our collection, use, retention, protection, disclosure, transfer, and any other processing of personal data. There is uncertainty and inconsistency in how these data protection and privacy laws and regulations are interpreted and applied, and they continue to evolve in ways that could adversely impact our business. These laws have a substantial impact on our operations both outside and in the United States, directly as a data controller/business and as a data processor/service provider and handler for various offshore entities. Laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet may be or become applicable to our business, such as the Federal Communications Act, the Federal Wiretap Act, the Electronic Communications Privacy Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (the "CAN-SPAM Act"), and similar state consumer protection and communication privacy laws, such as the California Invasion of Privacy Act. We may make telephone calls and send short message service ("SMS") text messages to customers. The actual or perceived improper calling of customer phones or sending of text messages may subject us to potential risks. Federal or state regulatory authorities, regulatory authorities in foreign jurisdictions, or private litigants may claim that the notices and disclosures we provide, forms of consent we obtain, or our calling or SMS texting practices are not adequate or violate applicable law. This may in the future result in civil claims against us. We also send marketing messages via email and are subject to the CAN-SPAM Act. The CAN-SPAM Act imposes certain obligations regarding the content of commercial emails and providing recipients a mechanism to opt out of receiving such emails (with the corresponding requirement to honor such opt-out requests promptly). While we strive to ensure that all of our marketing communications comply with the requirements of the CAN-SPAM Act, we could nonetheless commit violations that could result in civil or criminal penalties. In addition, the scope and interpretation of the laws that are or may be applicable to the delivery of text messages or email marketing are continuously evolving and developing. If we do not comply with these laws or regulations, we could face direct liability, could be required to change some portions of our marketing strategy, or could face negative publicity, and our business, results of operations, financial condition, and prospects could be adversely affected. Even an unsuccessful challenge of our calling or SMS texting practices by our customers, regulatory authorities, or other third parties could result in negative publicity and could require a costly response from and defense by us. In the United States, federal and state lawmakers and regulatory authorities have increased their attention to the collection and use of consumer data. For example, certain states in the United States have enacted stringent privacy and data protection legislation and regulations, such as the California Consumer Privacy Act (the "CCPA"), which gives California residents the right to access and request deletion of their personal data, opt out of the sale of personal data, and receive detailed information about how their personal data is processed, and provides a private right of action for certain data breaches involving the loss of personal data. The California Privacy Rights Act modified the CCPA by expanding consumers' rights with respect to certain personal data and creating a new state agency to oversee implementation and enforcement efforts. Another example is the Virginia Consumer Data Protection Act, which regulates how businesses collect and share personal information. With bills proposed in many other jurisdictions, it remains quite possible that other states will enact similar privacy and data protection legislation. Such proposed legislation, if enacted, may add additional complexity, conflicting requirements, additional restrictions, and potential legal risk. The existence of comprehensive privacy laws in different states will make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance. As a result of our presence in Europe and some of our customers being located in the European Union and the United Kingdom, we are subject to the EU's General Data Protection Regulation ("GDPR") and the UK General Data Protection Regulation (the "UK GDPR"). These regimes impose stringent data protection requirements and may increase both the risk of noncompliance and the costs of providing our products and services in a compliant manner. These regimes grant rights for data subjects in regard to their personal data (including the right to be "forgotten" and the right to data portability) and enhance preexisting rights (e.g., data subject access requests). A breach of the GDPR or UK GDPR could result in regulatory investigations, reputational damage, fines and sanctions, orders to cease or change our processing of our data, enforcement notices, assessment notices (for a compulsory audit), and civil claims, including representative actions and other class action-type litigation. Further, Post-Brexit, the UK GDPR will not automatically incorporate changes made to the GDPR going forward, which creates a risk that the GDPR and the UK GDPR may increasingly diverge from each other, thereby increasing both our compliance costs and the potential for noncompliance. In addition, the GDPR imposes strict rules on the transfer of personal data out of the EEA to a "third country", including the United States. The same is true for the UK GDPR. These obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other requirements or our practices. On July 11, 2023, the European Commission entered into force its adequacy decision for the EU-U.S. Data Privacy Framework (the "EU-U.S. DPF") (a new framework for transferring personal information from the EEA to the United States), having determined that such framework ensures that the protection of personal information transferred from the EEA to the United States will be comparable to the protection offered in the EU. However, this decision will likely face legal challenges and ultimately may be invalidated by the Court of Justice of the European Union just as the EU-U.S. Privacy Shield Framework was. Additionally, on October 12, 2023, a UK-U.S. Data Bridge went into effect to operate as an extension of the EU-U.S. DPF to facilitate transfers of personal data from the United Kingdom to the United States. Such Data Bridge could not only be challenged, but also may be affected by any challenges to the EU-U.S. DPF. Complying with these obligations and applicable guidance regarding cross-border data transfers could be expensive and time-consuming. It may require us to modify our data handling policies and procedures, update and implement revised standard contractual clauses and other relevant documentation and measures for intragroup, customer, and vendor arrangements requiring transfers of personal information, and may ultimately prevent or restrict us from transferring personal data outside Europe or the United Kingdom, which could cause significant business disruption and affect the manner in which we provide our services and the geographical location or segregation of our relevant systems and operations. We are also subject to evolving EU privacy laws on cookies and e-marketing. In the EU, regulators are increasingly focusing on compliance with requirements in the online behavioral advertising ecosystem, and EU national laws that implement the ePrivacy Directive (Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector) may be replaced by an EU regulation known as the ePrivacy Regulation, which may alter rules on tracking technologies, impose burdensome requirements surrounding obtaining consent, and significantly increase fines for noncompliance. In the EU, informed consent-including a prohibition on pre-checked consents and a requirement to ensure separate consents for each cookie-is required for the placement of a cookie or similar technologies on a user's device and for direct electronic marketing (and under the GDPR and the UK GDPR). Valid consent is tightly defined, including a prohibition on pre-checked consents for each type of cookie or similar technology. While the text of the ePrivacy Regulation is still under development, enforcement of the ePrivacy Regulation could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, negatively impact our efforts to understand customers, adversely affect our margins, increase costs, and subject us to additional liabilities. As these and other laws and regulations continue to evolve and be enacted, or new interpretations of existing laws and regulations are applied, we may need to modify our data processing practices, agreements, and policies, which could incur substantial costs. Restrictions on the collection, use, sharing, or disclosure of personal information or additional requirements and liability for security and data integrity could require us to modify our solutions and features, possibly in a material manner. Such restrictions could also limit our ability to develop new services and features, and could subject us to increased compliance obligations and regulatory scrutiny. We use a variety of technical and organizational security measures and other measures to protect the data we process, including personal data pertaining to our customers, employees, and business partners. Despite the measures we put in place, we may be unable to anticipate or prevent unauthorized access to such personal data. Moreover, while we strive to publish and prominently display privacy policies that are accurate, comprehensive, and compliant with applicable laws, rules, regulations, and industry standards, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient to protect us from claims, proceedings, liability, or adverse publicity. Although we endeavor to comply with our privacy policies, we may at times fail to do so or be alleged to have failed to do so. If our public statements about our use, collection, disclosure, and other processing of personal information-whether made through our privacy policies, information provided on our website, press statements, or otherwise-are alleged to be deceptive, unfair, or misrepresentative of our actual practices, we may be subject to potential government investigations and enforcement actions, including by the FTC or relevant state attorneys general. Despite our efforts to comply with applicable laws, regulations, and other obligations relating to privacy, data protection, and information security, it is possible that our practices or technology could fail, or be alleged to fail to meet applicable requirements. For instance, the overall regulatory framework governing the application of privacy laws to blockchain technology is still undeveloped and likely to evolve. Data protection authorities may adopt different views than we do with respect to the classification and protection of data associated with blockchain technology under applicable privacy laws. Despite our efforts to choose vendors that meet applicable laws, regulations, and other obligations relating to privacy, data protection, and information security and that maintain robust security controls, it is possible that a vendor could fail to comply or experience a data breach impacting our data and our business. Our failure, or the failure by our third-party providers or partners, to comply with applicable laws or regulations could damage our reputation or result in fines or proceedings by governmental agencies as well as private litigation.

Our industry has been characterized by many rapid, significant, and disruptive products and services in recent years. We face intense and increasing competition from both established enterprises and early-stage companies. Our ability to grow our end-user base, capture new revenue streams, and monetize opportunities depends heavily on our ability to innovate and create successful new products and services, both independently and in collaboration with third-party partners. Developing new products and services may require substantial expenditures, divert management's attention, consume considerable time and resources, and ultimately may not be successful. For example, in 2025 we launched Circle Payments Network,which connects eligible financial institutions to facilitate near-instant, 24/7/365 payment settlement using regulated stablecoins, and Arc, our Layer-1 blockchain project, each of which requires considerable time, financial and personnel resources, and rely on adoption by third parties in order to be successful, and we may not see the return on investment in the timeframe anticipated or at all. New product or service offerings could fail to attract customers and generate revenue (or diversify existing revenue). In addition, if new product or service offerings do not integrate effectively with our existing offerings, we may be unable to realize expected synergies or deliver enhanced utility for the Circle platform. If we fail to introduce new and improved products and services, if such offerings are not favorably received or adopted by the market, or if required expenditures outpace revenue generated by these products, our business, results of operations, financial condition, and prospects could be adversely affected.

The various markets for stablecoins have varying degrees of liquidity. There is no assurance that there will continue to be an active and liquid secondary market for any market participant to buy or sell Circle stablecoins. We provide Circle Mint customers the ability to mint and redeem USDC and EURC directly from us on a one-for-one basis for the U.S. dollar and the euro, respectively, as well as end-users that are not Circle Mint customers (subject to certain eligibility requirements) the ability to redeem USDC and EURC directly from Circle Internet Financial Europe SAS on a one-for-one basis for the U.S. dollar and the euro, respectively. All end-users can purchase, sell, or exchange Circle stablecoins in the secondary markets. However, significant disruptions at secondary marketplaces caused by technical, operational, security, legal, or regulatory issues could cause non-Circle Mint customers to have limited access to markets to obtain Circle stablecoins, cause non-Circle Mint customers to have limited access to markets to exchange their Circle stablecoins for fiat currency or other digital assets, or cause temporary market pricing dislocations, which could have a material adverse effect on the acceptance and use of Circle stablecoins.

We operate in a relatively new industry that is not widely understood and requires highly skilled and technical personnel. We believe that our future success is highly dependent on the talents and contributions of our senior management team, including Jeremy Allaire, our co-founder, Chairman, and Chief Executive Officer, members of our executive leadership team, and other key employees across our business. We must be able to attract, develop, motivate, and retain highly qualified and skilled employees. Due to the nascent nature of the digital assets ecosystem, the pool of qualified talent is limited, particularly with respect to executive talent with engineering, risk management, and financial regulatory expertise. We face intense competition for qualified individuals from numerous software and other technology companies. To attract and retain key personnel, we incur significant costs, including salaries and benefits and equity incentives. Even so, these measures may not be enough to attract and retain the personnel we require to operate our business effectively. The loss of even a few qualified employees-or an inability to attract, retain, and motivate additional highly skilled employees required for the planned expansion of our business-could adversely impact our operations and impair our ability to grow.

Natural disasters, fire, power shortages, or other catastrophic events may cause damage or disruption to our operations, international commerce, and the global economy, and could have an adverse effect on our business, results of operations, financial condition, and prospects. In addition, our global operations expose us to risks associated with public health crises, such as pandemics and epidemics, which could harm our business and cause our operating results to suffer. Further, acts of terrorism, labor activism or unrest, and other geopolitical unrest could cause disruptions in our business or the businesses of our partners or the economy as a whole. In the event of a natural disaster, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in development of our products and services, lengthy interruptions in service, breaches of data security, and loss of critical data, all of which could have an adverse effect on our operating results. We do not maintain insurance sufficient to compensate us for the potentially significant losses that could result from disruptions to our products and services. Additionally, all of the aforementioned risks may be further increased if we do not implement a disaster recovery plan or our business partners' disaster recovery plans prove to be inadequate. To the extent natural disasters or other catastrophic events concurrently impact data centers we rely on in connection with private key restoration, customers will experience significant delays in withdrawing funds, or in the extreme, we may suffer losses of our customer funds.