Fold Holdings (FLD) Risk Analysis

Commodity interests, as such term is defined by the CEA and CFTC rules and regulations, are subject to more extensive supervisory oversight by the CFTC, including registrations of entities engaged in, and platforms offering, commodity interest transactions. This CFTC authority extends to bitcoin futures contracts and swaps, including transactions that are based on current and future prices of bitcoin and indices of bitcoin. To the extent that transactions in bitcoin are deemed to fall within the definition of a commodity interest, including pursuant to subsequent rulemaking or guidance by the CFTC, we may be subject to additional regulatory requirements and oversight and could be subject to judicial or administrative sanctions if we do not or did not at a relevant time possess appropriate registrations as an exchange (for example, as a designated contract market for trading futures or options on futures, or as a swaps execution facility for trading swaps) or as a registered intermediary (for example, as a futures commission merchant or introducing broker). Such actions could result in injunctions, cease and desist orders, as well as civil monetary penalties, fines, and disgorgement, as well as reputational harm. The CFTC has previously brought enforcement actions against entities engaged in crypto asset activities for failure to obtain appropriate exchange, execution facility and intermediary registrations. Furthermore, the CFTC and the SEC have jointly adopted regulations defining "security-based swaps," which include swaps based on single securities and narrow-based indices of securities. If bitcoin is deemed to be a security, certain transactions referencing bitcoin could constitute a security-based swap. Bitcoin or a transaction therein that is based on or references a security or index of securities, whether or not such securities are themselves crypto assets, could also constitute a security-based swap. To the extent that bitcoin is deemed to fall within the definition of a security-based swap, including pursuant to subsequent rulemaking or guidance by the CFTC or SEC, we may be subject to additional regulatory requirements and oversight by the SEC and could be subject to judicial or administrative sanctions if we do not or did not a relevant time possess appropriate registrations as an exchange (for example, as a security-based swaps execution facility) or as a registered intermediary (for example, as a security-based swap dealer or broker-dealer). This could result in injunctions, cease and desist orders, as well as civil monetary penalties, fines, and disgorgement, as well as reputational harm.

Any transaction in a commodity, including bitcoin, entered into with or offered to retail investors using leverage, margin, or other financing arrangements (a "retail commodity transaction") is subject to CFTC regulation as a futures contract unless such transaction results in actual delivery within 28 days. The meaning of "actual delivery" has been the subject of commentary and litigation, and in 2020, the CFTC adopted interpretive guidance addressing the "actual delivery" of a crypto asset. To the extent that bitcoin transactions that we facilitate or facilitated are deemed retail commodity transactions, including pursuant to current or subsequent rulemaking or guidance by the CFTC, we may be subject to additional regulatory requirements and oversight, and we could be subject to judicial or administrative sanctions if we do not or did not at a relevant time possess appropriate registrations. The CFTC has previously brought enforcement actions against entities engaged in retail commodity transactions without appropriate registrations, as well as recent enforcement settled orders against developers of decentralized platforms.

The SEC and its staff have taken the position that a range of crypto assets, products and services fall within the definition of a "security" under the U.S. federal securities laws. Despite the SEC being the principal federal securities law regulator in the United States, whether or not an asset, product or service is a security or constitutes a securities offering under federal securities laws is ultimately determined by a federal court. The legal test for determining whether any given crypto asset, product or service is a security was set forth in the 1946 Supreme Court case SEC v. W.J. Howey Co. and requires a highly complex, fact-driven analysis. Accordingly, whether any given crypto asset, product or service would be ultimately deemed to be a security is uncertain and difficult to predict notwithstanding the conclusions of the SEC or any conclusions we may draw based on our risk-based assessment regarding the likelihood that a particular crypto asset, product or service could be deemed a "security" or "securities offering" under applicable laws. The SEC generally does not provide advance guidance or confirmation on its assessment of the status of any particular crypto asset, product or service as a security. It is also possible that a change in the governing administration or the appointment of new SEC commissioners could substantially impact the approach to enforcement by the SEC and its staff. Public statements made by senior officials at the SEC indicate that the SEC does not intend to take the position that bitcoin (as currently offered and sold) is a "security" under the U.S. federal securities laws. However, such statements are not official policy statements by the SEC and reflect only the speakers' views, which are not binding on the SEC or any other agency or court and cannot be generalized to any other crypto asset. As of the date hereof, with the exception of certain centrally issued digital assets that have received "no-action" letters from the SEC staff, bitcoin is the only crypto asset which senior officials at the SEC have publicly stated is unlikely to be considered a "security." Any enforcement action by the SEC or any international or state securities regulator asserting that bitcoin is a "security," or a court decision to that effect, would be expected to have an immediate material adverse impact on the trading value of bitcoin, as well as our business. This is because the business models behind most crypto assets are incompatible with regulations applying to transactions in securities. If a crypto asset is determined or asserted to be a "security," it is likely to become difficult or impossible for the crypto asset to be traded, cleared or custodied in the United States and elsewhere through the same channels used by non-security crypto assets, which in addition to materially and adversely affecting the trading value of the crypto asset is likely to significantly impact its liquidity and market participants' ability to convert the crypto asset into USD and other currencies. The classification of a crypto asset, product or service as a security under applicable law has wide-ranging implications for the regulatory obligations that flow from the offer, sale, trading, and clearing, as applicable, of such assets, products or services. For example, a crypto asset, product or service that is a security in the United States may generally only be offered or sold in the United States pursuant to a registration statement filed with the SEC or in an offering that qualifies for an exemption from registration. Persons that effect transactions in crypto assets, products or services that are securities in the United States may be subject to registration with the SEC as a "broker" or "dealer." Platforms that bring together purchasers and sellers to trade crypto assets that are securities in the United States are generally subject to registration as national securities exchanges, or must qualify for an exemption, such as by being operated by a registered broker-dealer as an alternative trading system ("ATS") in compliance with rules for ATSs. Persons facilitating clearing and settlement of securities may be subject to registration with the SEC as a clearing agency. Foreign jurisdictions may have similar licensing, registration, and qualification requirements. Neither Fold nor the Fold App is registered or licensed with the SEC or foreign authorities as a broker-dealer, national securities exchange, or ATS (or foreign equivalents), and none of our products or services are registered as securities offerings, because we only offer products and services related to bitcoin, and we believe there are good arguments that bitcoin and our related products and services are not securities (including based on prior statements by a number of SEC senior officials). However, statements, settlements and enforcement actions are not rules or regulations of the SEC and are not binding on the SEC. Regardless of public statements made by senior officials at the SEC and our conclusions, we could in the future be subject to legal or regulatory action in the event the SEC or a state or a foreign regulatory authority were to assert, or a court were to determine, that either bitcoin itself or a product or service that we offer related to bitcoin, such as lending, rewards or savings products, could be viewed a "security" under applicable laws. There can be no assurance that we will properly characterize over time any given bitcoin product or service offering as a security or non-security, or that the SEC, foreign regulatory authority, or a court having final determinative authority on the topic, if the question was presented to it, would agree with our assessment. We expect our risk assessment policies and procedures to continuously evolve to take into account case law, legislative developments, facts, and developments in technology. If an applicable regulatory authority or a court, in either case having final determinative authority on the topic, were to determine that a product or service offered by us is a security, we would not be able to offer such product or service until we are able to do so in a compliant manner. A determination by the SEC, a state or foreign regulatory authority, or a court that a product or service that we offer constitutes a security may result in us ceasing to offer that product or service, and may also result in us determining that it is advisable to cease offering products and services entirely, that have similar characteristics to the product or service that was alleged or determined to be a security. Alternatively, we may determine to continue to offer a product or service even if the SEC or another regulator alleges that the product or service is a security, pending a final judicial determination as to that product or service's proper characterization, and the fact that we waited for a final judicial determination would generally not preclude penalties or sanctions against us for our having previously made that product or service available without registering that product or service with the SEC. As such, we could be subject to judicial or administrative sanctions for failing to offer or sell the product or service in compliance with the registration requirements, or for acting as a broker, dealer, or national securities exchange without appropriate registration. Such an action could result in injunctions, cease and desist orders, as well as civil monetary penalties, fines, and disgorgement, criminal liability, and reputational harm. Additionally, the SEC has brought and may in the future bring enforcement actions against other cryptoeconomy participants and their product offerings and services that may cause us to modify or discontinue a product offering or service. If we were to modify or discontinue any product offering or service for any reason, our decision may be unpopular with users, may reduce our ability to attract and retain customers (especially if similar products or services continue to be offered by our competitors), and may adversely affect our business, operating results, and financial condition.

The CFTC has stated, and judicial decisions involving CFTC enforcement actions have confirmed, that bitcoin falls within the definition of a "commodity" under the Commodity Exchange Act (the "CEA"). As a result, the CFTC has general enforcement authority to police against manipulation and fraud in the bitcoin market. From time to time, manipulation, fraud, and other forms of improper trading by market participants have resulted in, and may in the future result in, CFTC investigations, inquiries, enforcement action, and similar actions by other regulators, government agencies, and civil litigation. Such investigations, inquiries, enforcement actions, and litigation may cause us to incur substantial costs and could result in negative publicity.

As crypto assets have grown in both popularity and market size, various U.S. federal, state, and local and foreign governmental organizations, consumer agencies and public advocacy groups have been examining the operations of crypto networks, users and platforms, with a focus on how crypto assets can be used to launder the proceeds of illegal activities, fund criminal or terrorist enterprises, and the safety and soundness of platforms and other service providers that hold crypto assets for users. Many of these entities have called for heightened regulatory oversight and have issued consumer advisories describing the risks posed by crypto assets to users and investors. For instance, in September 2022, the White House published a fact sheet described as the first-ever "Comprehensive Framework for Responsible Development of Digital Assets," which encouraged "agencies to issue guidance and rules to address current and emergent risks in the digital asset ecosystem." Competitors, including traditional financial services providers, have spent years cultivating professional relationships with relevant policymakers on behalf of their industry so that those policymakers may understand that industry, the current legal landscape affecting that industry, and the specific policy proposals that could be implemented in order to responsibly develop that industry. The lobbyists working for these competitors have similarly spent years developing and working to implement strategies to advance these industries. Members of the cryptoeconomy have started to engage policymakers directly and with the help of external advisors and lobbyists. However, this work is in a relatively nascent stage. As a result, new laws and regulations may be proposed and adopted in the United States and internationally, or existing laws and regulations may be interpreted in new ways, that harm the cryptoeconomy or crypto asset platforms, which could adversely impact our business. Additionally, any political activities to further our mission may be perceived unfavorably by investors and the public and have an adverse impact on our brand and reputation.

The Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act") was signed into law on July 21, 2010. The Dodd-Frank Act is extensive and significant legislation that, among other things, created the Consumer Financial Protection Bureau (the "CFPB"), an agency responsible for administering and enforcing the laws and regulations for consumer financial products and services. The CFPB has broad rulemaking, examination and enforcement authority over providers of financial services and products, which could include us and our affiliates, including authority to prevent "unfair, deceptive or abusive" practices and to collect fines and provide consumer restitution in the event of violations. In addition to the CFPB, other federal agencies, such as the Federal Trade Commission (the "FTC"), and state regulators, such as consumer protection and financial services regulators and attorneys general, may exercise supervision and enforcement authority over providers of goods or services, like us. Depending on how such governmental authorities elect to exercise its statutory authority, it could increase the compliance costs for us and our third party service providers, potentially delay our ability to respond to marketplace changes, result in requirements to alter products and services that would make them less attractive to consumers, impair our ability to offer products and services, and harm our reputation or otherwise adversely affect our businesses. We are also subject to other various regulatory, financial and other requirements in the jurisdictions in which we operate. We may become involved from time to time in reviews, investigations and proceedings and information gathering requests by government and self-regulatory agencies, including state attorneys general. Any of such events could result in the imposition of damages, fines or civil or criminal claims and/or penalties. No assurance can be given that the ultimate outcome of any such event would not have a material adverse effect on us or our ability to provide services. The financial services industry is likely to see increased disclosure obligations, licensing requirements, restrictions on pricing and enforcement proceedings. Compliance with applicable laws is costly and can affect operating results, as processes, procedures, control and infrastructure are required to support applicable requirements. Compliance may also create operational constraints and impose limits on pricing, as financial services industry laws are designed primarily to protect consumers. The failure to comply could result in significant statutory civil and criminal penalties, monetary damages, attorneys' fees and costs, possible revocation of licenses and damage to reputation, brand, loss of our bank partnerships, and loss of customer relationships.

We are required to comply with laws and regulations related to economic sanctions and export controls enforced by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC") and the U.S. Department of Commerce's Bureau of Industry and Security, as well as U.S. anti-money laundering and counter-terrorist financing laws and regulations enforced by the Financial Crimes Enforcement Network ("FinCEN") and certain state financial services regulators. U.S. sanctions and export control laws and regulations generally restrict dealings by persons subject to U.S. jurisdiction with certain jurisdictions that are the target of comprehensive embargoes, currently the Crimea Region, the so-called Donetsk People's Republic, and the so-called Luhansk People's Republic, Cuba, Iran, and North Korea, as well as with persons, entities, and governments of those and other jurisdictions identified on certain prohibited party lists. Moreover, as a result of the Russian invasion of Ukraine, the United States, the E.U., the United Kingdom, and other jurisdictions have imposed wide-ranging sanctions on Russia and Belarus and persons and entities associated with Russia and Belarus. There can be no certainty regarding whether such governments or other governments will impose additional sanctions, or other economic or military measures against Russia or Belarus. Through Sardine.ai, we have an OFAC compliance program in place that includes monitoring of IP addresses to identify prohibited jurisdictions and of blockchain addresses that have either been identified by OFAC as prohibited or that otherwise are believed by us to be associated with prohibited persons or jurisdictions. Nonetheless, there can be no guarantee that our compliance program will prevent transactions with particular persons or addresses or prevent every potential violation of OFAC sanctions. Any present or future government inquiries relating to sanctions could result in negative consequences for us, including costs related to government investigations, financial penalties, and harm to our reputation. The impact on us related to such matters could be substantial. Although we have implemented controls, and are working to implement additional controls and screening tools designed to prevent sanctions violations, there is no guarantee that we will not inadvertently provide access to our products and services to sanctioned parties or jurisdictions in the future. Regulators worldwide frequently study each other's approaches to the regulation of the cryptoeconomy. Consequently, developments in any jurisdiction may influence other jurisdictions, including in the United States. As a result, the risks created by any new law or regulation in one jurisdiction may be replicated in the United States, affecting our business. The complexity of U.S. federal and state and international regulatory and enforcement regimes, coupled with the scope of our operations and the evolving global regulatory environment, could result in a single event prompting overlapping investigations and legal and regulatory proceedings by government authorities in different jurisdictions. Any of the foregoing could, individually or in the aggregate, harm our reputation, damage our brand and business, and adversely affect our operating results and financial condition. Due to the uncertain application of existing laws and regulations, it may be that, despite our analysis that certain products and services are currently unregulated, such products or services may indeed be subject to financial regulation, licensing, or authorization obligations that we have not obtained or with which we have not complied. As a result, we are at a heightened risk of enforcement action, litigation, regulatory, and legal scrutiny which could lead to sanctions, cease and desist orders, or other penalties and censures which could significantly and adversely affect our continued operations and financial condition.

Our business is subject to extensive laws, rules, regulations, policies, orders, determinations, directives, treaties, and legal and regulatory interpretations and guidance in the markets in which we operate, including those governing financial services and banking, credit, bitcoin asset custody, exchange, and transfer, privacy, data governance, data protection, cybersecurity, fraud detection, payment services (including payment processing and settlement services), money transmission (including prepaid access), virtual currency business, consumer protection, escheatment, antitrust and competition, bankruptcy, tax, anti-bribery, economic and trade sanctions, anti-money laundering, and counter-terrorist financing. Many of these legal and regulatory regimes were adopted prior to the advent of the internet, mobile technologies, bitcoin assets, generative artificial intelligence ("AI") and related technologies. As a result, some applicable laws and regulations do not contemplate or address unique issues associated with the bitcoin economy, are subject to significant uncertainty, and vary widely across U.S. federal, state, and local and international jurisdictions. These legal and regulatory regimes, including the laws, rules, and regulations thereunder, evolve frequently and may be modified, interpreted, and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another. Moreover, the complexity and evolving nature of our business and the significant uncertainty surrounding the regulation of the bitcoin economy, prepaid access, virtual currency business, credit cards, and gift card resale requires us to exercise our judgment as to whether certain laws, rules, and regulations apply to us, and it is possible that governmental bodies and regulators may disagree with our conclusions. To the extent we have not complied with applicable laws, rules, and regulations, we could be subject to significant fines, revocation of licenses, limitations on or temporary or permanent suspensions of our products and services, reputational harm, and other regulatory consequences, each of which may be significant and could adversely affect our business, operating results, and financial condition. Additionally, various governmental and regulatory bodies, including legislative and executive bodies, in the United States and in other countries may adopt new laws and regulations, the direction and timing of which may be influenced by changes in the governing administrations and major events in the cryptoeconomy. For example, following the failure of several prominent crypto trading venues and lending platforms, such as FTX, Celsius Networks, Voyager and Three Arrows Capital in 2022 (the "2022 Events"), the U.S. Congress expressed the need for both greater federal oversight of the cryptoeconomy and comprehensive cryptocurrency legislation. Presently, and in the future, various governmental and regulatory bodies, including in the U.S. and each U.S. state, may introduce new policies, laws, and regulations relating to virtual currency, bitcoin assets and the cryptoeconomy generally, and crypto asset platforms in particular. Other companies' failures of risk management and other control functions, such as those that played a role in the 2022 Events, could accelerate an existing regulatory trend toward stricter oversight of crypto asset platforms and the cryptoeconomy. Furthermore, new interpretations of existing laws and regulations may be issued by such bodies or the judiciary, which may adversely impact the development of the cryptoeconomy as a whole and our legal and regulatory status in particular by changing how we operate our business, how our products and services are regulated, and what products or services we and our competitors can offer, requiring changes to our compliance and risk mitigation measures, imposing new licensing requirements, or imposing a total ban on certain crypto asset transactions, as has occurred in certain jurisdictions in the past. If we are unable to comply with any new requirements, our ability to offer our products and services in their current form may be adversely affected. We believe that the products and services offered by us directly, as opposed to those that are offered by our third party service providers, including BitGo and Sutton Bank, are not subject to supervisory authority of regulatory authorities, or are only subject to certain regulatory regimes, such as banking regulations. However, these products and services may cause us to be deemed to be engaged in a form of regulated activity for which licensure is required or cause us to become subject to new and additional forms of regulatory oversight or supervision. To the extent that we or our employees, contractors, or agents are deemed or alleged to have violated or failed to comply with any laws or regulations, including related interpretations, orders, determinations, directives, or guidance, we or they could be subject to a litany of civil, criminal, and administrative fines, penalties, orders and actions, including being required to limit, suspend, or terminate the offering of certain products and services. Moreover, to the extent our customers nevertheless access our and our partners' platforms, products or services outside of jurisdictions where we have obtained required governmental licenses and authorization, we could similarly be subject to a variety of civil, criminal, and administrative fines, penalties, orders and actions as a result of such activity. Due to our business activities, it is possible that in the future we may be subject to investigations and inquiries by U.S. federal and state regulators and foreign regulators, many of which have broad discretion to audit and examine our business. Further, we believe increasingly strict legal and regulatory requirements and additional regulatory investigations and enforcement, any of which could occur or intensify, may continue to result in changes to our business, as well as increased costs, and supervision and examination for ourselves, our agents, and service providers. Moreover, new laws, regulations, or interpretations may result in future litigation, regulatory investigations, and enforcement or other actions, including preventing or delaying us from offering certain products or services offered by our competitors or could impact how we offer such products and services. Adverse changes to, or our failure to comply with, any laws and regulations have had, and may continue to have, an adverse effect on our reputation and brand and our business, operating results, and financial condition.

We are registered as a service provider with the Visa network. As such, we are subject to card network rules that could subject us to a variety of fines or penalties and other compliance obligations. The termination of our registration or any changes in card network rules or standards, including interpretation and implementation of existing rules or standards, could increase the cost of operating our business or limit our ability to provide our services to our customers, and could have a material adverse effect on our business, financial condition and results of operations.

Fold, through its partnership with Sutton Bank (and/or any other partner banks), may provide deposit accounts to Fold's customers. Sutton Bank (and/or any other partner banks) may hold funds in the deposit account in an omnibus account on behalf of customers. In certain circumstances, Sutton Bank (and/or any other partner banks) may rely on Fold's records for identifying customers and reconciling certain transactions made to or from deposit accounts, including any commingled funds within the omnibus account. Any failure by Fold to maintain complete and accurate records could create uncertainty as to fund attribution and cause delays or outages for customers seeking to withdraw funds from or through Fold's platform. Certain U.S. federal and state prudential banking regulators have cited the recent bankruptcy case of Synapse Financial Technologies, Inc. in connection with related proposed regulatory initiatives which may affect our business. On September 17, 2024, the FDIC, citing certain alleged recordkeeping issues attendant to Synapse's commingling of customer funds in custodial accounts, published a notice of proposed rulemaking which would require certain heightened standards for reconciliation and recordkeeping associated with certain custodial accounts containing commingled customer funds. These and other regulatory initiatives by U.S. federal or state prudential banking regulators, if enacted, may increase compliance costs associated with our business or impact our relationships with current or prospective partner banks (see above risk factor: Our relationships with bank partners in the United States may subject us and our partners to additional regulatory scrutiny.).

Our organizational documents provide that we indemnify our directors and officers, in each case to the fullest extent permitted by Delaware law. In addition, as permitted by Section 145 of the DGCL, our bylaws and our indemnification agreements with our directors and officers provide that: - We will indemnify our directors and officers for serving us in those capacities or for serving other business enterprises at our request, to the fullest extent permitted by Delaware law. Delaware law provides that a corporation may indemnify such person if such person acted in good faith and in a manner such person reasonably believed to be in or not opposed to the best interests of the registrant and, with respect to any criminal proceeding, had no reasonable cause to believe such person's conduct was unlawful;- We may, in our discretion, indemnify employees and agents in those circumstances where indemnification is permitted by applicable law;- We will be required to advance expenses, as incurred, to our directors and officers in connection with defending a proceeding, except that such directors or officers shall undertake to repay such advances if it is ultimately determined that such person is not entitled to indemnification;- We are not obligated pursuant to indemnify a person with respect to proceedings initiated by that person against us or our other indemnitees, except with respect to proceedings authorized by our board of directors or brought to enforce a right to indemnification;- The rights conferred in our bylaws are not exclusive, and we are authorized to enter into indemnification agreements with our directors, officers, employees and agents and to obtain insurance to indemnify such persons; and - We may not retroactively amend our bylaw provisions to reduce our indemnification obligations to directors, officers, employees and agents.

Our products and services may be exploited to facilitate illegal activity including fraud, sanctions violations, money laundering, gambling, tax evasion, and scams. We or our partners may be specifically targeted by individuals seeking to conduct fraudulent transfers, and it may be difficult or impossible for us to detect and avoid such transactions in certain circumstances. The use of our platform for illegal or improper purposes could subject us to claims, individual and class action lawsuits, and government and regulatory investigations, prosecutions, enforcement actions, inquiries, or requests that could result in liability and reputational harm for us. Moreover, certain activities that may be legal in one jurisdiction may be illegal in another jurisdiction, and certain activities that are at one time legal may in the future be deemed illegal in the same jurisdiction. As a result, there is significant uncertainty and cost associated with detecting and monitoring transactions for compliance with local laws. In the event that a customer is found responsible for intentionally or inadvertently violating the laws in any jurisdiction or we are found responsible for failure to prevent the use of our products or services for illegal activities, we may be subject to governmental inquiries, enforcement actions, prosecuted, or otherwise held secondarily liable for aiding or facilitating such activities. Changes in law have also increased the penalties for certain illegal activities, and government authorities may consider increased or additional penalties from time to time. Any threatened or resulting claims could result in reputational harm, and any resulting liabilities, loss of transaction volume, or increased costs could harm our business. Moreover, while fiat currencies can be used to facilitate illegal activities, bitcoin is relatively new and, in many jurisdictions, may be lightly regulated or largely unregulated. Bitcoin has characteristics, such as the speed with which digital currency transactions can be conducted, the ability to conduct transactions without the involvement of regulated intermediaries, the ability to engage in transactions across multiple jurisdictions, the irreversible nature of certain crypto asset transactions, and encryption technology that anonymizes these transactions, that make it susceptible to use in illegal activity. U.S. federal and state and foreign regulatory authorities and law enforcement agencies, such as the Department of Justice ("DOJ"), SEC, CFTC, FTC, or the Internal Revenue Service ("IRS"), and various state securities and financial regulators have taken and continue to take legal action against persons and entities alleged to be engaged in fraudulent schemes or other illicit activity involving bitcoin. While we believe that our risk management and compliance framework is designed to detect significant illicit activities conducted by our potential or existing customers, we cannot ensure that we will be able to detect all illegal activity on our platform. If any of our customers use our platform for such illegal activities or we are found responsible for failure to prevent the use of our products or services for illegal activities, our business could be adversely affected.

Our cardholders use Fold-branded debit and credit cards in a variety of transactions. We are exposed to risks associated with chargebacks and refunds, including in connection with payment card fraud. If a cardholder successfully disputes a transaction and is entitled to a refund or credit, card network rules often allow our bank partners to charge back the disputed transaction to the merchant. However, neither we nor our bank partners fully control the outcome of chargebacks, and our bank partners' obligation to credit a cardholder in connection with a disputed transaction may not be contingent on successfully charging the transaction back to the merchant. In the event a chargeback dispute is decided in favor of a merchant, or a chargeback is otherwise unrecoverable, we may be liable to our bank partners for disputed amounts pursuant to our contractual arrangements, including if amounts are not recoverable from the cardholder. If we are unable to collect chargebacks or refunds from merchants where they are held liable, or if merchants refuse to or are unable to make payment for chargebacks or refunds due to closure, bankruptcy, or other reasons, we may bear the loss for the credits or refunds made to our cardholders in connection with disputed transactions. The number of disputes filed by our cardholders is expected to increase as more users adopt our platform, and chargeback levels may be elevated during periods of economic uncertainty. These transaction disputes and corresponding increases in operating expenses may adversely affect our business, financial condition, and results of operations.

Due to the new and evolving nature of crypto assets and the absence of comprehensive legal and tax guidance with respect to crypto asset products and transactions, many significant aspects of the U.S. tax treatment of transactions involving crypto assets, such as the purchase and sale of bitcoin on our platform, are uncertain, and it is unclear whether, when and what guidance may be issued in the future on the treatment of crypto asset transactions for U.S. tax purposes. In 2014, the IRS released Notice 2014-21, discussing certain aspects of "virtual currency" for U.S. federal income tax purposes and, in particular, stating that such virtual currency (i) is "property," (ii) is not "currency" for purposes of the rules relating to foreign currency gain or loss, and (iii) may be held as a capital asset. From time to time, the IRS has released other notices and rulings relating to the tax treatment of virtual currency or crypto assets reflecting the IRS's position on certain issues. The IRS has not addressed many other significant aspects of the U.S. federal income tax treatment of crypto assets and related transactions. There continues to be uncertainty with respect to the timing, character and amount of income inclusions for various crypto asset transactions. Although we believe our treatment of bitcoin transactions for federal income tax purposes is consistent with existing positions from the IRS and/or existing U.S. federal income tax principles, because of the rapidly evolving nature of crypto asset innovations and the increasing variety and complexity of crypto asset transactions and products, it is possible the IRS and various U.S. states may disagree with our treatment of certain bitcoin offerings for U.S. tax purposes, which could adversely affect our customers and the vitality of our business. There can be no assurance that the IRS, the U.S. state revenue agencies or other foreign tax authorities, will not alter their respective positions with respect to crypto assets in the future or that a court would uphold the treatment set forth in existing positions. It also is unclear what additional tax authority positions, regulations, or legislation may be issued in the future on the treatment of existing crypto asset transactions and future crypto asset innovations under U.S. federal or U.S. state tax law. Any such developments could result in adverse tax consequences for holders of crypto assets and could have an adverse effect on the value of crypto assets and the broader crypto assets markets. Future technological and operational developments that may arise with respect to crypto assets may increase the uncertainty with respect to the treatment of crypto assets for U.S. tax purposes. The uncertainty regarding tax treatment of crypto asset transactions impacts our customers, and could impact our business, both domestically and abroad.

Realization of our deferred tax assets, in the form of future domestic tax deductions, credits or other tax benefits, will depend on future taxable income, and there is a risk that some or all of such tax assets could be subject to limitation or otherwise unavailable to offset future income tax liabilities, all of which could adversely affect our operating results. For example, future changes in our stock ownership, the causes of which may be outside of our control, could result in an ownership change under Section 382 of the Internal Revenue Code of 1986, as amended, which could limit our use of such tax assets in certain circumstances. Similarly, additional changes may be made to U.S. (federal and state) tax laws which could further limit our ability to fully utilize these tax assets against future taxable income. Under the Inflation Reduction Act, our ability to utilize tax deductions or losses from prior years may be limited by the imposition of the 15% minimum tax if, in future years, such minimum tax applies to us. Therefore, we may be required to pay additional U.S. federal income taxes in future years despite any available future tax deductions, U.S. federal net operating loss carryforwards, credits or other tax benefits that we accumulate.

We are subject to complex tax laws and regulations in the United States. The U.S. has in the past and may in the future make changes to its corporate income tax rates and other income tax laws which could increase our future income tax provision. For example, our future income tax obligations could be adversely affected by earnings that are lower than anticipated in jurisdictions where we have lower statutory rates and by earnings that are higher than anticipated in jurisdictions where we have higher statutory rates, by changes in the valuation of our deferred tax assets and liabilities, by changes in the amount of unrecognized tax benefits, or by changes in tax laws, regulations, accounting principles, or interpretations thereof, including changes with possible retroactive application or effect. Our determination of our tax liability is subject to review and may be challenged by applicable U.S. tax authorities. Any adverse outcome of such a challenge could harm our operating results and financial condition. The determination of our provision for income taxes and other tax liabilities requires significant judgment and, in the ordinary course of business, there are many transactions and calculations where the ultimate tax determination is complex and uncertain. Furthermore, if we operate in multiple taxing jurisdictions, the application of tax laws can be subject to diverging and sometimes conflicting interpretations by tax authorities of these jurisdictions. The taxing authorities of the jurisdictions in which we operate or may operate may challenge our tax treatment of certain items or the methodologies we use for valuing developed technology or intercompany arrangements, which could impact our effective tax rate and harm our financial position and operating results. Further, any changes in the tax laws governing our activities may increase our tax expense, the amount of taxes we pay, or both. For example, the Tax Cuts and Jobs Act (the "TCJA"), enacted on December 22, 2017, significantly reformed the U.S. federal tax code, reducing the U.S. federal corporate income tax rate, making sweeping changes to the rules governing international business operations, and imposing new limitations on a number of tax benefits, including deductions for business interest and the use of net operating loss carryforwards. Effective beginning in 2022, the TCJA also eliminated the option to immediately deduct research and development expenditures (the "R&D Deduction") and required taxpayers to amortize domestic expenditures over five years and foreign expenditures over fifteen years. The Inflation Reduction Act of 2022 (the "Inflation Reduction Act"), enacted on August 16, 2022, further amended the U.S. federal tax code, imposing a 15% minimum tax on "adjusted financial statement income" of certain corporations as well as an excise tax on the repurchase or redemption of stock by certain corporations, beginning in the 2023 tax year. The legislation referred to as the One Big Beautiful Bill Act, enacted on July 4, 2025, made permanent certain expiring and renewed certain expired provisions of the TCJA, modified certain rules governing international business operations, and restored the R&D Deduction. There can be no assurance that future tax law changes will not increase the rate of the corporate income tax, impose new limitations on deductions, credits or other tax benefits, or make other changes that may adversely affect our business, cash flows or financial performance. In addition, the IRS has yet to issue guidance on a number of important issues regarding the tax treatment of cryptocurrency and the products we provide to our customers and from which we derive our income. In the absence of such guidance, we will take positions with respect to any such unsettled issues. There is no assurance that the IRS or a court will agree with the positions taken by us, in which case tax penalties and interest may be imposed that could adversely affect our business, cash flows or financial performance. We also are subject to non-income taxes, such as payroll, sales, use, value-added, digital services, net worth, property, and goods and services taxes in the United States. Tax authorities may disagree with certain positions we have taken. As a result, we may have exposure to additional tax liabilities that could have an adverse effect on our operating results and financial condition. As a result of these and other factors, the ultimate amount of tax obligations owed may differ from the amounts recorded in our financial statements and any such difference may harm our operating results in future periods in which we change our estimates of our tax obligations or in which the ultimate tax outcome is determined.

From time to time we have been, and may in the future be, subject to claims and disputes with our customers with respect to our products and services, such as fraudulent or unauthorized transactions, account takeovers, deposits and withdrawals of bitcoin, failures or malfunctions of our systems and services, or other issues relating to our products and services. Additionally, the ingenuity of criminal fraudsters, combined with many consumer users' susceptibility to fraud, may cause our customers to be subject to ongoing account takeovers and identity fraud issues. While we have taken measures to detect and reduce the risk of fraud, there is no guarantee that they will be successful and, in any case, require continuous improvement and optimization for continually evolving forms of fraud to be effective. There can be no guarantee that we will be successful in detecting and resolving these disputes or defending ourselves in any of these matters, and any failure may result in impaired relationships with our customers, damage to our brand and reputation, and substantial fines and damages. In some cases, the measures we have implemented to detect and deter fraud have led to poor customer experiences, including indefinite account inaccessibility for some of our customers, which increases our customer support costs and can compound damages. We could incur significant costs in compensating our customers, such as if a transaction was unauthorized, erroneous, or fraudulent. We could also incur significant legal expenses resolving and defending claims, even those without merit. To the extent we are found to have failed to fulfill our regulatory obligations, we could become subject to conditions that could make operations more costly, impair our ability to grow, and adversely impact our operating results. We may in the future become subject to investigation and enforcement action by state, federal, and international consumer protection agencies, including the Consumer Financial Protection Bureau (the "CFPB"), the Federal Trade Commission (the "FTC"), the Federal Deposit Insurance Corporation (the "FDIC") and state attorneys general in the United States, each of which monitors customer complaints against us and, from time to time, escalates matters for investigation and potential enforcement against us. While certain of our customer agreements contain arbitration provisions with class action waiver provisions that may limit our exposure to consumer class action litigation, some federal, state, and foreign courts have refused or may refuse to enforce one or more of these provisions, and there can be no assurance that we will be successful in enforcing these arbitration provisions, including the class action waiver provisions, in the future or in any given case. Legislative, administrative, or regulatory developments may directly or indirectly prohibit or limit the use of pre-dispute arbitration clauses and class action waiver provisions. Any such prohibitions or limitations on or discontinuation of the use of such arbitration or class action waiver provisions could subject us to additional lawsuits, including additional consumer class action litigation, and significantly limit our ability to avoid exposure from consumer class action litigation.

In order to transfer bitcoin on the bitcoin network, a person must have a private and public key pair associated with a network address, commonly referred to as a "wallet." Each wallet is associated with a unique "public key" and "private key" pair, each of which is a large number. To send bitcoin, a user must sign a transaction that is created using the private key of the wallet from where the user is transferring bitcoin, a hash of the recipient wallet's public key, the amount of bitcoin to be sent, and the transaction fee. The transaction must be signed using the user's private key through a cryptographic process, which creates a digital signature to prove ownership of the bitcoin. Once signed, the transaction is broadcasted to be included in a new block by miners. If we wish to purchase bitcoin, the seller would need to send a transaction to our designated wallet in this manner. A number of errors can occur in the process of transmitting bitcoin, such as typos, mistakes, or the failure to include the information required by the network, which could result in losses of our proprietary bitcoin or, where our customers choose to transfer and use bitcoin on its underlying network, the bitcoin held by us on behalf of our customers. For instance, a customer may incorrectly enter our crypto custody partner's wallet's address or the desired recipient's public key when depositing and withdrawing bitcoin, respectively. Alternatively, a customer may send bitcoin to a wallet address that the customer does not own, control or hold the private keys to. If any of the foregoing errors occur, all of the bitcoin sent by the customer will be permanently and irretrievably lost with no means of recovery. We have encountered and expect to continue to encounter similar incidents with our customers, and although we have not experienced such incidents with respect to bitcoin that we hold on a proprietary basis it is possible that they could occur in the future. Such incidents could result in customer disputes, damage to our brand and reputation, legal claims against us, and financial liabilities, any of which could adversely affect our business. BitGo has represented that it will safekeep all bitcoin held in custody for customers, and that it has procedures to process redemptions and withdrawals expeditiously, following the terms of the applicable user agreements. Our customers have not experienced excessive redemptions or withdrawals, or prolonged suspended redemptions or withdrawals, of bitcoin to date. However, similar to traditional financial institutions, BitGo may experience temporary process-related withdrawal delays. For example, BitGo may experience such delays if there is a significant volume of withdrawal requests that is vastly beyond anticipated levels. This does not mean BitGo cannot or will not satisfy withdrawals, but it may result in a temporary delay in satisfying withdrawal requests, which our customers still expect to be satisfied within the withdrawal timelines set forth in the applicable user agreements or otherwise communicated by us or BitGo. To the extent we or BitGo have process-related delays, even if brief or due to network congestion or heightened redemption activity, and within the terms of an applicable user agreement or otherwise communicated by us, we may experience increased customer complaints and damage to our brand and reputation and face additional regulatory scrutiny, any of which could adversely affect our business.

We rely upon third-party service providers, payment processors and financial institution partners to provide key components of our services on our behalf, including payments processing and disbursement. Our utilization of such payment processing tools may be impacted by factors outside of our control, including disruptions in the payment processing industry generally. If these service providers, processors or partners do not perform adequately, or if our relationships with these service providers were to change or terminate, it could negatively affect our customers' ability to complete transactions, and our ability to operate our services. This could decrease revenue, increase costs, lead to potential legal liability and negatively impact our brands and business. In addition, if these providers increase the fees they charge us, our operating expenses could increase. Alternatively, if we respond by increasing the fees we charge to our customers, some customers may stop using our services or even close their accounts altogether. Moreover, if we or any of our third-party payment processors or financial institution partners experience a security breach affecting payment card information, we could be subjected to fines, penalties and assessments arising out of state and federal regulatory enforcement, liability to consumers, the major card brands' rules and regulations, contractual indemnification obligations or other obligations contained in user agreements and similar contracts, and we may lose our ability to accept card payments for our services. As we expand the availability of our services to additional markets or make new payment methods available to our customers in the future, we may become subject to additional and evolving regulations and compliance requirements, and may be exposed to heightened fraud risk, which could lead to an increase in our operating expenses. The laws and regulations related to payments and financial services are complex and vary across different jurisdictions in the U.S. Furthermore, changes in laws, rules and regulations have occurred and may occur in the future,which may impact our business practices. We may be required to expend considerable time and effort to determine if such laws and regulations apply to our business and may be required to spend significant time and effort to comply, and ensure we are in compliance, with those laws and regulations. Any failure or claim of our failure to comply or any failure by our third-party service providers and partners to comply with such laws and regulations or other requirements, including the payment network rules and Payment Card Industry Data Security Standard, could divert substantial resources, result in liabilities or force us to stop offering our services, which will harm our business and results of operations. There can be no assurance that we meet, or we will be able to meet, all compliance obligations under applicable law, including obtaining any such licenses in all of the jurisdictions we operate in or offer a service in, and, even if we were able to do so, there could be substantial costs and potential product changes involved in complying with such laws, which could have a material and adverse effect on our business financial condition and results of operations. Any noncompliance by us in relation to existing or new laws and regulations, or any alleged noncompliance, could result in reputational damage, litigation, penalties, fines, increased costs or liabilities, damages or require us to stop offering payment services in certain markets. For example, if we are deemed to be a money transmitter, including a money services business, provider of prepaid access, or any other similar term defined by applicable money transmission or money services business laws, or virtual currency business we could be subject to certain laws, rules and regulations enforced by multiple authorities and governing bodies in the U.S. and numerous state and local agencies who may define money transmitter and virtual currency business differently. For example, certain states may have a more expansive view of money transmitters and virtual currency business activities. If we are found to be a money transmitter or virtual currency business under any applicable regulation and we are not in compliance with such regulations, we may be subject to fines or other penalties in one or more jurisdictions levied by federal, state or local regulators, including state Attorneys General, as well as those levied by foreign regulators. In addition to fines and penalties, consequences for failing to comply with applicable rules and regulations could include criminal and civil proceedings, forfeiture of significant assets or other enforcement actions. We could also be required to make changes to our business practices or compliance programs as a result of regulatory scrutiny. In addition, failure to predict how a U.S. law or regulation with respect to money transmission or similar requirements apply or will be applied to us could result in licensure or registration requirements, administrative enforcement actions and/or could materially interfere with our ability to offer certain payment methods or to conduct our business in particular jurisdictions. We cannot predict what actions the U.S. government may take or what restrictions it may impose that will affect our ability to process, accept or transmit payments or to conduct our business in particular jurisdictions. Further, we may become subject to changing payment and financial services regulations and requirements that could potentially affect the compliance of our current payment processes and increase the operational costs we incur to support payments. The factors identified here could impose substantial additional costs, involve considerable delay to the development or provision of our solutions, require significant and costly operational changes, or prevent us from providing our products or solutions in any given market. We are also subject to rules governing electronic funds transfers and payment card association rules. We may also be directly or indirectly liable to the payment networks for rule violations. Payment networks set and interpret their network operating rules and may allege that our business model violates these operating rules. If such allegations are not resolved favorably, they may result in significant fines and penalties or require changes in our business practices that may be costly and adversely affect our business. The payment networks could adopt new operating rules or interpret or reinterpret existing rules, including as a result of a change in our designation by major payment card providers or by a payment network, that we or our processors might find difficult or even impossible to follow, or costly to implement. As a result, we could lose our ability to give customers the option of using cards to fund their accounts or purchases or the choice of currency in which they would like their card to be charged or we may be required to change our business operations. If we are unable to accept cards or are limited in our ability to do so, our business would be adversely affected. In addition, any increase to fees charged or interchange assessed under, or increased costs associated with compliance with, payment network rules or payment card provider rules could lead to increased fees and costs for us or our customers, which may negatively impact payments on our services and usage of our services. Payment networks have imposed, and may impose in the future, special fees on the purchase of crypto assets, including on our platform, which could negatively impact us and significantly increase our costs. We could attempt to pass these increases along to our customers, but this could negatively impact our business or result in the loss of customers, thereby reducing our revenue and earnings. If competitive practices prevent us from passing along the higher fees to our customers in the future, we may have to absorb all or a portion of such increases, thereby increasing our operating costs and reducing our earnings. Due to the risk of our platform being used for illegal or illicit activity, any perceived or actual breach of compliance by us with respect to anti-money laundering ("AML") laws, rules and regulations, including the Bank Secrecy Act, USA Patriot Act and Title 18 U.S.C. Sections 1956-57 and 1960, could have a significant impact on our reputation and could cause us to lose customers, prevent us from obtaining new customers, require us to expend significant funds to remedy civil and criminal problems caused by violations and to avert further violations and expose us to legal risk and potential liability that could have a material effect on our business. Several of these laws require certain companies to adopt an AML compliance program, including those companies that are characterized as a federal money services business or state money transmitter. Moreover, many states have their own AML and money transmitter and virtual currency regulatory regimes and interpretations and applications of those legal principles are complex and varied. If the federal government or any state government took the position that we were a money services business, money transmitter or virtual currency business, they could require us to register as such and obtain money transmitter or virtual currency licenses. Furthermore, should a federal or state regulator make a determination that we have operated as an unlicensed money services business, money transmitter, or virtual currency business, we could be subject to civil and criminal fines, penalties, costs, legal fees, reputational damage or other negative consequences, all of which may have an adverse effect on our business, financial condition and results of operations.

Applicable insolvency law is not fully developed with respect to the holding of digital assets in custodial accounts. Thus, bitcoin held by us or our customers at a custodial partner such as BitGo may be considered to be the property of a bankruptcy estate in the event of a bankruptcy. Recent bankruptcy decisions involving digital-asset companies have demonstrated that, where custodial arrangements are not clearly segregated in practice or do not confer explicit ownership rights under applicable law, courts may treat customer assets as property of the bankruptcy estate notwithstanding contractual language to the contrary. In addition, bitcoin held on behalf of our customers could also be considered part of our own bankruptcy estate if we were to become insolvent. Further, such bitcoin could be misappropriated by a custodial partner despite clear commitments to segregation and ownership rights such that we are treated as an unsecured creditor. Bitcoin held in segregated wallets could be viewed as less of a risk in an insolvency proceeding. This is because such bitcoin can be clearly identified, as opposed to where assets are commingled with those of other holders. However, BitGo does not currently offer segregated wallet services to our customers. This may cause our customers to view our bitcoin-related services as more risky compared to other types of bitcoin products and services, and may cause our customers to withdraw bitcoin from the wallet services we provide through BitGo. If custodially-held bitcoin is determined to be the property of BitGo's or another custodial partner's bankruptcy estate, we and our customers could be treated as a general unsecured creditor, inhibiting our and our customers' ability to exercise ownership rights with respect to such bitcoin and potentially being required to share the value of our bitcoin, either in the form of spot bitcoin or a determined cash value on a given date, with those of other creditors. In addition, it is possible that a bankruptcy court would require all bitcoin and other digital assets held by a custodian to be converted into cash, which could result in our incurring significant capital gains tax charges. Even if we are able to prevent our and our customers' bitcoin from being considered the property of BitGo's bankruptcy estate as part of an insolvency proceeding, it is possible that we or our customers would still be delayed or may otherwise experience difficulty in accessing bitcoin held by BitGo during the pendency of the insolvency proceedings. Furthermore, bankruptcy trustees and regulatory authorities have, in recent cases, pursued clawback, preference, and fraudulent transfer claims against digital-asset companies and counterparties, even where the transfers involved customer-facing operational flows. Similar theories could be asserted against us or our customers depending on future legal developments. Any such outcome could have a material adverse effect on our financial condition and the market price of our securities. In addition, even if BitGo itself does not become insolvent, a series of insolvencies of high-profile custodians such as occurred in 2022, and more recently in October 2025 with the Nevada cease-and-desist order issued against Fortress Trust, LLC, one of our former custodians, could result in customers finding our services more risky and less attractive as compared to competitors, and any failure to increase our customer base or discontinuation or reduction in use of our platform and products by existing customers could adversely impact our business, operating results, and financial condition. On August 14, 2023, Prime Core Technologies, Inc. ("Prime Core"), one of our former service providers, filed for bankruptcy protection. On August 14, 2025, we were named as a defendant in an adversary proceeding filed by the Prime Core bankruptcy estate seeking recovery of alleged preference transfers and other relief (the "Prime Core Dispute"). We intend to defend ourselves vigorously, and we believe the claims lack merit; however, the outcome is inherently uncertain. Although the Prime Core Dispute relates to a former service provider and does not impact customer bitcoin balances or our current custodial arrangements, any adverse ruling or unexpected expansion of theories of liability in that proceeding or in similar proceedings against other parties could heighten perceptions of counterparty risk or highlight unresolved legal questions regarding digital-asset custody in insolvency. Additionally, because courts in several recent cases have applied traditional bankruptcy doctrines to digital-asset businesses, adverse outcomes in the Prime Core Dispute or similar proceedings against third parties could influence future interpretations of similar doctrines by courts, regulators, or counterparties.

Volatility in the banking and financial services sectors and regulatory enforcements by the FDIC or other regulators may impact our bank partnerships and could negatively impact our business. For example, we offer certain FDIC-insured products through our partnership with Sutton Bank, a member of the FDIC, and if the FDIC were to seek to enter into an enforcement action against Sutton Bank, it may adversely impact our business or relationship with Sutton Bank. For example, in February 2024, Sutton Bank became subject to an FDIC enforcement order that, among other things, required Sutton Bank to correct certain banking practices and within 60 days devise a plan to review all prepaid card customers since July 1, 2020 for compliance with anti-money laundering requirements. Similarly, for certain bitcoin related services, we partner with BitGo, which is regulated by various federal and state regulators, and if such regulators were to enter into an enforcement action against BitGo, it may adversely impact our business or relationship with BitGo. For example, we ceased using one of our previous partners, Fortress Trust, LLC ("Fortress"), due to regulatory concerns; Fortress subsequently received a cease-and-desist order from the State of Nevada in October 2025. In addition, although we believe our banking and financial services programs comply with all applicable law, if Sutton Bank or BitGo fail to comply with applicable law, it may adversely impact our business and reputation. Although we believe our banking partner maintains proper records and satisfies requirements for each eligible participant's deposits to be covered by FDIC insurance, up to the applicable maximum deposit insurance amount, the FDIC may disagree. In such an event, the FDIC may not recognize the participants' claims as covered by deposit insurance in the event Sutton Bank fails and enters receivership proceedings under the Federal Deposit Insurance Act ("FDIA"). If the FDIC were to determine that funds held at Sutton Bank are not covered by deposit insurance, or if Sutton Bank were to fail and enter receivership proceedings under the FDIA, our customers may seek to withdraw their funds, or may not be able to withdraw all their funds in a timely manner, which could adversely affect our brand, business and results of operations, and may lead to claims or litigation, which may be costly to address. Additionally, in instances where we are a service-provider to or are otherwise in a third-party relationship with Sutton Bank in connection with these programs, we are subject to certain risk-management standards for third-party relationships in accordance with federal bank regulatory guidance and examinations by the federal banking regulators. We intend to continue to explore other products, models, and structures for our product offerings, including with existing and new bank and cryptocurrency partners. Certain of our current product offerings may subject us to reporting requirements, bonding requirements, and inspection by applicable federal or state regulatory agencies, and our future product offerings may potentially require, or be deemed to require, additional data, procedures, partnerships, licenses, regulatory approvals, or capabilities that we have not yet obtained or developed. Should we fail to successfully expand and evolve our product offerings, or should our new products, models or structures, or new laws or regulations or interpretations of existing laws or regulations, impose requirements on us that are cumbersome or that we cannot satisfy, our business may be materially and adversely affected.

Our customers enter into agreements for banking services directly with Sutton Bank and enter into agreements for bitcoin-related services directly with BitGo. Our third-party service providers have not agreed to indemnify us for losses based on their breaches of their agreements with our customers. Although our terms of use clearly state that we are not responsible for the services provided by those third parties, it is possible that customers could blame us for a failure by one of those third parties to fulfill its obligations. This could have a material adverse impact on our reputation and business.

We market Fold prepaid cards issued by Sutton Bank to consumers through a program agreement with Bank. If our relationship with Sutton Bank were to end or if Sutton Bank were to cease or restrict operations, our ability to continue to offer our card product would be affected, which could adversely affect our financial and business results. In such an event, we would need to partner with a different bank to continue to offer the Fold Debit Card product (as defined below). If we partner with a new bank, issuance and servicing of the Fold Debit Card product could be disrupted and delayed as we transition to a different bank partner. We also may face increased costs and compliance burdens if the program agreement with Sutton Bank is terminated. Sutton Bank is subject to regulation and supervision by the Federal Deposit Insurance Corporation ("FDIC"). Many laws and regulations that apply directly to Sutton Bank indirectly impact us (and our products) as Sutton Bank's service provider. As such, our partnership with Sutton Bank is subject to the supervision and enforcement authority of the FDIC, Sutton Bank's primary banking regulator.

We market certain bitcoin services to consumers which are offered or supported solely by BitGo through program agreements. If our relationship with BitGo were to end, or if BitGo were to restrict or cease operations, our ability to continue to offer bitcoin services would be materially affected, which could materially adversely affect our financial and business results. In such an event, we would need to partner with a different financial institution with authority to provide services substantially similar to our bitcoin services to continue to offer these services. In the event that we needed to partner with a new crypto service provider, our bitcoin-related services would be disrupted and delayed as customers would be required to open new accounts with a different bitcoin service provider, and as we transition connectivity of our information technology systems to such different financial institution partner. We also may face increased costs and compliance burdens if our program agreement with BitGo is terminated. Many laws and regulations that apply directly to BitGo indirectly impact us (and our products) as a partner of BitGo.

The performance of the Fold Credit Card depends in significant part on the application process and credit risk models we use to verify applicants, prevent fraud, evaluate credit profiles, set credit limits and pricing, and manage ongoing account performance. These processes and models are new and may not accurately predict repayment behavior, delinquency, and loss profiles, particularly during periods of economic stress or rapid changes in consumer behavior. Pursuant to our program agreements, we are responsible for verified fraud losses and most straight charge-offs across the entire Credit Card portfolio. As a result, if our underwriting, pricing, servicing and collections practices are not effective, or if our assumptions about portfolio behavior are incorrect, we could experience greater-than-expected losses, which could have a material adverse effect on our business, operating results and financial condition. In deciding whether to extend credit to prospective or existing cardholders, we rely on a combination of internal and external data sources, including information provided by applicants and data from credit reporting agencies and other third parties. If decision inputs, analytics, or models are unstable, biased, incomplete, or otherwise flawed, or if macroeconomic conditions deteriorate more rapidly than we anticipate, we may make incorrect credit decisions and incur higher delinquencies and losses. If any third-party data source experiences an outage, if we are unable to access data used in our decision strategy, if such data contains inaccuracies, or if our access to such data is limited, our ability to accurately evaluate applicants and manage existing accounts may be compromised. If we make errors in the development, validation, or implementation of underwriting models or tools used for the Fold Credit Card, the receivables may experience higher delinquencies and losses. Higher losses could adversely affect our ability to finance, sell, or otherwise fund credit card receivables on acceptable terms (including through credit facilities, securitizations or whole-loan sales), could reduce advance rates, increase borrowing costs, trigger performance-based amortization or termination events, or limit future funding capacity.

The Fold Credit Card was launched in March 2026 on a limited basis to Fold employees. We anticipate we will release the Fold Credit Card on a broader, but still limited, basis in the upcoming weeks, subject to obtaining necessary third-party approvals and lender financing. We cannot guarantee that we will be able to release the credit card more broadly in the timeline indicated, in the manner indicated, or at all. Operating the Fold Credit Card requires us to allocate significant resources, including to marketing, underwriting, compliance, customer support, servicing, disputes and chargebacks, and collections. The Fold Credit Card also faces intense competition from large, well-capitalized financial institutions and other fintech companies that may have more experience, larger customer bases, more established brands, and greater resources than we do. There is no guarantee that we will generate sufficient revenue to recoup our investment of resources into the operation of the Fold Credit Card, and the operation of the Fold Credit Card may divert management time and attention from other initiatives. In addition, increased costs as a result of business and economic conditions may require that we reduce investments in other areas of our business. Revenue growth for the Fold Credit Card will depend on factors that are partly outside of our control, including consumer spending levels, the size and mix of revolving balances, the volume of transactions subject to interchange, and our ability to increase fee-based revenue while maintaining competitive product terms. Economic downturns may reduce consumer spending and increase delinquencies and charge-offs, which could negatively impact the profitability of the program. We have invested and plan to invest in growth initiatives to support the Fold Credit Card and attract cardholders. There can be no assurance that these investments will be effective, particularly as consumer and business behaviors change. To the extent our product or marketing attracts customers looking for short-term incentives rather than long-term engagement, cardholder attrition and related acquisition costs could be high. In addition, we may not be able to cost-effectively manage and expand cardholder benefits, including containing the growth of marketing, promotion, rewards and customer service expenses. Our ability to do so will depend in part on our ability to generate offsetting revenue and to obtain value from partners. If such expenses increase beyond our expectations, we may need to reduce benefits, increase pricing, decrease operating expenses, or reduce other investments in our business, and we may not succeed in doing so, particularly in a competitive and evolving regulatory environment that has included heightened scrutiny of certain credit card fees and rewards programs.

Unfavorable publicity regarding, for example, our product changes, product quality, litigation or regulatory activity, privacy practices, terms of service, employment matters, the use of our products or services (including bitcoin-related products and services) for illicit or objectionable ends, the actions of our customers, or the actions of other companies that provide similar services to ours, has in the past, and could in the future, adversely affect our reputation. Further, we have in the past, and may in the future, be the target of social media campaigns criticizing actual or perceived actions or inactions that are disfavored by our customers, employees, or society at-large, which campaigns could materially impact our customers' decisions to use our platform. Any such negative publicity could have an adverse effect on the size, activity, and loyalty of our customers and result in a decrease in net revenue, which could adversely affect our business, operating results, and financial condition.

Our business depends on the continued growth, development, and acceptance of bitcoin, which is subject to a high degree of uncertainty. Key factors influencing the further development of bitcoin include the global adoption of bitcoin and general acceptance of blockchain networks; regulatory and quasi-government restrictions on access to and operation of bitcoin or blockchain networks more broadly; and the maintenance of open source protocols that support the bitcoin network. Additional factors, such as shifts in consumer demographics and public preferences, the availability of alternative transaction methods, the potentially speculative nature of bitcoin, and economic conditions domestically and globally, also contribute to this uncertainty. If bitcoin adoption, acceptance, or functionality slows, halts, or changes in a way that diminishes our ability to grow our business, our financial condition and growth prospects could be materially and adversely affected.

Certain of our third-party vendors utilize or may in the future utilize AI and machine learning technologies in furnishing services to us. As with many technological innovations, AI presents risks and challenges that could affect its adoption, and therefore our business. By policy, we do not allow the upload of any personal or company confidential information to any AI tools except those from which we have obtained commercially reasonable assurances that such information will not be used other than to provide the services to the company (e.g., no training of models), nor will it be shared with any third party. Though we have taken steps to be thoughtful in the allowed use of AI, it could pose certain risks to our customers, and it is not guaranteed that regulators will agree with our approach to limiting these risks or to our compliance more generally. Risks can include, but are not limited to, the potential for errors or inaccuracies in the algorithms or models used by AI, the potential for bias or inaccuracies in the data used to train the AI, the potential for improper processing of personal information, and the potential for cybersecurity breaches that could compromise internal operations. Such risks could negatively affect the performance of our business, as well as our reputation and the reputations of our customers, and we could incur liability through the violation of laws or contracts to which we are a party or civil claims. As the regulatory framework for AI and machine learning technology evolves, our business, financial condition, and results of operations may be adversely affected. It is possible that new laws and regulations will be adopted in the U.S., or that existing laws and regulations may be interpreted in ways that would affect the operations of our platform and the way in which we use AI and machine learning technology. For example, the European Union has passed laws and regulations regulating digital services such as certain online platforms and marketplaces, and similarly, the European Union's Artificial Intelligence Act, which establishes broad obligations for the development and use of AI-based technologies made available in the European Union based on their potential risks and level of impact, came into force on August 1, 2024. In addition, in the United States, the Trump administration rescinded an executive order relating to the safe and secure development of AI technologies that was previously implemented by the Biden administration. The Trump administration then issued a new executive order that, among other thing requires certain agencies to develop and submit to the president action plans to "sustain and enhance America's global AI dominance," and to specifically review and, if possible, rescind rulemaking taken pursuant to the rescinded Biden executive order. Thus, the Trump administration may continue to rescind other existing federal orders and/or administrative policies relating to AI technologies, or may implement new executive orders and/or other rule-making relating to AI technologies in the future. Any such changes at the federal level, together with state-level laws regulating AI technologies that entered into force or are expected to enter into force in 2026, could require us to expend significant resources to modify our products, services, or operations to ensure compliance or remain competitive. Further, the cost to comply with such laws or regulations could be significant and would increase our operating expenses, which could adversely affect our business, financial condition, and results of operations.

We are dependent on the ability of our products and services to integrate with a variety of operating systems, web browsers, and wired and wireless interfaces to mobile devices that we do not control, including those of Sutton Bank and BitGo. Any changes in these systems that degrade the functionality of our products and services, impose additional costs or requirements on us, or give preferential treatment to competitive services, including their own services, could materially and adversely affect usage of our products and services. In addition, we rely on app marketplaces, such as the Apple App Store and Google Play, to drive downloads of our mobile apps. Apple, Google, or other operators of app marketplaces regularly make changes to their marketplaces, and those changes may make access to our products and services more difficult. In the event that it is difficult for our customers to access and use our products and services, our business may be materially and adversely affected. Furthermore, Apple, Google, or other operators of app marketplaces regularly provide software updates, and such software updates may not operate effectively with our products and services, which may reduce the demand for our products and services, result in dissatisfaction by our customers, and materially and adversely affect our business.

We have experienced periods of operational expansion and subsequent adjustments as our business and market conditions have evolved. As our business changes, it becomes increasingly complex. To effectively manage and capitalize on our growth periods, we need to manage headcount, capital and processes efficiently while making investments, such as expanding our information technology and financial, operating, and administrative systems and controls. Growth and contraction initiatives could strain our existing resources, and we could experience ongoing operating difficulties in managing our business as our regulatory, banking partner, and operational requirements grow more complex, including difficulties in hiring, training, managing and retaining a remote and evolving employee base. If we do not adapt or scale to meet these evolving challenges, we may experience erosion to our brand, the quality of our products and services may suffer, and our company culture may be harmed. Moreover, the failure of our systems and processes could undermine our ability to provide accurate, timely, and reliable reports on our financial and operating results, including the financial statements provided herein, and could impact the effectiveness of our internal controls over financial reporting. In addition, our systems and processes may not prevent or detect all errors, omissions, or fraud. Any of the foregoing operational failures could lead to noncompliance with laws, loss of operating licenses or other authorizations, or loss of bank relationships that could substantially impair or even suspend company operations. Successful implementation of our growth strategy will also require significant expenditures before any substantial associated revenue is generated and we cannot guarantee that these increased investments will result in corresponding and offsetting revenue growth. Because we have a limited history operating our business at its current scale, it is difficult to evaluate our current business and future prospects, including our ability to plan for and model future growth. Our limited operating experience at this scale, combined with the rapidly evolving nature of the bitcoin market in which we operate, substantial uncertainty concerning how the bitcoin market may develop, and other economic factors beyond our control, reduces our ability to accurately forecast quarterly or annual revenue. Additionally, from time to time, we may realign our resources and talent to implement stage-appropriate business strategies, including furloughs, layoffs and reductions in force. If there are unforeseen expenses associated with such realignments in our business strategies, and we incur unanticipated charges or liabilities, then we may not be able to effectively realize the expected cost savings or other benefits of such actions. Failure to manage any growth or any scaling back of our operations could have an adverse effect on our business, operating results, and financial condition.

Our software, systems, and processes may contain undetected errors or vulnerabilities that could have a material adverse effect on our business, particularly to the extent such errors or vulnerabilities are not detected and remedied quickly. We have from time to time found defects in our user-facing software, internal systems, and technical integrations with third-party systems, and new errors or vulnerabilities may be introduced in the future. If there are such errors or defects in our software, hardware, or systems, we may face negative publicity, government investigations, and litigation. We do not manufacture hardware products, but we do depend on third-party service providers and infrastructure vendors, and defects or failures in their systems may affect the performance of our services. As our software services continue to increase in size and complexity, these risks may correspondingly increase as well. In addition, we provide incremental releases of product and service updates and functional enhancements, which increase the possibility of errors. Any errors, data leaks, security breaches or incidents, disruptions in services, or other performance problems with our products or services caused by external or internal actors could hurt our reputation and damage our business. Software and system errors, or human error, could delay or inhibit settlement of payments, result in settlement discrepancies, cause reporting errors, or prevent us from collecting transaction-based fees, or negatively impact our ability to serve our customers. Similarly, security breaches or incidents, which may be caused by or result from cyber-attacks by hackers or others, computer viruses, worms, ransomware, other malicious software programs, security vulnerabilities, employee or service provider theft, misuse or negligence, phishing, identity theft or compromised credentials, denial-of-service attacks, or other causes, could impact our business and disrupt the proper functioning of our products or services, cause errors, allow loss or unavailability of, unauthorized access to, or disclosure of, proprietary, confidential or otherwise sensitive information of ours or our customers, and other destructive outcomes. Any of the foregoing issues could result in costly and time-consuming efforts to redesign and redistribute our products, give rise to regulatory inquiries and investigations, and result in lawsuits and other liabilities and losses, which could have a material and adverse effect on our business.

Our technology platform includes software licensed to us by third-party authors under "open source" licenses. Use and distribution of open source software may entail greater risks than use of third-party commercial software, as open source licensors generally do not provide support, warranties, indemnification or other contractual protections regarding infringement claims or the quality of the code. In addition, the public availability of such software may make it easier for others to compromise our technology or services. Some open source licenses contain requirements that we make available source code for modifications or derivative works we create based upon the type of open source software we use, or grant other licenses to our intellectual property. If we combine our proprietary software with open source software in a certain manner, we could, under certain open source licenses, be required to release the source code of our proprietary software to the public, be precluded from charging fees to users of our proprietary software, or be required to license our proprietary software for purposes of making derivative works. Among other things, this would allow our competitors to create similar offerings with lower development effort and time and ultimately could result in a loss of competitive advantage. While we try to avoid subjecting our proprietary software to such open-source licenses, we cannot guarantee we will always be successful, and if we discover any potential open-source issues, we could be required to expend substantial time and resources to re-engineer some or all of our software. We have not recently conducted an extensive audit of our use of open source software and, as a result, we cannot assure you that our processes for controlling our use of open source software in our platform are, or will be, effective. If we are held to have breached or failed to fully comply with all the terms and conditions of an open source software license, we could face litigation or other liability, or be required to seek costly licenses from third parties to continue providing our offerings on terms that are not economically feasible, to re-engineer our platform, to discontinue or delay the provision of our offerings if re-engineering could not be accomplished on a timely basis or to make generally available, in source code form, our proprietary code, any of which could adversely affect our business, operating results, and financial condition. Moreover, the terms of many open source licenses have not been interpreted by U.S. or foreign courts. As a result, there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to provide or distribute our platform. From time to time, there have been claims challenging the ownership of open source software against companies that incorporate open source software into their solutions. As a result, we could be subject to lawsuits by parties claiming ownership of what we believe to be open source software. Any of the foregoing could have a material adverse effect on our business, financial condition and results of operations.

Many customers locate our website through internet search engines, such as Google, and advertisements on social networking sites and other web-based platforms. If we are listed less prominently or fail to appear in search results for any reason, downloads of our mobile application, and visits to our website, could decline significantly, and we may not be able to replace this traffic. Search engines revise their algorithms from time to time in an attempt to optimize their search results. If the search engines on which we rely for algorithmic listings modify their algorithms,we may appear less prominently or not at all in search results, which could result in reduced traffic to our website that we may not be able to replace. Additionally, if the costs of search engine marketing services, such as Google AdWords, increase, we may incur additional marketing expenses, we may be required to allocate a larger portion of our marketing spend to this channel or we may be forced to attempt to replace it with another channel (which may not be available at reasonable prices, if at all), and our business, financial condition and results of operations could be adversely affected. Furthermore, competitors may in the future bid on search terms that we use to drive traffic to our website and engagement with current and potential customers. Such actions could increase our marketing costs and result in decreased traffic to our website or use of our application. In addition, search engines, social networking sites and other web-based platforms may change their advertising policies from time to time. If any change to these policies delays or prevents us from advertising through these channels, it could result in reduced traffic to our website or use of our application. Additionally, new search engines, social networking sites and other web-based platforms may develop in specific jurisdictions or more broadly that reduce traffic on existing search engines, social networking sites and other web-based platforms. Moreover, the use of voice recognition technology and artificial intelligence may impact search engine results, potentially resulting in reduced traffic to our website or use of our application. If we are not able to achieve awareness through advertising or otherwise, we may not achieve significant traffic to our website or mobile application.

Our third-party banking partner, Sutton Bank holds cash on behalf of our customers, and our third-party custody partner, BitGo safeguards bitcoin on behalf of our customers. Safeguarding customers' cash and bitcoin is integral to the trust we build with our customers. We believe our and BitGo's policies, procedures, operational controls and controls over financial reporting help to protect us from material risks surrounding the safeguarding of these assets and conflicts of interest; however, our and/or BitGo's efforts to develop and implement such policies, procedures, operational controls and internal controls may not be sufficient. BitGo's controls include, among others, controls over the segregation of corporate bitcoin balances from customer bitcoin balances, controls over the processes of customer bitcoin transactions, and controls relating to on-chain movement and reconciliation of bitcoin balances. As of December 31, 2025, a substantial majority of (over 99%) the bitcoin held in our Rewards Treasury (as defined below) and Investment Treasury (as defined below, and together with the Rewards Treasury, our "Corporate Treasury") was held at BitGo. Bitcoin that we hold at BitGo is required to be held in separate wallets under Fold's name and is required to not be commingled with the bitcoin held at BitGo on behalf of our customers, BitGo's other customers, or BitGo itself. As of December 31, 2025, a substantial majority (over 99%) of our Corporate Treasury that we custody with BitGo was held in multi-signature cold storage wallets, with the remainder held in self-managed hot wallets for operational purposes. All bitcoin held on behalf of our customers is stored directly at BitGo for which BitGo controls the private keys. At any given time, approximately 90% of bitcoin held in this capacity is held in omnibus cold storage wallets, with the remainder held in hot wallets used to facilitate customer withdrawals and other real-time operational needs. Sutton Bank holds cash in accounts designated as "for the benefit of our customers." We have also entered into partnerships with third parties where our partners receive and hold customer funds. Our customers open accounts directly with BitGo to custody their bitcoin and receive other bitcoin-related services, and directly with Sutton Bank to hold cash and receive other fiat-related services. Our and our financial partners' abilities to accurately hold customer cash and bitcoin, as well as cash and bitcoin we hold for our own investment and operating purposes, requires a high level of internal controls. We are limited in our ability to influence or manage the controls and processes of third party partners or vendors and may be dependent on our partners' and vendors' operations, liquidity and financial condition to manage these risks. As we maintain, grow and expand our product and services offerings we also must scale and strengthen our internal controls and processes, and monitor our third party partners' and vendors' ability to similarly scale and strengthen. Failure to do so could adversely impact our business, operating results, and financial condition. This is important both to the actual controls and processes and the public perception of the same. Any material failure by us or our partners to maintain the necessary controls, policies, procedures or to manage the bitcoin or cash we hold for our own investment and operating purposes could also adversely impact our business, operating results, and financial condition. Further, any material failure by us or our partners to maintain the necessary controls or to manage customer bitcoin and funds appropriately and in compliance with applicable regulatory requirements could result in reputational harm, litigation, regulatory enforcement actions, significant financial losses, lead customers to discontinue or reduce their use of our and our partners' products, and result in significant penalties and fines and additional restrictions, which could adversely impact our business, operating results, and financial condition.

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, "IT Systems"). We own and manage some of these IT Systems but also rely on third parties for a range of IT Systems and related products and services, including but not limited to cloud computing services. We and certain of our third-party providers collect, maintain and process data about customers, employees, business partners and others, including information about individuals and their financial assets (such as bitcoin), as well as proprietary information belonging to our business such as trade secrets (collectively, "Confidential Information"). We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error, and as a result of malicious code embedded in open-source software, or misconfigurations, bugs or other vulnerabilities in commercial software that is integrated into our (or our suppliers' or service providers') IT Systems, products or services. As knowledge and techniques in cryptography continue to advance, threat actors may exploit these advancements to develop more sophisticated and effective attack methods, increasing the frequency and severity of cyberattacks as well. Because we make extensive use of third party suppliers, service providers, and partners (including our partnerships with crypto wallet providers and financial institutions), successful cyberattacks that disrupt or result in unauthorized access to third party IT Systems can materially impact our operations and financial results. Moreover, we may acquire companies with cybersecurity vulnerabilities and/or unsophisticated security measures, which exposes us to significant cybersecurity, operational, and financial risks. Remote working arrangements at our company (and at our third-party providers) also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. Additionally, any integration of artificial intelligence in our or any service providers' operations, products or services is expected to pose new or unknown cybersecurity risks and challenges. Because our products and services are integrated with our customers' systems and processes, any circumvention or failure of our cybersecurity defenses or measures could compromise the confidentiality, integrity, and availability of our customers' own IT Systems and/or Confidential Information as well. Moreover, certain threats are designed to remain dormant or undetectable until launched against a target and we may not be able to implement adequate preventative measures. If such an event were to occur and cause interruptions in our operations, result in the unauthorized access, disclosure, loss, processing, or other compromise of Personal Information (as defined below) or Confidential Information, or jeopardize the confidentiality, integrity, or availability of our information systems or any information residing therein, it could result in a material disruption of our development programs and our business operations, whether due to a loss of our trade secrets or other similar disruptions. Some of the federal, state, and foreign government requirements include obligations of companies to notify individuals of certain cybersecurity breaches involving particular personal information, which could result from breaches experienced by us or by our vendors, contractors, or organizations with which we have formed strategic relationships. Even though we may have contractual protections with such vendors, contractors, or other organizations, notifications and follow-up actions related to a cybersecurity breach could impact our reputation, cause us to incur significant costs, including legal expenses, harm customer confidence, hurt our expansion into new markets, cause us to incur remediation costs, or cause us to lose existing customers. Further, the cryptocurrency industry is a frequent target for cyberattacks, including hacks of exchanges and wallets. The underlying technology of cryptocurrencies, including blockchain, is complex and still developing, which means technical issues, bugs, or vulnerabilities could impact our operations and the security of user funds. Future technological developments, such as quantum computing, could impact the security of crypto wallets in particular, and the rapid development of artificial intelligence makes it difficult to predict the timeframe on which quantum computing could develop. Additionally, any actual or perceived breach or cybersecurity attack directed at other financial institutions or crypto companies, whether or not we are directly impacted, could lead to a general loss of customer confidence in the cryptoeconomy or in the use of technology to conduct financial transactions, which could negatively impact us, including the market perception of the effectiveness of our security measures and technology infrastructure. Cyberattacks are expected to accelerate on a global basis in frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools - including artificial intelligence - that circumvent security controls, evade detection and remove forensic evidence. As a result, we may be unable to detect, investigate, remediate or recover from future attacks or incidents, or to avoid a material adverse impact to our IT Systems, Confidential Information or business. There can also be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information. Furthermore, given the nature of complex systems, software and services like ours, and the scanning tools that we deploy across our networks and products, we regularly identify and track security vulnerabilities. We are unable to comprehensively apply patches or confirm that measures are in place to mitigate all such vulnerabilities, or that patches will be applied before vulnerabilities are exploited by a threat actor. In other situations, vulnerabilities persist even after we have issued security patches because our customers may fail to apply patches or update their systems to newer software versions. If attackers are able to exploit critical vulnerabilities before patches are installed or mitigating measures are implemented, significant compromises could impact our and our customers' IT Systems and/or Confidential Information. We and certain of our third-party providers regularly experience cyberattacks and other incidents, and we expect such attacks and incidents to continue in varying degrees. While to date no incidents have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future. Any adverse impact to the availability, integrity or confidentiality of our IT Systems or Confidential Information can result in legal claims or proceedings (such as class actions), regulatory investigations and enforcement actions, fines and penalties, negative reputational impacts that cause us to lose existing or future customers, and/or significant incident response,system restoration or remediation and future compliance costs. Any or all of the foregoing could materially adversely affect our business, results of operations, and financial condition. Finally, we cannot guarantee that any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all.

The bitcoin market has been characterized by significant volatility and unexpected price movements, and has previously experienced significant declines. Bitcoin may become more volatile and less liquid in a very short period of time. A series of recent high-profile bankruptcies, closures, liquidations, regulatory enforcement actions and other events relating to companies operating in the digital asset industry, including the filings for bankruptcy protection by Three Arrows Capital, Celsius Network, Voyager Digital, FTX Trading and Genesis Global Capital, the closure or liquidation of certain financial institutions that provided lending and other services to the digital assets industry, including Signature Bank and Silvergate Bank, SEC enforcement actions against Coinbase, Inc. and Binance Holdings Ltd., the placement of Prime Trust, LLC into receivership following a cease-and desist order issued by Nevada's Department of Business and Industry, a similar cease-and-desist order issued by Nevada against Fortress Trust, LLC, and the filing and subsequent settlement of a civil fraud lawsuit by the New York Attorney General against Genesis Global Capital, its parent company Digital Currency Group, Inc., and former partner Gemini Trust Company, have highlighted the counterparty risks applicable to owning and transacting in digital assets. Although these bankruptcies, closures, liquidations and other events have not to date resulted in any loss or misappropriation of our bitcoin, nor have such events adversely impacted our access to our bitcoin, they created significant volatility in the markets for cryptocurrency generally and for bitcoin particularly and have raised the risk of loss of our and our customer's bitcoin. For example, the bankruptcy of Prime Trust has resulted in litigation against us and our customers as described in "Management's Discussion and Analysis of Financial Conditions and Results of Operations" and in "Note 13. Commitments and Contingencies" in the Notes to our Financial Statements. Additional bankruptcies, closures, liquidations, regulatory enforcement actions or other events involving participants in the digital assets industry in the future could result in market prices being subject to erratic and abrupt market movement, which could harm our business. Further, because there is no centralized authority which determines the price of bitcoin, pricing often differs between exchanges. When some exchanges are viewed as higher risk, that price differential can widen as traders attempt to exploit these differences. Volatility in the price of bitcoin, as well as the lack of a standard price, could lead consumers to see bitcoin as an unsafe asset, which would result in losses of customers and resulting harm to our business. In addition, if we were to attempt to monetize the bitcoin we hold on our balance sheet, such price volatility could lead to trading losses, impacting our financial position. For example, based on aggregate US exchange markets data collected by CoinMarketCap, on December 18, 2023, the price of bitcoin at 10:00 P.M. UTC was $42,623.54. On December 18, 2024, the price of bitcoin at 10:00 P.M. UTC was $100,041.54. Between those dates, bitcoin experienced significant volatility. For example, on August 1, 2024, the price of bitcoin was $65,353.50, and on August 5, 2024 the price of bitcoin was $53,991.35. On August 24, 2024, the price of bitcoin had risen again to $64,176.37. In 2022, price swings were even more drastic, with prices as high as $47,459 at the end of March 2022 and as low as $16,530 at the end of the year. Such volatility will impact the overall value of our business and could cause volatility in the price of our stock. The price of bitcoin was approximately $42.3 thousand, $93.4 thousand and $87.5 thousand as of December 31, 2023, December 31, 2024 and December 31, 2025, respectively. The trading volume of bitcoin typically increases during periods of extreme volatility. For example, in the days following the federal elections in November 2024, the price of bitcoin rose sharply from $69,289.27 on November 2 to $87,250.43 on November 14, and volumes increased from 18,184,612,091 to 87,616,705,248 during that time period according to aggregate data from US exchange markets collected by CoinMarketCap. Such volume increases can lead to extreme pressures on our and our partners' platforms and infrastructure that can lead to inadvertent suspension of services across parts of the platforms or the entire platforms. As a result, from time to time we may experience outages. Outages can lead to increased customer service expense, can cause customer loss and reputational damage, result in inquiries and actions by regulators, and can lead to other damages for which we may be responsible, any of which could harm our business.