of, or incidental to, the business of banking include taking deposits, borrowing and lending money and discounting or negotiating promissory notes, drafts, bills of exchange, and other evidences of debt. Subsidiaries of national banking associations generally may only engage in activities permissible for the parent national bank.

and resolution of billing errors, and the treatment of credit balances. For certain types of credit transactions, lenders are not permitted to originate loans with certain high-risk features, such as negative amortization and balloon payments, and must provide certain consumer protections during the underwriting and origination process, such as providing a right to an appraisal of mortgaged property, and verifying the consumer’s ability to repay the loan prior to making a decision to approve an application for the loan. Private Education Lenderseducation lenders must provide multiple disclosures to applicants under TILA and must provide applicants with 30 days in which to accept or reject a loan offer as well as the right to rescind the loan transaction for three business days following receipt of the Final TILA disclosure.

prohibitions on “U.S. persons” engaging in financial or other transactions relating to a sanctioned country or with certain designated persons and entities; (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons); and (iii) restrictions on transactions with or involving certain persons or entities. Blocked assets (for example, property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences for the Company.

Act and the Telemarketing Sales Rule, and analogous state laws, to the extent that we market credit or other products and services by use of email or telephone marketing.

also have the authority to conduct periodic examinations of SoFi Securities, and may also conduct administrative proceedings, and have the authority to levy fines and other penalties on SoFi Securities.

standards and regulations designed to regulate consumer information and data privacy, security and protection, and mitigate identity theft. These laws impose obligations with respect to the collection, processing, storage, disposal, use, transfer, retention and disclosure of PII,personal information, and, with limited exceptions, give consumers the right to prevent use of their PIIpersonal information and disclosure of it to third parties. The GLBA requires us to disclose certain information sharing practices to consumers, and any subsequent changes to such practices, and provide an opportunity for consumers to opt out of certain sharing of their PII.non-public personal information. This may limit our ability to share PIIpersonal information with third parties for certain purposes, such as marketing. In addition, the CFPB is expected to issue a new rule regulating the disclosure of consumer information, which may limit our ability to receive or use PIIpersonal information and other consumer information and records supplied by third parties, or share information with third parties. Further, all 50 states and the District of Columbia have adopted data breach notification laws that impose, in varying degrees, an obligation to notify affected individuals and government authorities in the event of a data or security breach or compromise, including when a consumer’s PIIpersonal information has or may have been accessed by an unauthorized person. These laws may also require us to notify relevant law enforcement, regulators or consumer reporting agencies in the event of a data breach. Some laws may also impose physical and electronic security requirements regarding the safeguarding of PII.personal information.

entities.. We believe our name, logo, motto and products are important brand identifiers for our members and enterprise partners. In addition, Galileo has been granted eightseveral patents.

amendments to these documents, as soon as reasonably practicable following the time they are electronically filed with or furnished to the SEC. These reports can also be found on the SEC’s website at www.sec.gov.

requirements, we may need to retain additional outside consultants. In addition, our current controls and any new controls that we develop may become inadequate because of poor design and changes in our business. For example, our continuing growth and expansion in globally dispersed markets, such as our anticipated acquisition of Technisys, may place significant additional pressure on our system of internal control over financial reporting, as acquisition targets may not be in compliance with the provisions of the Sarbanes-Oxley Act. We do not conduct a formal evaluation of companies’ internal control over financial reporting prior to an acquisition. We may be required to hire additional staff and incur substantial costs to implement the necessary new internal controls at companies we acquire. Any failure to implement and maintain effective internal controls over financial reporting could adversely affect the results of assessments by our independent registered public accounting firm and their attestation reports. If we or, if required, our independent registered public accounting firm, are unable to conclude that our internal control over financial reporting is effective, investors may lose confidence in its financial reporting, which could negatively impact the price of our securities.