Forge Global Holdings (FRGE) Risk Factors

Various laws and regulations in the United States and abroad, such as the Bank Secrecy Act, the Dodd-Frank Act, and the USA PATRIOT Act, impose certain anti-money laundering ("AML") requirements on companies that are financial institutions or that provide financial products and services. Under these laws and regulations, financial institutions are required to develop and implement risk-based AML programs, report suspicious activity, and maintain transaction records, among other requirements. State regulators may impose similar requirements. In addition, our contracts with financial institution partners and other third parties may contractually require us to maintain an AML program. We are also subject to economic and trade sanctions programs administered by OFAC, which prohibit or restrict transactions to or from or dealings with specified countries, their governments, and in certain circumstances, their nationals, and with individuals and entities that are specially-designated nationals of those countries, narcotics traffickers, terrorists or terrorist organizations, and other sanctioned persons and entities. Our failure to comply with AML, economic and trade sanctions regulations, and similar laws could subject us to substantial civil and criminal penalties, or result in the loss or restriction of our financial institution registrations and state licenses, or liability under our contracts with third parties, which may significantly affect our ability to conduct some aspects of our business. Changes in this regulatory environment, including changing interpretations and the implementation of new or varying regulatory requirements, must be monitored for, and our AML program adapted accordingly.

We are subject to a variety of federal, state, local, and non-U.S. laws, directives, rules, policies, industry standards and regulations, as well as contractual obligations, relating to privacy and the collection, protection, use, retention, security, disclosure, transfer, and other processing of personal information and other data, including the Gramm-Leach-Bliley Act of 1999 ("GLBA"), Section 5(c) of the Federal Trade Commission Act (the "FTC Act"), and the California Consumer Privacy Act (the "CCPA"). The regulatory framework for data privacy and security worldwide is continuously evolving and developing and, as a result, interpretation and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. New laws, amendments to or reinterpretations of existing laws, regulations, standards, and other obligations may require us to incur additional costs and restrict our business operations, and may require us to change how we use, collect, store, transfer, or otherwise process certain types of personal information and to implement new processes to comply with those laws and our customers' exercise of their rights thereunder. In the United States, federal law, such as the GLBA and its implementing regulations, restricts certain collection, processing, storage, use, and disclosure of personal information, requires notice to individuals of privacy practices and provides individuals with certain rights to prevent the use and disclosure of certain nonpublic or otherwise legally protected information. These rules also impose requirements for the safeguarding and proper destruction of personal information through the issuance of data security standards or guidelines. Additionally, the FTC Act imposes standards for the online collection, use, and dissemination of personal information. The U.S. government, including Congress, the Federal Trade Commission, and the Department of Commerce, has expressed the need for greater regulation for the collection, use and other processing of information concerning consumer behavior on the internet, including regulation aimed at restricting certain targeted advertising practices. There is also a risk of enforcement actions in response to rules and regulations promulgated under the authority of federal agencies and state attorneys general and legislatures and consumer protection agencies. In addition, privacy advocates and industry groups have proposed and may propose new and different self-regulatory standards that either legally or contractually may apply to our business operations. If we fail to follow these security standards, even if no personal information is compromised, we may incur significant fines or experience a significant increase in costs. Numerous states have enacted or are in the process of enacting state-level data privacy laws and regulations governing the collection, use, and other processing of state residents' personal information. For example, the CCPA, which took effect on January 1, 2020, established a new privacy framework for covered businesses such as ours, and may require us to modify our data processing practices and policies and incur compliance related costs and expenses. The CCPA provides certain data privacy rights to California residents, such as affording California residents the right to access and delete their information and to opt out of certain sharing and sales of personal information. The law also prohibits covered businesses from discriminating against California residents (for example, charging more for services) for exercising any of their rights under the CCPA. The CCPA allows for severe civil penalties and statutory damages as well as a private right of action for certain data breaches involving personal information. This private right of action is expected to increase the likelihood of, and risks associated with, data breach litigation. In November 2020, California voters passed the California Privacy Rights Act of 2020 ("CPRA"). Effective in most material respects as of January 1, 2023, the CPRA imposes additional obligations on companies covered by the legislation and significantly amends the CCPA, including by expanding the CCPA with additional data privacy compliance requirements that may impact our business. The CPRA also establishes a regulatory agency dedicated to enforcing the CCPA, as amended by the CPRA. The effects of the CCPA, as amended by the CPRA, other similar state or federal laws, and other future changes in laws or regulations relating to privacy, data protection, and information security, particularly any new or modified laws or regulations that require enhanced protection of certain types of data or new obligations with regard to data retention, transfer, or disclosure, are significant and may require us to modify our data processing practices and policies and could greatly increase the cost of providing our offerings, require significant changes to our operations, or even prevent us from providing certain offerings in jurisdictions in which we currently operate and in which we may operate in the future or incur potential liability in an effort to comply with such legislation. The CPRA and the CCPA have led other states to pass comparable legislation, with potentially greater penalties and more rigorous compliance requirements relevant to our business, and additional states may follow suit. For example, many state legislatures have adopted comprehensive legislation that would apply to the online collection of personal information of a broad number of U.S. state residents, including measures relating to privacy, data security, data breaches, and the protection of sensitive and personal information. We also may be subject to laws in all 50 states which require businesses to provide notice to customers whose personally identifiable information has been disclosed as a result of a data breach. These laws are inconsistent with one another, as certain state laws may be more stringent, broader in scope, or offer greater individual rights with respect to sensitive and personal information. Privacy laws at the federal or international level may also impose differing obligations, which could make our compliance efforts more complex, costly, and may increase the likelihood that we become subject to enforcement actions or other liabilities for noncompliance. The NYDFS also imposes Cybersecurity Requirements for Financial Services Companies, and which require banks, insurance companies and other financial services institutions regulated by the NYDFS, including Forge Securities, to establish and maintain a cybersecurity program designed to protect personal information of consumers and ensure the safety and soundness of New York State's financial services industry. The cybersecurity regulation adds specific requirements for these institutions' cybersecurity compliance programs and imposes an obligation to conduct ongoing, comprehensive risk assessments. Further, on an annual basis, each institution is required to submit a certification of compliance with these requirements. We have in the past and may in the future be subject to investigations and examinations by the NYDFS regarding, among other things, our cybersecurity practices. Additionally, we are subject to the EU General Data Protection Regulation (the "EU GDPR"), which imposes additional obligations and risk upon our business, including substantial expenses and changes to business operations that are required to comply with the EU GDPR. Further, following the withdrawal of the U.K. from the EU, we are required to comply separately with the EU GDPR as implemented in the U.K. (the "U.K. GDPR," and together with the EU GDPR, the "GDPR"), which may lead to additional compliance costs and could increase our overall risk. Failure to comply with the GDPR, and any supplemental European Economic Area country's national data protection laws which may apply by virtue of the location of the individuals whose personal information we may collect, may result in significant fines and other administrative penalties. For example, non-compliance with the GDPR, and the related national data protection laws of European Economic Area countries, may result in monetary penalties of up to €20,000,000 (£17.5 million) or 4% of worldwide annual revenue, whichever is higher. We make public statements about our use, collection, disclosure, and other processing of personal information through our privacy policies, information provided on our website and press statements. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other statements that provide promises and assurances about data privacy and security can subject us to potential government or legal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Any failure or perceived failure by us or our third-party service providers to comply with our posted privacy policies or with any applicable federal, state or similar foreign laws, rules, regulations, industry standards, policies, certifications, or orders relating to data privacy and security, or any compromise of security that results in the theft, unauthorized access, acquisition, use, disclosure, or misappropriation of personal information or other customer data, could result in significant awards, fines, civil and/or criminal penalties or judgments, proceedings or litigation by governmental agencies or customers, including class action privacy litigation in certain jurisdictions and negative publicity and reputational harm, one or all of which could have an adverse effect on our reputation, business, financial condition, and results of operations.

As a financial services company operating in the securities industry, among others, our business model exposes us to various risks, including capital adequacy and liquidity risk, strategic risk, operational risk, information technology risk, cybersecurity risk, vendor/third party risk, financial risk, and reputational risk. Our risk management and compliance processes, policies, and procedures may not be fully effective in identifying or mitigating all exposures and particularly against emerging risks. We have devoted significant resources to develop our compliance and risk management policies and procedures and will continue to do so, but there can be no assurance these are sufficient or that we will not sustain unexpected losses, especially as our business is growing and evolving. Our limited operating history, evolving business, and growth make it difficult to predict all of the risks and challenges we may encounter and the level of resources needed to address them, particularly when compared with more mature financial services companies. It also makes it difficult to predict completely the landscape of risks we will face as we introduce new products and services and expand into new jurisdictions. Insurance and other traditional risk mitigating tools may be held by or available to us in order to manage certain exposures, but they are subject to terms such as deductibles, coinsurance, limits, and policy exclusions, as well as risk of counterparty denial of coverage, default, or insolvency. Any perceived or actual breach of laws and regulations could also negatively impact our business, financial condition, and results of operations.

Maintaining adequate liquidity is crucial to our securities brokerage business operations, including key functions such as transaction settlement and custody requirements. We meet our liquidity needs primarily from working capital and cash generated by customer activity, as well as from external equity financing. Increases in the number of customers, fluctuations in customer cash or deposit balances, as well as market conditions or changes in regulatory treatment of customer deposits, may affect our ability to meet our liquidity needs. Our broker-dealer subsidiary, Forge Securities, is subject to Rule 15c3-1 under the Exchange Act, which specifies minimum capital requirements intended to ensure the general financial soundness and liquidity of broker-dealers. Forge Securities is exempt from the requirements of Rule 15c3-3 under the Exchange Act, which requires broker-dealers to maintain certain liquidity reserves. Additionally, our trust company subsidiary, Forge Trust Co., is subject to minimum capital requirements of the State of South Dakota, in which it is chartered. A reduction in our liquidity position could reduce our customers' confidence in us, which could result in the withdrawal of customer assets and loss of customers, or could cause us to fail to satisfy broker-dealer or other regulatory capital guidelines, which may result in immediate suspension of securities activities, regulatory prohibitions against certain business practices, increased regulatory inquiries and reporting requirements, increased costs, fines, penalties, or other sanctions, including suspension or expulsion by the SEC, FINRA, or other self-regulatory organizations or state regulators, and could ultimately lead to the liquidation of our broker-dealers or other regulated entities.

We must comply with state licensing requirements and varying compliance requirements in all the states in which we operate and the District of Columbia. In addition, we rely on certain exemptions from licensing requirements in other jurisdictions where we conduct business. Changes in licensing and registration laws may result in increased disclosure requirements, increased fees, or may impose other conditions to licensing or registrations that we or our personnel are unable to meet. In most states and jurisdictions in which we operate, a regulatory agency or agencies regulate and enforce laws relating to loan servicers, brokers, originators, collection agencies, and money services businesses. We are subject to periodic examinations by state and other regulators in the jurisdictions in which we conduct business, which can result in increases in our administrative costs and refunds to borrowers of certain fees earned by us, and we may be required to pay substantial and material penalties imposed by those regulators due to compliance errors, including any failures to properly register for applicable licenses or registrations, or we may lose our license or our ability to do business in the jurisdiction otherwise may be impaired. Fines and penalties incurred in one jurisdiction may cause investigations or other actions by regulators in other jurisdictions. We may not be able to acquire or maintain all requisite licenses, registrations, and permits. If we change or expand our business activities, either in scope or geographically such as through our recent establishment of Forge Europe, we may be required to obtain additional licenses before we can engage in those activities. In addition, the jurisdictions that currently do not regulate our business may later choose to do so, and if this occurs, we may not be able to obtain or acquire or maintain all requisite licenses, registrations, and permits, which could require us to modify or limit our activities in the relevant jurisdictions. The failure to satisfy those and other regulatory requirements could have a material adverse effect on our business, financial condition, and results of operations.

We have and may in the future become involved in, disputes and litigation matters between customers with respect to transactions on our platform. The high notional value of transactions on our platform makes us a target for customers to engage in lawsuits between one another and/or with us. There is a risk that customers may increasingly look to us to make them whole for delayed and/or broken trades. Customers may litigate over a failure of sellers to deliver securities or over the untimely deliveries of securities. Any litigation to which we are a party could be expensive and time consuming, regardless of the ultimate outcome, and the potential costs and risks of such litigation may incentivize us to settle. Additionally, we may agree to forego commissions in a failed settlement situation even if we are not at fault or do not have an obligation to do so for customer relations or other reasons. If we reduce or forego commissions on behalf of customers, it would lead to a reduction in profits.