Oportun Financial (OPRT) Risk Analysis

We are increasingly dependent on information systems, services and infrastructure to operate our business. In the ordinary course of our business, we collect, process, transmit and store large amounts of sensitive information, including personal information, credit information and other sensitive data of our members and potential members. It is critical that we do so in a manner designed to maintain the confidentiality, integrity and availability of such sensitive information. Our reputation and ability to attract, retain and serve our members is dependent upon the reliable performance and security of our technology infrastructure and those of third parties that we utilize in our operations. These systems may be subject to damage or interruption from, among other things, earthquakes, adverse weather conditions, other natural disasters, terrorist attacks, rogue employees, power loss, telecommunications failures, technological errors or outages, and cybersecurity risks. Like other financial and technology services firms, we have been and continue to be the subject of actual or attempted unauthorized access, mishandling or misuse of information, computer viruses, ransomware or other malware, and cyber-attacks that could obtain or disclose confidential information, destroy data, disrupt or degrade service, threaten the integrity and availability of our systems, distributed denial of service attacks, social engineering, security breaches and incidents, and infiltration, exfiltration or other similar events. Our adoption of remote working arrangements for our corporate and many of our contact center employees may result in increased consumer or employee privacy, security, and fraud concerns arising from the increased electronic transfer and other online activity. For example, our employees are accessing our servers remotely through home or other networks to perform their job responsibilities and such security systems may be less secure than those used in our offices, which may subject us to increased security risks, including cybersecurity-related events, and expose us to risks of data or financial loss and associated disruptions to our business operations. Techniques used in cybersecurity attacks to obtain unauthorized access, disable or sabotage information technology systems change frequently, as data breaches and other cybersecurity events have become increasingly commonplace, including as a result of the intensification of state-sponsored cybersecurity attacks during periods of geopolitical conflict, such as the ongoing conflicts in Ukraine and the Middle East. We have seen, and will continue to see, industry-wide vulnerabilities, which could affect our or other parties' systems. We also have incorporated A.I. technologies into our platform, and may continue to incorporate additional A.I. technologies into our platform in the future. Our use of A.I. technologies may create additional cybersecurity risks or increase cybersecurity risks, including risks of security breaches and incidents. Further, A.I. technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents. While we regularly monitor data flow inside and outside the company, attackers have become very sophisticated in the way they conceal access to systems, and we may not be aware that we have been attacked or otherwise have suffered a security breach or incident. Any event that leads to unauthorized access, use, destruction, or disclosure of personal information or other sensitive information that we maintain, including our own proprietary business information and sensitive information such as personal information regarding our members or employees, could disrupt our business, harm our reputation, compel us to comply with applicable federal and/or state breach notification laws and foreign law equivalents, subject us to time consuming, distracting and expensive litigation, regulatory investigation and oversight, mandatory corrective action, require us to verify the correctness of data, or otherwise subject us to liability under laws, regulations and contractual obligations, including those that protect the privacy and security of personal information. We also face indirect technology, cybersecurity and operational risks relating to the members and other third parties with whom we do business or upon whom we rely on, or whose technology we use to facilitate or enable our business activities, including suppliers, vendors, payment processors, and parties who have access to confidential information due to our agreements with them. The use of bank partnerships could leave us exposed to additional information security risks arising from the interaction between our and any partners' information technology infrastructure, and the sharing between us of member information. We cannot guarantee that our systems and networks, or those of any third parties with whom we do business, have not been breached or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to any of our systems and networks. Potential vulnerabilities can be exploited from inadvertent or intentional actions of our employees, contractors, third-party vendors, business partners, or by malicious third parties. In addition, any security compromise in our industry, whether actual or perceived, or information technology system disruptions, whether from attacks on our technology environment or from technical errors, computer malware, natural disasters, terrorism, war, geopolitical conflicts, or telecommunication or electrical failures, could interrupt our business or operations, harm our reputation, erode borrower confidence, negatively affect our ability to attract new members, or subject us to third-party lawsuits, regulatory fines or other action or liability, which could adversely affect our business and results of operations. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until they are launched against a target, we and our vendors may be unable to anticipate these techniques or to implement adequate preventative measures. Any failure or perceived failure by us, or the third parties with whom we do business, to comply with our privacy, confidentiality, or cybersecurity-related legal or other obligations to third parties, or any security breaches impacting us, our third-party providers or partners, or any security incidents or other events that result in the unauthorized access, release, destruction, or transfer of sensitive information, which could include personal information, may result in governmental investigations, enforcement actions, regulatory fines, litigation, or public statements against us by advocacy groups or others. In addition, a security breach or incident could cause third parties, to lose trust in us or subject us to claims by third parties that we have breached our privacy- and confidentiality-related obligations. Any belief by members or others that a security breach or other incident has affected us, even if a security breach or other incident has not affected us or any of our third-party providers or partners, could have any or all of the foregoing impacts on us, including harm to our reputation. Even the perception of inadequate security may harm our reputation and negatively impact our ability to attract and retain members. Moreover, security incidents and other inappropriate access can be difficult to detect, and any delay in identifying them may lead to increased harm of the types described above. Due to the nature of security incidents, we cannot fully guarantee that our security measures intended to protect our systems and data will successfully prevent service interruptions or security incidents. We incur significant costs to detect and prevent security breaches and other security-related incidents, and as we continuously explore cost-saving initiatives and technology reworks to enhance operational efficiency, the integration of new technologies, upgrades, or modifications undertaken for the purpose of cost-savings could create unforeseen challenges that may impact the robustness of our security infrastructure and result in significant legal and financial exposure and/or reputational harm. While these endeavors are aimed at improving various efficiencies of our business, they may inadvertently expose our security systems to vulnerabilities that could be exploited by malicious actors, leading to unauthorized access, data breaches or other security incidents. Any event that leads, or is believed to have led, to unauthorized access to, or use, loss, corruption, disclosure or other processing of our data could disrupt our business; harm our reputation; compel us to comply with applicable federal and/or state breach notification laws and foreign law equivalents; subject us to litigation, regulatory investigation and oversight, or mandatory corrective action; require us to verify the correctness of database contents; or otherwise subject us to liability under laws and contractual obligations, including those that protect the privacy and security of personal information. This could result in increased costs for us to address the incident and in an effort to prevent further breaches or incidents, and result in significant legal and financial exposure and/or reputational harm. These mandatory disclosures regarding a security breach are costly to implement and often lead to widespread negative publicity. We cannot ensure that any limitations of liability provisions in any agreements with third parties would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular cybersecurity claim. We maintain errors, omissions, and cyber liability insurance policies covering certain security and privacy damages. However, we cannot be certain that our coverage will continue to be available on economically reasonable terms or will be available in sufficient amounts to cover one or more large claims, or that the insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have an adverse effect on our business and financial condition. Our retail locations also process physical member loan documentation that contain confidential information about our members, including financial and personal information. We retain physical records in various storage locations outside of our retail locations. The loss or theft of, or other unauthorized access to or use of, member information and data from our retail locations or other storage locations could subject us to additional regulatory scrutiny, possible civil litigation and possible financial liability and losses.

We operate in multiple jurisdictions and are subject to tax laws and regulations of the U.S. federal, state and local and non-U.S. governments. U.S. federal, state and local and non-U.S. tax laws and regulations are complex and subject to varying interpretations. Legislation or other changes in U.S. federal, state and local and non-U.S. tax laws could increase our liability and adversely affect our after-tax profitability. For example, in August 2022, the United States enacted the Inflation Reduction Act of 2022, which implemented, among other changes, a 15% alternative minimum tax on adjusted financial statement income for certain large companies and a 1% excise tax on certain stock buybacks. In addition, many countries and the Organisation for Economic Co-operation and Development have reached an agreement to implement a 15% global minimum tax. Such proposed changes, as well as regulations and legal decisions interpreting and applying these changes, may have significant impacts on our effective tax rate,cash tax expenses and net deferred taxes in the future. As the legislation becomes effective in countries in which we do business, our taxes could increase and negatively impact our provision for income taxes. Additionally, U.S. federal, state and local and non-U.S. tax authorities may interpret tax laws and regulations differently than we do and challenge tax positions that we have taken. This may result in differences in the treatment of revenues, deductions, credits and/or differences in the timing of these items. The differences in treatment may result in payment of additional taxes, interest or penalties that could have an adverse effect on our financial position and results of operations. Limitations may also apply under state law.

We collect, store, use, disclose, and otherwise process a large volume of personal information about individuals (including members and employees). New laws and regulations concerning the processing of personal information continue to be vigorously debated and enacted at all levels of government across the United States and around the globe while existing laws, such as the Gramm-Leach-Bliley Act, are being amended or reinterpreted to account for the rapidly evolving data economy. The California Consumer Privacy Act (the "CCPA"), as augmented and otherwise amended by the California Privacy Rights Act of 2020, imposes significant requirements on businesses processing consumer personal information – principally around enabling and honoring consumer choices related to such processing. Violations of the CCPA can result in civil penalties assessed by the Attorney General or the California Privacy Protection Agency and individual plaintiffs may pursue statutory damages in a private right of action for certain data breaches. Several U.S. states have already followed California's lead in enacting comprehensive privacy legislation and others are likely to do so in the future. The CCPA and other state comprehensive privacy laws enacted to date contain certain exemptions for personal information that is subject to the Gramm-Leach-Bliley Act. In some cases, these laws also contain broader exemptions for entities such as Oportun that are subject to the Gramm-Leach-Bliley Act. These exemptions may not exempt Oportun completely from these laws, however, and such exemptions' scope and interpretation remain subject to uncertainty. Further, future laws may not include such exemptions. At the federal level, regulators, including the CFPB and FTC, have adopted, or are considering adopting, laws and regulations concerning personal information and data privacy and security. The FTC, for example, released its updated Standards for Safeguarding Customer Information (Safeguards Rule), effective June 9, 2023, which raises the bar for covered financial institutions' information security programs through proscriptive requirements for things like accountability and oversight, performing risk assessments, encryption, and enabling multi-factor authentication to protect all forms of customer information. Further, on October 22, 2024, the CFPB finalized the Section 1033 Rule on Personal Financial Data?Rights, which requires certain financial institutions, and any party who controls?or possesses information concerning a covered financial product or?service, to provide financial data to consumers in a standardized?electronic format through a consumer interface and limits collecting and maintaining data only as necessary?to carry out transactions a consumer requests, prohibiting use of any?information for targeted or behavioral advertising. The final rule has been challenged in the Eastern District Court of Kentucky.?The U.S. federal government also is contemplating federal privacy legislation. This patchwork of legislation and regulation may give rise to conflicts or differing views of personal privacy rights and of privacy, data protection, and security obligations to which companies such as Oportun must adhere. The rapidly evolving regulatory environment relating to privacy, data protection, and cybersecurity, along with increased scrutiny from consumers and their advocates and increased complexity in Oportun's organizational structure, demands careful attention to our own processing of personal information and processing by third parties acting on our behalf. For example, we've seen an increase in third-party arrangements, including, for example, with lead aggregators, bank partners, Lending as a Service partners and affiliate relationships. Our failure, or any failure by third parties with whom we do business, to comply with applicable laws or regulations or contractual obligations required by our business partners relating to privacy, data protection, or cybersecurity, and even a perceived failure, could damage our reputation, harm our ability to obtain market adoption, discourage existing and prospective members from using our products and services, require us to change our business practices, business partners or operational structure, or result in investigations, claims, or fines by governmental agencies and private plaintiffs, and other liabilities. Even in the absence of a challenge to our practices, we may incur substantial costs to implement new systems to comply with regulatory requirements, such as consumer requests concerning the processing of their personal information and to honor any choices that may be available to them by law.

The industries in which we compete are highly competitive, continuously changing, highly innovative, and increasingly subject to regulatory scrutiny and oversight. Our current and potential future competition primarily includes other consumer finance companies, financial technology companies, technology platforms, neobanks, challenger banks, and financial institutions, as well as other nonbank lenders serving consumers who do not have access to mainstream credit, including online marketplace lenders, point-of-sale lending, payday lenders, and auto title lenders and pawn shops focused on underserved borrowers. We may compete with others in the market who may in the future provide offerings similar or are competitive with ours, particularly companies who may provide lending, money management and other services through a platform similar to our platform. Many of our current or potential competitors have significantly more access to low-cost capital as well as more financial, technical, marketing, and other resources than we do and may be able to devote greater resources to the development, promotion, sale and support of their platforms and distribution channels. As such, many of our competitors can leverage their size, robust networks, financial wherewithal, brand awareness, pricing power and technological assets to compete with us. In addition, our potential competitors also include smaller, earlier-stage companies with more versatile technology platforms, increased operational efficiencies, and greater brand recognition than us. To the extent new entrants gain market share, the use of our products and services would decline. Our long-term success depends on our ability to compete effectively against existing and potential competitors that seek to provide banking and financial technology products and services. If we fail to compete effectively against these competitors, our revenues, results of operations, prospects for future growth and overall business will be materially and adversely affected.

Negative publicity about our industry or our company, including the terms of the consumer loans, effectiveness of our proprietary credit risk models, privacy and security practices, originations, marketing, servicing and collections, use of A.I, and other business practices or initiatives, litigation, regulatory compliance and the experience of members, even if inaccurate, could adversely affect our reputation and the confidence in our brands and business model or lead to changes in our business practices. We regularly engage with media outlets and consumer advocates, taking their feedback into account as we assess and refine our business practices and policies; based on those interactions, we have made and may continue to make adjustments to better serve our members and stakeholders. Despite our responsiveness to the inquiries, certain media outlets and consumer advocates chose to and have continued to highlight the very past practices that we had already modified. The proliferation of social media may increase the likelihood that negative public opinion will impact our reputation and business. Our reputation is very important to attracting new members and retaining existing members. While we believe that we have a good reputation and that we provide members with a superior experience, there can be no assurance that we will continue to maintain a good relationship with members. In addition, negative perception may result in our being subject to more restrictive laws and regulations and potential investigations, enforcement actions and lawsuits. If there are changes in the laws affecting any of our products, or our marketing and servicing, or if we become subject to such investigations, enforcement actions and lawsuits, our financial condition and results of operations would be adversely affected. Entry into new products, as well as into the banking business or new origination channels, such as bank partnerships and other partnerships, could lead to negative publicity or draw additional scrutiny. Harm to our reputation can also arise from many other sources, including employee or former employee misconduct, misconduct by outsourced service providers or other counterparties, failure by us or our partners to meet minimum standards of service and quality, and inadequate protection of member information and compliance failures and claims. Our reputation may also be harmed if we fail to maintain our certification as a Community Development Financial Institution ("CDFI").

We have vendors that, among other things, provide us with key services, including financial, technology and other services to support our loan origination, servicing and other activities. Our expansion into new channels, products or markets may introduce additional third-party service providers, strategic partners and other third parties on which we may become reliant. For example, in connection with the secured personal loan product, we work with third parties that provide information and/or services in connection with valuation, title management and title processing, repossessions, and remarketing. These types of third-party relationships are subject to increasingly demanding regulatory requirements and attention by our partner banks' federal bank regulators (the Federal Reserve Board, the Office of Comptroller of the Currency and the Federal Deposit Insurance Corporation) and our consumer financial services regulators, including state regulators and the CFPB, which could increase the scope of management involvement and decreasing the benefit that we receive from using third-party vendors. We could be adversely impacted to the extent our vendors and partners fail to comply with the legal requirements applicable to the particular products or services being offered. Moreover, if our bank partners or their regulators conclude that we have not met the heightened standards for oversight of our third-party vendors, we could be subject to enforcement actions, civil monetary penalties, supervisory orders to cease and desist or other remedial actions. In some cases, third-party vendors are the sole source, or one of a limited number of sources, of the services they provide to us. Most of our vendor agreements are terminable on little or no notice, and if our current vendors were to stop or were unable to continue providing services to us on acceptable terms, we may be unable to procure alternatives from other vendors in a timely and efficient manner on acceptable terms or at all. If any third-party vendor fails to provide the services we require, due to factors outside our control, we could be subject to regulatory enforcement actions, suffer economic and reputational harm and incur significant costs to resolve any such disruptions in service. For a further discussion of the risks applicable to our partnership with Pathward, see "Risk Factors-We currently rely on Pathward to originate a substantial portion of our loans. If our relationship with Pathward terminates, or if Pathward were to suspend, limit, or cease its operations or loan origination activities for any reason, and we are unable to engage another originating bank partner on a timely basis or at all, our business, results of operations and financial condition would be materially and adversely affected."