Item 1A. Risk Factors.
RISK FACTORS
The below is a summary of principal risks to our business and risks associated with ownership of our securities. The risks and uncertainties described below should be carefully considered, together will all other information in this Annual Report on Form 10-K, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our financial statements and related notes, before making a decision to invest in our securities. Our business, financial condition, results of operations, or prospects could also be harmed by risks and uncertainties not currently known to us or what we currently do not believe are material. In the event that any of the risks actually occur, our business, financial condition, results of operations, and prospects could be adversely affected and could lead to a decline in the market price of our securities.
Risks Related to Fold’s Business and Industry
Our operating results have and will significantly fluctuate, including due to the highly volatile nature of bitcoin.
Our operating results are in part dependent on the broader bitcoin economy. Due to the rapidly evolving nature of digital assets and the volatile price of bitcoin, which has experienced and continues to experience significant volatility, our operating results have, and will continue to, fluctuate significantly from quarter to quarter in accordance with market sentiments and movements in the broader bitcoin economy. Our operating results will also continue to fluctuate significantly as a result of a variety of other factors, many of which are unpredictable and in certain instances are outside of our control, including:
•
our ability to attract, maintain, and grow our customer base and engage our customers;
•
changes in the legislative or regulatory environment or actions by U.S. or foreign governments or regulators, including fines, orders, or consent decrees;
•
regulatory changes or scrutiny that impact our ability to offer certain products or services;
•
our ability to continue to diversify and grow our subscription and services revenue;
•
our mix of revenue between transaction and subscription and services;
•
pricing for or temporary suspensions of our products and services;
•
investments we make in the development of products and services, as well as sales and marketing;
•
our ability to establish and maintain partnerships, collaborations, joint ventures, or strategic alliances with third parties;
•
market conditions of, and overall sentiment towards, bitcoin;
•
macroeconomic conditions, including interest rates, inflation and central banking policies;
•
adverse legal proceedings or regulatory enforcement actions, judgments, settlements, or other legal proceeding and enforcement-related costs;
•
the development and introduction of existing and new products and services by us or our competitors;
•
our ability to control costs, including our operating expenses incurred to grow and expand our operations and to remain competitive, and our costs associated with being a public company;
•
system failure, outages or interruptions affecting our platform or the platforms of the third-party partners we rely upon;
•
the financial stability of our third-party partners;
•
our lack of control over decentralized or third-party blockchains and networks that may experience downtime, cyber-attacks, critical failures, errors, bugs, corrupted files, data losses, or other similar software failures, outages, breaches and losses;
•
breaches of security or privacy;
23
•
inaccessibility of our and our partners’ platforms due to our or third-party actions;
•
our ability to attract and retain talent; and
•
our ability to compete with our competitors.
Additionally, we believe that younger generations increasingly view bitcoin not as a peripheral or alternative asset, but as a core component of their financial lives. We believe that our society is entering a long-term generational wealth transfer period and transition in how households think about savings, security, and wealth preservation. We believe that this generational transition has the potential to drive growth within our industry. However, as a result of the factors outlined above, it is difficult for us to forecast growth trends accurately and our business and future prospects are difficult to evaluate, particularly in the short term.
In view of the rapidly evolving nature of our business and bitcoin, period-to-period comparisons of our operating results may not be meaningful, and you should not rely upon them as an indication of future performance. Quarterly and annual expenses reflected in our financial statements may be significantly different from historical or projected rates. Our operating results in one or more future quarters may fall below the expectations of securities analysts and investors. As a result, the trading price of our securities may increase or decrease significantly.
The slowing or stopping of the development or acceptance of bitcoin and bitcoin-based technologies, and blockchain networks more broadly, could have a material adverse effect on the successful development and adoption of our business.
Our business depends on the continued growth, development, and acceptance of bitcoin, which is subject to a high degree of uncertainty. Key factors influencing the further development of bitcoin include the global adoption of bitcoin and general acceptance of blockchain networks; regulatory and quasi-government restrictions on access to and operation of bitcoin or blockchain networks more broadly; and the maintenance of open source protocols that support the bitcoin network. Additional factors, such as shifts in consumer demographics and public preferences, the availability of alternative transaction methods, the potentially speculative nature of bitcoin, and economic conditions domestically and globally, also contribute to this uncertainty. If bitcoin adoption, acceptance, or functionality slows, halts, or changes in a way that diminishes our ability to grow our business, our financial condition and growth prospects could be materially and adversely affected.
We are subject to an extensive, highly-evolving and uncertain regulatory landscape and any adverse changes to, or our failure to comply with, any laws and regulations could adversely affect our brand, reputation, business, operating results, and financial condition.
Our business is subject to extensive laws, rules, regulations, policies, orders, determinations, directives, treaties, and legal and regulatory interpretations and guidance in the markets in which we operate, including those governing financial services and banking, credit, bitcoin asset custody, exchange, and transfer, privacy, data governance, data protection, cybersecurity, fraud detection, payment services (including payment processing and settlement services), money transmission (including prepaid access), virtual currency business, consumer protection, escheatment, antitrust and competition, bankruptcy, tax, anti-bribery, economic and trade sanctions, anti-money laundering, and counter-terrorist financing. Many of these legal and regulatory regimes were adopted prior to the advent of the internet, mobile technologies, bitcoin assets, generative artificial intelligence (“AI”)and related technologies. As a result, some applicable laws and regulations do not contemplate or address unique issues associated with the bitcoin economy, are subject to significant uncertainty, and vary widely across U.S. federal, state, and local and international jurisdictions. These legal and regulatory regimes, including the laws, rules, and regulations thereunder, evolve frequently and may be modified, interpreted, and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another. Moreover, the complexity and evolving nature of our business and the significant uncertainty surrounding the regulation of the bitcoin economy, prepaid access, virtual currency business, credit cards, and gift card resale requires us to exercise our judgment as to whether certain laws, rules, and regulations apply to us, and it is possible that governmental bodies and regulators may disagree with our conclusions. To the extent we have not complied with applicable laws, rules, and regulations, we could be subject to significant fines, revocation of licenses, limitations on or temporary or permanent suspensions of our products and services, reputational harm, and other regulatory
24
consequences, each of which may be significant and could adversely affect our business, operating results, and financial condition.
Additionally, various governmental and regulatory bodies, including legislative and executive bodies, in the United States and in other countries may adopt new laws and regulations, the direction and timing of which may be influenced by changes in the governing administrations and major events in the cryptoeconomy. For example, following the failure of several prominent crypto trading venues and lending platforms, such as FTX, Celsius Networks, Voyager and Three Arrows Capital in 2022 (the “2022 Events”), the U.S. Congress expressed the need for both greater federal oversight of the cryptoeconomy and comprehensive cryptocurrency legislation.
Presently, and in the future, various governmental and regulatory bodies, including in the U.S. and each U.S. state, may introduce new policies, laws, and regulations relating to virtual currency, bitcoin assets and the cryptoeconomy generally, and crypto asset platforms in particular. Other companies’ failures of risk management and other control functions, such as those that played a role in the 2022 Events, could accelerate an existing regulatory trend toward stricter oversight of crypto asset platforms and the cryptoeconomy. Furthermore, new interpretations of existing laws and regulations may be issued by such bodies or the judiciary, which may adversely impact the development of the cryptoeconomy as a whole and our legal and regulatory status in particular by changing how we operate our business, how our products and services are regulated, and what products or services we and our competitors can offer, requiring changes to our compliance and risk mitigation measures, imposing new licensing requirements, or imposing a total ban on certain crypto asset transactions, as has occurred in certain jurisdictions in the past. If we are unable to comply with any new requirements, our ability to offer our products and services in their current form may be adversely affected.
We believe that the products and services offered by us directly, as opposed to those that are offered by our third party service providers, including BitGo and Sutton Bank, are not subject to supervisory authority of regulatory authorities, or are only subject to certain regulatory regimes, such as banking regulations. However, these products and services may cause us to be deemed to be engaged in a form of regulated activity for which licensure is required or cause us to become subject to new and additional forms of regulatory oversight or supervision. To the extent that we or our employees, contractors, or agents are deemed or alleged to have violated or failed to comply with any laws or regulations, including related interpretations, orders, determinations, directives, or guidance, we or they could be subject to a litany of civil, criminal, and administrative fines, penalties, orders and actions, including being required to limit, suspend, or terminate the offering of certain products and services. Moreover, to the extent our customers nevertheless access our and our partners’ platforms, products or services outside of jurisdictions where we have obtained required governmental licenses and authorization, we could similarly be subject to a variety of civil, criminal, and administrative fines, penalties, orders and actions as a result of such activity.
Due to our business activities, it is possible that in the future we may be subject to investigations and inquiries by U.S. federal and state regulators and foreign regulators, many of which have broad discretion to audit and examine our business. Further, we believe increasingly strict legal and regulatory requirements and additional regulatory investigations and enforcement, any of which could occur or intensify, may continue to result in changes to our business, as well as increased costs, and supervision and examination for ourselves, our agents, and service providers. Moreover, new laws, regulations, or interpretations may result in future litigation, regulatory investigations, and enforcement or other actions, including preventing or delaying us from offering certain products or services offered by our competitors or could impact how we offer such products and services. Adverse changes to, or our failure to comply with, any laws and regulations have had, and may continue to have, an adverse effect on our reputation and brand and our business, operating results, and financial condition.
Our or our third-party partners’ failure to safeguard and manage our and our customers’ fiat currencies and bitcoin could adversely impact our business, operating results, and financial condition.
Our third-party banking partner, Sutton Bank holds cash on behalf of our customers, and our third-party custody partner, BitGo safeguards bitcoin on behalf of our customers. Safeguarding customers’ cash and bitcoin is integral to the trust we build with our customers. We believe our and BitGo's policies, procedures, operational controls and controls over financial reporting help to protect us from material risks surrounding the safeguarding of these assets and conflicts of interest; however, our and/or BitGo’s efforts to develop and implement such policies, procedures, operational controls and internal controls may not be sufficient. BitGo's controls include, among others, controls over
25
the segregation of corporate bitcoin balances from customer bitcoin balances, controls over the processes of customer bitcoin transactions, and controls relating to on-chain movement and reconciliation of bitcoin balances.
As of December 31, 2025, a substantial majority of (over 99%) the bitcoin held in our Rewards Treasury (as defined below) and Investment Treasury (as defined below, and together with the Rewards Treasury, our "Corporate Treasury") was held at BitGo. Bitcoin that we hold at BitGo is required to be held in separate wallets under Fold’s name and is required to not be commingled with the bitcoin held at BitGo on behalf of our customers, BitGo’s other customers, or BitGo itself. As of December 31, 2025, a substantial majority (over 99%) of our Corporate Treasury that we custody with BitGo was held in multi-signature cold storage wallets, with the remainder held in self-managed hot wallets for operational purposes.
All bitcoin held on behalf of our customers is stored directly at BitGo for which BitGo controls the private keys. At any given time, approximately 90% of bitcoin held in this capacity is held in omnibus cold storage wallets, with the remainder held in hot wallets used to facilitate customer withdrawals and other real-time operational needs.
Sutton Bank holds cash in accounts designated as "for the benefit of our customers." We have also entered into partnerships with third parties where our partners receive and hold customer funds. Our customers open accounts directly with BitGo to custody their bitcoin and receive other bitcoin-related services, and directly with Sutton Bank to hold cash and receive other fiat-related services. Our and our financial partners’ abilities to accurately hold customer cash and bitcoin, as well as cash and bitcoin we hold for our own investment and operating purposes, requires a high level of internal controls. We are limited in our ability to influence or manage the controls and processes of third party partners or vendors and may be dependent on our partners’ and vendors’ operations, liquidity and financial condition to manage these risks. As we maintain, grow and expand our product and services offerings we also must scale and strengthen our internal controls and processes, and monitor our third party partners’ and vendors’ ability to similarly scale and strengthen. Failure to do so could adversely impact our business, operating results, and financial condition. This is important both to the actual controls and processes and the public perception of the same.
Any material failure by us or our partners to maintain the necessary controls, policies, procedures or to manage the bitcoin or cash we hold for our own investment and operating purposes could also adversely impact our business, operating results, and financial condition. Further, any material failure by us or our partners to maintain the necessary controls or to manage customer bitcoin and funds appropriately and in compliance with applicable regulatory requirements could result in reputational harm, litigation, regulatory enforcement actions, significant financial losses, lead customers to discontinue or reduce their use of our and our partners’ products, and result in significant penalties and fines and additional restrictions, which could adversely impact our business, operating results, and financial condition.
Our relationships with bank partners in the United States may subject us and our partners to additional regulatory scrutiny.
Prudential banking regulators in the United States, including the FDIC, have recently increased their scrutiny of bank partnerships with third-party financial service providers through the release of statements, requests for information, and proposed regulations. These releases have coincided with a significant increase in the number of enforcement actions relating to banks’ third-party arrangements. These and other regulatory initiatives by U.S. federal or state prudential banking regulators may constrain the operations of our partner banks in the United States, including those with which we may partner in the future either in addition to or in lieu of our existing arrangements. Such banks may be prohibited from partnering with us, or may terminate our relationship once established, as a result of increased regulatory scrutiny or changes to applicable laws and regulations.
Our relationship with partner banks may also subject us to additional regulatory scrutiny, requirements and supervision. For example, we are subject to audit by Sutton Bank in accordance with FDIC guidance related to management of vendors. We also may be subject to the examination authority of the FDIC under the Bank Service Company Act as a result of our relationship with Sutton Bank. To the extent that we enter into similar relationships with other partner banks, either in lieu of or in addition to our relationship with Sutton Bank, we may become subject to additional regulatory requirements imposed indirectly by the partner bank or directly by U.S. federal or state prudential banking regulators. Additional regulatory requirements may adversely affect us or our bank partners,
26
including our originating bank partners, and, therefore, our business, results of operations, financial condition and future prospects.
We may be subject to additional regulatory scrutiny and recordkeeping requirements due to the recent bankruptcy case of Synapse Financial Technologies, Inc.
Fold, through its partnership with Sutton Bank (and/or any other partner banks), may provide deposit accounts to Fold’s customers. Sutton Bank (and/or any other partner banks) may hold funds in the deposit account in an omnibus account on behalf of customers. In certain circumstances, Sutton Bank (and/or any other partner banks) may rely on Fold’s records for identifying customers and reconciling certain transactions made to or from deposit accounts, including any commingled funds within the omnibus account. Any failure by Fold to maintain complete and accurate records could create uncertainty as to fund attribution and cause delays or outages for customers seeking to withdraw funds from or through Fold’s platform.
Certain U.S. federal and state prudential banking regulators have cited the recent bankruptcy case of Synapse Financial Technologies, Inc. in connection with related proposed regulatory initiatives which may affect our business. On September 17, 2024, the FDIC, citing certain alleged recordkeeping issues attendant to Synapse’s commingling of customer funds in custodial accounts, published a notice of proposed rulemaking which would require certain heightened standards for reconciliation and recordkeeping associated with certain custodial accounts containing commingled customer funds. These and other regulatory initiatives by U.S. federal or state prudential banking regulators, if enacted, may increase compliance costs associated with our business or impact our relationships with current or prospective partner banks (see above risk factor: Our relationships with bank partners in the United States may subject us and our partners to additional regulatory scrutiny.).
Changes in card network rules or standards could adversely affect our business.
We are registered as a service provider with the Visa network. As such, we are subject to card network rules that could subject us to a variety of fines or penalties and other compliance obligations. The termination of our registration or any changes in card network rules or standards, including interpretation and implementation of existing rules or standards, could increase the cost of operating our business or limit our ability to provide our services to our customers, and could have a material adverse effect on our business, financial condition and results of operations.
We operate in a highly competitive industry and compete against companies with greater financial and other resources, and our business, operating results, and financial condition may be adversely affected if we are unable to respond to our competitors effectively.
The bitcoin-focused, consumer financial services industry is highly innovative, rapidly evolving, and characterized by healthy competition, experimentation, changing customer needs, frequent introductions of new products and services, and uncertain and evolving industry and regulatory requirements. We expect competition to further intensify in the future as existing and new competitors introduce new products or enhance existing products. We compete against a number of companies operating both within the United States and abroad, and both those that focus on traditional financial services and those that focus on bitcoin-based services. Our main competition falls into the following categories:
•
traditional financial firms that have entered the bitcoin market in recent years and offer overlapping features targeted at our customers;
•
financial technology providers that do not focus on bitcoin and may attempt to position themselves as a safer alternative to our products and services;
•
mobile payment companies; and
•
companies focused on the bitcoin market, some of whom choose to operate outside of local rules and regulations or in jurisdictions with less stringent local rules and regulations and are potentially able to more quickly adapt to trends and to develop new bitcoin-based products and services as a result of operating under different regulatory frameworks.
27
Many innovative start-up companies and larger companies have made, and continue to make, significant investments in research and development, and we expect these companies to continue to develop similar or potentially superior products and technologies that compete with our products. Further, more traditional financial and non-financial services businesses may choose to offer bitcoin-based services in the future as the industry continues to gain adoption. Our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources.
Our existing competitors have, and our potential competitors are expected to have, various competitive advantages over us, such as:
•
the ability to offer products and services that we do not support or offer on our platform (due to constraints from regulatory authorities, our banking partners, and other factors) such as non-bitcoin digital assets or services that would requires securities, derivatives, or other specialized regulatory permissions under U.S. or foreign laws;
•
greater name recognition, longer operating histories, larger customer bases, and larger market shares;
•
larger sales and marketing budgets and organizations;
•
more established marketing, banking, and compliance relationships;
•
greater customer support resources;
•
greater resources to make acquisitions;
•
lower labor, compliance, risk mitigation, and research and development costs;
•
larger and more mature intellectual property portfolios;
•
greater number of applicable licenses or similar authorizations;
•
operations in certain jurisdictions with lower compliance costs and greater flexibility to explore new product offerings; and
•
substantially greater financial, technical, and other resources.
If we are unable to compete successfully, or if competing successfully requires us to take costly actions in response to the actions of our competitors, our business, operating results, and financial condition could be adversely affected.
Our long-term success depends on our ability to develop new and innovative products and services to address and keep pace with the rapidly evolving market for payments and financial services, and if we are not able to implement successful enhancements and new features for our products and services, our business, operating results and financial condition could be materially and adversely affected.
Rapid and significant technological changes continue to confront the industries in which we operate, including developments in digital banking, mobile financial apps, and point-of-service solutions, as well as developments in bitcoin.
These new and evolving services and technologies may be superior to, impair, or render obsolete the products and services we currently offer or the technologies we currently use to provide them. For example, disruptive technologies such as generative AI may fundamentally alter the use of our products or services in unpredictable ways. We cannot predict the effects of new services and technologies on our business. However, our ability to grow our customer base and net revenue will depend heavily on our ability to innovate and create successful new products and services, both independently and in conjunction with third-party developers. Incorporating new technologies into our products and services may require substantial expenditures and take considerable time, and we may not be successful in realizing a return on these development efforts in a timely manner or at all. Our ability to develop new and innovative products and services may be inhibited by industry-wide standards, payment networks, existing and future laws and regulations, resistance to change from our customers' or third parties’ intellectual property rights. Our success will depend on our ability to develop new technologies and to adapt to technological changes and evolving industry
28
standards. If we are unable to provide enhancements and new features for our products and services or to develop new and innovative products and services that achieve market acceptance or that keep pace with rapid technological developments and evolving industry standards, our business, operating results and financial condition would be materially and adversely affected.
We often rely not only on our own initiatives and innovations, but also on third parties, including payment networks, banking partners, and technology vendors, for the development of and access to new technologies and development of a robust market for these new products and technologies. Failure to accurately predict or to respond effectively to developments in our industry may significantly impair our business.
As we expand our activities, our obligations to comply with the laws, rules, regulations, and policies of a variety of jurisdictions will increase and we may be subject to inquiries, investigations, and enforcement actions by U.S. and non-U.S. regulators and governmental authorities, including those related to sanctions, export control, and anti-money laundering.
We are required to comply with laws and regulations related to economic sanctions and export controls enforced by the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) and the U.S. Department of Commerce’s Bureau of Industry and Security, as well as U.S. anti-money laundering and counter-terrorist financing laws and regulations enforced by the Financial Crimes Enforcement Network (“FinCEN”) and certain state financial services regulators. U.S. sanctions and export control laws and regulations generally restrict dealings by persons subject to U.S. jurisdiction with certain jurisdictions that are the target of comprehensive embargoes, currently the Crimea Region, the so-called Donetsk People’s Republic, and the so-called Luhansk People’s Republic, Cuba, Iran, and North Korea, as well as with persons, entities, and governments of those and other jurisdictions identified on certain prohibited party lists. Moreover, as a result of the Russian invasion of Ukraine, the United States, the E.U., the United Kingdom, and other jurisdictions have imposed wide-ranging sanctions on Russia and Belarus and persons and entities associated with Russia and Belarus. There can be no certainty regarding whether such governments or other governments will impose additional sanctions, or other economic or military measures against Russia or Belarus. Through Sardine.ai, we have an OFAC compliance program in place that includes monitoring of IP addresses to identify prohibited jurisdictions and of blockchain addresses that have either been identified by OFAC as prohibited or that otherwise are believed by us to be associated with prohibited persons or jurisdictions. Nonetheless, there can be no guarantee that our compliance program will prevent transactions with particular persons or addresses or prevent every potential violation of OFAC sanctions. Any present or future government inquiries relating to sanctions could result in negative consequences for us, including costs related to government investigations, financial penalties, and harm to our reputation. The impact on us related to such matters could be substantial. Although we have implemented controls, and are working to implement additional controls and screening tools designed to prevent sanctions violations, there is no guarantee that we will not inadvertently provide access to our products and services to sanctioned parties or jurisdictions in the future.
Regulators worldwide frequently study each other’s approaches to the regulation of the cryptoeconomy. Consequently, developments in any jurisdiction may influence other jurisdictions, including in the United States. As a result, the risks created by any new law or regulation in one jurisdiction may be replicated in the United States, affecting our business.
The complexity of U.S. federal and state and international regulatory and enforcement regimes, coupled with the scope of our operations and the evolving global regulatory environment, could result in a single event prompting overlapping investigations and legal and regulatory proceedings by government authorities in different jurisdictions. Any of the foregoing could, individually or in the aggregate, harm our reputation, damage our brand and business, and adversely affect our operating results and financial condition. Due to the uncertain application of existing laws and regulations, it may be that, despite our analysis that certain products and services are currently unregulated, such products or services may indeed be subject to financial regulation, licensing, or authorization obligations that we have not obtained or with which we have not complied. As a result, we are at a heightened risk of enforcement action, litigation, regulatory, and legal scrutiny which could lead to sanctions, cease and desist orders, or other penalties and censures which could significantly and adversely affect our continued operations and financial condition.
29
We may be subject to material litigation, including individual and class action lawsuits, as well as investigations and enforcement actions by regulators and governmental authorities. These matters are often expensive and time consuming, and, if resolved adversely, could harm our business, financial condition, and operating results.
We may from time to time become subject to claims, arbitrations, individual and class action lawsuits with respect to a variety of matters, including employment, consumer protection, advertising, and securities. In addition, we may from time to time become subject to, government and regulatory investigations, inquiries, actions or requests, other proceedings and enforcement actions alleging violations of laws, rules, and regulations, both foreign and domestic. The scope, determination, and impact of claims, lawsuits, government and regulatory investigations, enforcement actions, disputes, and proceedings to which we are subject cannot be predicted with certainty, and may result in:
•
substantial payments to satisfy judgments, fines, or penalties;
•
substantial outside counsel, advisor, and consultant fees and costs;
•
substantial administrative costs, including arbitration fees;
•
additional compliance and licensure requirements;
•
loss or non-renewal of existing licenses or authorizations, or prohibition from or delays in obtaining additional licenses or authorizations, required for our business;
•
loss of productivity and high demands on employee time;
•
criminal sanctions or consent decrees;
•
termination of certain employees, including members of our executive team;
•
barring of certain employees from participating in our business in whole or in part;
•
orders that restrict our business or prevent us from offering certain products or services;
•
changes to our business model and practices;
•
delays to planned transactions, product launches or improvements; and
•
damage to our brand and reputation.
Regardless of the outcome, any such matters can have an adverse impact, which may be material, on our business, operating results, or financial condition because of legal costs, diversion of management resources, reputational damage, and other factors. We are currently the defendant in a bankruptcy clawback proceeding as described in “Management's Discussion and Analysis of Financial Conditions and Results of Operations” and in “Note 13. Commitments and Contingencies” in the Notes to our Financial Statements; while the outcome of this proceeding is uncertain, we do not believe it is likely to result in a material adverse effect on our future operating results, financial condition, or cash flows.
Loss of a critical banking or insurance relationship could adversely impact our business, operating results, and financial condition.
Although a number of significant U.S. banks and investment institutions have indicated they plan to begin allowing their customers to carry and invest in bitcoin, the acceptance and use of bitcoin by banks is relatively uncommon and may never become mainstream. Indeed, a number of companies and individuals engaged in bitcoin-related activities have been unable to find banks or financial institutions that are willing to provide them with banking services. Similarly, a number of companies and individuals or businesses associated with bitcoin may have had and may continue to have their existing banking services discontinued with financial institutions in response to government action. We also may be unable to obtain or maintain these services for our business. To date, we have not experienced such issues in finding banks or financial institutions willing to provide services to us that have had a material impact on our business, financial condition or results of operations.
We rely on bank relationships to provide our products and services and to connect us to payment card networks. As a bitcoin-focused, consumer financial services business, our banking partners may view us as a higher risk customer for purposes of their anti-money laundering programs. We may face difficulty establishing or maintaining banking
30
relationships due to instability in the global banking system, increasing regulatory uncertainty and scrutiny, or our banking partners’ policies. The loss of these banking partners or the imposition of operational restrictions by these banking partners and the inability for us to utilize other redundant financial institutions may result in a disruption of business activity as well as regulatory risks.
However, if these financial institutions are subject to receivership, resolution or failure, or if banking relationships become severely limited or unavailable to bitcoin participants, there could be temporary delays in or unavailability of services that are critical to our or our partners’ operations or our customers, a further limit on available vendors, and reduced quality in services. For example, while our business and operations were not materially affected by the closures of Silvergate Capital Corp. and Signature Bank and the cessation of their real-time fiat currency payment networks in March 2023, large bitcoin and digital asset industry participants experienced a temporary inability to transfer fiat currencies outside of standard business hours.
We also rely on insurance carriers to insure customer losses resulting from a breach of our physical security, cyber security, or by employee or third party theft. Our ability to maintain crime, specie, and cyber insurance is subject to the insurance carriers’ ongoing underwriting criteria and our inability to obtain and maintain appropriate insurance coverage could cause a substantial business disruption, adverse reputational impact, inability to compete with our competitors, and regulatory scrutiny.
Any significant disruption in our products and services, in our information technology systems, or in the bitcoin network related to our business, could result in a loss of customers or funds and adversely impact our brand and reputation and our business, operating results, and financial condition.
Our reputation and ability to attract and retain customers and grow our business depends on our ability to operate our service at high levels of reliability, scalability, and performance, including the ability to process and monitor, on a daily basis, a large number of transactions that occur at high volume and frequencies across multiple systems. Our platform, our ability to enable bitcoin-related transactions and rewards, and our ability to operate at a high level are dependent on our ability to access the bitcoin network, for which access is dependent on our systems’ ability to access the internet. Further, the successful and continued operations of the bitcoin network will depend on a network of computers, miners, and validators, and their continued operations, all of which may be impacted by service interruptions.
Our systems, the systems of our third-party service providers and partners, and the bitcoin network have experienced from time to time, and may experience in the future, service interruptions or degradation because of hardware and software defects or malfunctions, computer viruses or other malware, distributed denial-of-service and other cyberattacks, disruptions in telecommunications services, insider threats, break-ins, sabotage, human error, vandalism, earthquakes, hurricanes, floods, fires, and other natural disasters, power losses, fraud, military or political conflicts, terrorist attacks, or other events. In addition, extraordinary volumes of usage could cause our computer systems to operate at an unacceptably slow speed or even fail. Some of our systems or the systems of our third-party service providers and partners are not fully redundant, and our or their disaster recovery planning may not be sufficient for all possible outcomes or events.
If any of our systems, or those of our third-party service providers, are disrupted for any reason, our products and services may be interrupted or fail, resulting in unanticipated disruptions, slower response times or delays in processing customer transactions, failed settlement of trades, incomplete or inaccurate accounting, recording or processing of transactions, unauthorized transactions, loss of customer information, increased demand on limited customer support resources, customer claims, complaints with regulatory organizations, lawsuits, or enforcement actions. A prolonged interruption in the availability or reduction in the availability, speed, or functionality of our products and services could harm our business. Significant or persistent interruptions in our services could cause current or potential customers to believe that our systems are unreliable, leading them to switch to our competitors or to avoid or reduce the use of our products and services, and could permanently harm our reputation and brands. Moreover, to the extent that any system failure or similar event results in damages to our customers, these customers could seek significant compensation or contractual penalties from us for their losses, and those claims, even if unsuccessful, would likely be time-consuming and costly for us to address. Problems with the reliability or security of our systems would harm our reputation and the cost of remedying these problems could negatively affect our business, operating results, and financial condition.
31
In addition, we are continually improving and upgrading our information systems and technologies. Implementation of new systems and technologies is complex, expensive, time-consuming, and may not be successful. If we fail to timely and successfully implement new information systems and technologies, or improvements or upgrades to existing information systems and technologies, or if such systems and technologies do not operate as intended, it could have an adverse impact on our business, internal controls (including internal controls over financial reporting), operating results, and financial condition.
Our and our customers’ bitcoin could be subject to risk in the event of an insolvency of BitGo.
Applicable insolvency law is not fully developed with respect to the holding of digital assets in custodial accounts. Thus, bitcoin held by us or our customers at a custodial partner such as BitGo may be considered to be the property of a bankruptcy estate in the event of a bankruptcy. Recent bankruptcy decisions involving digital-asset companies have demonstrated that, where custodial arrangements are not clearly segregated in practice or do not confer explicit ownership rights under applicable law, courts may treat customer assets as property of the bankruptcy estate notwithstanding contractual language to the contrary. In addition, bitcoin held on behalf of our customers could also be considered part of our own bankruptcy estate if we were to become insolvent. Further, such bitcoin could be misappropriated by a custodial partner despite clear commitments to segregation and ownership rights such that we are treated as an unsecured creditor.
Bitcoin held in segregated wallets could be viewed as less of a risk in an insolvency proceeding. This is because such bitcoin can be clearly identified, as opposed to where assets are commingled with those of other holders. However, BitGo does not currently offer segregated wallet services to our customers. This may cause our customers to view our bitcoin-related services as more risky compared to other types of bitcoin products and services, and may cause our customers to withdraw bitcoin from the wallet services we provide through BitGo.
If custodially-held bitcoin is determined to be the property of BitGo's or another custodial partner's bankruptcy estate, we and our customers could be treated as a general unsecured creditor, inhibiting our and our customers’ ability to exercise ownership rights with respect to such bitcoin and potentially being required to share the value of our bitcoin, either in the form of spot bitcoin or a determined cash value on a given date, with those of other creditors. In addition, it is possible that a bankruptcy court would require all bitcoin and other digital assets held by a custodian to be converted into cash, which could result in our incurring significant capital gains tax charges. Even if we are able to prevent our and our customers’ bitcoin from being considered the property of BitGo's bankruptcy estate as part of an insolvency proceeding, it is possible that we or our customers would still be delayed or may otherwise experience difficulty in accessing bitcoin held by BitGo during the pendency of the insolvency proceedings. Furthermore, bankruptcy trustees and regulatory authorities have, in recent cases, pursued clawback, preference, and fraudulent transfer claims against digital-asset companies and counterparties, even where the transfers involved customer-facing operational flows. Similar theories could be asserted against us or our customers depending on future legal developments.
Any such outcome could have a material adverse effect on our financial condition and the market price of our securities. In addition, even if BitGo itself does not become insolvent, a series of insolvencies of high-profile custodians such as occurred in 2022, and more recently in October 2025 with the Nevada cease-and-desist order issued against Fortress Trust, LLC, one of our former custodians, could result in customers finding our services more risky and less attractive as compared to competitors, and any failure to increase our customer base or discontinuation or reduction in use of our platform and products by existing customers could adversely impact our business, operating results, and financial condition.
On August 14, 2023, Prime Core Technologies, Inc. (“Prime Core”), one of our former service providers, filed for bankruptcy protection. On August 14, 2025, we were named as a defendant in an adversary proceeding filed by the Prime Core bankruptcy estate seeking recovery of alleged preference transfers and other relief (the “Prime Core Dispute”). We intend to defend ourselves vigorously, and we believe the claims lack merit; however, the outcome is inherently uncertain. Although the Prime Core Dispute relates to a former service provider and does not impact customer bitcoin balances or our current custodial arrangements, any adverse ruling or unexpected expansion of theories of liability in that proceeding or in similar proceedings against other parties could heighten perceptions of counterparty risk or highlight unresolved legal questions regarding digital-asset custody in insolvency. Additionally, because courts in several recent cases have applied traditional bankruptcy doctrines to digital-asset businesses, adverse
32
outcomes in the Prime Core Dispute or similar proceedings against third parties could influence future interpretations of similar doctrines by courts, regulators, or counterparties.
The theft, loss, or destruction of private keys required to access any bitcoin may be irreversible. If we or BitGo are unable to access private keys for the bitcoin wallets holding our or our customers’ bitcoin, or if we or BitGo experience a hack or other data loss relating to its ability to access any bitcoin, it could cause regulatory scrutiny, reputational harm, and other losses.
Bitcoin is generally controllable only by the possessor of the unique private key relating to the digital wallet in which the bitcoin is held. While blockchain protocols typically require public addresses to be published when used in a transaction, private keys must be safeguarded and kept private in order to prevent a third party from accessing the bitcoin held in such a wallet. To the extent that any of the private keys relating to wallets containing bitcoin held for the benefit of us or our customers are lost, destroyed, or otherwise compromised or unavailable, and no backup of the private key is accessible, we or BitGo will be unable to access the bitcoin assets held in the related wallet. Further, we cannot provide assurance that the private keys to bitcoin wallets held by us directly or by BitGo will not be hacked or compromised. Bitcoin assets and blockchain technologies have been, and may in the future be, subject to security breaches, hacking, or other malicious activities. Any loss of private keys relating to, or hack or other compromise of, digital wallets used to store our customers’ bitcoin could adversely affect our customers’ ability to access or sell their bitcoin. In addition, if any of our customers’ bitcoin is lost, we may choose, or in some cases we may be required to, reimburse our customers for their losses, which could subject us to significant financial losses in addition to losing customer trust in us and our products. As such, any loss of private keys due to a hack, employee or service provider misconduct or error, or other compromise by third parties could hurt our brand and reputation, result in significant losses, and adversely impact our business.
We believe this risk is reduced because the majority of the bitcoin held on behalf of our customers is retained in multi-signature “cold storage” wallets, which means that the related private keys are not held on a computer system that is connected to the internet. Multi-signature cold storage wallets are intended to keep the bitcoin as secure as possible by requiring multiple keys to authorize a transaction while also providing redundancy in the event that one of the private keys is lost. In the event that a private key is lost, the remaining keys in the multi-signature wallet can be used to regenerate a new key. However, multi-signature controls cannot eliminate all risks associated with operational error, partner failure, or cybersecurity threats.
With regards to bitcoin held on behalf of our customers, approximately 90% is retained in multi-signature cold storage wallets at any given time, while the remaining assets are held in hot wallets used to facilitate customer withdrawals and other real-time operational needs.
Our digital asset custody partners’ security technology is designed to prevent, detect, and mitigate inappropriate access to their systems, by internal or external threats. We believe our digital asset custody partners have developed and maintained administrative, technical, and physical safeguards designed to comply with applicable legal requirements and industry standards. However, it is nevertheless possible that hackers, employees or service providers acting contrary to those policies, or others could circumvent these safeguards to improperly access the systems or documents of our business partners, agents, or service providers, and improperly access, obtain, or misuse customer digital assets and funds. The methods used to obtain unauthorized access, disable, or degrade service or sabotage systems are constantly changing and evolving and may be difficult to anticipate or detect for long periods of time. Additionally, transactions undertaken through our websites or other electronic channels may create risks of fraud, hacking, unauthorized access or acquisition, and other deceptive practices. Any security incident resulting in a compromise of customer assets could result in substantial costs to us and require us to notify impacted individuals, and in some cases regulators, of a possible or actual incident, expose us to regulatory enforcement actions, including substantial fines, limit our ability to provide services, subject us to litigation, significant financial losses, damage our reputation, and adversely affect our business, operating results, financial condition, and cash flows.
BitGo has advised us that it carries a $250 million umbrella insurance policy for the digital assets it custodies. However, this insurance policy covers all digital assets custodied by BitGo, not only those held on behalf of Fold and its customers. In addition, BitGo has not contractually committed to maintain any specific levels of insurance coverage and has no obligation to reimburse us for any damages due to loss or theft of bitcoin (including claims by our customers) except where such loss or theft is due to BitGo’s gross negligence or willful misconduct. Insurance
33
coverage maintained by BitGo does not ensure that all customer or corporate losses would be recoverable, and any losses not covered by insurance could result in significant financial exposure to us and reputational harm.
Other Risks Related to Fold’s Business and Financial Position
Volatility in the price of bitcoin could limit our options in obtaining cash funding on favorable terms.
We frequently use the bitcoin in our Investment Treasury as collateral to secure loans or other sources of funding. A sharp decline in the price of bitcoin could limit our options in obtaining funding by increasing the number of bitcoin we must set aside as collateral. For example, to make a draw under our Credit Facility, we must deposit bitcoin as collateral with a third-party custodian equal in value to 160% of the cash we obtain. A sharp decline in the value of bitcoin would increase the cost and difficulty for us in making a draw under the Credit Facility and leave us unable to draw as much cash as we would like, or require us to provide additional bitcoin to Two Prime to satisfy our collateral requirements. For example, on February 5, 2025 the Company provided an additional 50 bitcoin as collateral to Two Prime due to the drop in the price of bitcoin in order to satisfy our collateral maintenance requirements under the Credit Facility. Additionally, continued decline or volatility in the price of bitcoin could increase our difficulty in obtaining funds in the future by increasing the minimum number of bitcoin that must be set aside as collateral in future loans or by leading to the imposition of other stricter or more onerous lending terms. For additional information, see the discussion in “Risk Factors - We may suffer losses due to abrupt and erratic market movements” and “Risk Factors - Our investments in bitcoin are subject to volatile market prices and risks of loss.”Even if the value of bitcoin is high at the time we seek out new funding, recent market volatility may nevertheless make lenders cautious and more likely to impose stricter restrictions or terms on us. If we cannot obtain funding, or cannot obtain funding on favorable enough terms, it could have a material adverse effect on our financial position and results of operations.
We may suffer losses due to abrupt and erratic market movements.
The bitcoin market has been characterized by significant volatility and unexpected price movements, and has previously experienced significant declines. Bitcoin may become more volatile and less liquid in a very short period of time. A series of recent high-profile bankruptcies, closures, liquidations, regulatory enforcement actions and other events relating to companies operating in the digital asset industry, including the filings for bankruptcy protection by Three Arrows Capital, Celsius Network, Voyager Digital, FTX Trading and Genesis Global Capital, the closure or liquidation of certain financial institutions that provided lending and other services to the digital assets industry, including Signature Bank and Silvergate Bank, SEC enforcement actions against Coinbase, Inc. and Binance Holdings Ltd., the placement of Prime Trust, LLC into receivership following a cease-and desist order issued by Nevada’s Department of Business and Industry, a similar cease-and-desist order issued by Nevada against Fortress Trust, LLC, and the filing and subsequent settlement of a civil fraud lawsuit by the New York Attorney General against Genesis Global Capital, its parent company Digital Currency Group, Inc., and former partner Gemini Trust Company, have highlighted the counterparty risks applicable to owning and transacting in digital assets.
Although these bankruptcies, closures, liquidations and other events have not to date resulted in any loss or misappropriation of our bitcoin, nor have such events adversely impacted our access to our bitcoin, they created significant volatility in the markets for cryptocurrency generally and for bitcoin particularly and have raised the risk of loss of our and our customer's bitcoin. For example, the bankruptcy of Prime Trust has resulted in litigation against us and our customers as described in “Management's Discussion and Analysis of Financial Conditions and Results of Operations” and in “Note 13. Commitments and Contingencies” in the Notes to our Financial Statements. Additional bankruptcies, closures, liquidations, regulatory enforcement actions or other events involving participants in the digital assets industry in the future could result in market prices being subject to erratic and abrupt market movement, which could harm our business. Further, because there is no centralized authority which determines the price of bitcoin, pricing often differs between exchanges. When some exchanges are viewed as higher risk, that price differential can widen as traders attempt to exploit these differences. Volatility in the price of bitcoin, as well as the lack of a standard price, could lead consumers to see bitcoin as an unsafe asset, which would result in losses of customers and resulting harm to our business. In addition, if we were to attempt to monetize the bitcoin we hold on our balance sheet, such price volatility could lead to trading losses, impacting our financial position.
34
For example, based on aggregate US exchange markets data collected by CoinMarketCap, on December 18, 2023, the price of bitcoin at 10:00 P.M. UTC was $42,623.54. On December 18, 2024, the price of bitcoin at 10:00 P.M. UTC was $100,041.54. Between those dates, bitcoin experienced significant volatility. For example, on August 1, 2024, the price of bitcoin was $65,353.50, and on August 5, 2024 the price of bitcoin was $53,991.35. On August 24, 2024, the price of bitcoin had risen again to $64,176.37. In 2022, price swings were even more drastic, with prices as high as $47,459 at the end of March 2022 and as low as $16,530 at the end of the year. Such volatility will impact the overall value of our business and could cause volatility in the price of our stock. The price of bitcoin was approximately $42.3 thousand, $93.4 thousand and $87.5 thousand as of December 31, 2023, December 31, 2024 and December 31, 2025, respectively.
The trading volume of bitcoin typically increases during periods of extreme volatility. For example, in the days following the federal elections in November 2024, the price of bitcoin rose sharply from $69,289.27 on November 2 to $87,250.43 on November 14, and volumes increased from 18,184,612,091 to 87,616,705,248 during that time period according to aggregate data from US exchange markets collected by CoinMarketCap. Such volume increases can lead to extreme pressures on our and our partners’ platforms and infrastructure that can lead to inadvertent suspension of services across parts of the platforms or the entire platforms. As a result, from time to time we may experience outages. Outages can lead to increased customer service expense, can cause customer loss and reputational damage, result in inquiries and actions by regulators, and can lead to other damages for which we may be responsible, any of which could harm our business.
Our investments in bitcoin are subject to volatile market prices and risks of loss.
As of December 31, 2025, we had approximately $140.5 million of bitcoin in our treasury accounts. The price of bitcoin has been highly volatile and may continue to be volatile in the future, including as a result of various associated risks and uncertainties. For additional information, see the discussion in “Risk Factors - We may suffer losses due to abrupt and erratic market movements” and “Risk Factors - Volatility in the price of bitcoin could limit our options in obtaining cash funding on favorable terms.”For example, the prevalence of bitcoin is a relatively recent trend, and the long-term adoption of bitcoin by investors, consumers, and businesses remains uncertain. The lack of a physical form, reliance on technology for creation, existence, and transactional validation, and decentralization may subject bitcoin’s integrity to the threat of malicious attacks and technological obsolescence. To the extent the market value of the bitcoin we hold decreases materially relative to our cost basis, our financial condition may be adversely impacted.
If there are future changes in applicable accounting rules that require us to change the manner in which we account for our bitcoin, there could be a material and adverse effect on our financial results and the market price of our common stock may suffer as a result.
We have a history of negative cash flows.
We cannot anticipate with any degree of certainty what our cash flows will be in future periods. Our net cash used in operating activities was a loss of $16.1 million for 2025 compared to a loss of $3.3 million for 2024, and we incurred an operating loss of $27.7 million for 2025 compared to an operating loss of $5.8 million for 2024. Though we have the Credit Facility and the Facility, as potential sources of cash, the negative cash flows generated from operating activities introduces potential risk of an interruption to operating activities. As of December 31, 2025, we have approximately $7.7 million in cash and cash equivalents. We have encountered recurring cash outflows from operations, which historically we have funded through equity offerings and debt. Through December 31, 2025, our accumulated deficit was $170.9 million. See Liquidity and Capital Resources under "Management's Discussion and Analysis of Financial Condition and Results of Operation" for a more thorough discussion.
We may not be able to generate sufficient cash flow to service all of our obligations.
Our ability to make payments on and to upsize our current facilities (including our Credit Facility), refinance any of our outstanding indebtedness, obtain additional financing, and to fund planned capital expenditures, strategic transactions and expansion efforts will depend on, among other things, our financial and operating performance, including, our ability to generate cash in the future. This, to a certain extent, is subject to general economic, financial, competitive, legislative, regulatory and other factors that are beyond our control.
35
Our business may not be able to generate sufficient cash flows from operations, and there is no assurance that our future cash flows from operations will be sufficient to enable us to make payments due on our current or future indebtedness and to fund our other liquidity needs. If this is the case, we will need to refinance all or a portion of our indebtedness on or before maturity, and we cannot assure that we will be able to refinance any of our indebtedness in a timely manner, on commercially reasonable terms, or at all. We may need to implement one or more alternatives, such as reducing or delaying planned business activities, expenses and capital expenditures, selling assets, restructuring debt, or obtaining additional equity or debt financing. These financing strategies may not be executed on satisfactory terms, if at all or on terms that would be advantageous to our stockholders. Our ability to upsize our current facilities (including our Credit Facility), refinance our indebtedness or obtain additional financing, and to do so on commercially reasonable terms, will depend on, among other things, our financial condition at the time, restrictions in agreements governing our indebtedness, and other factors, including the condition of the financial markets and the markets in which we will compete.
If we fail to retain existing customers or add new customers, or if our customers decrease their level of engagement with our products, services and platform, our business, operating results, and financial condition may be significantly harmed.
Our success depends on our ability to retain existing customers and attract new customers to increase engagement with our products, services, and platform. To do so, we must continue to offer leading technologies and ensure that our products and services are secure, reliable, and engaging. We must also expand our products and services, and offer competitive prices in an increasingly crowded and price-sensitive market. There is no assurance that we will be able to continue to do so, that we will be able to retain our current customers or attract new customers, or keep our customers engaged. Any number of factors can negatively affect customer retention, growth, and engagement, including if:
•
customers increasingly engage with competing products and services, including products and services that we are unable to offer due to regulatory reasons;
•
we fail to introduce new and improved products and services, or if we introduce new products or services that are not favorably received;
•
there are changes in sentiment about the quality or usefulness of our products and services or concerns related to privacy, security, or other factors;
•
there are adverse changes in our products and services that are mandated by legislation, regulatory authorities, or litigation;
•
customers perceive bitcoin to be a bad investment;
•
technical or other problems prevent us from delivering our products and services with the speed, functionality, security, and reliability that our customers expect;
•
cybersecurity incidents, employee or service provider misconduct, or other unforeseen activities cause losses to us or our customers, including losses to assets held by us on behalf of our customers;
•
modifications to our pricing model or modifications by competitors to their pricing models;
•
we fail to provide adequate customer service;
•
regulatory and governmental bodies in countries that we target for expansion express negative views or take hostile regulatory actions towards bitcoin or, more broadly, the bitcoin economy; or
•
we or other companies or high-profile figures in the digital assets industry are the subject of adverse media reports or other negative publicity.
From time to time, certain of these factors have negatively affected customer retention, growth, and engagement to varying degrees. If we are unable to maintain or increase our customer base and customer engagement, our revenue and financial results may be adversely affected. Any decrease in user retention, growth, or engagement could render our products and services less attractive to customers, which may have an adverse impact on our revenue, business,
36
operating results, and financial condition. If our customer growth rate slows or declines, we will become increasingly dependent on our ability to maintain or increase levels of user engagement and monetization in order to drive growth of revenue.
Our operating expenses may increase in the future and we may not be able to achieve profitability or positive cash flow from operations on a consistent basis, which may cause our business, operating results, and financial condition to be adversely impacted.
Our operating expenses may increase in the future as we continue to attract and retain talent, expand our sales and marketing efforts, develop additional products and services, incur unforeseen regulatory or compliance expenses, and operate as a public company. While we consistently evaluate opportunities to drive efficiency, we cannot guarantee that these efforts will be successful or that we will not re-accelerate operating expenditures in the future. Our operations may prove more expensive than we currently anticipate, and we may not succeed in increasing our net revenue sufficiently to offset these higher expenses. Our revenue growth may be further impacted by reduced demand for our offerings, increased competition, adverse macroeconomic conditions, a decrease in the growth or size of the bitcoin economy, regulatory uncertainty or scrutiny, or changes that impact our ability to offer certain products or services, any failure to capitalize on growth opportunities, or the failure of new products and services we develop to gain traction in the market. We cannot be certain that we will be able to achieve profitability or achieve positive operating cash flow on any quarterly or annual basis. If we are unable to effectively manage these risks and difficulties as we encounter them, our business, operating results, and financial condition may suffer.
If we do not effectively scale our business, or are unable to maintain and improve our systems and processes, our operating results could be adversely affected.
We have experienced periods of operational expansion and subsequent adjustments as our business and market conditions have evolved. As our business changes, it becomes increasingly complex. To effectively manage and capitalize on our growth periods, we need to manage headcount, capital and processes efficiently while making investments, such as expanding our information technology and financial, operating, and administrative systems and controls. Growth and contraction initiatives could strain our existing resources, and we could experience ongoing operating difficulties in managing our business as our regulatory, banking partner, and operational requirements grow more complex, including difficulties in hiring, training, managing and retaining a remote and evolving employee base. If we do not adapt or scale to meet these evolving challenges, we may experience erosion to our brand, the quality of our products and services may suffer, and our company culture may be harmed. Moreover, the failure of our systems and processes could undermine our ability to provide accurate, timely, and reliable reports on our financial and operating results, including the financial statements provided herein, and could impact the effectiveness of our internal controls over financial reporting. In addition, our systems and processes may not prevent or detect all errors, omissions, or fraud. Any of the foregoing operational failures could lead to noncompliance with laws, loss of operating licenses or other authorizations, or loss of bank relationships that could substantially impair or even suspend company operations.
Successful implementation of our growth strategy will also require significant expenditures before any substantial associated revenue is generated and we cannot guarantee that these increased investments will result in corresponding and offsetting revenue growth. Because we have a limited history operating our business at its current scale, it is difficult to evaluate our current business and future prospects, including our ability to plan for and model future growth. Our limited operating experience at this scale, combined with the rapidly evolving nature of the bitcoin market in which we operate, substantial uncertainty concerning how the bitcoin market may develop, and other economic factors beyond our control, reduces our ability to accurately forecast quarterly or annual revenue.
Additionally, from time to time, we may realign our resources and talent to implement stage-appropriate business strategies, including furloughs, layoffs and reductions in force. If there are unforeseen expenses associated with such realignments in our business strategies, and we incur unanticipated charges or liabilities, then we may not be able to effectively realize the expected cost savings or other benefits of such actions. Failure to manage any growth or any scaling back of our operations could have an adverse effect on our business, operating results, and financial condition.
37
Our services must integrate with a variety of operating systems. If we are unable to ensure that our services interoperate with such operating systems and devices, our business may be materially and adversely affected.
We are dependent on the ability of our products and services to integrate with a variety of operating systems, web browsers, and wired and wireless interfaces to mobile devices that we do not control, including those of Sutton Bank and BitGo. Any changes in these systems that degrade the functionality of our products and services, impose additional costs or requirements on us, or give preferential treatment to competitive services, including their own services, could materially and adversely affect usage of our products and services. In addition, we rely on app marketplaces, such as the Apple App Store and Google Play, to drive downloads of our mobile apps. Apple, Google, or other operators of app marketplaces regularly make changes to their marketplaces, and those changes may make access to our products and services more difficult. In the event that it is difficult for our customers to access and use our products and services, our business may be materially and adversely affected. Furthermore, Apple, Google, or other operators of app marketplaces regularly provide software updates, and such software updates may not operate effectively with our products and services, which may reduce the demand for our products and services, result in dissatisfaction by our customers, and materially and adversely affect our business.
Our strategy and focus on delivering high-quality, compliant, easy-to-use, and secure bitcoin-related financial services may not maximize short-term or medium-term financial results.
We have taken, and expect to continue to take, actions that we believe are in the best interests of our customers and the long-term interests of our business, even if those actions do not necessarily maximize short-term or medium-term results. These include expending significant managerial, technical, and legal efforts on complying with laws and regulations that are applicable to our products and services and ensuring that our products are secure. We also focus on driving long-term engagement with our customers through innovation and developing new industry-leading products and technologies. These decisions may not be consistent with the short-term and medium-term expectations of our stockholders and may not produce the long-term benefits that we expect, which could have an adverse effect on our business, operating results, and financial condition.
Due to our limited operating history, it may be difficult to evaluate our business and future prospects, and we may not be able to achieve or maintain profitability in any given period.
We began our operations in 2019 and since then our business model has continued to evolve. Our net revenue has significantly grown since our formation, but there is no assurance that growth will continue in future periods and you should not rely on the net revenue growth of any given quarterly or annual period as an indication of our future performance. If our total net revenue were to decline significantly for an extended period of time, our business, operating results and financial condition could be adversely affected. Our limited operating history and the volatile nature of our bitcoin-focused business make it difficult to evaluate our current business and our future prospects. We have encountered and will continue to encounter risks and difficulties as described in this section. If we do not manage these risks successfully, our business may be adversely impacted. If our revenue growth rate were to decline significantly or become negative, it could adversely affect our operating results and financial condition. If we are not able to achieve or maintain positive cash flow from operations, our business may be adversely impacted and we may require additional financing, which may not be available on favorable terms or at all, or which would be dilutive to our stockholders.
Disputes with our customers could adversely impact our brand and reputation and our business, operating results, and financial condition.
From time to time we have been, and may in the future be, subject to claims and disputes with our customers with respect to our products and services, such as fraudulent or unauthorized transactions, account takeovers, deposits and withdrawals of bitcoin, failures or malfunctions of our systems and services, or other issues relating to our products and services. Additionally, the ingenuity of criminal fraudsters, combined with many consumer users’ susceptibility to fraud, may cause our customers to be subject to ongoing account takeovers and identity fraud issues. While we have taken measures to detect and reduce the risk of fraud, there is no guarantee that they will be successful and, in any case, require continuous improvement and optimization for continually evolving forms of fraud to be effective. There can be no guarantee that we will be successful in detecting and resolving these disputes or defending ourselves in any of these matters, and any failure may result in impaired relationships with our customers, damage to our brand and
38
reputation, and substantial fines and damages. In some cases, the measures we have implemented to detect and deter fraud have led to poor customer experiences, including indefinite account inaccessibility for some of our customers, which increases our customer support costs and can compound damages. We could incur significant costs in compensating our customers, such as if a transaction was unauthorized, erroneous, or fraudulent. We could also incur significant legal expenses resolving and defending claims, even those without merit. To the extent we are found to have failed to fulfill our regulatory obligations, we could become subject to conditions that could make operations more costly, impair our ability to grow, and adversely impact our operating results. We may in the future become subject to investigation and enforcement action by state, federal, and international consumer protection agencies, including the Consumer Financial Protection Bureau (the “CFPB”), the Federal Trade Commission (the “FTC”), the Federal Deposit Insurance Corporation (the “FDIC”) and state attorneys general in the United States, each of which monitors customer complaints against us and, from time to time, escalates matters for investigation and potential enforcement against us.
While certain of our customer agreements contain arbitration provisions with class action waiver provisions that may limit our exposure to consumer class action litigation, some federal, state, and foreign courts have refused or may refuse to enforce one or more of these provisions, and there can be no assurance that we will be successful in enforcing these arbitration provisions, including the class action waiver provisions, in the future or in any given case. Legislative, administrative, or regulatory developments may directly or indirectly prohibit or limit the use of pre-dispute arbitration clauses and class action waiver provisions. Any such prohibitions or limitations on or discontinuation of the use of such arbitration or class action waiver provisions could subject us to additional lawsuits, including additional consumer class action litigation, and significantly limit our ability to avoid exposure from consumer class action litigation.
We may from time to time make acquisitions and investments, which could require significant management attention, disrupt our business, result in dilution to our stockholders, and adversely affect our financial results.
As part of our business strategy, we may become active in acquiring and investing in order to, among other things, add specialized employees, complementary companies, products, services, licenses, or technologies. As part of our business strategy, we may conduct discussions and evaluate opportunities for possible acquisitions, strategic investments, entries into new businesses, joint ventures, and other transactions. We may also invest in companies and technologies that are highly speculative in nature. In the future, we may not be able to find suitable acquisition and investment candidates, and we may not be able to complete acquisitions or make investments on favorable terms, if at all. In some cases, the costs of such acquisitions may be substantial, and there is no assurance that we will receive a favorable return on investment for our acquisitions. We may in the future be required to write off acquisitions or investments. Moreover, our future acquisitions may not achieve our goals, and any future acquisitions we complete could be viewed negatively by customers, partners, developers, advertisers, or investors. In addition, if we fail to successfully close or integrate any acquisitions, or integrate the products or technologies associated with such acquisitions into our company, our net revenue and operating results could be adversely affected. Our ability to acquire and integrate companies, products, services, licenses, employees, or technologies in a successful manner is unproven. Any integration process may require significant time and resources, and we may not be able to manage the process successfully, including successfully securing regulatory approvals which may be required to close the transaction and to continue to operate the target firm’s business or products in a manner that is useful to us. We may not successfully evaluate or utilize the acquired products, services, technology, or personnel, or accurately forecast the financial impact of an acquisition transaction, including accounting charges. We may have to pay cash, incur debt, or issue equity securities to pay for any such acquisition, any of which could adversely affect our financial results. The issuance of equity to finance any such acquisitions could result in dilution to our stockholders, which, depending on the size of the acquisition, may be significant. The incurrence of indebtedness would result in increased fixed obligations and could also include covenants or other restrictions that would impede our ability to manage our operations.
While Fold regularly evaluates strategic opportunities, Fold does not currently have any formal plans, proposals or understandings to make any material acquisitions or strategic investments.
Our business could be harmed if we are unable to accurately forecast customer demand for bitcoin and to adequately manage our bitcoin balances, including the bitcoin balances we maintain for our own account or bitcoin balances that may be maintained for use in our rewards program.
Our purpose for holding bitcoin in treasury is twofold: (1) to fulfill bitcoin rewards to customers in accordance with the terms and conditions of Fold’s user agreements (“Rewards Treasury”); and (2) as a treasury asset to support
39
our operating business with the intention to hold it as a near- to long-term investment to preserve potential upside in the value of that bitcoin (“Investment Treasury”). Our goal is to maintain an amount of bitcoin in our Rewards Treasury sufficient to satisfy our obligations to provide customer rewards in accordance with our user agreements. Customer rewards are denominated in bitcoin as of the date the rewards are earned, and therefore we try to purchase bitcoin for our Rewards Treasury at a similar cost basis to the rewards earned by our customers. If the price of bitcoin were to decrease, we may need to fulfill customer reward obligations with bitcoin that we have previously purchased at a higher price, which could adversely impact our financial position and operating results. In addition, if the price of bitcoin were to increase, demand for bitcoin on the open market may also increase. If we were unable to obtain additional bitcoin for our Rewards Treasury in a cost-effective manner, that may adversely impact our financial position and operating results.
If we fail to develop, maintain, and enhance our brand and reputation, our business, operating results, and financial condition may be adversely affected.
Our brand and reputation are key assets and a competitive advantage. Maintaining, protecting, and enhancing our brand depends largely on the success of our marketing efforts, ability to provide consistent, high-quality, and secure products, services, features, and support, and our ability to successfully secure, maintain, and defend our rights to use the “Fold” mark and other trademarks important to our brand. We believe that the importance of our brand will increase as competition further intensifies. Our brand and reputation could be harmed if we fail to achieve these objectives or if our public image were to be tarnished by negative publicity, unexpected events, or actions by third parties. Unfavorable publicity about us, including our products, services, technology, customer service, personnel, and bitcoin or bitcoin-related platforms generally could diminish confidence in, and the use of, our products and services. Moreover, to the extent that we acquire a company and maintain that acquired company’s separate brand, we could experience brand dilution or fail to retain positive impressions of our own brand to the extent such impressions are instead attributed to the acquired company’s brand. In addition, because we are a founder-led company, actions by, or unfavorable publicity about, Will Reeves, our co-founder and Chief Executive Officer, may adversely impact our brand and reputation. Such negative publicity also could have an adverse effect on the size and engagement of our customers and could result in decreased revenue, which could have an adverse effect on our business, operating results, and financial condition.
Our long-term success depends on our ability to develop products and services to address the rapidly evolving market for payments and financial services, and, if we are not able to implement successful enhancements and new features for our products and services, our business could be materially and adversely affected.
Rapid and significant technological changes continue to confront the industries in which we operate, including developments in omnichannel commerce, proximity payment devices (including contactless payments via NFC technology), digital banking, mobile financial apps, tokenization (i.e., replacing sensitive data such as payment card information with symbols (tokens) to keep the data safe), the bitcoin network, and artificial intelligence (“AI”), including machine learning.
These new and evolving services and technologies may be superior to, impair, or render obsolete the products and services we currently offer or the technologies we currently use to provide them. Our ability to develop new products and services may be inhibited by industry-wide standards, payment card networks, existing and future laws and regulations, resistance to change from our customers and other third parties, or third parties’ intellectual property rights. Incorporating new technologies into our products and services may require substantial expenditures and take considerable time, and we may not be successful in realizing a return on our efforts in a timely manner or at all.
Our success will depend on our ability to develop new technologies, to adapt to technology changes and evolving industry standards, to incorporate new technologies into our products and services, and to provide products and services that are tailored to specific needs and requirements of our customers. For example, generative AI has become more publicly available and enterprise adoption of generative AI has grown. If we are unable to provide enhancements and new features (including new security features) for our products and services or to develop new products and services that achieve market acceptance or that keep pace with rapid technological developments and evolving industry standards, our business would be materially and adversely affected.
40
We often rely, not only on our own initiatives and innovations, but also on third parties, including payment processors, banking partners and technology vendors, for the development of and access to new technologies and the development of a robust market for these new products and technologies. Failure to accurately predict or respond effectively to developments in our industry may significantly impair our business. In addition, because our products and services are designed to operate with a variety of systems, infrastructures, and devices, we need to continuously modify and enhance our products and services to keep pace with changes in technologies. Any failure of our products and services to continue to operate effectively with third-party infrastructures and technologies could reduce the demand for our products and services, result in dissatisfaction of our customers, and materially and adversely affect our business.
Our products and services may not function as intended due to undetected errors in our software and systems, product defects, developmental delays, or due to security breaches or incidents or human error in administering these systems, which could damage user or third-party relations, decrease our potential profitability and expose us to liability, and materially and adversely affect our business.
Our software, systems, and processes may contain undetected errors or vulnerabilities that could have a material adverse effect on our business, particularly to the extent such errors or vulnerabilities are not detected and remedied quickly. We have from time to time found defects in our user-facing software, internal systems, and technical integrations with third-party systems, and new errors or vulnerabilities may be introduced in the future. If there are such errors or defects in our software, hardware, or systems, we may face negative publicity, government investigations, and litigation. We do not manufacture hardware products, but we do depend on third-party service providers and infrastructure vendors, and defects or failures in their systems may affect the performance of our services. As our software services continue to increase in size and complexity, these risks may correspondingly increase as well.
In addition, we provide incremental releases of product and service updates and functional enhancements, which increase the possibility of errors. Any errors, data leaks, security breaches or incidents, disruptions in services, or other performance problems with our products or services caused by external or internal actors could hurt our reputation and damage our business. Software and system errors, or human error, could delay or inhibit settlement of payments, result in settlement discrepancies, cause reporting errors, or prevent us from collecting transaction-based fees, or negatively impact our ability to serve our customers. Similarly, security breaches or incidents, which may be caused by or result from cyber-attacks by hackers or others, computer viruses, worms, ransomware, other malicious software programs, security vulnerabilities, employee or service provider theft, misuse or negligence, phishing, identity theft or compromised credentials, denial-of-service attacks, or other causes, could impact our business and disrupt the proper functioning of our products or services, cause errors, allow loss or unavailability of, unauthorized access to, or disclosure of, proprietary, confidential or otherwise sensitive information of ours or our customers, and other destructive outcomes. Any of the foregoing issues could result in costly and time-consuming efforts to redesign and redistribute our products, give rise to regulatory inquiries and investigations, and result in lawsuits and other liabilities and losses, which could have a material and adverse effect on our business.
Key business metrics and other estimates are subject to inherent challenges in measurement and to change as our business evolves, and our business, operating results, and financial condition could be adversely affected by real or perceived inaccuracies in those metrics or any changes in metrics we disclose.
We regularly review key business metrics to measure our performance and make strategic decisions. These key metrics are calculated using internal company data and not all of these metrics have been validated by an independent third-party. While these numbers are based on what we believe to be reasonable estimates for the applicable period of measurement at the time of reporting, there are inherent challenges in such measurements. If we fail to maintain an effective analytics platform, our key metrics calculations may be inaccurate, and we may not be able to identify those inaccuracies. Additionally, we have in the past and may in the future, calculate key business metrics using third-party data. While we believe the third-party data we have used in the past or may use in the future is reliable, we do not always have the ability to independently verify the accuracy or completeness of the data contained in such sources and there can be no assurance that such data is free of error. Any inaccuracy in the third-party data we use could cause us to overstate or understate our key metrics. We regularly review our processes for calculating these metrics, and from time to time we make adjustments to improve their accuracy.
41
Our key business metrics may also be impacted by compliance or fraud-related bans, technical incidents, or false or spam accounts in existence on our platform. We regularly deactivate fraudulent and spam accounts that violate our terms of service, and exclude these users from the calculation of our key business metrics; however, we may not succeed in identifying and removing all such accounts from our platform.
We may change our key business metrics from time to time, which may be perceived negatively. Given the rapid evolution of the digital assets space, we regularly evaluate whether our key business metrics remain meaningful indicators of the performance of our business. As a result of these evaluations, in the past we have decided to make changes, and in the future may make additional changes, to our key business metrics, including eliminating or replacing existing metrics. Further if investors or the media perceive any changes to our key business metrics disclosures negatively, our business could be adversely affected.
Unfavorable media coverage could negatively affect our business.
Unfavorable publicity regarding, for example, our product changes, product quality, litigation or regulatory activity, privacy practices, terms of service, employment matters, the use of our products or services (including bitcoin-related products and services) for illicit or objectionable ends, the actions of our customers, or the actions of other companies that provide similar services to ours, has in the past, and could in the future, adversely affect our reputation. Further, we have in the past, and may in the future, be the target of social media campaigns criticizing actual or perceived actions or inactions that are disfavored by our customers, employees, or society at-large, which campaigns could materially impact our customers’ decisions to use our platform. Any such negative publicity could have an adverse effect on the size, activity, and loyalty of our customers and result in a decrease in net revenue, which could adversely affect our business, operating results, and financial condition.
Our products and services may be exploited to facilitate illegal activity such as fraud, money laundering, gambling, sanctions violations, tax evasion, and scams. If any of our customers use our products or services to further such illegal activities, our business could be adversely affected.
Our products and services may be exploited to facilitate illegal activity including fraud, sanctions violations, money laundering, gambling, tax evasion, and scams. We or our partners may be specifically targeted by individuals seeking to conduct fraudulent transfers, and it may be difficult or impossible for us to detect and avoid such transactions in certain circumstances. The use of our platform for illegal or improper purposes could subject us to claims, individual and class action lawsuits, and government and regulatory investigations, prosecutions, enforcement actions, inquiries, or requests that could result in liability and reputational harm for us. Moreover, certain activities that may be legal in one jurisdiction may be illegal in another jurisdiction, and certain activities that are at one time legal may in the future be deemed illegal in the same jurisdiction. As a result, there is significant uncertainty and cost associated with detecting and monitoring transactions for compliance with local laws. In the event that a customer is found responsible for intentionally or inadvertently violating the laws in any jurisdiction or we are found responsible for failure to prevent the use of our products or services for illegal activities, we may be subject to governmental inquiries, enforcement actions, prosecuted, or otherwise held secondarily liable for aiding or facilitating such activities. Changes in law have also increased the penalties for certain illegal activities, and government authorities may consider increased or additional penalties from time to time. Any threatened or resulting claims could result in reputational harm, and any resulting liabilities, loss of transaction volume, or increased costs could harm our business.
Moreover, while fiat currencies can be used to facilitate illegal activities, bitcoin is relatively new and, in many jurisdictions, may be lightly regulated or largely unregulated. Bitcoin has characteristics, such as the speed with which digital currency transactions can be conducted, the ability to conduct transactions without the involvement of regulated intermediaries, the ability to engage in transactions across multiple jurisdictions, the irreversible nature of certain crypto asset transactions, and encryption technology that anonymizes these transactions, that make it susceptible to use in illegal activity. U.S. federal and state and foreign regulatory authorities and law enforcement agencies, such as the Department of Justice (“DOJ”), SEC, CFTC, FTC, or the Internal Revenue Service (“IRS”), and various state securities and financial regulators have taken and continue to take legal action against persons and entities alleged to be engaged in fraudulent schemes or other illicit activity involving bitcoin.
While we believe that our risk management and compliance framework is designed to detect significant illicit activities conducted by our potential or existing customers, we cannot ensure that we will be able to detect all illegal
42
activity on our platform. If any of our customers use our platform for such illegal activities or we are found responsible for failure to prevent the use of our products or services for illegal activities, our business could be adversely affected.
Our compliance and risk management methods might not be effective and may result in outcomes that could adversely affect our reputation, operating results, and financial condition.
Our ability to comply with applicable complex and evolving laws, regulations, and rules is largely dependent on the establishment, maintenance, and scaling of our compliance and reporting systems to continuously keep pace with our customer activity and transaction volume, as well as our ability to attract and retain qualified compliance and other risk management personnel. While we have devoted significant resources to develop policies and procedures to identify, monitor, and manage our risks, and expect to continue to do so in the future, we cannot assure you that our policies and procedures are and will always be effective or that we have been and will always be successful in monitoring or evaluating the risks to which we are or may be exposed in all market environments or against all types of risks, including unidentified or unanticipated risks. Our risk management policies and procedures rely on a combination of technical and human controls and supervision that are subject to error and failure. Some of our methods for managing risk are discretionary by nature and are based on internally developed controls and observed historical market behavior, and also involve reliance on standard industry practices. Accordingly, in the future, we may identify gaps in such policies and procedures or existing gaps may become higher risk, and may require significant resources and management attention. Our risk management policies and procedures also may not adequately prevent losses due to technical errors. In addition, we may elect to adjust our risk management policies and procedures to allow for an increase in risk tolerance, which could expose us to the risk of greater losses.
Our financial institution partners, including their regulators, may periodically review our compliance program, including our policies and procedures, and applicable law. We may from time to time receive examination reports citing violations of applicable law and inadequacies in existing compliance programs requiring us to enhance certain practices with respect to our practices or compliance program, including due diligence, training, monitoring, reporting, and recordkeeping. If we fail to comply with these, or do not adequately remediate certain findings, regulators and financial institution partners could take a variety of actions that could impair our ability to conduct our business, including, but not limited to, delaying, denying, withdrawing, or conditioning approval of certain products and services. In addition, regulators have broad enforcement powers to censure, fine, issue cease and desist orders, prohibit us from engaging in some of our business activities, or revoke our licenses. We face significant intervention by regulatory authorities, including extensive auditing and surveillance activities, and will continue to face the risk of significant intervention by regulatory authorities and financial institution partners in the future. In the case of non-compliance or alleged non-compliance, we could be subject to investigations and proceedings that may result in substantial penalties or civil lawsuits, including by customers, for damages, which can be a significant loss to us or our financial institution partner(s). Any of these outcomes would adversely affect our reputation and brand and our business, operating results, and financial condition. Some of these outcomes could adversely affect our ability to conduct our business.
Risks Related to Bitcoin
Due to unfamiliarity and some negative publicity associated with bitcoin products and services, confidence or interest in our platforms may decline.
Bitcoin is relatively new. Some of our competitors offering bitcoin-related products and services may be unlicensed, unregulated, operate without supervision by any governmental authorities, and do not provide the public with significant information regarding their ownership structure, management team, corporate practices, cybersecurity, and regulatory compliance. As a result, customers and the general public may lose confidence or interest in bitcoin platforms, including platforms like ours that partner with regulated providers.
Negative perception, a lack of stability and standardized regulation in the broader bitcoin network and digital asset economy, and the closure or temporary shutdown of digital asset platforms due to fraud, business failure, hackers or malware, or government mandated regulation, and associated losses suffered by customers may continue to reduce confidence or interest in the digital asset economy and result in greater volatility of the prices of assets, including significant depreciation in value. Any of these events could have an adverse impact on our business and our customers’ perception of us, including decreased use of our platform and loss of customer demand for our products and services.
43
Transferring bitcoin on the bitcoin network involves risks, which could result in loss of customer assets or our proprietary assets, customer disputes and other liabilities, which could adversely impact our business.
In order to transfer bitcoin on the bitcoin network, a person must have a private and public key pair associated with a network address, commonly referred to as a “wallet.” Each wallet is associated with a unique “public key” and “private key” pair, each of which is a large number. To send bitcoin, a user must sign a transaction that is created using the private key of the wallet from where the user is transferring bitcoin, a hash of the recipient wallet’s public key, the amount of bitcoin to be sent, and the transaction fee. The transaction must be signed using the user’s private key through a cryptographic process, which creates a digital signature to prove ownership of the bitcoin. Once signed, the transaction is broadcasted to be included in a new block by miners. If we wish to purchase bitcoin, the seller would need to send a transaction to our designated wallet in this manner. A number of errors can occur in the process of transmitting bitcoin, such as typos, mistakes, or the failure to include the information required by the network, which could result in losses of our proprietary bitcoin or, where our customers choose to transfer and use bitcoin on its underlying network, the bitcoin held by us on behalf of our customers. For instance, a customer may incorrectly enter our crypto custody partner’s wallet’s address or the desired recipient’s public key when depositing and withdrawing bitcoin, respectively. Alternatively, a customer may send bitcoin to a wallet address that the customer does not own, control or hold the private keys to. If any of the foregoing errors occur, all of the bitcoin sent by the customer will be permanently and irretrievably lost with no means of recovery. We have encountered and expect to continue to encounter similar incidents with our customers, and although we have not experienced such incidents with respect to bitcoin that we hold on a proprietary basis it is possible that they could occur in the future. Such incidents could result in customer disputes, damage to our brand and reputation, legal claims against us, and financial liabilities, any of which could adversely affect our business.
BitGo has represented that it will safekeep all bitcoin held in custody for customers, and that it has procedures to process redemptions and withdrawals expeditiously, following the terms of the applicable user agreements. Our customers have not experienced excessive redemptions or withdrawals, or prolonged suspended redemptions or withdrawals, of bitcoin to date. However, similar to traditional financial institutions, BitGo may experience temporary process-related withdrawal delays. For example, BitGo may experience such delays if there is a significant volume of withdrawal requests that is vastly beyond anticipated levels. This does not mean BitGo cannot or will not satisfy withdrawals, but it may result in a temporary delay in satisfying withdrawal requests, which our customers still expect to be satisfied within the withdrawal timelines set forth in the applicable user agreements or otherwise communicated by us or BitGo. To the extent we or BitGo have process-related delays, even if brief or due to network congestion or heightened redemption activity, and within the terms of an applicable user agreement or otherwise communicated by us, we may experience increased customer complaints and damage to our brand and reputation and face additional regulatory scrutiny, any of which could adversely affect our business.
A temporary or permanent bitcoin network “fork” could adversely affect our business.
The bitcoin protocol is open source. Any user can download the software, modify it, and then propose that Bitcoin users and miners adopt the modification. When a modification is introduced and a substantial majority of users and miners consent to the modification, the change is implemented and the bitcoin network remains uninterrupted. However, if less than a substantial majority of users and miners consent to the proposed modification, and the modification is not compatible with the software prior to its modification, the consequence would be what is known as a “fork” (i.e., “split”) of the impacted bitcoin network, with one prong running the pre-modified software and the other running the modified software. The effect of such a fork would be the existence of two parallel versions of the bitcoin protocols running simultaneously, but with each split network’s bitcoin lacking interchangeability.
Bitcoin has previously been subject to “forks” that resulted in the creation of new networks, including Bitcoin Cash ABC, Bitcoin Cash SV, Bitcoin Diamond, Bitcoin Gold, and others. Some of these forks have caused fragmentation among platforms as to the correct naming convention for forked crypto assets. Due to the lack of a central registry or rulemaking body, no single entity has the ability to dictate the nomenclature of forked crypto assets, causing disagreements and a lack of uniformity among platforms on the nomenclature of forked crypto assets, and which results in further confusion to customers as to the nature of assets they hold on platforms. In addition, several of these forks were contentious and as a result, participants in certain communities may harbor ill will towards other communities. As a result, certain community members may take actions that adversely impact the use, adoption, and price of bitcoin.
44
Future forks may occur at any time. A fork can lead to a disruption of networks and our information technology systems, cybersecurity attacks, replay attacks, or security weaknesses, any of which can further lead to temporary or even permanent loss of our and our customers’ assets. In addition, BitGo has the right to temporarily suspend their services in the event of a fork, and to determine not to support any particular fork in the future. If a fork of the Bitcoin network occurs and BitGo provides access to a forked asset, we intend to retain the forked assets that are created as a result of our proprietary bitcoin. Any forked assets corresponding to our customers’ bitcoin holdings would be managed by BitGo in accordance with their policies. We will cooperate with BitGo in connection with its distribution of any forked assets corresponding to our customers’ bitcoin, solely to the extent our involvement is requested by BitGo. Prior to undertaking any such involvement in the distribution or other action by BitGo in respect of any forked assets, we would take steps to seek to ensure that any actions we may take would be in compliance with applicable law, including federal securities laws, which steps may include, among others, (i) communicating regularly with BitGo regarding its legal analysis pertaining to forked assets and any distribution thereof, (ii) staying abreast of developments regarding treatment of digital assets, including forked assets, under applicable securities laws, (iii) consulting with legal counsel regarding the specific facts and circumstances pertaining to the legal status of any forked asset and (iv) seeking guidance and clarification from applicable government regulators, including the SEC, with respect to the legal status of any forked asset. If a fork occurs and BitGo determines not to support one of the assets created as a result of the fork, this could cause us or our customers to miss an opportunity regarding a new digital asset. In addition, any suspension of services ahead of a fork could cause customer complaints and cause us to be exposed to liability, even in circumstances where we do not have the ability to alter BitGo's policy regarding a fork. To the extent a forked asset is determined to be a “security” under applicable federal securities laws, any distribution of such forked asset would expose the distributor thereof to significant liability under such laws. For additional information regarding the risks and liabilities associated with uncertainty regarding the status of bitcoin and other digital assets as a “security,” please see the risk factor above entitled “Bitcoin’s status as a “security” in any relevant jurisdiction, as well as the status of our Bitcoin-related products and services, is subject to a high degree of uncertainty and if we are unable to properly characterize a product or service offering, we may be subject to regulatory scrutiny, inquiries, investigations, fines, and other penalties, which may adversely affect our business, operating results, and financial condition.”
Future developments regarding the treatment of crypto assets for U.S. tax purposes could adversely impact our business.
Due to the new and evolving nature of crypto assets and the absence of comprehensive legal and tax guidance with respect to crypto asset products and transactions, many significant aspects of the U.S. tax treatment of transactions involving crypto assets, such as the purchase and sale of bitcoin on our platform, are uncertain, and it is unclear whether, when and what guidance may be issued in the future on the treatment of crypto asset transactions for U.S. tax purposes.
In 2014, the IRS released Notice 2014-21, discussing certain aspects of “virtual currency” for U.S. federal income tax purposes and, in particular, stating that such virtual currency (i) is “property,” (ii) is not “currency” for purposes of the rules relating to foreign currency gain or loss, and (iii) may be held as a capital asset. From time to time, the IRS has released other notices and rulings relating to the tax treatment of virtual currency or crypto assets reflecting the IRS’s position on certain issues. The IRS has not addressed many other significant aspects of the U.S. federal income tax treatment of crypto assets and related transactions.
There continues to be uncertainty with respect to the timing, character and amount of income inclusions for various crypto asset transactions. Although we believe our treatment of bitcoin transactions for federal income tax purposes is consistent with existing positions from the IRS and/or existing U.S. federal income tax principles, because of the rapidly evolving nature of crypto asset innovations and the increasing variety and complexity of crypto asset transactions and products, it is possible the IRS and various U.S. states may disagree with our treatment of certain bitcoin offerings for U.S. tax purposes, which could adversely affect our customers and the vitality of our business.
There can be no assurance that the IRS, the U.S. state revenue agencies or other foreign tax authorities, will not alter their respective positions with respect to crypto assets in the future or that a court would uphold the treatment set forth in existing positions. It also is unclear what additional tax authority positions, regulations, or legislation may be issued in the future on the treatment of existing crypto asset transactions and future crypto asset innovations under U.S. federal or U.S. state tax law. Any such developments could result in adverse tax consequences for holders of crypto assets and could have an adverse effect on the value of crypto assets and the broader crypto assets markets.
45
Future technological and operational developments that may arise with respect to crypto assets may increase the uncertainty with respect to the treatment of crypto assets for U.S. tax purposes. The uncertainty regarding tax treatment of crypto asset transactions impacts our customers, and could impact our business, both domestically and abroad.
Our tax information reporting obligations with respect to bitcoin transactions are subject to change.
Although we believe we are compliant with U.S. tax reporting and withholding requirements with respect to our customers’ bitcoin transactions, the exact scope and application of such requirements, including but not limited to U.S. onboarding requirements through Forms W-9 and W-8, backup withholding, non-resident alien withholding, and Form 1099 and Form 1042-S reporting obligations, is not entirely clear for all of the crypto asset transactions that we facilitate. In November 2021, the U.S. Congress passed the Infrastructure Investment and Jobs Act (the “IIJA”), providing that brokers would be responsible for reporting to the IRS the transactions of their customers in digital assets, including transfers to other exchanges or non-exchanges. In June 2024, the U.S. Treasury Department and the IRS released regulations in addition to other administrative guidance on tax information reporting in connection with the IIJA (the “IIJA Regulations”) for reporting transactions with respect to digital assets became effective. The IIJA Regulations introduce new rules related to our tax reporting and withholding obligations on our customer transactions in ways that differ from our existing compliance protocols and there is risk that we will not have proper records to ensure compliance for certain legacy customers or transactions. If the IRS determines that we are not in compliance with our tax reporting or withholding requirements with respect to customer bitcoin transactions, we may be exposed to significant taxes and penalties, which could adversely affect our financial position. The IIJA Regulations will require us to invest substantially in new compliance measures and that may require significant retroactive compliance efforts, which also could adversely affect our financial position. Further, additional guidance may be issued, including, guidance on the treatment of non-custodial parties, which could impose additional compliance efforts, and which would adversely affect our financial position.
The nature of our business requires the application of complex financial accounting rules, and there is limited guidance from accounting standard setting bodies on certain topics. If financial accounting standards undergo significant changes, our operating results could be adversely affected.
The accounting rules and regulations that we must comply with are complex and subject to interpretation by the Financial Accounting Standards Board (the “FASB”), the SEC, and various other bodies formed to promulgate and interpret appropriate accounting principles. Recent actions and public comments from the FASB and the SEC have focused on the integrity of financial reporting and internal controls and many companies’ accounting policies are being subjected to heightened scrutiny by regulators and the public. Further, there has been limited precedent for the financial accounting of crypto assets and related valuation and revenue recognition. Moreover, a change in these principles or interpretations could have a significant effect on our reported financial results, and may even affect the reporting of transactions completed before the announcement or effectiveness of a change. For example, on March 31, 2022, the staff of the SEC issued Staff Accounting Bulletin No. 121 (“SAB 121”), which represented a significant change regarding how a company safeguarding crypto assets held for its platform users reports such crypto assets on its balance sheet and required retrospective application as of January 1, 2022. In January 2025, the SEC released Staff Accounting Bulletin (“SAB”) 122 rescinding SAB 121, which required an entity to record a liability to reflect its obligation to safeguard the crypto assets held for its platform users with a corresponding asset and required disclosures related to the entity’s safeguarding obligations. SAB 122 is effective for annual periods beginning after December 15, 2024 and is required to be applied on a fully retrospective basis, with early adoption permitted.
Uncertainties in or changes to regulatory or financial accounting standards could result in the need to change our accounting methods and restate our financial statements and impair our ability to provide timely and accurate financial information, which could adversely affect our financial statements, result in a loss of investor confidence, and more generally impact our business, operating results, and financial condition.
46
Risks Related to Government Regulation and Privacy Matters
The regulatory environment in which the consumer finance industry operates could have a material adverse effect on our business and operating results.
The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) was signed into law on July 21, 2010. The Dodd-Frank Act is extensive and significant legislation that, among other things, created the Consumer Financial Protection Bureau (the "CFPB"), an agency responsible for administering and enforcing the laws and regulations for consumer financial products and services. The CFPB has broad rulemaking, examination and enforcement authority over providers of financial services and products, which could include us and our affiliates, including authority to prevent “unfair, deceptive or abusive” practices and to collect fines and provide consumer restitution in the event of violations. In addition to the CFPB, other federal agencies, such as the Federal Trade Commission (the "FTC"), and state regulators, such as consumer protection and financial services regulators and attorneys general, may exercise supervision and enforcement authority over providers of goods or services, like us. Depending on how such governmental authorities elect to exercise its statutory authority, it could increase the compliance costs for us and our third party service providers, potentially delay our ability to respond to marketplace changes, result in requirements to alter products and services that would make them less attractive to consumers, impair our ability to offer products and services, and harm our reputation or otherwise adversely affect our businesses.
We are also subject to other various regulatory, financial and other requirements in the jurisdictions in which we operate. We may become involved from time to time in reviews, investigations and proceedings and information gathering requests by government and self-regulatory agencies, including state attorneys general. Any of such events could result in the imposition of damages, fines or civil or criminal claims and/or penalties. No assurance can be given that the ultimate outcome of any such event would not have a material adverse effect on us or our ability to provide services.
The financial services industry is likely to see increased disclosure obligations, licensing requirements, restrictions on pricing and enforcement proceedings. Compliance with applicable laws is costly and can affect operating results, as processes, procedures, control and infrastructure are required to support applicable requirements. Compliance may also create operational constraints and impose limits on pricing, as financial services industry laws are designed primarily to protect consumers. The failure to comply could result in significant statutory civil and criminal penalties, monetary damages, attorneys’ fees and costs, possible revocation of licenses and damage to reputation, brand, loss of our bank partnerships, and loss of customer relationships.
The cryptoeconomy is novel. As a result, policymakers are just beginning to consider what a regulatory regime for crypto would look like and the elements that would serve as the foundation for such a regime. We may be unable to effectively react to proposed legislation and regulation of crypto assets or crypto asset platforms that are adverse to our business.
As crypto assets have grown in both popularity and market size, various U.S. federal, state, and local and foreign governmental organizations, consumer agencies and public advocacy groups have been examining the operations of crypto networks, users and platforms, with a focus on how crypto assets can be used to launder the proceeds of illegal activities, fund criminal or terrorist enterprises, and the safety and soundness of platforms and other service providers that hold crypto assets for users. Many of these entities have called for heightened regulatory oversight and have issued consumer advisories describing the risks posed by crypto assets to users and investors. For instance, in September 2022, the White House published a fact sheet described as the first-ever “Comprehensive Framework for Responsible Development of Digital Assets,” which encouraged “agencies to issue guidance and rules to address current and emergent risks in the digital asset ecosystem.”
Competitors, including traditional financial services providers, have spent years cultivating professional relationships with relevant policymakers on behalf of their industry so that those policymakers may understand that industry, the current legal landscape affecting that industry, and the specific policy proposals that could be implemented in order to responsibly develop that industry. The lobbyists working for these competitors have similarly spent years developing and working to implement strategies to advance these industries. Members of the cryptoeconomy have started to engage policymakers directly and with the help of external advisors and lobbyists. However, this work is in a relatively nascent stage. As a result, new laws and regulations may be proposed and adopted in the United States and internationally, or existing laws and regulations may be interpreted in new ways, that harm
47
the cryptoeconomy or crypto asset platforms, which could adversely impact our business. Additionally, any political activities to further our mission may be perceived unfavorably by investors and the public and have an adverse impact on our brand and reputation.
Bitcoin is subject to regulatory authority by the Commodity Futures Trading Commission (the "CFTC"). Any fraudulent or manipulative activity in bitcoin occurring through our products and services could subject us to increased regulatory scrutiny, regulatory enforcement, and litigation.
The CFTC has stated, and judicial decisions involving CFTC enforcement actions have confirmed, that bitcoin falls within the definition of a “commodity” under the Commodity Exchange Act (the "CEA"). As a result, the CFTC has general enforcement authority to police against manipulation and fraud in the bitcoin market. From time to time, manipulation, fraud, and other forms of improper trading by market participants have resulted in, and may in the future result in, CFTC investigations, inquiries, enforcement action, and similar actions by other regulators, government agencies, and civil litigation. Such investigations, inquiries, enforcement actions, and litigation may cause us to incur substantial costs and could result in negative publicity.
Bitcoin’s status as a “security” in any relevant jurisdiction, as well as the status of our bitcoin-related products and services, is subject to a high degree of uncertainty and if we are unable to properly characterize a product or service offering, we may be subject to regulatory scrutiny, inquiries, investigations, fines, and other penalties, which may adversely affect our business, operating results, and financial condition.
The SEC and its staff have taken the position that a range of crypto assets, products and services fall within the definition of a “security” under the U.S. federal securities laws. Despite the SEC being the principal federal securities law regulator in the United States, whether or not an asset, product or service is a security or constitutes a securities offering under federal securities laws is ultimately determined by a federal court. The legal test for determining whether any given crypto asset, product or service is a security was set forth in the 1946 Supreme Court case SEC v. W.J. Howey Co. and requires a highly complex, fact-driven analysis. Accordingly, whether any given crypto asset, product or service would be ultimately deemed to be a security is uncertain and difficult to predict notwithstanding the conclusions of the SEC or any conclusions we may draw based on our risk-based assessment regarding the likelihood that a particular crypto asset, product or service could be deemed a “security” or “securities offering” under applicable laws. The SEC generally does not provide advance guidance or confirmation on its assessment of the status of any particular crypto asset, product or service as a security. It is also possible that a change in the governing administration or the appointment of new SEC commissioners could substantially impact the approach to enforcement by the SEC and its staff.
Public statements made by senior officials at the SEC indicate that the SEC does not intend to take the position that bitcoin (as currently offered and sold) is a “security” under the U.S. federal securities laws. However, such statements are not official policy statements by the SEC and reflect only the speakers’ views, which are not binding on the SEC or any other agency or court and cannot be generalized to any other crypto asset. As of the date hereof, with the exception of certain centrally issued digital assets that have received “no-action” letters from the SEC staff, bitcoin is the only crypto asset which senior officials at the SEC have publicly stated is unlikely to be considered a “security.”
Any enforcement action by the SEC or any international or state securities regulator asserting that bitcoin is a “security,” or a court decision to that effect, would be expected to have an immediate material adverse impact on the trading value of bitcoin, as well as our business. This is because the business models behind most crypto assets are incompatible with regulations applying to transactions in securities. If a crypto asset is determined or asserted to be a “security,” it is likely to become difficult or impossible for the crypto asset to be traded, cleared or custodied in the United States and elsewhere through the same channels used by non-security crypto assets, which in addition to materially and adversely affecting the trading value of the crypto asset is likely to significantly impact its liquidity and market participants’ ability to convert the crypto asset into USD and other currencies.
The classification of a crypto asset, product or service as a security under applicable law has wide-ranging implications for the regulatory obligations that flow from the offer, sale, trading, and clearing, as applicable, of such assets, products or services. For example, a crypto asset, product or service that is a security in the United States may generally only be offered or sold in the United States pursuant to a registration statement filed with the SEC or in an
48
offering that qualifies for an exemption from registration. Persons that effect transactions in crypto assets, products or services that are securities in the United States may be subject to registration with the SEC as a “broker” or “dealer.” Platforms that bring together purchasers and sellers to trade crypto assets that are securities in the United States are generally subject to registration as national securities exchanges, or must qualify for an exemption, such as by being operated by a registered broker-dealer as an alternative trading system ("ATS") in compliance with rules for ATSs. Persons facilitating clearing and settlement of securities may be subject to registration with the SEC as a clearing agency. Foreign jurisdictions may have similar licensing, registration, and qualification requirements.
Neither Fold nor the Fold App is registered or licensed with the SEC or foreign authorities as a broker-dealer, national securities exchange, or ATS (or foreign equivalents), and none of our products or services are registered as securities offerings, because we only offer products and services related to bitcoin, and we believe there are good arguments that bitcoin and our related products and services are not securities (including based on prior statements by a number of SEC senior officials). However, statements, settlements and enforcement actions are not rules or regulations of the SEC and are not binding on the SEC. Regardless of public statements made by senior officials at the SEC and our conclusions, we could in the future be subject to legal or regulatory action in the event the SEC or a state or a foreign regulatory authority were to assert, or a court were to determine, that either bitcoin itself or a product or service that we offer related to bitcoin, such as lending, rewards or savings products, could be viewed a “security” under applicable laws. There can be no assurance that we will properly characterize over time any given bitcoin product or service offering as a security or non-security, or that the SEC, foreign regulatory authority, or a court having final determinative authority on the topic, if the question was presented to it, would agree with our assessment. We expect our risk assessment policies and procedures to continuously evolve to take into account case law, legislative developments, facts, and developments in technology.
If an applicable regulatory authority or a court, in either case having final determinative authority on the topic, were to determine that a product or service offered by us is a security, we would not be able to offer such product or service until we are able to do so in a compliant manner. A determination by the SEC, a state or foreign regulatory authority, or a court that a product or service that we offer constitutes a security may result in us ceasing to offer that product or service, and may also result in us determining that it is advisable to cease offering products and services entirely, that have similar characteristics to the product or service that was alleged or determined to be a security. Alternatively, we may determine to continue to offer a product or service even if the SEC or another regulator alleges that the product or service is a security, pending a final judicial determination as to that product or service’s proper characterization, and the fact that we waited for a final judicial determination would generally not preclude penalties or sanctions against us for our having previously made that product or service available without registering that product or service with the SEC. As such, we could be subject to judicial or administrative sanctions for failing to offer or sell the product or service in compliance with the registration requirements, or for acting as a broker, dealer, or national securities exchange without appropriate registration. Such an action could result in injunctions, cease and desist orders, as well as civil monetary penalties, fines, and disgorgement, criminal liability, and reputational harm. Additionally, the SEC has brought and may in the future bring enforcement actions against other cryptoeconomy participants and their product offerings and services that may cause us to modify or discontinue a product offering or service. If we were to modify or discontinue any product offering or service for any reason, our decision may be unpopular with users, may reduce our ability to attract and retain customers (especially if similar products or services continue to be offered by our competitors), and may adversely affect our business, operating results, and financial condition.
Certain transactions in bitcoin may constitute “retail commodity transactions” subject to regulation by the CFTC as futures contracts. If bitcoin transactions we facilitate are deemed to be such retail commodity transactions, we would be subject to additional regulatory requirements, licenses and approvals, and potentially face regulatory enforcement, civil liability, and significant increased compliance and operational costs.
Any transaction in a commodity, including bitcoin, entered into with or offered to retail investors using leverage, margin, or other financing arrangements (a “retail commodity transaction”) is subject to CFTC regulation as a futures contract unless such transaction results in actual delivery within 28 days. The meaning of “actual delivery” has been the subject of commentary and litigation, and in 2020, the CFTC adopted interpretive guidance addressing the “actual delivery” of a crypto asset. To the extent that bitcoin transactions that we facilitate or facilitated are deemed retail commodity transactions, including pursuant to current or subsequent rulemaking or guidance by the CFTC, we may be subject to additional regulatory requirements and oversight, and we could be subject to judicial or administrative sanctions if we do not or did not at a relevant time possess appropriate registrations. The CFTC has previously brought
49
enforcement actions against entities engaged in retail commodity transactions without appropriate registrations, as well as recent enforcement settled orders against developers of decentralized platforms.
Certain transactions in bitcoin could be deemed “commodity interests” (i.e., futures, options, swaps) or security-based swaps subject to regulation by the CFTC or SEC, respectively. If the products and services we or BitGo offer to our customers are deemed a commodity interest or a security-based swap, we would be subject to additional regulatory requirements, registrations and approvals and potentially face regulatory enforcement, civil liability, and significant increased compliance and operational costs.
Commodity interests, as such term is defined by the CEA and CFTC rules and regulations, are subject to more extensive supervisory oversight by the CFTC, including registrations of entities engaged in, and platforms offering, commodity interest transactions. This CFTC authority extends to bitcoin futures contracts and swaps, including transactions that are based on current and future prices of bitcoin and indices of bitcoin. To the extent that transactions in bitcoin are deemed to fall within the definition of a commodity interest, including pursuant to subsequent rulemaking or guidance by the CFTC, we may be subject to additional regulatory requirements and oversight and could be subject to judicial or administrative sanctions if we do not or did not at a relevant time possess appropriate registrations as an exchange (for example, as a designated contract market for trading futures or options on futures, or as a swaps execution facility for trading swaps) or as a registered intermediary (for example, as a futures commission merchant or introducing broker). Such actions could result in injunctions, cease and desist orders, as well as civil monetary penalties, fines, and disgorgement, as well as reputational harm. The CFTC has previously brought enforcement actions against entities engaged in crypto asset activities for failure to obtain appropriate exchange, execution facility and intermediary registrations.
Furthermore, the CFTC and the SEC have jointly adopted regulations defining “security-based swaps,” which include swaps based on single securities and narrow-based indices of securities. If bitcoin is deemed to be a security, certain transactions referencing bitcoin could constitute a security-based swap. Bitcoin or a transaction therein that is based on or references a security or index of securities, whether or not such securities are themselves crypto assets, could also constitute a security-based swap. To the extent that bitcoin is deemed to fall within the definition of a security-based swap, including pursuant to subsequent rulemaking or guidance by the CFTC or SEC, we may be subject to additional regulatory requirements and oversight by the SEC and could be subject to judicial or administrative sanctions if we do not or did not a relevant time possess appropriate registrations as an exchange (for example, as a security-based swaps execution facility) or as a registered intermediary (for example, as a security-based swap dealer or broker-dealer). This could result in injunctions, cease and desist orders, as well as civil monetary penalties, fines, and disgorgement, as well as reputational harm.
If we or our third-party providers fail to protect confidential information and/or experience cybersecurity incidents, there may be damage to our brand and reputation, material financial penalties, and legal liability, which would materially adversely affect our business, results of operations, and financial condition.
We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, “IT Systems”). We own and manage some of these IT Systems but also rely on third parties for a range of IT Systems and related products and services, including but not limited to cloud computing services. We and certain of our third-party providers collect, maintain and process data about customers, employees, business partners and others, including information about individuals and their financial assets (such as bitcoin), as well as proprietary information belonging to our business such as trade secrets (collectively, “Confidential Information”).
We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error, and as a result of malicious code embedded in open-source software, or misconfigurations, bugs or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) IT Systems, products or services. As knowledge and techniques in cryptography continue to advance, threat actors may exploit these advancements to develop more sophisticated and effective attack methods, increasing the frequency and severity of cyberattacks as well. Because we make extensive use of third party suppliers, service providers, and partners (including our partnerships with crypto wallet providers and financial institutions), successful cyberattacks that disrupt or result in unauthorized access to third party IT Systems can materially impact our operations and financial results.
50
Moreover, we may acquire companies with cybersecurity vulnerabilities and/or unsophisticated security measures, which exposes us to significant cybersecurity, operational, and financial risks. Remote working arrangements at our company (and at our third-party providers) also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. Additionally, any integration of artificial intelligence in our or any service providers’ operations, products or services is expected to pose new or unknown cybersecurity risks and challenges. Because our products and services are integrated with our customers’ systems and processes, any circumvention or failure of our cybersecurity defenses or measures could compromise the confidentiality, integrity, and availability of our customers’ own IT Systems and/or Confidential Information as well. Moreover, certain threats are designed to remain dormant or undetectable until launched against a target and we may not be able to implement adequate preventative measures. If such an event were to occur and cause interruptions in our operations, result in the unauthorized access, disclosure, loss, processing, or other compromise of Personal Information (as defined below) or Confidential Information, or jeopardize the confidentiality, integrity, or availability of our information systems or any information residing therein, it could result in a material disruption of our development programs and our business operations, whether due to a loss of our trade secrets or other similar disruptions.
Some of the federal, state, and foreign government requirements include obligations of companies to notify individuals of certain cybersecurity breaches involving particular personal information, which could result from breaches experienced by us or by our vendors, contractors, or organizations with which we have formed strategic relationships. Even though we may have contractual protections with such vendors, contractors, or other organizations, notifications and follow-up actions related to a cybersecurity breach could impact our reputation, cause us to incur significant costs, including legal expenses, harm customer confidence, hurt our expansion into new markets, cause us to incur remediation costs, or cause us to lose existing customers.
Further, the cryptocurrency industry is a frequent target for cyberattacks, including hacks of exchanges and wallets. The underlying technology of cryptocurrencies, including blockchain, is complex and still developing, which means technical issues, bugs, or vulnerabilities could impact our operations and the security of user funds. Future technological developments, such as quantum computing, could impact the security of crypto wallets in particular, and the rapid development of artificial intelligence makes it difficult to predict the timeframe on which quantum computing could develop. Additionally, any actual or perceived breach or cybersecurity attack directed at other financial institutions or crypto companies, whether or not we are directly impacted, could lead to a general loss of customer confidence in the cryptoeconomy or in the use of technology to conduct financial transactions, which could negatively impact us, including the market perception of the effectiveness of our security measures and technology infrastructure.
Cyberattacks are expected to accelerate on a global basis in frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools - including artificial intelligence - that circumvent security controls, evade detection and remove forensic evidence. As a result, we may be unable to detect, investigate, remediate or recover from future attacks or incidents, or to avoid a material adverse impact to our IT Systems, Confidential Information or business. There can also be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information. Furthermore, given the nature of complex systems, software and services like ours, and the scanning tools that we deploy across our networks and products, we regularly identify and track security vulnerabilities. We are unable to comprehensively apply patches or confirm that measures are in place to mitigate all such vulnerabilities, or that patches will be applied before vulnerabilities are exploited by a threat actor. In other situations, vulnerabilities persist even after we have issued security patches because our customers may fail to apply patches or update their systems to newer software versions. If attackers are able to exploit critical vulnerabilities before patches are installed or mitigating measures are implemented, significant compromises could impact our and our customers’ IT Systems and/or Confidential Information.
We and certain of our third-party providers regularly experience cyberattacks and other incidents, and we expect such attacks and incidents to continue in varying degrees. While to date no incidents have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future. Any adverse impact to the availability, integrity or confidentiality of our IT Systems or Confidential Information can result in legal claims or proceedings (such as class actions), regulatory investigations and enforcement actions, fines and penalties, negative reputational impacts that cause us to lose existing or future customers, and/or significant incident response,
51
system restoration or remediation and future compliance costs. Any or all of the foregoing could materially adversely affect our business, results of operations, and financial condition. Finally, we cannot guarantee that any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all.
We are subject to laws, regulations, and industry requirements related to data privacy, data protection and information security, and user protection across different markets where we conduct our business. Any actual or perceived failure to comply with such laws, regulations, and industry requirements, or our privacy policies, could adversely affect our business, results of operations, or financial condition.