Risk Factors - UPST

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

$UPST Risk Factor changes from 00/02/16/23/2023 to 00/02/15/24/2024

Item 1A.

“Risk Factors” of this Annual Report on Form 10-K. Fair Credit Reporting Act The federal Fair Credit Reporting Act, or FCRA, as amended by the Fair and Accurate Credit Transactions Act, implemented by Regulation V, and administered by the CFPB, promotes the accuracy, fairness, and privacy of information in the files of consumer reporting agencies. FCRA requires a permissible purpose to obtain a consumer credit report and requires that persons who report loan payment information to credit bureaus do so accurately and to resolve disputes regarding reported information timely. FCRA also imposes disclosure requirements on creditors who take adverse action on credit applications based on information contained in a credit report. Under FCRA, certain information must be provided to applicants whose credit applications are not approved on the basis of a report obtained from a consumer reporting agency, promptly update any credit information reported to a credit reporting agency about a customer and have a process by which customers may inquire about credit information furnished by us to a consumer reporting agency. We, our lending partners and the automotive dealerships with whom we partner have a permissible purpose for obtaining credit reports on potential borrowers, and we also obtain explicit consent from borrowers to obtain such reports. As part of our loan servicing activities, we accurately report loan payment and delinquency information to appropriate consumer reporting agencies on behalf of our lending partners. We provide an adverse action notice to rejected applicants on behalf of each lending partner at the time the applicant is rejected that includes all the required disclosures. We also have processes in place to ensure that consumers are given “opt-out” opportunities, as required by the FCRA, regarding the sharing of their personal information. We have also implemented an identity theft prevention program, as required by FCRA and its implementing regulations. Fair Debt Collection Practices Act The federal Fair Debt Collection Practices Act, or FDCPA, and Regulation F that implements FDCPA, provides guidelines and limitations on the conduct of certain debt collectors in connection with the collection of consumer debts. The FDCPA limits certain communications with third parties, imposes notice and debt validation requirements, and prohibits threatening, harassing or abusive conduct in the course of debt collection. While the FDCPA primarily applies to third-party debt collectors, debt collection laws of certain states impose similar requirements more broadly on creditors who collect their own debts and loan servicers of debt. In addition, the CFPB prohibits unfair, deceptive or abusive acts or practices, or UDAAPs, in debt collection, including first-party debt collection. We use our internal collection team, except for the HELOC product, and professional third-party debt collection agents to collect delinquent accounts. Any third-party debt collection agents we use are required to comply with the FDCPA and all other applicable laws in collecting delinquent accounts of borrowers. While our internal servicing team is not subject to the formal requirements of the FDCPA in most cases, we have established policies intended to substantially comply with the collection practice requirements under the FDCPA as a means of complying with more general UDAAP standards. Privacy and Data Security Laws The federal Gramm-Leach-Bliley Act, or GLBA, includes limitations on financial institutions’ disclosure of nonpublic personal information about a consumer to non-affiliated third parties, in certain circumstances requires financial institutions to limit the use and further disclosure of nonpublic personal information by non-affiliated third parties to whom they disclose such information and requires financial institutions to disclose certain privacy policies 17Table of Contentsand practices with respect to information sharing with affiliated and non-affiliated entities as well as to safeguard personal customer information. For example, the Gramm-Leach-Bliley Act includes limitations on financial institutions’ disclosure of nonpublic personal information about a consumer to nonaffiliated third parties, in certain circumstances requires financial institutions to limit the use and further disclosure of nonpublic personal information by nonaffiliated third parties to whom they disclose such information and requires financial institutions to disclose certain privacy notices and practices with respect to information sharing with affiliated and unaffiliated entities as well as to safeguard personal borrower information. We collect and use a wide variety of information to help ensure the integrity of our services and to provide features and functionality to borrowers on our platform. This aspect of our business, including the collection, use, and protection of the information we acquire from our own services as well as from third-party sources, is subject to laws and regulations in the United States. Various tax authorities may disagree with tax positions we take and if any such tax authorities were to successfully challenge one or more of our tax positions, the results could adversely affect our financial condition. Accordingly, we publish our privacy policies and terms of service, which describe our practices concerning the use, transmission, and disclosure of information. We have a detailed privacy policy that addresses the GLBA and is accessible from every page of our website. We work to maintain the security of consumers’ personal information securely, and we do not sell, rent or share such information with third parties for marketing purposes unless previously agreed to by the consumer.We rely on third-party vendors and if such third parties do not perform adequately or terminate their relationships with us, our costs may increase and our business, financial condition and results of operations could be adversely affected. In addition, we take measures to safeguard the personal information of borrowers and investors and protect against unauthorized access to this information. We also are subject to other privacy and security laws and regulations that apply to certain personal information that we collect or otherwise process, such as the California Consumer Privacy Act, or CCPA. The CCPA, which went into effect in 2020, requires, among other things, that covered companies provide disclosures to California consumers and afford such consumers rights with respect to how covered companies process their personal information. Other states have enacted similar laws, but many have GLBA exemptions that apply to us. As our business continues to expand, and as state and federal laws and regulations continue to be passed and their interpretations continue to evolve, additional laws and regulations may become relevant to us. Dodd-Frank Wall Street Reform and Consumer Protection Act In July 2010, the Dodd-Frank Act was signed into law. The Dodd-Frank Act is extensive and significant legislation that includes consumer protection provisions. Among other things, the Dodd-Frank Act created the CFPB, which commenced operations in July 2011 and has significant authority to implement and enforce federal consumer financial laws, such as TILA and ECOA. The CFPB is authorized to prevent “unfair, deceptive or abusive acts or practices” through its regulatory, supervisory and enforcement authority. The CFPB is also authorized to prevent “unfair, deceptive or abusive acts or practices” through its rulemaking, supervisory and enforcement authority. The CFPB also engages in consumer financial education, requests data and promotes the availability of financial services to underserved customers and communities. The CFPB has regulatory and enforcement powers over most providers of consumer financial products and services through the laws it enforces, including us. It also has supervisory and examination powers over certain providers of consumer financial products and services, including large banks, payday lenders, “larger participants” in certain financial services markets defined by CFPB regulation, and non-bank entities determined to present a risk to consumers after notice and an opportunity to respond. sanctions laws, our lending partners are required to maintain anti-money laundering, customer due diligence and record-keeping policies and procedures, which we perform on behalf of our lending partners, and to avoid doing business with certain sanctioned persons or entities or certain types of sanctioned activity in certain countries. The CFPB has imposed, and will continue to impose, restrictions on lending practices, including with respect to the terms of certain loans. We and our lending partners are subject to the CFPB’s enforcement authority. The CFPB may request reports concerning our organization, business conduct, markets and activities. In additi