Risk Factors Dashboard

Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.

View risk factors by ticker

Search filings by term

Risk Factors - UPST

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Item 1A. “Risk Factors” of this Annual Report on Form 10-K.

Federal Lending and Related Laws

Truth in Lending Act

The Truth in Lending Act (“TILA”) and Regulation Z, promote informed use of consumer credit by requiring clear and meaningful disclosure of credit terms and costs.

Equal Credit Opportunity Act

The Equal Credit Opportunity Act (“ECOA”) and Regulation B prohibit discrimination in any aspect of a credit transaction on the basis of race, color, religion, national origin, sex, marital status, age (provided the applicant has the capacity to contract), receipt of public assistance income, or the good-faith exercise of rights under the Consumer Credit Protection Act. The ECOA requires creditors to provide applicants with notices of adverse action when credit is denied or offered on less favorable terms, maintain procedures to ensure consistent and nondiscriminatory treatment of applicants, and retain relevant application and decision records for prescribed periods.

Fair Credit Reporting Act

The Fair Credit Reporting Act (“FCRA”), as amended by the Fair and Accurate Credit Transactions Act, implemented by Regulation V, promotes the accuracy, fairness, and privacy of information in the files of consumer reporting agencies. The FCRA also imposes disclosure requirements on creditors who take adverse action on credit applications based on information contained in a credit report and an obligation to maintain an identity theft prevention program.

Fair Debt Collection Practices Act

The federal Fair Debt Collection Practices Act (“FDCPA”) and Regulation F, provide guidelines and limitations on the conduct of certain debt collectors in connection with the collection of consumer debts, specifically establishing standards for abusive, deceptive or unfair collection practices. While the FDCPA applies primarily to third-party debt collectors that acquire debt after it is delinquent, we may be subject to certain requirements and we generally adhere to many standards set forth in the FDCPA as a best practice. The law prohibits threatening, harassing or abusive conduct in the course of debt collection.

Privacy and Data Security Laws

We collect and use a wide variety of information to help ensure the integrity of our services and to provide features and functionality to the borrowers and lending partners on our platform. The collection, use, and protection of this data are subject to the federal Gramm-Leach-Bliley Act (“GLBA”), and Regulation P, including limitations on disclosure of nonpublic personal information to non-affiliated third parties. In certain circumstances, GLBA requires limiting the use and further disclosure of nonpublic personal information by non-affiliated third parties to whom they disclose such information and requires financial institutions to disclose certain privacy policies and practices with respect to information sharing with affiliated and non-affiliated entities. Further, the Federal Trade

Table of Conte nts

Commission’s Safeguards Rule requires us to develop, implement, and maintain a written, comprehensive cybersecurity program containing safeguards appropriate to the size and complexity of our business.

Consumer Financial Protection Act

The Consumer Financial Protection Act (“CFPA”) created the CFPB, which has authority to implement and enforce federal consumer financial laws, such as TILA, FCRA, and ECOA. The law prohibits unfair, deceptive or abusive acts or practices (“UDAAP”) in connection with the offering or provision of consumer financial products or services. It also has supervisory and examination powers over certain providers of consumer financial products and services, including large banks, payday lenders, “larger participants” in certain financial services markets defined by CFPB regulation, and non-bank entities the CFPB determines present a risk to consumers after notice and an opportunity to respond.

Federal Trade Commission Act

Under Section 5 of the Federal Trade Commission Act, we and our lending partners are prohibited from engaging in unfair or deceptive acts or practices (“UDAP”). The FTC has oversight of non-bank financial service providers, technology platforms, and other entities engaged in consumer credit-related activities. Their broad enforcement powers extend to representations made to consumers about credit products, fees, interest rates, loan terms, data use and security practices.

Federal Trade Commission’s Consumer Claims and Defenses Rule

The Federal Trade Commission’s Consumer Claims and Defenses Rule, otherwise known as the Holder Rule, applies to the retail installment sales contracts. The Holder Rule is designed to protect consumers that purchase goods or services with credit arranged by the seller or its assignee by requiring the seller to include a specific notice in every consumer credit contract informing consumers of their right to assert against the assignee of credit contracts, certain claims the consumer may have against the originator of a credit contract (such a dealer as the originating creditor in auto retail installment sales contracts). This rule preserves the consumer’s right to assert the same claims and defenses against anyone who purchases the contract, as they would have against the original seller of the goods or services.

Electronic Fund Transfer Act and NACHA Rules

The federal Electronic Fund Transfer Act (“EFTA”) and Regulation E establish the rights, liabilities, and responsibilities of consumers and financial institutions with respect to electronic funds transfers. The law applies to electronic transactions involving consumer bank accounts, including preauthorized loan payments, disbursements, and refunds. They require consumer authorization for recurring electronic payments, advance notice of variable transfer amounts and clear disclosures of consumers’ rights and obligations. Further, they prohibit conditioning an extension of credit on the borrower’s agreement to repay the loan through preauthorized (recurring) electronic fund transfers. In addition to compliance with federal laws, transfers performed by ACH electronic transfers are subject to detailed timing and notification rules and guidelines administered by the National Automated Clearinghouse Association (“NACHA”).

Electronic Signatures in Global and National Commerce Act

The federal Electronic Signatures in Global and National Commerce Act (“ESIGN”) and similar state laws, particularly the Uniform Electronic Transactions Act (“UETA”), authorize the creation of legally binding and enforceable agreements utilizing electronic records and signatures. ESIGN and UETA require businesses that want to use electronic records or signatures in consumer transactions to get affirmative consent from consumers to receive

Table of Conte nts

or sign electronically any documents otherwise required by law to be “in writing.” The law establishes standards for obtaining and documenting such consent and delivery of required notices.

Federal Marketing Regulations

The Telephone Consumer Protection Act (“TCPA”) and similar state laws generally prohibit robocalls, including those calls made using an auto-dialer or prerecorded or artificial voice calls made to a wireless telephone without the prior express consent of the called party (or prior express written consent, if messages constitute telemarketing). In addition, the FTC Telemarketing Sales Rule implements the FTC’s Do-Not-Call Registry and imposes numerous other requirements and limitations in connection with telemarketing.

Federal Laws Protecting Servicemembers

The Servicemembers Civil Relief Act (“SCRA”) and the Military Lending Act (“MLA”) provide important financial protections to eligible members of the U.S. Armed Forces and, in the case of MLA, certain dependents. The SCRA affords relief on financial obligations incurred prior to active duty, including an interest rate cap at 6% during active service and restrictions on certain creditor actions without a court order.

Bank Secrecy Act, USA PATRIOT Act, and U.S. Sanctions Laws

Our operations, indirectly through our lending partners or in some cases, directly, are subject to the Bank Secrecy Act (“BSA”), the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (“USA PATRIOT ACT”), certain U.S. sanctions laws, and implementing regulations issued by the Financial Crimes Enforcement Network (“FinCEN”). These laws require risk-based programs to detect and prevent money laundering, terrorist financing, and other financial crimes. Such programs must include written internal policies and procedures, a designated compliance officer, ongoing employee training and independent testing of the program's effectiveness. The Anti-Money Laundering (“AML”) and BSA laws require establishment of customer identification and verification procedures, as well as processes for identifying and reporting suspicious activity. We also maintain anti-money laundering, customer due diligence and record-keeping policies and procedures, as well as processes to avoid doing business with certain sanctioned persons or entities or certain types of sanctioned activity in specific countries under the lists promulgated by the U.S. Department of the Treasury’s Office of Foreign Assets Controls, or OFAC, and equivalent foreign authorities.

Bankruptcy Code

Under the Bankruptcy Code, a lender is prohibited by the automatic stay, reorganization plan and discharge provisions, among others, in seeking enforcement of debts against parties who have filed for bankruptcy protection. The lender’s rights to repossess a vehicle subject to a loan in bankruptcy are also restricted.

Real Estate Settlement Procedures Act

The Real Estate Settlement Procedures Act (“RESPA”) and Regulation X require lenders and servicers of home loans to provide borrowers with pertinent and timely disclosures regarding the nature and costs of the real estate settlement process. RESPA also prohibits specific practices, such as kickbacks, and places limitations upon

Table of Conte nts

the use of escrow accounts. Prior to referring a consumer to an affiliate, RESPA requires the person making each referral to provide each person to whom business is referred an Affiliated Business Arrangement Disclosure Statement.

State Lending Regulations

In addition to federal regulation, we are subject to extensive state and local laws that govern consumer lending, loan brokering, servicing, debt collection and related practices. These laws vary from state to state and may impose requirements regarding licensing, interest rate and fee limitations, disclosure obligations, fair lending, servicing, data security, advertising and recordkeeping. Certain states require us to obtain and maintain licenses and registrations to engage in such activities and to comply with the associated financial responsibility, examination and reporting requirements of such licensure.

Federal Securities Regulations

We conduct our business and structure our activities to comply with applicable U.S. federal securities laws and regulations. Asset-backed securities issued in connection with our loan financing activities have been offered pursuant to exemptions from registration under the Securities Act, including Section 4(a)(2), with placement by initial purchasers relying on Rule 144A and Regulation S to qualified institutional buyers and non-U.S. investors. We believe our securitization structures and organizational arrangements comply with applicable asset-backed securities risk retention requirements, including Regulation RR.

Additionally, based on applicable law and regulatory guidance, we do not believe we require registration as an investment adviser under the Investment Advisers Act of 1940 or as a broker-dealer under the Exchange Act. We intend to continue to conduct our operations in a manner consistent with these interpretations.

Compliance

We review our policies and procedures to ensure compliance with laws and regulations applicable to us and our lending partners. We have built our systems and processes with controls in place in order to permit our policies and procedures to be followed on a consistent basis. For example, to ensure proper controls are in place to maintain compliance with the consumer protection related laws and regulations, we have developed a compliance management system consistent with the regulatory expectations published by governmental agencies. While no compliance program can assure that there will not be violations, or alleged violations, of applicable laws, we believe that our compliance management system is reasonably designed and managed to minimize compliance-related risks.

Intellectual Property

We protect our intellectual property through a combination of patents, trademarks, domain names, copyrights and trade secrets, as well as through contractual provisions, our information security infrastructure and restrictions on access to or use of our proprietary technology. We may file additional patent applications or pursue additional patent protection in the future to the extent we believe it will be beneficial.

We will pursue additional trademark registrations to the extent we believe it will be beneficial. We also have registered domain names for websites that we use in our business. We may be subject to third party claims from time to time with respect to our intellectual property.

Table of Conte nts

Additionally, we rely upon unpatented trade secrets and confidential know-how and continuing technological innovation to develop and maintain our competitive position. We also enter into confidentiality and intellectual property rights agreements with our employees, consultants, contractors and business partners. Under such agreements, our employees, consultants and contractors are subject to invention assignment provisions designed to protect our proprietary information and ensure our ownership in intellectual property developed pursuant to such agreements.

For additional information about our intellectual property and associated risks, see Item 1A. “Risk Factors” of this Annual Report on Form 10-K.

Culture and Workforce

We have built a very special company culture at Upstart. Building the best place for top talent to do great work has been a priority for us from day one. We have received best place to work awards in both our San Mateo and Columbus locations, and our employees remain engaged and inspired by our mission; retention of our top talent is as high as it has been since we went public in 2020.

We brought together a remarkable diversity of thinkers to build Upstart. Our co-founders and the members of our management team come from diverse backgrounds with varying ethnicities, education backgrounds, genders and ages. This diversity of thought ensures we tackle problems from all angles and arrive at the best solution for all stakeholders.

Recruiting

We attract and recruit diverse, exceptionally talented, highly educated, experienced and motivated employees. We have an extremely rigorous recruiting and employee candidate screening process. The majority of the members of this team have doctorate degrees in statistics, mathematics, computer science, economics or physics and many have extensive past experience in quantitative finance.

Culture

The Upstart culture is central to our talent advantage and we have carefully and thoughtfully built it as we have grown. Equity and inclusion underpin everything we do in the people programs we build.

Digital First Approach

In 2020, we shifted our talent location strategy to one that focused on “digital” work first. However, to ensure we continue to build relationships and capture the magic of those innovative, in-person “aha” moments, we also provide travel and onsite budgets to ensure teams can come together regularly. We believe the benefits of in-office work can be achieved by convening for focused, intensive days a few times each year, either during onsite sessions or at our annual company-wide conference, Upstart Live. This flexible approach gives Upstart the best of both worlds: meaningful in-person collaboration and team building, along with access to diverse talent across the country.

Table of Conte nts

Employee Benefits

In addition to providing competitive benefits like fully paid health insurance, life insurance and disability, flexible time off for our salaried employees, and fully paid parental leave, we invest in benefits that will provide financial flexibility and financial wellness for our employees. We see this as central to our brand as an employer, and to attracting the types of employees that will be passionate about our mission to serve borrowers. We continue to provide flexible wellness and productivity budgets allowing our diverse population of employees to spend in ways that will be most useful for them. We believe that these employee benefits, combined with competitive salaries and an equity program that grants restricted stock units to all full-time employees, have ensured that we remain a top employer in our industry.

As of December 31, 2025, we had 1,405 full-time employees. We also engage temporary employees, contractors and consultants as needed to support our operations. None of our employees are represented by a labor union or subject to a collective bargaining agreement. We have not experienced any work stoppages, and we consider our relations with our employees to be good.

Corporate Information

Upstart Network, Inc. was incorporated in Delaware in 2012. Pursuant to a restructuring, Upstart Holdings, Inc. was incorporated in December 2013 and became the holding company of Upstart Network, Inc. Our principal executive offices are located at 2950 S. Delaware Street, Suite 410, San Mateo, California 94403, and our telephone number is (833) 212-2461. Our website address is www.upstart.com. The content of our websites and information that can be accessed through our websites is not incorporated by reference into this Annual Report on Form 10-K or in any other report or document we file with the SEC, and any references to our websites are intended to be inactive textual references only.

Available Information

Our website is located at www.upstart.com and our investor relations website at ir.upstart.com. The SEC also maintains a website that contains our SEC filings at www.sec.gov. The content of our websites and information that can be accessed through our websites is not incorporated by reference into this Annual Report on Form 10-K or in any other report or document we file with the SEC, and any references to our websites are intended to be inactive textual references only.

We announce material information to the public about us, our products and services and other matters through a variety of means, including filings with the SEC, press releases, public conference calls, webcasts, the investor relations (ir.upstart.com) and newsroom (upstart.com/news) sections of our website, and our X (formerly known as Twitter) account @Upstart, in order to achieve broad, non-exclusionary distribution of information to the public and for complying with our disclosure obligations under Regulation FD.

Table of Conte nts

ITEM 1A. RISK FACTORS

RISK FACTORS

Investing in our common stock involves a high degree of risk. The risks and uncertainties described below should be carefully considered, together with all of the other information in this Annual Report on Form 10-K, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and related notes, before making a decision to invest in our common stock. Our business, financial condition, results of operations, or prospects could also be harmed by risks and uncertainties not currently known to us or that we currently do not believe are material. If any of the risks actually occur, our business, financial condition, results of operations, and prospects could be adversely affected. In that event, the market price of our common stock could decline, and you could lose part or all of your investment.

SUMMARY OF RISK FACTORS

The material risks that may affect our business, financial condition or results of operations include, but are not limited to, those relating to the following:

•Our business has been and will continue to be adversely affected by economic conditions and other factors that we cannot control.

•If we are unable to maintain diverse and resilient loan funding to our marketplace from institutional investors or successfully manage risks associated with committed capital and other co-investment arrangements, our growth prospects, business, financial condition and results of operations could be adversely affected.

•

•If we are unable to continue to improve our artificial intelligence (“AI”) models or if our AI models are ineffective, including by failing to accurately or timely reflect changes in economic conditions on borrowers’ credit risk, our growth prospects, business, financial condition and results of operations would be adversely affected.

•

•A limited number of lending partners account for a significant portion of loan originations and revenue on our marketplace, and our business depends on our ability to retain existing lending partners and attract new ones.

•

•If we are unable to manage risks associated with the loans on our balance sheet, our business, financial condition and results of operations may be adversely affected.

•

•Our reputation and brand are important to our success, and failure to maintain, protect and promote our brand may harm our business.

•If we are unable to manage the risks related to our loan servicing and collections obligations, our business,

financial condition and results of operations could be adversely affected.

Table of Conte nts

•A significant portion of our business has historically depended on a single loan product, and shifts in product demand or mix could adversely affect our business.

•

•Security breaches, improper access to our or borrowers’ data, or other security incidents may harm our reputation, adversely affect our results of operations and expose us to liability.

•Any significant disruption of, or failure in, our technology systems, including our AI lending platform, could adversely affect our business, financial condition and results of operations.

•We rely on strategic relationships with loan aggregators to attract applicants to our marketplace, and if we cannot maintain effective relationships with loan aggregators or successfully replace their services, our business could be adversely affected.

•Our business is subject to a wide range of laws and regulations, many of which are evolving, and failure or perceived failure to comply with such laws and regulations could harm our business, financial condition and results of operations.

RISKS RELATED TO OUR BUSINESS AND INDUSTRY

Our business has been and will continue to be adversely affected by economic conditions and other factors that we cannot control.

Uncertainty, volatility and negative trends in general economic conditions historically have created a difficult operating environment for our industry. Many factors, including factors that are beyond our control, have impacted and will continue to impact our business, financial condition and results of operations by affecting the supply of capital to our marketplace from our lending partners and institutional investors, the demand by borrowers for Upstart-powered loans, and borrowers’ ability and willingness to repay their loans.

Adverse macroeconomic conditions and resulting uncertainty and volatility have had, and may have in the future, a material adverse effect on our business and results of operations. Such conditions can reduce borrower demand, approval and acceptance rates, loan origination volume and loan funding from lending partners and institutional investors, reduce liquidity in the capital markets, increase funding costs, and increase our reliance on our balance sheet. Many borrowers that access our marketplace have poor, limited or no credit history and may be disproportionately affected by inflation, higher interest rates, unemployment or recessionary conditions, which can reduce their ability or willingness to borrow or repay loans. During economic downturns, borrowers may prioritize secured obligations over unsecured personal loans, and higher interest rates may further increase payment burdens, leading to higher delinquencies, defaults, charge-offs and lower recoveries. Because our operations are concentrated in U.S. consumer credit, adverse developments affecting the U.S. economy or consumer credit markets could have a disproportionate impact on our business. In addition, changes in fiscal, monetary or regulatory policy priorities across presidential administrations may contribute to economic volatility and uncertainty.

Table of Conte nts

If we are unable to maintain diverse and resilient loan funding to our marketplace from institutional investors or successfully manage risks associated with committed capital and other co-investment arrangements, our growth prospects, business, financial condition and results of operations could be adversely affected.

Our business depends on sourcing and maintaining diverse and resilient sources of capital from institutional investors to our marketplace, including through the purchase of whole loans and interests in loans through pass-through certificates and asset-backed securities. A significant portion of loans transacted on our marketplace are purchased by institutional investors. Decreased capital from institutional investors has negatively impacted our business in the past, and may negatively impact us in the future.

A significant portion of our loan funding from institutional investors comes from committed capital and other co-investment arrangements, which may include downside credit risk protection, subject to certain limits and conditions. Under these arrangements, we may be required to compensate investors if loan credit performance deviates from expectations. We may also be required to compensate investors if committed loan sale volumes are not achieved. If loans do not perform as expected for any reason, including due to changes in borrower behavior or ability to pay, borrower demand declines, or our credit performance expectations are inaccurate, our financial results could be adversely affected, including through unfavorable fair value adjustments.

Capital arrangements entered into during periods of higher interest rates may become more costly if interest rates decline and the terms of such arrangements remain in place.

We have facilitated securitizations, and may in the future facilitate additional securitizations, of Upstart-powered loans to allow institutional investors, certain lending partners, and/or us to liquidate or finance such loans through the asset-backed securities markets or other capital markets products. In securitization transactions, we sell and convey pools of loans to special purpose entities (“SPEs”), which issue notes or certificates pursuant to indentures and trust agreements. Securities issued by securitization SPEs and borrowings under warehouse facilities are secured by the loan pools owned by the applicable SPEs, and we, our lending partners and/or institutional investors may contribute loans to such SPEs in exchange for cash and/or debt or equity interests.

When we act as sole sponsor of securitizations, we are required under Regulation RR to retain a portion of the credit risk of the underlying loans for a specified period of time. We may finance some or all of these retained interests through risk retention financing facilities. If retained interests decline in value, or if we are unable to finance or refinance retained risk positions on acceptable terms, our liquidity, funding costs and results of operations could be adversely affected. We may also retain subordinated or residual interests beyond minimum risk retention requirements, which are exposed to greater credit risk and may lose value, including becoming worthless. Regulatory requirements applicable to securitizations, including under the Dodd-Frank Act, the Investment

Table of Conte nts

Company Act of 1940, and the “Volcker Rule,” as well as changes in state licensing requirements, may limit the type or structure of securitizations we are able to complete, and failure to comply with applicable securitization laws or regulations could restrict our ability to access securitization markets or require us to restructure or discontinue certain financing arrangements.

Servicing fees generated by our loan servicing activities for loans sold to institutional investors or contributed to asset-based securitizations and pass-through certificate transactions also represent a material portion of our earnings, and investor demand for Upstart-powered loans and related securities may fluctuate based on loan performance, pricing and servicing economics, macroeconomic conditions, investor risk appetite, regulatory or accounting considerations and the availability of funding and liquidity in the capital markets.

In connection with our asset-backed securitizations, pass-through certificate transactions, warehouse credit facilities and whole loan sale arrangements, we make representations and warranties concerning the loans transferred. If such representations and warranties are inaccurate and are not timely cured, we may be required to repurchase loans, make payments or provide indemnification to financing parties. Failure to satisfy these obligations could constitute a default or termination event under the applicable agreements and could require us to fund repurchases or make other payments at a time when liquidity may be constrained. If repurchase or payment obligations were to increase, or if we are unable to fund such obligations when required, our liquidity, financial condition and results of operations could be adversely affected, and a high volume of repurchases or payments could harm our reputation as a loan seller and servicer. If securitizations, warehouse facilities or risk retention financing are not available or economical, we may need to seek alternative financing, rely more heavily on our balance sheet or reduce loan originations, which could adversely affect our business, financial condition and liquidity.

We are also subject to counterparty risk arising from derivative instruments, beneficial interests, warehouse facilities and custodial arrangements, and a counterparty’s failure to perform could result in losses and adversely affect our business, financial condition and results of operations.

Our ability to attract borrowers and facilitate loan originations on our marketplace depends in large part on the effectiveness of our AI models in evaluating borrower creditworthiness and pricing loans appropriately. Our overall operating efficiency and margins further depend in part on our ability to maintain a high degree of automation in our application process and achieve incremental improvements in the degree of automation. If our AI models contain errors, rely on inaccurate assumptions or data, or otherwise fail to perform as expected, loans may be sub-optimally priced or incorrectly decisioned, which could result in losses that are higher than expected, reduced borrower demand, and decreased loan originations. Our AI models and related decisioning processes also depend on the availability, accuracy and timeliness of data and other inputs, including information provided by applicants and third-party sources.

In addition, we may make errors in the development, validation, testing, governance, or implementation of our AI models or related tools and processes, and such errors may not be detected prior to deployment. Or, our AI models may not be able to accurately predict borrower behavior or loan performance under all circumstances, particularly during periods of economic uncertainty or rapid changes in macroeconomic conditions.

Table of Conte nts

Underperformance of Upstart-powered loans relative to expectations may also reduce demand from lending partners and institutional investors, constrain capital and negatively affect our financial results. If model performance deteriorates, our lending partners and investors may change or tighten their underwriting or pricing requirements, reduce demand for Upstart-powered loans, require additional credit enhancement or other structural protections, or impose less favorable terms across our loan funding arrangements, any of which could adversely affect our business.

As we continue to refine UMI, we have revised previously published values and may further revise current or historical values in the future. Significant changes or revisions to UMI could harm our credibility and reputation with lending partners and institutional investors, which could adversely affect our business. Furthermore, the correlation between UMI and actual macroeconomic risk, including loan losses or defaults, may not be as meaningful or reliable as we expect. If UMI fails to accurately or adequately reflect macroeconomic risk, or is perceived as misaligned or misleading, lending partners and institutional investors may distrust or disregard UMI, which could negatively affect their willingness to use our marketplace or fund loans.

UMI may not be an appropriate indicator of risk for specific loan products, borrower segments or non-Upstart loan portfolios, and it is not intended to measure or predict broader economic conditions, future loan performance, our results of operations or our stock price. Investors, lending partners or analysts may misunderstand, misinterpret or misuse UMI for unintended purposes, which could harm our reputation, reduce confidence in our disclosures and impair our ability to attract and retain lending partners and institutional investors.

The vast majority of our revenue comes from platform and referral fees and servicing fees on loans facilitated through our marketplace. To increase the number of loans facilitated through our marketplace, we must have an adequate supply of capital from lending partners and institutional investors, and borrowers must satisfy the requirements for approval established by our models and our lending partners.

While we continue to improve the accuracy of our AI models, which we believe is key to our long-term success, such improvements may not result in an increase in the number of borrowers approved on our platform. These improvements have led us in the past and may lead us in the future to reevaluate our credit decisioning process, including the risks associated with certain borrowers. Changes in borrower default patterns and credit performance have in the past and could in the future result in fewer borrowers being approved for loans on our platform.

In addition, our lending partners’ credit requirements and the target returns our lending partners and institutional investors demand in order to provide capital to our marketplace have, and could continue to, negatively impact our ability to extend loan offers with competitive terms or at all to certain borrowers on our marketplace. If we are not able to fill purchase commitments for our institutional investors or maintain a platform meeting the origination requirements of our lending partners, we risk jeopardizing our marketplace.

Table of Conte nts

Macroeconomic environments fluctuate over time, and the costs and risks associated with consumer borrowing evolve in response to economic conditions. During periods of challenging macroeconomic conditions, including periods of elevated borrowing costs and heightened consumer credit risk, the pool of qualified borrowers may become smaller, and fewer applicants may receive or accept loan offers on our marketplace. Approving more borrowers can also be limited as we have historically limited the maximum annual percentage rates offered on Upstart-powered loans due to regulatory reasons. These factors have adversely affected, and may in the future adversely affect, transaction volume on our marketplace and therefore our revenue.

A limited number of lending partners account for a significant portion of loan originations and revenue on our marketplace, and our business depends on our ability to retain existing lending partners and attract new ones.

Our success depends in significant part on the continued participation of lending partners in our marketplace, which provide both loan funding and a substantial portion of our revenue.

Our ability to attract new lending partners may be limited by lengthy or complex onboarding processes, prospective partners’ diligence requirements, or changes in target returns, funding costs or risk tolerance.

We enter into a separate agreement with each of our lending partners. These agreements are non-exclusive and may contain minimum fee amounts. In addition, lending partners may adjust or terminate their business with us based on macroeconomic conditions, funding costs, regulatory requirements, credit performance, internal priorities, competitive dynamics or changes in business strategy. Federal or state regulators may also require lending partners to terminate or limit their business with us, or impose regulatory pressure that constrains their ability or willingness to participate in our marketplace.

Although we have been profitable in certain periods, we have also incurred net losses and may do so again in the future. We have made, and expect to continue to make, significant investments in our business, and we may not be able to increase revenue sufficiently to offset these costs, which could prevent us from achieving or sustaining profitability. These investments include investment in our proprietary AI models, product development, borrower acquisition, platform enhancements and expansion of our loan offerings.

We have incurred losses in the past, and may incur losses in the future, due to a variety of factors, including the other risks described in this section, macroeconomic conditions, unforeseen expenses, operational challenges, and delays in executing our business strategies. Any failure to maintain or increase revenue at a pace sufficient to support our investment levels and other operating expenses could adversely affect our ability to achieve or sustain profitability.

Table of Conte nts

If we are unable to manage risks associated with the loans on our balance sheet, our business, financial condition and results of operations may be adversely affected.

We have held more Upstart-powered loans on our balance sheet in recent years and may continue to do so in the future. We have used, and may continue to use, our balance sheet to support our research and development activities for new loan products and borrower segments.

Increases in market interest rates may reduce the fair value of loans held on our balance sheet, which have negatively affected, and may in the future negatively affect, the fair value of such loans. Our exposure to rising borrower default rates and their volatility has increased, and may continue to increase, as we hold more Upstart-powered loans on our balance sheet. Also, loans for research and development purposes make up a substantial portion of the loans held on our balance sheet and are generally more risky and more likely to default than the core personal loans.

At times, default rates and charge-offs for certain loan categories have been higher than expected, resulting in unfavorable fair value adjustments to the loans on our balance sheet. Unfavorable fair value adjustments have negatively impacted our revenue in the past and may do so again in the future if loan performance deteriorates or fails to meet expectations. Furthermore, a portion of our revenue is interest income derived from loans held on our balance sheet, and increasing the number of loans we hold would increase the mix of our revenue that comes from interest on loans. If we are unable to sell loans held on our balance sheet on commercially reasonable terms or at all, our liquidity position could be adversely affected. Any of the foregoing could adversely affect our business, financial condition and results of operations.

Our operating and financial results have, in the past, and may, in the future, fluctuate significantly from period to period due to a variety of factors, many of which are outside of our control. Factors that may cause these fluctuations include, among others, changes in macroeconomic conditions; fluctuations in borrower demand and loan origination volume, including seasonal patterns; changes in the availability and cost of loan funding; changes in credit performance; shifts in product mix; the timing and success of new products, partnerships or funding arrangements; changes in interest rates; changes in regulatory requirements or enforcement priorities; and changes in our operating expenses.

In addition, we typically experience seasonality in the demand for Upstart-powered loans, which has been generally lower in the first quarter.

Fluctuations in our operating results may also make it difficult for investors to evaluate our business and future prospects, which could further contribute to volatility in the market price of our common stock.

Table of Conte nts

Our reputation and brand are important to our success, and failure to maintain, protect and promote our brand may harm our business.

We believe maintaining a strong brand and trustworthy reputation is critical to our success and our ability to attract borrowers to our marketplace, attract new lending partners, maintain diverse and resilient loan funding and sustain good relations with regulators. The maintenance of our brand and reputation depend on a number of factors, including the performance and perceived effectiveness of our proprietary AI models, the quality and pricing of our products, the reliability and scalability of our platform, regulatory compliance, loan performance outcomes and our ability to innovate and respond to evolving customer and partner needs. In addition, the availability and perceived attractiveness of alternative products or platforms from our competitors may influence how our brand and value proposition are perceived. Competitive pressures may result in reduced demand for Upstart-powered loans, pricing pressure, increased costs or loss of market share, any of which would harm our reputation and brand.

Furthermore, negative publicity about us or the consumer lending industry, including regarding our AI-powered credit decisioning models, loan performance, servicing or collections practices, marketplace model, use of AI, regulatory compliance, data privacy and cybersecurity practices, litigation or regulatory actions, or the experience of participants on our platform, even if inaccurate or unfounded, could harm our reputation and reduce confidence in our platform. Such reputational harm could reduce usage of our platform and adversely affect our business, financial condition and results of operations.

If we are unable to manage the risks related to our loan servicing and collections obligations, our business, financial condition and results of operations could be adversely affected.

Our success depends in part on our loan servicing and collection efforts. A meaningful portion of our revenue from fees is generated from loan servicing fees. Even where loans are secured, including auto loans or HELOCs, we may be limited in our ability to recover amounts owed if collateral cannot be located or recovered or if collateral values decline.

Our ability to collect on loans is largely dependent on borrowers’ financial health and may be adversely affected by factors such as unemployment, illness, bankruptcy, economic downturns or other circumstances beyond a borrower’s control. Federal and state laws, including bankruptcy and insolvency laws, may further limit recoveries.

We conduct collection activities for certain lending partners, institutional investors, and financing lenders. We also rely on third-party collection agencies and, in certain cases, litigation strategies to collect from certain delinquent borrowers. If our collection efforts or those of third-party vendors are ineffective, inconsistent, unprofessional or otherwise harm borrowers, our reputation could be damaged, borrower demand could decline and delinquencies and charge-offs could increase.

We act as servicer for most loans facilitated through our marketplace, including loans sold in whole loan transactions, contributed to securitizations and pass-through securities, and pledged in warehouse facilities. Loan servicing is a highly regulated and operationally complex activity, involving manual processes and regulatory compliance obligations. Errors in servicing, failures to comply with servicing requirements or inadequate performance could expose us to liability to borrowers, lending partners, institutional investors or financing lenders, and harm our reputation. If the costs of servicing exceed the servicing fees we earn, our results of operations could be adversely affected.

Table of Conte nts

Auto loans facilitated through our marketplace and retail installment contracts purchased from motor vehicle dealers are secured by vehicles that may depreciate rapidly and may be difficult to locate. We rely on third-party repossession vendors to recover collateral, and repossession may not result in full recovery of amounts owed. Failures by such vendors to adhere to applicable law and regulations could result in loss of the collateral, regulatory action, litigation and/or reputational harm. As we scale our auto lending business, we may face increased operational and compliance risk in coordinating repossession activity and managing title and other collateral requirements that vary by state. For home-secured products such as HELOCs, collections and recovery may involve enforcing liens or pursuing foreclosure-related remedies that can be time-consuming, costly and subject to heightened regulatory and reputational scrutiny.

Servicing and collection activities are subject to extensive and evolving federal and state laws and regulatory oversight. If we fail to comply with applicable servicing, collection or licensing requirements, we could lose licenses, become subject to enforcement actions, sanctions or litigation, or be restricted from servicing loans or operating in certain jurisdictions, which could adversely affect our business, financial condition and results of operations.

A significant portion of our business has historically depended on a single loan product, and shifts in product demand or mix could adversely affect our business.

A significant portion of the loan originations facilitated through our marketplace has historically consisted of unsecured personal loans. A variety of factors could adversely affect demand for unsecured personal loans, including macroeconomic conditions, increased interest rates, changes in consumer credit behavior, competition, regulatory developments and other conditions in the credit markets.

Unsecured personal loans are seen as a more risky credit product because they are not backed by collateral. As such, borrowers may choose not to prioritize repayment of unsecured personal loans, particularly during an economic down cycle, and instead prioritize repayment of secured indebtedness obligations over unsecured personal loans.

While the unsecured personal loan product represents the majority of our business, we offer other loan products on our marketplace and may continue to expand and scale additional products over time. Newer loan products may have different margins or default rates than our core personal loan products. Offering and scaling multiple products introduces additional operational, regulatory, funding and servicing complexity and exposes us to risks that differ from those associated with a single product offering. In order to preserve and expand our relationships with lending partners and institutional investors, it may become important for us to offer a broader range of loan products than we have historically offered. Our competitors may also seek to gain or maintain market share by underpricing certain loan products or accepting lower returns, even if such practices result in losses. These competitive dynamics could reduce demand for loans facilitated through our marketplace or adversely affect the economics of our platform.

We have limited operating history with respect to certain of these products, and new initiatives are inherently risky, as each involves unproven business strategies, new regulatory

Table of Conte nts

requirements and new financial products and services with which we, and in some cases our lending partners, have limited or no prior development or operating experience.

As part of our growth strategy, we may continue to offer and scale multiple loan products with distinct borrower profiles, underwriting considerations, regulatory requirements, funding sources and servicing obligations. While these newer products currently represent a small portion of our business, they are expected to grow at a different rate than our core personal loan product. Investment in new products or services may also need to be delayed, modified or deferred due to market, macroeconomic or other conditions.

We may also have difficulty securing adequate loan funding from lending partners or institutional investors for new loan products and services, which may require us to hold more loans on our balance sheet for extended periods of time. If the borrower profile for new products differs from that of existing products, our AI models may not accurately evaluate credit risk and we may not be able to obtain loan funding for such products on commercially reasonable terms, or at all. New products may also experience higher levels of delinquencies or defaults as our models calibrate to different borrower populations or data sets. Furthermore, new products and services may raise new or complex regulatory compliance obligations, increase our costs, reduce margins or take longer than anticipated to achieve target margins. Our development efforts may also divert management attention and resources from existing operations.

If we do not compete effectively in our target markets, our business, results of operations and financial condition could be harmed.

The consumer lending market is highly competitive and increasingly dynamic as emerging technologies continue to enter the marketplace.

We compete to varying degrees with other sources of consumer credit, including banks, non-bank lenders, retail-based lenders and other financial technology platforms. Many competitors operate under different business models, have different funding sources, cost structures or regulatory obligations, or focus on different segments of the market.

Our competitors may have longer operating histories, greater brand recognition and loyalty, lower costs of capital, more diversified products, broader borrower or partner relationships, more diversified funding sources or greater balance sheet capacity than we do. Competitors may also modify their pricing or business models to compete more directly with us, including by offering lower pricing or more flexible terms. Our ability to compete will also depend on our ability to provide lending partners with a competitive suite of loan products and services. In addition, competitors may pursue acquisitions or strategic alliances that provide access to lower-cost capital, expanded distribution or enhanced regulatory capabilities, further intensifying competition.

If we are unable to compete effectively or keep pace with innovation in our industry, demand for our marketplace could stagnate or decline, which could harm our business, results of operations and financial condition.

Table of Conte nts

If we are unable to manage the risks associated with fraudulent activity, our brand and reputation, business, financial condition and results of operations could be adversely affected.

Fraud rates may also increase during economic downturns.

We use a combination of proprietary AI models and third-party tools to detect and prevent fraud by validating applicant-reported data and information obtained from third-party sources. However, these efforts may not be sufficient to identify all fraudulent activity. If fraud detection controls are ineffective, fraud-related losses on Upstart-powered loans could increase, erode confidence in our marketplace, and adversely affect our financial condition and results of operations. Fraud perpetrators may also target our platform due to the high degree of automation in our credit decisioning processes.

Further, if higher levels of fraud lead to increased human review of loan applications, the level of automation on our platform could decline, negatively affecting our operating efficiency and unit economics.

We depend on our key personnel and other highly skilled personnel, and if we fail to attract, retain and motivate our personnel, our business, financial condition and results of operations could be adversely affected.

Competition is high for skilled personnel, including engineering and data analytics personnel, particularly in the San Francisco Bay Area where our headquarters is located. We may not be able to hire or retain such personnel at compensation or flexibility levels consistent with our existing compensation structure and policies. In addition, the current regulatory environment related to immigration is uncertain, including with respect to the availability of H1-B and other U.S. visas. If a new or revised U.S. visa program is implemented, it may impact our ability to recruit, hire, retain, or effectively collaborate with qualified skilled personnel.

Workforce reductions may adversely affect employee morale, culture and productivity, and our ability to attract and retain personnel, result in the loss of institutional knowledge, disrupt operations, or impair our ability to pursue new initiatives due to reduced resources.

Table of Conte nts

Borrowers may prepay a loan at any time without penalty, which could reduce our servicing fees and deter our lending partners and institutional investors from investing in loans facilitated through our lending marketplace.

If the entire outstanding unpaid principal amount of a loan is prepaid, we would not receive a servicing fee for the period after the loan is prepaid in full.

The long-term impact of operating with a Digital First workforce on our business, financial condition and results of operations is uncertain.

Our workforce is principally distributed across the U.S., with only limited presence in Canada, and we expect this to continue. There is no guarantee that we will realize any anticipated benefits from this model.

Our Digital First model could lead to a negative long-term impact on our operations, the execution of our business plans and sales and marketing efforts, our company culture, or the productivity and retention of key personnel and other employees necessary to conduct our business, or otherwise cause operational failures. The increase in remote working may also result in increased exposure to consumer privacy and data security incidents, or fraudulent activity. If we are unable to successfully address the foregoing risks and challenges as we encounter them, our business, financial condition and results of operations could be adversely affected.

Unfavorable outcomes in legal proceedings may harm our business and results of operations.

These claims, lawsuits and proceedings could involve a wide range of legal and regulatory matters, including consumer protection, employment, intellectual property, data privacy, securities and other commercial or statutory claims. For example, we are a defendant in a number of securities class actions and other related lawsuits. See the “Legal” section under “Note 11. Commitments and Contingencies” in Part II, Item 8 of this Annual Report on Form 10-K.

See the risk factor titled “—If loans originated by our lending partners were found to violate state law, loans facilitated through our marketplace may be unenforceable or otherwise impaired, we or our lending partners, institutional investors or warehouse lenders may face fines and penalties, and our commercial relationships may suffer, each of which would adversely affect our business and results of operations” for more information.

Even if we adequately address the issues raised by an investigation or proceeding or successfully defend a third-party lawsuit or counterclaim, we may have to devote significant financial and management resources to address these issues, which could harm our business, financial condition and results of operations.

Table of Conte nts

We may pursue acquisitions or investments in other businesses or technologies, which could disrupt our business and may not achieve anticipated benefits.

We may pursue acquisitions or investments in other businesses or technologies as part of our growth strategy. These transactions may require significant management attention, involve the integration of different business models, technologies, systems, controls or cultures, and divert resources from our existing operations.

We may encounter difficulties integrating acquired businesses, technologies or personnel, or fail to realize anticipated synergies, cost savings or strategic benefits. In addition, acquisitions or investments may expose us to unforeseen liabilities, integration costs, impairment charges, regulatory scrutiny or other risks.

Our financial reporting relies on significant estimates, judgments, key operating metrics and effective internal controls, and inaccuracies or control failures could adversely affect our business.

The preparation of our financial statements requires management to make estimates and assumptions that affect reported amounts and disclosures, including with respect to revenue recognition, loan valuation, credit losses, fair value measurements and other areas. Although we believe these estimates and assumptions are reasonable, they are inherently uncertain, may change as new information becomes available, and may differ materially from actual outcomes.

Our ability to produce timely and accurate financial statements and other periodic reports depends on the maintenance of appropriate information systems, processes and controls. In addition, we regularly assess, and report on, the effectiveness of our internal control over financial reporting. If we or our independent auditors identify deficiencies in internal controls that are deemed to be material weaknesses, or if significant deficiencies or material weaknesses are identified in the future, our financial reporting may be delayed or unreliable.

Our operating and financial results also depend on certain operating and financial metrics that we disclose, including key measures of loan performance, revenue and related performance indicators. These metrics are based on underlying data that involve estimates and assumptions, may not be comparable to similarly titled measures used by other companies, and may change over time as our business evolves. In addition, we may from time to time publish certain operating or performance metrics on a more frequent basis in our Regulation FD channels, which are subject to the same inherent limitations, estimates and potential variability as our other disclosed metrics.

Deficiencies in our disclosure controls or internal control over financial reporting could lead to material errors in our financial statements, restatements, regulatory scrutiny, loss of investor confidence and reputational harm. Any of the foregoing could adversely affect our business, financial condition and results of operations.

We maintain cash deposits in excess of federally insured limits, and adverse developments affecting financial institutions could adversely affect our liquidity and financial performance.

We regularly maintain domestic cash deposits in Federal Deposit Insurance Corporation (“FDIC”) insured banks that exceed the FDIC insurance limits. Adverse developments affecting financial institutions or the broader banking system, including bank failures, liquidity constraints or disruptions in the financial or credit markets, could impair our ability to access such funds in a timely manner, which could adversely affect our liquidity, financial condition and results of operations. There can be no assurance that our deposits in excess of the FDIC or other

Table of Conte nts

comparable insurance limits will be backstopped by the U.S. treasury, or that any bank or financial institution with which we do business will be able to obtain needed liquidity from other banks, government institutions or by acquisition in the event of a failure or liquidity crisis.

Our business is subject to the risks of natural disasters and other catastrophic events, many of which are becoming more acute and frequent due to climate change, and to interruption by human-induced problems.

Significant natural disasters or other catastrophic events, such as earthquakes, fires, hurricanes, blizzards or floods (including those associated with climate change), as well as power losses, telecommunications failures, strikes, epidemics or pandemics, cyber incidents, system failures or failures of financial institutions, could adversely affect our business, results of operations and financial condition. The effects of climate change may increase the frequency or severity of certain natural disasters. Our operations, including our headquarters in the San Francisco Bay Area and our office in Columbus, Ohio, are located in regions that may be vulnerable to earthquakes, wildfires, severe weather events or other climate-related conditions. Our insurance coverage may be insufficient to compensate us for all losses that may occur. In addition, for loans secured by collateral, catastrophic events may also damage or impair collateral or adversely affect collateral values, which could reduce recovery amounts and increase losses.

Acts of war, armed conflict, terrorism, geopolitical unrest, disruptions in global trade, or travel restrictions could cause business disruptions and lead to interruptions, delays or loss of critical data. If our business continuity or disaster recovery plans prove inadequate, or if our personnel, systems or data centers are affected, we may experience interruptions or delays in our operations. To the extent these events adversely affect borrowers’ ability to repay their loans, our business, financial condition and results of operations could be negatively affected.

RISKS RELATED TO OUR INTELLECTUAL PROPERTY AND PLATFORM DEVELOPMENT

Security breaches, improper access to our or borrowers’ data, or other security incidents may harm our reputation, adversely affect our results of operations and expose us to liability.

It is critical that we do so in a manner designed to maintain the confidentiality, integrity, and availability of such information. We also rely on third-party vendors and service providers, including those that support our information technology infrastructure, and certain of these third parties may have access to our systems or sensitive information.

Our information technology systems, as well as those of our third-party vendors and service providers, are vulnerable to inadvertent or intentional security breaches, attacks, outages, disruptions and other incidents. The size, complexity, accessibility and distributed nature of our information technology systems, including systems operated by third parties on our behalf, may increase the likelihood or severity of such incidents. These risks may arise from actions by employees, contractors, vendors, lending partners, institutional investors or other third parties, as well as from malicious threat actors. While we continue to invest in security controls and monitoring, no system can provide absolute security, and our controls and any related actions may fail to prevent, detect, or remediate security incidents promptly or at all. In addition, our use of advanced technologies, including AI, may introduce additional cybersecurity risks or be exploited by threat actors, increasing the complexity of managing our security environment.

Security breaches, attacks, outages, disruptions, or other

Table of Conte nts

incidents affecting us or our vendors or service providers could compromise the confidentiality, integrity or availability of our systems, proprietary models, algorithms, or data, cause service interruptions, disrupt our operations, degrade the user experience of our platform, or result in unauthorized access to, disclosure of, or other processing of sensitive information, including borrower data. Such incidents could adversely affect borrowers, lending partners and other third parties that rely on our platform and could harm our reputation, reduce transaction volume or otherwise adversely affect our business.

Security incidents, whether actual or perceived, may trigger notification obligations, regulatory investigations or enforcement actions, litigation, contractual liability, significant remediation costs, or negative publicity. Any of these consequences could cause borrowers, lending partners, or other third parties to lose confidence in our platform and could harm our reputation. We maintain insurance policies intended to cover certain cybersecurity and privacy-related risks; however, this coverage may be insufficient, unavailable on acceptable terms, subject to exclusions or deductibles, or contested by insurers.

Any significant disruption of, or failure in, our technology systems, including our AI lending platform, could adversely affect our business, financial condition and results of operations.

We rely on these systems to process loan applications, service loans, support underwriting and pricing decisions, and manage data and reporting for our lending partners and institutional investors. Our reliance on electronic loan origination, disclosures and signatures, rather than paper-based processes, may increase the risk of errors or system failures.

We are also dependent on a number of third-party infrastructure and services, including cloud computing, data storage and network services, to operate our platform. In the event that our AWS service agreements are terminated, there is a lapse of service, interruption of internet service provider connectivity, or damage to AWS data centers, we could experience interruptions in access to our platform, as well as delays and additional expense if we must secure alternative cloud infrastructure services, which could reduce confidence in the reliability of our platform and cause lending partners or institutional investors to reduce, suspend or cease funding or other participation on our marketplace.

We also collect, store, and process large volumes of sensitive borrower and applicant information, as well as proprietary information, including data used to develop, train, and operate our AI models and related technologies. Unauthorized access to or use of our systems or data, or other security breaches or incidents could result in service disruptions, loss of data, including proprietary or AI-related data, regulatory investigations and other proceedings, litigation, remediation costs and reputational harm.

Our disaster recovery, business continuity and information security controls may not be effective in all circumstances. As our business grows and our technology systems become more complex, we may need to make significant investments to maintain the capacity, reliability and security of our platform.

Our platform and internal systems rely on software that is highly technical, and if our software contains undetected errors, our business could be adversely affected.

Table of Conte nts

Any real or perceived errors, bugs, or defects could result in incorrect or delayed processing of loan applications, inaccurate pricing or disclosures, failures in compliance or fraud-detection controls, disruptions to our platform or services, or other operational issues.

It may be difficult and costly to protect our intellectual property rights, and we may not be able to ensure their protection.

Our ability to operate our platform depends, in part, upon our proprietary technology. We have limited patent protection, and our current patent applications may not be successful. A third party may attempt to reverse engineer or otherwise obtain and use our proprietary technology without our consent. Our failure to secure, protect and enforce our intellectual property rights could adversely affect our brand and adversely impact our business.

Our proprietary technology, including our AI models, may actually or may be alleged to infringe upon third-party intellectual property rights, and we may face intellectual property challenges from such other parties. We may not be successful in defending against any such challenges or in obtaining licenses to avoid or resolve any intellectual property disputes. Defending such claims could also be costly, time-consuming and divert management attention.

Moreover, it has become common in recent years for individuals and groups to purchase intellectual property assets for the sole purpose of making claims of infringement and attempting to extract settlements from companies such as ours. Even where we believe such claims are without merit, defending against them may be expensive and time-consuming. In addition, contractual protections or insurance may be insufficient or unavailable to cover all such costs or liabilities.

We incorporate open source software into processes supporting our business. The terms of various open source licenses have not been definitively interpreted by U.S. courts, and there is a risk that such licenses could be construed in a manner that limits our use of the software, inhibits certain aspects of our systems or otherwise adversely affects our business operations. Certain open source licenses may require that modifications or derivative works be made available under the same license terms. Third parties may seek to enforce the terms of applicable open source licenses, including by demanding the release or licensing of modifications or derivative works.

Table of Conte nts

In addition, open source software is generally provided without warranties or assurances regarding its origin, functionality or performance. As a result, open source software may contain vulnerabilities, defects or other issues that could adversely affect our systems.

Despite policies governing their use, employee or contractor errors, misuse or unauthorized use of generative AI technologies could result in security incidents and could otherwise introduce security, legal, compliance, or operational risks. Even authorized use of generative AI technologies may generate content, including software code, that is inaccurate, misleading or contains security vulnerabilities. In particular, generative AI tools may produce outputs that appear accurate but are factually incorrect or incomplete, which could result in incorrect information being relied upon by employees or contractors. Use of such technology by employees, contractors or others could result in reputational harm, competitive harm or legal liability. In addition, generative AI technologies may introduce cybersecurity risks if vulnerabilities are incorporated into our systems or products. We also use, or may in the future use, agentic AI tools to support servicing or other customer-facing functions, such as customer support, which may increase the risk of errors, inconsistent outputs or failure to adhere to our policies, regulatory obligations or customer expectations.

Many aspects of the legal framework governing intellectual property rights, licensing, and liability related to generative AI remains unsettled, and our use of such generative AI technologies may expose us to claims of copyright infringement, other intellectual property claims, or reputational harm. While we have taken, and continue to take, steps designed to mitigate risks associated with the use of generative AI in our business, including through policies and controls governing the use of generative AI technologies, our use of AI may present ethical, reputational, legal, competitive, and regulatory risks that could adversely affect our business, financial condition, results of operations, and future prospects.

RISKS RELATED TO OUR DEPENDENCE ON THIRD PARTIES

Our proprietary AI models rely in part on the use of loan applicant and borrower data and other third-party data, and if we lose the ability to use such data, or if such data contain inaccuracies, our business could be adversely affected.

We rely on our proprietary AI models, which are statistical models built using a variety of data sets. Our AI models rely on data collected from applicants and borrowers, data obtained from credit bureaus and other third parties, and our historical credit performance data. If the data used by our AI models are inaccurate, incomplete, outdated, biased or otherwise unreliable, or if our access to such data is limited or interrupted, our models may not perform as expected. Evolving regulatory obligations, including “open banking” requirements and obligations associated with data-sharing frameworks, may limit our ability to access, use or control such data or increase the cost of obtaining it. If our access to applicant, borrower or third-party data is restricted, becomes more costly or is otherwise unavailable, our ability to accurately evaluate borrowers, detect fraud and verify applicant information could be compromised, which could negatively affect pricing accuracy, automation levels and loan volume.

Data obtained from third-party sources or provided by applicants may be inaccurate, incomplete, outdated or misleading, including due to reporting errors, staleness or applicant misrepresentation. In particular, data from credit bureaus or other consumer reporting agencies may not accurately reflect an applicant’s or borrower’s actual credit history due to reporting errors, staleness, incompleteness or other inaccuracies. In addition, limitations on data access or data quality could impair our ability to train, validate and improve our AI models over time, and could require us to modify our models or data-usage arrangements, or to require us to share proprietary data, which could reduce our competitive advantage.

Table of Conte nts

We rely on strategic relationships with loan aggregators to attract applicants to our marketplace, and if we cannot maintain effective relationships with loan aggregators or successfully replace their services, our business could be adversely affected.

A significant number of consumers that apply for a loan on our platform learn about and access our platform through the websites of loan aggregators, typically with hyperlinks from such loan aggregators’ websites to landing pages on our website. Loan aggregators are not required to display offers from our lending partners and may work with our competitors. If traffic from loan aggregators decreases in the future for any reason or if loan aggregators implement policies that adversely impact our business, our loan originations and results of operations could be adversely affected. There is no assurance that loan aggregators will continue to partner with us on commercially reasonable terms or at all, and our competitors may be effective in providing incentives to loan aggregators to favor their products or services.

For example, loan aggregators may be required to obtain and maintain licenses or comply with additional regulatory requirements in certain jurisdictions, which could subject them to increased supervision and more stringent business obligations. Borrowers or regulators could also assert claims based on the content presented on a loan aggregator’s website, which could result in litigation, regulatory scrutiny or reputational harm.

Our success depends in part on our relationships with third-party vendors that provide services critical to the operation of our platform. For example, we rely on national consumer reporting agencies for a significant portion of the data used in our AI models, as well as third-party verification technologies and services that are critical to maintaining a high level of automation on our platform. We also rely on third-party payment processors or banks to access payment networks and process loan payments.

We also rely on other software and services supplied by vendors, and our business may be adversely affected if such services do not meet our expectations or experience disruptions or outages.

If our third-party vendors fail to comply with applicable laws, regulations or contractual obligations, including with respect to privacy, data protection or security, we could experience service disruptions, regulatory enforcement actions, consumer demands or litigation, and suffer economic or reputational harm. Regulators have increasingly emphasized that supervised financial institutions may be held responsible for the actions of their third-party service providers. If we or our vendors fail to meet these expectations, we or our lending partners could be subject to supervisory actions, enforcement

Table of Conte nts

proceedings or remedial requirements, which could adversely affect our business, financial condition and results of operations.

We are subject to counterparty risk with respect to the capped call transactions.

Our exposure to the credit risk of the counterparties will not be secured by any collateral. Adverse global economic conditions could affect the financial condition of these counterparties. In addition, if a counterparty fails to perform or its obligations under a capped call transaction are terminated, we may suffer adverse consequences and may experience greater dilution of our common stock than we otherwise would have expected.

RISKS RELATED TO REGULATION AND LITIGATION

Litigation, regulatory actions and compliance issues could subject us to significant fines, penalties, judgments, remediation costs and other adverse consequences.

In the ordinary course of business, we have been named as a defendant in various legal actions, including securities class action lawsuits and other litigation. These matters may arise from claims relating to consumer protection, lending, servicing, collections, credit reporting, marketing or other aspects of our business.

Certain matters may involve claims for substantial or indeterminate damages, including statutory damages, penalties assessed on a per-violation basis, or class-wide relief, which could exceed amounts we earned from the underlying activities and may not be fully covered by insurance. Our involvement in any such matters could also cause significant harm to our or our lending partners’ reputations, even if the matters are ultimately resolved in our favor.

Any such actions involving us could require significant operational changes, remediation payments or restrictions on our business. In addition, if our arbitration provisions were found to be unenforceable or otherwise limited, our exposure to class action litigation and related costs could increase. From time to time, we may also identify compliance issues that require operational changes or remediation to impacted borrowers, which could result in additional costs, litigation or regulatory scrutiny.

Table of Conte nts

Our business is subject to a wide range of laws and regulations, many of which are evolving, and failure or perceived failure to comply with such laws and regulations could harm our business, financial condition and results of operations.

We are subject to numerous federal, state and local laws and regulations aimed at consumer protection in the financial services industry. These laws and regulations are complex, evolving and subject to varying interpretations, including with respect to the application of AI and machine learning technologies and the bank partnership model. The application of these laws and regulations may change over time as new products are introduced, regulatory priorities evolve, or judicial or administrative interpretations develop.

New laws, regulations and regulatory interpretations continue to be adopted and may subject us to increased scrutiny, compliance obligations or operational constraints. As we expand into new markets, introduce new financial products and services and continue to evolve our AI models, additional regulatory requirements may apply. In some cases, we may be required to obtain or maintain licenses or approvals, and regulators could deny applications, delay approvals, impose conditions, levy fines or penalties, or otherwise restrict our ability to operate our marketplace.

We may also be subject to heightened regulatory supervision or enforcement at the federal or state level, including by the CFPB, state attorneys general or other regulatory agencies. Federal and state regulators have increased scrutiny of fees and practices that may be viewed as unfair, deceptive or abusive, and fees charged in connection with loans facilitated through our marketplace could be subject to challenge or refund.

State regulators have also increased scrutiny of financial technology companies and bank partnership arrangements, including through licensing requirements, enforcement actions or the adoption of laws regulating such relationships. Our business and the activities we facilitate for our lending partners are subject to extensive federal and state laws governing consumer lending, loan servicing and collections, credit reporting, fair lending, privacy and data protection, debt collection, electronic payments, marketing and communications, and related financial services activities.

Furthermore, the regulatory framework governing the development and use of AI and machine learning technology is evolving and remains uncertain. Federal and state regulators have increased scrutiny of AI-driven decision-making, including in consumer lending, and have proposed or adopted laws, regulations and guidance addressing AI governance, transparency and discrimination risks. Regulators may require us to demonstrate robust governance, testing, validation, monitoring, documentation and explainability for our AI models and related decisioning processes. In some cases, regulators may seek explanations for specific model outputs or outcomes, which may be difficult, costly or impractical given the complexity of our models. Certain state laws regulating “high-risk” AI systems may impose additional compliance, governance, disclosure and risk management obligations.

Our use of AI and automated decision-making may also expose us to increased risk of regulatory enforcement actions and other proceedings, supervisory findings or private litigation, including claims alleging discriminatory or disparate impact, unfair or deceptive practices or improper reliance on automated decision making. Such actions or claims, regardless of merit, could result in significant legal costs, remediation requirements, civil penalties, other liabilities, reputational harm or restrictions on our business.

While compliance is a business priority, it is costly, time-consuming and may limit our operational flexibility. Changes in law, regulation or regulatory interpretation could restrict interest rates, fees or loan structures, require additional licensing or compliance obligations, or otherwise limit the availability of loans facilitated through our marketplace. For additional

Table of Conte nts

discussion of risks related to regulation of our bank partnership model and true lender considerations, see the risk factor titled “—If loans originated by our lending partners were found to violate state law, loans facilitated through our marketplace may be unenforceable or otherwise impaired, we or our lending partners, institutional investors or warehouse lenders may face fines and penalties, and our commercial relationships may suffer, each of which would adversely affect our business and results of operations” for more information.

We have been in the past and may in the future be subject to federal and state regulatory inquiries, investigations or enforcement actions, which could adversely affect our business.

We have received, and may continue to receive, inquiries, examinations or investigations from federal, state or local regulatory authorities regarding our business, including our marketplace activities, marketing practices, underwriting and pricing, fair lending compliance, licensing and registration requirements. Responding to such matters can be time-consuming and costly, may divert management attention and resources, and could result in supervisory findings, enforcement actions, fines, penalties, remedial requirements and/or restrictions on our operations.

Regulatory inquiries or investigations, whether or not they result in formal enforcement action or are ultimately resolved in our favor, may be made public and could harm our reputation, increase scrutiny from other regulators or market participants, and negatively affect borrower, lending partner or investor confidence. The initiation or perception of regulatory investigations could also adversely affect the market price of our common stock. Any adverse outcomes arising from regulatory matters could materially affect our business, financial condition, results of operations and cash flows.

The CFPB and other consumer protection regulators have broad authority over our business, and increased supervision or enforcement could adversely affect our business.

The Consumer Financial Protection Bureau (“CFPB”) has broad authority to regulate and enforce compliance with federal consumer financial protection laws, including the prohibition on unfair, deceptive or abusive acts or practices (“UDAAP”), and laws governing lending, servicing, collections, credit reporting and related activities. The CFPB also has supervisory authority over certain banks, thrifts and credit unions and certain participants in the consumer financial services market and larger participants in other areas of financial services, including some of our lending partners and our home lending business, and has authority to supervise or investigate other non-bank entities it determines may pose risks to consumers.

Consumer complaints, supervisory findings or enforcement actions, whether involving us, our lending partners, or other market participants, could increase regulatory scrutiny of our business. If the CFPB were to subject us or our subsidiaries to supervision or initiate enforcement proceedings, it could require operational changes, remediation to borrowers, civil monetary penalties, restrictions on our activities or other remedial actions.

We cannot predict how the CFPB or other regulators will exercise their authority in the future or how changes in regulatory priorities or interpretations may affect our business. The CFPB and other regulators have increased scrutiny of the use of alternative data, machine learning and AI-based decision-making in consumer lending, including with respect to fair lending compliance. If regulators determine that aspects of our AI models, disclosures, servicing or collections practices do not comply with applicable laws, we could be required to modify or discontinue products or practices, incur additional compliance costs or face enforcement actions.

Although we have committed resources to enhancing our compliance programs, regulatory actions involving us, our lending partners, or other market participants could result in reputational harm, loss of lending partners, borrowers or institutional investors, or reduced demand for loans facilitated through our marketplace. Any of the foregoing could adversely affect our business, financial condition and results of operations.

Table of Conte nts

If loans originated by our lending partners were found to violate state law, loans facilitated through our marketplace may be unenforceable or otherwise impaired, we or our lending partners, institutional investors or warehouse lenders may face fines and penalties, and our commercial relationships may suffer, each of which would adversely affect our business and results of operations.

When establishing the interest rates and fee structures charged to borrowers on loans originated through our marketplace, our lending partners rely on federal law preemption of state law to export the interest rate requirements of their home states. We, our securitization vehicles, our institutional investors, and warehouse credit facilities similarly rely on the ability to enforce the agreed-upon loan terms following the sale or assignment of such loans. States have enacted, and may continue to enact, laws or take regulatory or enforcement actions that seek to limit interest rate exportation, challenge federal preemption, impose additional licensing requirements or otherwise restrict bank-partnership lending models.

Certain courts, regulators and private plaintiffs have challenged, and may continue to challenge, the enforceability of bank-originated loans following their sale or assignment to non-bank entities.

In addition, states have enacted, and may continue to enact, “true lender” or similar laws or apply regulatory or judicial tests to determine whether a non-bank platform is deemed to be the lender for purposes of state consumer lending laws.

Loans originated through Upstart’s marketplace are originated in reliance on our lending partners being the “true lenders” for such loans. Their status as the originating lender determines various loan program details, including the interest rates and fees permissible at origination, since the loan terms and lending practices are set by duly chartered banks or credit unions. Because the loans facilitated by our marketplace are originated by our lending partners, many state consumer financial regulatory requirements, including state usury restrictions, licensing requirements and certain requirements under state consumer credit laws, are inapplicable to the loans, based on principles of federal preemption.

While we have taken steps to structure our programs in compliance with applicable laws and guidance, there can be no assurance that future regulatory, legislative or judicial developments will not adversely affect the enforceability or transferability of Upstart-powered loans, or the willingness of lending partners or investors to participate in our marketplace.

We receive, transmit, store and otherwise process large volumes of personal information and other sensitive data from applicants and borrowers. In some cases, this information may include sensitive or biometric data as defined by applicable state law. We share personal information with lending partners and, in more limited circumstances, with institutional investors, subject to contractual, legal and regulatory requirements.

We and our lending partners are subject to a growing body of federal and state privacy and data protection laws and regulations governing the collection, use, disclosure, storage, safeguarding and other processing of personal information. These laws and regulations are evolving and subject to differing interpretations, and impose obligations relating to disclosure, consent, data security, data use, data retention, automated decision making and other aspects of data processing. For example, we are subject to privacy and data protection requirements under laws such as the Gramm-Leach-Bliley Act, which are enforced by regulators including the CFPB and the FTC, and violations may be treated as unfair or deceptive acts or practices.

Table of Conte nts

Regulators have increased scrutiny of data security practices, third-party data sharing and user interface or design practices that may be viewed as unfair, deceptive or manipulative. In addition, state privacy laws, including those adopted in California and other jurisdictions, as well as biometric privacy laws such as the Illinois Biometric Information Privacy Act, impose additional compliance obligations and have been the basis for increased regulatory enforcement and private litigation.

Our efforts to comply with current and future privacy and data protection laws and regulations could result in increased compliance, technical or operating costs and may require us to modify our data infrastructure, data processing practices or business operations.

If we are deemed to be an investment company, investment adviser or broker-dealer, or if our securities-related activities fail to comply with applicable laws, our business could be materially adversely affected.

We believe that neither we nor our subsidiaries are required to register as an investment company under the Investment Company Act of 1940, as amended, because we are primarily engaged in operating an AI-based lending marketplace and providing technology and related services to lending partners. However, the SEC or its staff could disagree with our analysis, including with respect to whether loans or interests in loans held on our balance sheet constitute “investment securities.”

If we were deemed to be an investment company, we could be required to institute burdensome compliance requirements and be subject to restrictions on our activities, transactions with affiliates, borrowings and capital structure, as well as additional reporting and governance obligations, any of which could materially adversely affect our business.

We also believe that neither we nor our subsidiaries are required to register as an investment adviser under the Investment Advisers Act of 1940, as amended, or as a broker-dealer under the Securities Exchange Act of 1934, as amended, based on the nature of our activities and applicable guidance. However, regulatory interpretations or guidance could change, or regulators could disagree with our positions. If we or any of our subsidiaries were required to register or notice-file as an investment adviser or broker-dealer, or otherwise become subject to such regulatory regimes, we could be required to make significant changes to our business operations, compensation structures, marketing practices or financing activities.

Certain transactions involving institutional investors or loan financing arrangements may rely on exemptions from registration under the Securities Act of 1933, as amended, including Regulation D or Section 4(a)(2). If such transactions were found not to qualify for an exemption or otherwise violate securities laws, we could be subject to rescission claims, enforcement actions, civil penalties or restrictions on future financing activities, including potential “bad actor” disqualification.

Anti-money laundering, sanctions and anti-corruption laws could adversely affect our business.

We are subject to anti-money laundering, counter-terrorism financing, economic sanctions and anti-corruption laws and regulations, including the Bank Secrecy Act, the USA PATRIOT Act, sanctions administered by the Office of Foreign Assets Control and the Foreign Corrupt Practices Act, either directly or through our lending partners who are subject to such laws. These laws impose obligations related to borrower due diligence, transaction monitoring, recordkeeping, reporting and restrictions on dealings with sanctioned persons or jurisdictions.

Despite our compliance efforts, we cannot provide assurance that our policies, procedures and controls will be effective to prevent violations of these laws by us, our employees, agents, vendors, lending partners or other third parties. Violations or perceived violations of these laws could result in significant fines, penalties, remediation costs,

Table of Conte nts

contractual liability, restrictions on our activities and reputational harm, any of which could adversely affect our business, financial condition and results of operations.

RISKS RELATED TO INDEBTEDNESS

We rely on borrowings under our warehouse credit facilities and risk retention financing facilities to fund certain aspects of our operations, and any inability to meet our obligations as they come due or to comply with various covenants or representations contained in our warehouse credit facilities could harm our business.

We rely on borrowings under warehouse credit facilities and risk retention financing facilities to fund certain aspects of our operations, including financing loans and retained interests. These facilities are collateral-based and are secured by loans or securitization-related assets held by special purpose entities. Our ability to access and maintain these facilities depends on the performance and value of the underlying collateral, compliance with applicable covenants and representations, and the continued willingness of lenders to provide financing.

Our warehouse credit facilities and risk retention financing facilities contain operating and financial covenants and other requirements, and under certain circumstances lenders may reduce availability, require repayment of outstanding borrowings, impose additional conditions or terminate their commitments. If we fail to comply with these requirements or experience an event of default, we could be required to repay borrowings, post additional collateral, liquidate assets at unfavorable prices or seek alternative financing, which may be more costly or unavailable.

Any reduction, suspension or termination of these financing arrangements could limit our ability to purchase or hold loans, reduce loan origination volumes, increase our funding costs or require greater reliance on our balance sheet.

Corporate and asset-backed debt ratings could adversely affect our ability to support loan funding for our marketplace at attractive rates, which could negatively affect our results of operations, financial condition and liquidity.

Our unsecured senior corporate debt may be unrated or rated by a limited number of credit rating agencies. Ratings assigned to us or to asset-backed securities backed by Upstart-powered loans reflect rating agencies’ opinions regarding the credit performance of the underlying receivables, the ability of cash flows to service interest and repay principal, and the performance of us and other service providers under the applicable transaction documents.

The absence of a corporate debt rating, limited ratings coverage, or adverse rating actions with respect to our asset-backed securities could adversely affect our liquidity, financial condition and results of operations.

As a result, we may need to raise additional capital through equity, equity-linked or debt financings.

Table of Conte nts

If we raise additional funds by issuing equity or equity-linked securities, our stockholders may experience dilution. Debt financing, if available, may involve protective provisions or covenants that restrict our operations or financial flexibility, and any financing we obtain may contain terms that are not favorable to us or our stockholders.

We have issued the Notes and may issue additional equity-linked or debt securities in the future. Holders of the Notes may have the right to require us to repurchase their Notes upon the occurrence of certain events, and upon conversion we may be required to make cash payments unless we elect to settle conversions solely in shares of our common stock. We may not have sufficient cash or be able to obtain financing at the times required to meet these obligations, and our ability to do so may be limited by law, regulatory authority or agreements governing our indebtedness. Any failure to meet these obligations could result in defaults or cross-defaults that adversely affect our liquidity, financial condition and results of operations.

If a fundamental change (as defined in the applicable Indenture governing the Notes) occurs prior to the maturity date for a series of Notes, holders of the applicable series of Notes will have the right, at their option, to require us to repurchase all or a portion of such Notes.

Furthermore, the Indentures restrict our ability to engage in certain mergers, consolidations or similar transactions unless, among other things, the surviving entity assumes our obligations under the Notes.

RISKS RELATED TO TAXES

Our ability to use our deferred tax assets to offset future taxable income may be subject to certain limitations, which may have a material impact on our result of operations.

As of December 31, 2025, we have recorded a valuation allowance to recognize only deferred tax assets that are more likely than not to be realized in the United States federal, state and local tax jurisdictions.

We may also be limited in the portion of net operating losses (“NOLs”) that we can use to offset taxable income for U.S. federal and state income tax purposes. The Tax Cuts and Jobs Act made significant changes to the utilization of NOLs. In addition, under Section 382 of the Internal Revenue Code, an ownership change may limit our ability to utilize NOLs. Limitations may also apply under state and local law.

We continue to assess the realizability of our deferred tax assets, and future adjustments to our valuation allowance may be required, which could materially affect our results of operations.

Table of Conte nts

Changes in tax laws could have a material adverse effect on our business, financial condition and results of operations.

We are subject to federal, state and local taxes in the jurisdictions in which we operate, and applicable tax laws and rates vary and are subject to interpretation and change.

Further, the ultimate amount of tax payable in a given financial statement period may be impacted by changes in tax laws, interpretations, accounting rules or the geographic mix of our earnings, which could cause our tax obligations to differ materially from amounts recorded in our financial statements. As a result, our tax provision involves significant judgment and uncertainty, and fluctuations in our ultimate tax liabilities could materially affect our results of operations.

The application of indirect taxes, such as sales and use tax, value-added tax, digital services tax, gross receipts tax, and other similar taxes to platform and financial technology businesses is complex and evolving. In many cases, the ultimate tax determination is uncertain because it is not clear how new and existing statutes might apply to our business.

We have faced, and may face in the future, indirect tax audits in various U.S. jurisdictions.

Table of Conte nts

RISKS RELATED TO OWNERSHIP OF OUR COMMON STOCK

The trading price of our common stock may be volatile, and you could lose all or part of your investment.

Factors that could affect the trading price of our common stock include general market and economic conditions, volatility in the trading prices of financial technology and technology companies, changes in interest or inflation rates, a reduction in the availability of loan funding and liquidity from lending partners and institutional investors, quarterly fluctuations in demand for the loans we facilitate through our marketplace, changes in our operating performance or results of operations, sales or issuances of shares of our common stock, whether in connection with an acquisition or upon conversion of some or all of the outstanding Notes, analyst coverage or reports, announcements by us or our competitors, litigation or regulatory actions, data security incidents, changes in laws or accounting standards, developments relating to our intellectual property, market perception of our AI models, changes in the competitive landscape, and other events or factors beyond our control.

We cannot guarantee that our share repurchase program will be fully consummated or that it will enhance long-term shareholder value. Share repurchases could also affect the trading price of our stock, increase volatility of our stock and diminish our cash reserves.

Although our Board of Directors has authorized a share repurchase program that does not have an expiration date, the program does not obligate us to repurchase any specific dollar amount or to acquire any specific number of shares of our common stock. We cannot guarantee that the program will be fully consummated or that it will enhance long-term stockholder value. The program could affect the trading price of our stock, increase volatility and diminish our cash reserves. Our Board of Directors will review the program periodically and may authorize adjustments of its terms if appropriate. Any announcement of a suspension or termination of this program may result in a decrease in the trading price of our stock.

The capped call transactions entered into in connection with the issuance of certain of the Notes may affect the market price of our common stock.

These capped call transactions are expected generally to reduce the potential dilution to our common stock upon any conversion of the applicable Notes and/or offset any cash payments we may be required to make in excess of the principal amount of such converted Notes, as the case may be, with such reduction and/or offset subject to a cap.

This activity could also cause or prevent an increase or a decrease in the market price of our common stock.

Table of Conte nts

Certain insiders have significant voting power, which could limit your ability to influence the outcome of key transactions, including a change of control.

As a result, these stockholders, if acting together, are able to influence matters requiring approval by our stockholders, including the election of directors and the approval of mergers, acquisitions, or other extraordinary transactions. They may also have interests that differ from yours and may vote in a way with which you disagree and which may be adverse to your interests. This concentration of ownership may have the effect of delaying, preventing or deterring a change of control, could deprive our stockholders of an opportunity to receive a premium for their common stock as part of a sale, and might ultimately affect the trading price of our common stock.

Subject to applicable vesting conditions and compliance with our insider trading policies, shares issued upon the settlement of equity awards or other equity issuances may be available for resale in the open market. In addition, shares may be sold into the market in connection with “sell-to-cover” transactions to satisfy tax withholding obligations upon the vesting of equity awards, which could increase selling pressure on our common stock.

We may from time to time register shares for resale or issue shares in connection with financings or other transactions. We have an effective shelf registration statement on Form S-3ASR that permits us to offer and sell shares of our common stock, including through an “at-the-market” offering program. Sales of our shares could make it more difficult for us to sell equity securities in the future at times and prices that we deem appropriate, could cause the trading price of our common stock to decline, and could make it more difficult for stockholders to sell their shares.

We may issue additional shares of our common stock in the future in connection with financings, acquisitions, investments, our equity incentive plans or otherwise. We expect to continue granting equity awards to employees, directors and consultants under our equity incentive plans, and we may also raise capital through equity financings in the future.

Transactions relating to the Notes may dilute the ownership interest of stockholders, or may otherwise depress the price of our common stock.

If the Notes are converted by holders, we are required under the applicable Indentures to pay or deliver, as the case may be, cash, shares of our common stock, or a combination of cash and shares of common stock, at our election. If we elect to deliver shares of common stock upon conversion of the Notes, it would dilute the ownership interests of existing stockholders. Any sales in the public market of the common stock issuable upon such conversion could adversely affect prevailing market prices of our common stock. In addition, certain holders of the Notes may engage in short selling to hedge their position in the Notes. Anticipated future issuances of shares of our common stock upon conversion of the Notes could depress the price of our common stock.

Table of Conte nts

Delaware law and provisions in our amended and restated certificate of incorporation and amended and restated bylaws could make a merger, tender offer, or proxy contest difficult, thereby depressing the market price of our common stock.

Our status as a Delaware corporation and the anti-takeover provisions of the Delaware General Corporation Law may discourage, delay, or prevent a change in control by prohibiting us from engaging in a business combination with an interested stockholder for a period of three years after the person becomes an interested stockholder unless certain conditions are met, even if a change of control would be beneficial to our existing stockholders. In addition, our amended and restated certificate of incorporation and amended and restated bylaws contain provisions that may make the acquisition of our company more difficult, including the following:

•our Board of Directors is classified into three classes with staggered three-year terms and directors may only be removed for cause;

•vacancies and newly-created seats on our Board of Directors will be able to be filled only by our Board of Directors and not by stockholders;

•only the Chair of our Board of Directors, our Chief Executive Officer, our president, or a majority of our entire Board of Directors are authorized to call a special meeting of stockholders;

•certain litigation against us or our directors, stockholders, officers or employees can only be brought in Delaware;

•advance notice procedures apply for stockholders to nominate candidates for election as directors or to bring matters before an annual meeting of stockholders; and

•any amendment of the above anti-takeover provisions in our amended and restated certificate of incorporation or amended and restated bylaws will require the approval of at least 66 2/3% of the combined voting power of our then-outstanding shares of our capital stock.

These provisions could also discourage proxy contests and make it more difficult for stockholders to elect directors of their choosing and to cause us to take other corporate actions they desire, any of which, under certain circumstances, could limit the opportunity for our stockholders to receive a premium for their shares of our capital stock, and could also affect the price that some investors are willing to pay for our common stock.

Our amended and restated bylaws provide that, unless we consent in writing to the selection of an alternative forum, to the fullest extent permitted by law, the sole and exclusive forum for (i) any derivative action or proceeding brought on our behalf, (ii) any action asserting a claim of breach of a fiduciary duty owed by any of our directors, stockholders, officers, or other employees to us or our stockholders, (iii) any action arising pursuant to any provision of the Delaware General Corporation Law, our amended and restated certificate of incorporation, or our amended and restated bylaws, or (iv) any other action asserting a claim that is governed by the internal affairs doctrine shall be the Court of Chancery of the State of Delaware (or, if the Court of Chancery does not have jurisdiction, another state court in Delaware or the federal district court for the District of Delaware), in all cases subject to the court having jurisdiction over the claims at issue and the indispensable parties; provided that the exclusive forum provision will not apply to suits brought to enforce any liability or duty created by the Exchange Act.

Table of Conte nts

Section 22 of the Securities Act creates concurrent jurisdiction for federal and state courts over all such Securities Act actions. Accordingly, both state and federal courts have jurisdiction to entertain such claims. To prevent having to litigate claims in multiple jurisdictions and the threat of inconsistent or contrary rulings by different courts, among other considerations, our amended and restated bylaws also provide that, unless we consent in writing to the selection of an alternative forum, the federal district courts of the United are the sole and exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act.

Any person or entity purchasing, holding or otherwise acquiring any interest in any of our securities shall be deemed to have notice of and consented to this provision. This exclusive-forum provision may limit a stockholder’s ability to bring a claim in a judicial forum of its choosing for disputes with us or our directors, officers, or other employees, which may discourage lawsuits against us and our directors, officers, and other employees. This exclusive forum provision does not apply to any causes of action arising under the Exchange Act or any other claim for which the federal or other courts have exclusive jurisdiction. If a court were to find either of the exclusive-forum provisions in our amended and restated bylaws to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving the dispute in other jurisdictions, which could harm our results of operations.

The trading market for our common stock will depend in part on the research and reports that equity or industry analysts publish about us or our business. The analysts’ estimates are based upon their own opinions and are often different from our estimates or expectations. If one or more of the analysts who cover us downgrade our common stock or publish inaccurate or unfavorable research about our business, the price of our securities would likely decline. If few securities analysts commence coverage of us, or if one or more of these analysts cease coverage of us or fail to publish reports on us regularly, demand for our securities could decrease, which could cause the price and trading volume of our common stock to decline.

We do not intend to pay dividends for the foreseeable future.

We have never declared nor paid cash dividends on our capital stock. We currently intend to retain any future earnings to finance the operation and expansion of our business, as well as to fund our share repurchase program, and we do not expect to declare or pay any dividends in the foreseeable future. In addition, the terms of our corporate debt agreements may preclude us from paying dividends. As a result, capital appreciation of our common stock, if any, will be the only way for stockholders to realize any future gains on their investment for the foreseeable future.

Table of Conte nts

ITEM 1B. UNRESOLVED STAFF COMMENTS

Not applicable.

ITEM 1C. CYBERSECURITY

Risk Management and Strategy

We have established policies and processes for identifying, assessing, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

We conduct annual and event-driven risk assessments to identify cybersecurity threats or material business changes that may affect systems exposed to such threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

Following these risk assessments, we implement, test, and continuously improve reasonable safeguards to mitigate identified risks; address control gaps; and measure safeguard effectiveness through ongoing monitoring, metrics, and validation. We devote resources and designate high-level personnel, including our Chief Information Security Officer who reports to our Chief Risk Officer, to manage the risk assessment and mitigation process. Our Chief Information Security Officer works closely with a team of cybersecurity professionals with extensive experience and expertise in cybersecurity control development, threat assessments, detection & incident response and mitigation.

There are other policies related to cybersecurity involving employees' use of company equipment and resources, generative AI, remote work and workplace security and safety. These policies are reviewed periodically and approved by appropriate members of management.

We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. These services include product penetration testing, third party partner due diligence audits, security controls assessment, incident response preparedness, and vendor security review. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, in connection with the services they provide to us, and to promptly report any suspected breach of its security measures that may affect us.

For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please see Item 1.A. “Risk Factors” of this Annual Report on Form 10-K, including the risk factors titled “—Security breaches, improper access to our borrowers’ data, or other security incidents may harm our reputation, adversely affect our results of operations and expose us to liability”.

Table of Conte nts

Governance

One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for oversight of our risk management framework, which is designed to monitor and manage strategic and operational risks. Management is responsible for the day-to-day identification, assessment and management of risks in our operations, including cybersecurity risks. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

Our Chief Information Security Officer began her career as a network engineer and has held security engineering roles at large technology organizations.

Our Chief Information Security Officer oversees our cybersecurity policies and processes, including those described in “Risk Management and Strategy” above. The processes by which our Chief Information Security Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: tabletop exercises, vulnerability management programs, internal & external security risk assessments, threat modeling processes of new services, third party security risk functions, incident response processes, phishing awareness programs, and additional control validation services.

Our Chief Risk Officer reports to our CEO, and our Chief Risk Officer and/or Chief Information Security Officer provide quarterly briefings to the audit committee regarding our company’s cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing and activities of third parties. Our audit committee provides updates to the Board of Directors on such reports. We also have an established incident response plan led by our Chief Information Security Officer that lays out the process for the assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, our process, including those set forth in the incident response plan, provides for escalation and notification to management, the audit committee and the Board of Directors and/or external parties, as appropriate.

Recently Filed

Click on a ticker to see risk factors

Ticker *	File Date
HRZN	3 days, 2 hours ago
HY	3 days, 2 hours ago
ARCT	3 days, 2 hours ago
QSI	3 days, 2 hours ago
FTEK	3 days, 2 hours ago
ACEL	3 days, 2 hours ago
RYM	3 days, 2 hours ago
ANAB	3 days, 2 hours ago
PRKS	3 days, 2 hours ago
ABVC	3 days, 2 hours ago
FTCO	3 days, 2 hours ago
CVEO	3 days, 2 hours ago
DAR	3 days, 2 hours ago
ELVN	3 days, 2 hours ago
SANA	3 days, 2 hours ago
UPLD	3 days, 2 hours ago
HNGE	3 days, 2 hours ago
JRVR	3 days, 2 hours ago
IMNM	3 days, 2 hours ago
CENX	3 days, 2 hours ago
ADSK	3 days, 2 hours ago
RIGL	3 days, 2 hours ago
CALC	3 days, 2 hours ago
STAA	3 days, 2 hours ago
EVOX	3 days, 2 hours ago
CODQL	3 days, 4 hours ago
HLIO	3 days, 4 hours ago
CFFI	3 days, 5 hours ago
SRTA	3 days, 6 hours ago
YORW	3 days, 7 hours ago
CBL	3 days, 8 hours ago
INGM	3 days, 9 hours ago
AMRC	3 days, 10 hours ago
HNI	3 days, 10 hours ago
PRME	3 days, 10 hours ago
OFS	3 days, 10 hours ago
SRRK	3 days, 11 hours ago
PASG	3 days, 11 hours ago
AMLX	3 days, 11 hours ago
HYMC	3 days, 22 hours ago
ANIK	3 days, 23 hours ago
DAAQ	4 days ago
RAAQ	4 days ago
HTLD	4 days ago
NBBK	4 days, 1 hour ago
AMRN	4 days, 1 hour ago
CECO	4 days, 1 hour ago
SIVR	4 days, 1 hour ago
GLTR	4 days, 1 hour ago
PALL	4 days, 1 hour ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - UPST

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - UPST

-New additions in green-Changes in blue-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing