SoFi Technologies, Inc. (NASDAQ: SOFI)

SAMPLE DOCUMENT — ILLUSTRATIVE USE ONLY

This profile was produced entirely from public sources as a sample deliverable for the RuleboardAI marketing website. No client engagement exists between RuleboardAI and SoFi Technologies, Inc. No client documentation was reviewed. All data is sourced from public filings and regulatory records as cited below.

Not an audit, legal opinion, or attestation. Built from public sources only.

2.5 | KYC Onboarding Audit In Scope

Objective: Verify that SoFi's customer identification program (CIP) and identity theft prevention program (ITPP) meet FinCEN CDD Rule and BSA requirements across all regulated subsidiaries.

Frameworks: FinCEN CDD Rule; BSA; FINRA Rule 4370 (CIP); FATF Guidance.

Observation: FINRA fined SoFi Securities LLC $1.1 million (May 2024, AWC No. 2019062705801) for failing to establish and maintain reasonable CIP and ITPP programs for SoFi Money accounts (conduct period: December 2018 – April 2019). Approximately 800 fraudulent accounts were opened; ~$8.6M was transferred from customers of other institutions; ~$2.5M was withdrawn. The largely automated account-opening process failed to flag invalid SSNs, addresses, and high-risk emails. SoFi self-reported and remediated in April 2019. Post-remediation program quality cannot be confirmed from public sources.

Next Action: Obtain current CIP/ITPP policy documentation and evidence of post-2019 program enhancements; validate current fraud-alert SLA metrics against BSA exam standards.

2.2 | AML Transaction Monitoring In Scope

Objective: Confirm existence and adequacy of BSA/AML transaction monitoring program at SoFi Bank, N.A.

Frameworks: Bank Secrecy Act; FinCEN Regulations; FFIEC BSA/AML Examination Manual; FinCEN Investment Adviser AML Rule (effective January 1, 2028).

Observation: SoFi Bank is subject to full BSA/AML program requirements as a federally chartered national bank. The 10-K acknowledges BSA/AML obligations. No public enforcement action by FinCEN or OCC on AML program found. With $37.5B in deposits, 13.7M members, crypto operations (SoFi Crypto, SoFiUSD stablecoin launched 2025), and cross-border Tech Platform clients, AML transaction volume and complexity is material. FinCEN's new IA AML Rule (eff. Jan 1, 2028) will extend AML obligations to SoFi Wealth LLC and SoFi Capital Advisors LLC.

Next Action: Request BSA/AML program documentation, TM system vendor identity, SAR filing statistics (if disclosable), and CISO/BSA Officer assessment of crypto-related AML controls.

9.3 | Concentration Risk Assessment In Scope

Objective: Assess client and vendor concentration risk in SoFi's Technology Platform segment.

Frameworks: DORA ICT third-party (Conditional for US entity); OCC Third-Party Risk Management guidance (OCC 2013-29); internal ERM.

Observation: In FY2025, a single unnamed large Galileo client fully exited the platform, causing Technology Platform accounts to fall from 167.7 million to 128.5 million — a 23% decline. This is confirmed from public earnings disclosures. The concentration of revenue from one large client represents a material operational and revenue risk. Client identity, contractual terms, and SoFi's concentration risk management framework details are not publicly disclosed.

Next Action: Request client concentration analysis for Technology Platform; review OCC third-party risk management framework documentation; validate exit and termination plan per 9.4.

Confidence: Confirmed (public enforcement record) / Conditional (post-remediation status)

Regulatory Citation: FINRA AWC No. 2019062705801 (May 2024); BSA 31 U.S.C. §5318; FinCEN CDD Rule 31 CFR §1010.230; FinCEN IA AML Rule (eff. Jan 1, 2028)

SoFi Securities LLC was fined $1.1M by FINRA in May 2024 for failing to maintain a reasonable CIP and ITPP for SoFi Money during December 2018 – April 2019. Approximately 800 fraudulent accounts were opened; $8.6M transferred from external accounts; $2.5M withdrawn. Separately, FinCEN's new Investment Adviser AML Rule will require SoFi Wealth LLC and SoFi Capital Advisors LLC to implement AML programs by January 1, 2028.

Remediation: Obtain CIP/ITPP program documentation; conduct gap assessment against current FFIEC and FinCEN standards; initiate IA AML program design for 2028 compliance.

Owner: Chief Risk Officer; BSA/AML Officer

Deadline: IA AML Rule: January 1, 2028; CIP remediation validation: next examination cycle

Strategic Alternatives

Confidence: Confirmed

Regulatory Citation: Dodd-Frank Act §1025; CFPB Supervision and Examination Manual; 12 U.S.C. §5515

SoFi Bank and affiliates became subject to direct CFPB supervision and examination commencing January 1, 2024, triggered by total assets exceeding $10 billion for four consecutive quarters. Prior to this date, OCC examined SoFi Bank for compliance with CFPB rules. This represents a structural change in supervisory regime: the CFPB has now had direct examination authority for approximately 18 months as of this report date.

Remediation: Engage counsel to review first CFPB examination cycle findings; conduct UDAAP self-assessment across all consumer-facing products; review advertising claims compliance against FTC consent order terms.

Owner: General Counsel; Chief Compliance Officer

Deadline: Ongoing; first CFPB exam cycle already underway

Strategic Alternatives

Confidence: Confirmed

Regulatory Citation: FTC Docket No. C-4673; In re Social Finance, Inc. and SoFi Lending Corp. (2019); Federal Trade Commission Act §5

The FTC approved a final consent order against Social Finance, Inc. and SoFi Lending Corp. in February 2019 (conduct: 2018) for deceptive advertising regarding student loan refinancing savings — ads were alleged to have inflated average consumer savings, sometimes doubling the actual figure. The consent order prohibits SoFi from misrepresenting savings claims unless substantiated by competent and reliable evidence. The order remains active and will terminate on February 22, 2039 (or 20 years from any subsequent enforcement action, whichever is later).

Remediation: Confirm existence of advertising substantiation review process tied to the FTC order; document compliance reporting to FTC (required under Part III of the order).

Owner: General Counsel; Chief Marketing Officer

Deadline: Ongoing through 2039

Strategic Alternatives

Confidence: Confirmed

Regulatory Citation: SEC IA Release No. 5826 (August 19, 2021); Investment Advisers Act Section 206(2); SEC Rule 206(4)-7

The SEC charged SoFi Wealth LLC in August 2021 for breaching fiduciary duty by failing to disclose conflicts of interest when it reallocated approximately 20,000 automated portfolio accounts from third-party ETFs to two SoFi-sponsored ETFs (SFY and SFYX) in April 2019, without informing clients of the company's economic interest in those funds. SoFi Wealth also failed to assess tax consequences for clients (~$772K short-term capital gains, ~$662K long-term capital gains imposed). SoFi Wealth agreed to a cease-and-desist order, censure, and $300,000 civil penalty without admitting or denying findings.

Remediation: Confirm SEC order undertakings have been fulfilled; review current SoFi Wealth conflict-of-interest disclosure practices against Reg BI / fiduciary standard; verify no recurrence in subsequent product rollouts (e.g., SoFi Crypto, SoFiUSD).

Owner: SoFi Wealth Chief Compliance Officer; General Counsel

Deadline: Order compliance ongoing; SoFi Crypto-related conflict review: immediate

Strategic Alternatives

Confidence: Confirmed (threshold crossed); Conditional (regulatory outcome pending OCC rulemaking)

Regulatory Citation: 12 CFR Part 30 (OCC Heightened Standards); Dodd-Frank Act §165; OCC Proposed Rule (December 23, 2025 — raising threshold from $50B to $700B)

As of December 31, 2025, SoFi reported total assets of $50.7 billion, crossing the existing $50 billion OCC heightened standards threshold for national banks (12 CFR Part 30 App. D). This would normally trigger enhanced risk management, liquidity, and governance requirements. However, on December 23, 2025, the OCC proposed raising this threshold to $700 billion. If finalized as proposed, SoFi Bank would be exempt from the heightened standards. Until the rule is finalized, SoFi Bank technically operates at a threshold with regulatory uncertainty.

Remediation: Monitor OCC rulemaking; engage regulatory counsel to assess current obligations under existing $50B threshold; document readiness for either outcome.

Owner: Chief Risk Officer; General Counsel

Deadline: OCC rulemaking finalization (timeline uncertain); interim: immediate regulatory counsel review

Strategic Alternatives

Confidence: Confirmed

Regulatory Citation: OCC Third-Party Risk Management Guidance (OCC 2023-17); FFIEC IT Handbook — Outsourcing Technology Services

In FY2025, a single large, unnamed Galileo client fully transitioned off the Technology Platform, causing total Technology Platform accounts to fall from 167.7 million to 128.5 million (a 23% decline). This is a confirmed, material event from public earnings disclosures. It demonstrates single-client concentration risk in SoFi's B2B technology infrastructure business and reflects the vulnerability of the Galileo platform to large-customer churn.

Remediation: Request top-10 client concentration analysis for Galileo/Technology Platform; review vendor exit and termination plan documentation; assess revenue diversification strategy.

Owner: Technology Platform CEO / Business Unit Head; Chief Risk Officer

Deadline: Immediate

Strategic Alternatives

Confidence: Unknown

Regulatory Citation: AICPA Trust Services Criteria; FFIEC IT Handbook — Audit; OCC Third-Party Risk Management Guidance

SoFi's 10-K cybersecurity disclosure references ISO 27002:2013, NIST CSF, PCI-DSS, FFIEC, and CIS controls — but does not reference a SOC 2 Type II attestation. Galileo Financial Technologies is the foundational processing infrastructure for SoFi's B2B Technology Platform business. Institutional clients and banking customers typically require SOC 2 Type II attestations from their critical infrastructure providers. Whether SoFi/Galileo holds a current SOC 2 Type II is not confirmable from public sources.

Remediation: Obtain SOC 2 Type II report for Galileo and SoFi Bank's critical control environment; if not yet obtained, scope and commission SOC 2 examination.

Owner: CISO; Galileo Head of Compliance

Deadline: 90 days (to confirm or initiate)

Strategic Alternatives

Confidence: Confirmed (absence of disclosure)

Regulatory Citation: SEC Climate Disclosure Rules (Release No. 33-11275, phased implementation); TCFD Framework; California SB 253 / SB 261 (climate disclosure laws, may apply to companies with California revenues)

No TCFD-aligned or SEC climate disclosure was identified from public sources for SoFi Technologies. SoFi's investor relations governance documents page returned no substantive content. With $3.6 billion in revenue and California headquarters, SoFi may be subject to California's SB 253 (Scope 1/2/3 emissions disclosure) and SB 261 (climate-related financial risk disclosure). SEC climate rules are being phased in for large accelerated filers.

Remediation: Conduct ESG program readiness assessment; develop climate disclosure roadmap; assess California SB 253/261 applicability and timelines.

Owner: General Counsel; Chief Financial Officer; Board Audit Committee

Deadline: California SB 253: Scope 1/2 reporting beginning 2026 for FY2025 data (if applicable); SEC phased rules apply to large accelerated filers

Strategic Alternatives

Confidence: Confirmed (product launch); Conditional (regulatory treatment)

Regulatory Citation: SEC / CFTC jurisdiction over crypto assets (evolving); FinCEN virtual asset service provider guidance; OCC Conditional Approval No. 1277 (Jan 2022) — SoFi Bank prohibited from crypto-asset activities absent prior OCC non-objection under the Operating Agreement; OCC Interpretive Letters; Financial Innovation and Technology for the 21st Century Act (FIT21, pending); California DFPI crypto registration

SoFi launched SoFi Crypto (retail crypto trading) and SoFiUSD (a stablecoin) in December 2025. This is confirmed from FY2025 public earnings disclosures and the 10-K. Notably, the OCC's January 2022 conditional approval (CA #1277) for SoFi Bank stated that, while the Operating Agreement remains in effect, “the Resulting Bank shall not engage in any crypto-asset activities or services... unless it has received prior written determination of no supervisory objection from the OCC.” In other words, the prohibition is not absolute — the bank may conduct crypto activities if it first obtains OCC non-objection through the procedures set out in the Operating Agreement. The structure of SoFi Crypto and SoFiUSD relative to SoFi Bank N.A. vs. other corporate entities is not publicly detailed, and whether SoFi has sought or obtained the OCC's prior non-objection determination for the December 2025 crypto launches cannot be confirmed from public sources. If crypto activities are conducted within or linked to SoFi Bank without that prior OCC non-objection, this may conflict with the 2022 OCC condition.

Remediation: Map crypto product legal entity structure; confirm no SoFi Bank N.A. involvement in prohibited crypto activities per OCC condition; document OCC/FinCEN/SEC regulatory position for SoFi Crypto and SoFiUSD.

Owner: General Counsel; Chief Risk Officer; SoFi Digital Assets LLC compliance lead

Deadline: Immediate (pre-existing regulatory condition may be at risk)

Strategic Alternatives

Option A — Verification Sprint (4–6 Weeks)

Scope: Targeted LOA delivery; client provides: BSA/AML program overview, CIP/ITPP post-2019 documentation, SOC 2 status, legal entity structure for SoFi Crypto, and Galileo concentration data. RuleboardAI converts Gap Mode findings to Confirmed/Likely and closes the top escalations (E-01 through E-04). Deliverable: Updated CompanyScope profile with reduced data gaps and confirmed findings.

Ideal for: Closing the 9 data gaps identified in this profile quickly using minimum client effort.

Option B — Program Build (3–6 Months)

Scope: Full 48-workflow gap assessment with client documentation review. Builds a compliance program roadmap covering: BSA/AML program refresh (F-001, E-03), IA AML Rule readiness (2028), CFPB UDAAP self-assessment (F-002), OCC/Fed $50B threshold planning (F-005), SOC 2 readiness for Galileo (F-007), and ESG disclosure roadmap (F-008). Deliverable: Remediation roadmap with prioritized workstreams, effort/cost estimates, and regulatory exam readiness plan.

Ideal for: Building institutional GRC infrastructure ahead of CFPB exam cycle and OCC regulatory changes.

Option C — Managed Monitoring (Ongoing)

Scope: Monthly public-source monitoring of SoFi's regulatory environment: OCC rulemaking, CFPB enforcement database, FINRA BrokerCheck, SEC EDGAR, FTC enforcement, FinCEN advisories, California DFPI, crypto regulatory developments. Monthly RuleboardAI horizon scan briefings. Automatic escalation alerts for new enforcement actions or material regulatory changes affecting the SoFi RCPS profile.

Ideal for: Staying ahead of the fast-moving regulatory environment for a $50B+ fintech bank with crypto, stablecoin, and multi-regulator exposure.

SAMPLE DOCUMENT — ILLUSTRATIVE USE ONLY

This profile was produced entirely from public sources as a sample deliverable for the RuleboardAI marketing website. No client engagement exists between RuleboardAI and SoFi Technologies, Inc. No client documentation was reviewed. All data is sourced from public filings and regulatory records as cited below.

Not an audit, legal opinion, or attestation. Built from public sources only.