← All companies

SOFI · CIK 1818874

What SoFi Technologies, Inc. told the SEC could break it.

SoFi's flagged risks span its three sides — its technology platform, its bank and its lending operations. Revenue at its Galileo and Technisys technology-platform businesses is highly concentrated in a few clients, and a significant Galileo client recently moved to a competitor, while as a bank holding company SoFi Bank operates under federal capital rules where falling below thresholds triggers growth limits and, if critically undercapitalized, conservatorship within 90 days. Its lending business also leans on third parties — sub-servicers handle all of its student loans and certain home loans, and outside providers run fraud detection, cloud infrastructure and IT — so failures there could disrupt origination and servicing.

3 self-disclosed vulnerabilities, pulled from its own filings — each in the company’s words, with the source. This is the risk register almost nobody reads.

In its own words

What could break it.

Customer concentration

  • Galileo and Technisys client concentrationmedium

    Revenue at the Galileo and Technisys (Technology Platform) businesses is highly concentrated among a small number of clients, and a significant Galileo client recently moved to a competitor.

    Galileo and Technisys depend on a small number of clients, the loss or disruptions in operations of any of which could have a material adverse effect on their businesses and financial results, and negatively impact our financial results and results of operations. Galileo and Technisys revenue from clients is highly concentrated and a significant Galileo client recently moved to a competitor.

    SEC filing →As of 2026

Regulatory & policy

  • bank capital / prompt corrective action regulationmedium

    As a bank holding company, SoFi Bank is subject to federal prudential capital rules; falling below thresholds triggers asset-growth limits, capital-restoration plans and, if critically undercapitalized, conservatorship/receivership within 90 days.

    A bank that is “critically undercapitalized” (i.e., has a ratio of tangible equity to total assets that is equal to or less than 2.0%) will be subject to further restrictions, and generally will be placed in conservatorship or receivership within 90 days.

Supplier concentration

  • loan sub-servicers and third-party service providersmedium

    Relies on sub-servicers to service all student loans and certain home loans, and on third-party providers for fraud detection, cloud infrastructure, IT and telecom — failures could disrupt origination and servicing.

    We rely on sub-servicers to service all of our student loans, our home loans that we deliver to GSEs and do not sell servicing-released and certain home equity loans, and to perform certain back-up servicing functions with respect to our personal loans. In addition, we rely on third-party service providers to perform various functions relating to our loan origination and servicing business, including fraud detection, marketing, operational functions, cloud infrastructure services, information technology, telecommunications and processing remotely created checks.

    SEC filing →As of 2026

In the MyPRIA app, this is checked against the companies you actually own.

← World Watch