Sample CompanyScope Profile

SoFi Technologies, Inc. (NASDAQ: SOFI)

Report Date: September 26, 2026  ·  Gap Mode — Preliminary (public sources only)  ·  RCPS Methodology v1.2

SAMPLE DOCUMENT — ILLUSTRATIVE USE ONLY

This profile was produced entirely from public sources as a sample deliverable for the RuleboardAI marketing website. No client engagement exists between RuleboardAI and SoFi Technologies, Inc. No client documentation was reviewed. All data is sourced from public filings and regulatory records as cited below.

Not an audit, legal opinion, or attestation. Built from public sources only.

What a purchase covers. This sample shows the full report structure across every category. A CompanyScope profile ($500 one-time) covers one category you choose, in the same structure.

Table of Contents

Executive summary at a glance

Public-source, preliminary — figures summarize the detail below.

RCPS maturity

Composite maturity

Illustrative

Composite maturity

2.8 / 5.0

Defined

Illustrative target — not a promised outcome

3.9 / 5.0

What this number means

Each GRC category is scored from 1 to 5: Initial, Developing, Defined, Managed, Optimized. The composite is the average of the category scores, shown to one decimal.

The word beside it is the nearest whole level. A score of 2.8 is closest to 3, so it reads Defined.

Scores come from public sources only. A low score usually means the evidence is not visible from outside, not that a control is absent.

The target is the average of what each category could realistically reach for an institution of this size and stage. It is not a promise and not a benchmark. Full rule in the methodology.

Scored categories

  • Internal Governance
  • ESG & Non-Financial Reporting
  • Operational Risk
  • Third-Party / Supply Chain Risk
  • Cybersecurity
  • SOC 2 (Trust Services)
  • Financial Regulation
  • International Frameworks
  • Privacy & Data Protection
  • Ongoing / Scheduled
  • HR & People Risk

A full assessment scores each category 1–5. This sample publishes only its composite — the mean of its category scores — so no per-category scores are shown here. Illustrative.

Composite 2.6 of 5 — the mean of the category scores in the maturity scorecard. Illustrative target 3.8 of 5, not a promised outcome.

See the full maturity scorecard →

Workflow scoping

Every client is assessed against the same set of applicable regulatory workflows across the relevant GRC domains. Each workflow is sorted into one of three buckets, and the determination is recorded so you can see why a workflow was included or left out.

  • In scope

    Applies to this client — runs this cycle.

  • Conditional

    Applies only if a trigger is met — flagged for review.

  • Out of scope

    Not applicable to this client — documented, not ignored.

Illustrative — the actual scope is determined per client during RCPS classification.

See the workflow determination →

RCPS classification

Type 7 National Bank / BHC (primary) · Type 4 Broker-Dealer · Type 5 RIA · Type 16 Fintech Platform (secondary)

Every score and label in this profile follows the published RCPS Methodology & Scoring Standards — including what the scores mean and what they cannot conclude.

1. Executive Summary & Risk Posture

Overall Posture

SoFi Technologies, Inc. is a publicly traded (NASDAQ: SOFI), Delaware-incorporated bank holding company and financial holding company headquartered at 234 1st Street, San Francisco, CA 94105. As of December 31, 2025, SoFi reported total assets of $50.7 billion (up 40% year over year), total deposits of $37.5 billion, total net revenue of $3.6 billion (up 35%), and net income of $481.3 million. The company employs approximately 6,100 people, about 82% in the United States, across three reported segments: Lending, Financial Services, and Technology Platform. With 13.7 million members and 20.2 million products at year-end 2025, SoFi has grown from a pre-bank fintech into a nationally chartered bank holding company subject to multi-regulator oversight (OCC, Federal Reserve, CFPB, SEC, FINRA, FinCEN/BSA, FDIC, and state regulators). This profile is produced entirely from public sources; no internal documentation was reviewed (Gap Mode). Overall preliminary risk posture: Elevated, driven by rapid asset growth, multi-regulator complexity, the $50 billion asset threshold, and historical enforcement actions across multiple subsidiaries.

Top Risk

The single highest-priority build item identified from public sources is BSA/AML and KYC program adequacy at scale. SoFi Bank and its affiliates became subject to CFPB supervision and examination on January 1, 2024, and at $50.7 billion in total assets at December 31, 2025 the bank sits above the current $50 billion OCC heightened-standards threshold; a December 23, 2025 OCC proposal would raise that threshold to $700 billion, and nothing here treats the proposal as settled. Publicly, SoFi Bank's BSA/AML program is acknowledged in the 10-K but not described. Two subsidiary enforcement actions (FINRA, $1.1 million, May 2024, for 2018–2019 CIP and identity-theft-program failures; SEC, $300,000, August 2021, for undisclosed conflicts of interest) and an FTC consent order (2019, in force until 2039) are the public record of compliance program maturity lagging growth in earlier periods. Current program details cannot be confirmed from public sources; this is the most material data gap.

Regulatory Stack

Primary federal regulators: OCC (SoFi Bank, N.A., Cottonwood Heights, UT, charter no. 20862, listed active on the OCC national bank list as of August 31, 2026); Federal Reserve (bank holding company and financial holding company, BHCA §4(l)); CFPB (supervision and examination of SoFi Bank and its affiliates from January 1, 2024); FinCEN/BSA (Bank Secrecy Act obligations for SoFi Bank and affiliates); SEC (SoFi is a public reporting company, CIK 0001818874; SoFi Wealth LLC is an SEC-registered investment adviser; SoFi Securities LLC is an SEC-registered broker-dealer); FINRA (SoFi Securities LLC, CRD 151717); FDIC (deposit insurer for SoFi Bank, N.A., with secondary supervisory authority; expanded coverage up to $3 million through a reciprocal deposit program). State regulators: the 10-K states that the company and its affiliates are subject to supervision and examination by various state regulators. International: the company operates in Latin America, Canada and Switzerland largely through the Technology Platform segment, and in Hong Kong through SoFi Holdings (Hong Kong) Limited.

Fund / BDC Overlay

SoFi is not a registered investment company. SoFi Wealth LLC operates a robo-advisory service and is the group's SEC-registered investment adviser. SoFi Capital Advisors LLC, named in earlier filings, shows an inactive adviser registration in the SEC adviser registry as of September 26, 2026. Social Finance, Inc. sponsors registered ETFs advised by a third-party adviser: the SoFi Next 500 ETF (SFYX) was liquidated in February 2026, while the SoFi Select 500 ETF (SFY) and two other SoFi-branded ETFs remain registered per a June 2026 filing. SoFi Crypto launched November 2025 and SoFiUSD launched December 2025, both at SoFi Bank, N.A. Fund overlay: sponsor role only; no SoFi entity acts as adviser to a registered fund per public sources.

Key Person Risk

Anthony Noto (CEO, age 57, Director) is the key executive whose departure the 10-K risk factors identify as material (loss of key management members). CFO: Chris Lapointe. CRO: Arun Pinto (since February 2024). General Counsel: Rob Lavet. CTO: Jeremy Rishel. Board: Tom Hutton, independent Chair, separate from the CEO. Auditor: Deloitte & Touche LLP (since 2017). Key-person concentration is a Likely medium risk; succession planning details are Unresolved from public sources.

1A. Control Maturity Scorecard

Scores are Likely/Conditional inferences from public disclosures only. No internal documentation reviewed. Many scores reflect a data gap rather than a confirmed deficiency.

GRC Category

1. SOC 2 (Trust Services)

Current Maturity

3 — Defined (Likely)

Target

4

Evidence / Basis

FY2025 10-K states that SOC 2 and PCI-DSS "apply to or are maintained by certain of our solutions" and that third-party attestations and assessments are conducted periodically. Which entities and systems are covered, and the report itself, are not public.

GRC Category

2. Financial Regulation

Current Maturity

3 — Defined (Likely)

Target

5

Evidence / Basis

Multi-regulator structure confirmed (OCC, Fed, CFPB, SEC, FINRA, FinCEN). SoFi Bank "well capitalized" under all regulatory definitions at December 31, 2025 per 10-K. BSA/AML program acknowledged but not described publicly. Historical enforcement: FINRA $1.1M (May 2024, 2018–2019 CIP/ITPP conduct), SEC $300K (2021 conflicts), FTC consent order (2019–2039).

GRC Category

3. International Frameworks

Current Maturity

2 — Developing (Conditional)

Target

3

Evidence / Basis

No DORA applicability confirmed. ISO 27002:2013 referenced in 10-K Item 1C. BCP/ISO 22301 status not publicly disclosed. Technisys S.A. (Luxembourg) and operations in Latin America, Canada, Switzerland and Hong Kong may trigger non-U.S. obligations; Unresolved from public sources.

GRC Category

4. Internal Governance

Current Maturity

3 — Defined (Likely)

Target

4

Evidence / Basis

Independent Chair (Hutton); Audit (chair Meltzer), Risk (chair Hele), Compensation and Nominating committees all independent per DEF 14A 2026. Risk Committee oversees cybersecurity and the BSA/AML program; met six times in 2025. Enterprise Risk Management program referenced in 10-K. Internal audit team conducts annual IS/IT audits. Policy library details not public.

GRC Category

5. Ongoing / Scheduled

Current Maturity

3 — Defined (Conditional)

Target

4

Evidence / Basis

Regulatory change management implied by the multi-regulator environment. CISO provides quarterly cybersecurity updates to the Risk Committee (10-K Item 1C). Training completion details not public. Third-Party Security Risk Management program includes ongoing monitoring and contract review.

GRC Category

6. Privacy & Data Protection

Current Maturity

3 — Defined (Likely)

Target

4

Evidence / Basis

CCPA/CPRA obligations confirmed in 10-K. GDPR exposure conditional on offering services into the EU/UK per 10-K risk factor. Privacy policy public on sofi.com. Data retention and privacy impact assessment details not public.

GRC Category

7. Cybersecurity

Current Maturity

3 — Defined (Likely)

Target

4

Evidence / Basis

Frameworks in 10-K Item 1C: ISO 27002:2013, NIST CSF, PCI-DSS, FFIEC guidelines, CIS controls. CISO in role since June 2025 with over 25 years' experience. Annual internal audits and internal and external penetration tests confirmed. No material incidents identified per 10-K. Zero Trust maturity not publicly assessable.

GRC Category

8. HR & People Risk

Current Maturity

2 — Developing (Conditional)

Target

3

Evidence / Basis

Securities Trading and Section 16 Compliance Policy filed as Exhibit 19.1 to the 10-K. FINRA registration applies to SoFi Securities personnel. Public-company whistleblower channel under Dodd-Frank applies; internal whistleblower program details not public. Background check program details not public.

GRC Category

9. Third-Party / Supply Chain Risk

Current Maturity

3 — Defined (Likely)

Target

4

Evidence / Basis

Formal Third-Party Security Risk Management program confirmed (10-K Item 1C): risk-based onboarding due diligence, ongoing monitoring, contract review. Technology Platform is also a supplier to third parties. A large Galileo client fully transitioned off the platform in 2025, taking total accounts from 167.7 million to 128.5 million (down 23%): a confirmed public signal of concentration risk.

GRC Category

10. ESG & Non-Financial Reporting

Current Maturity

3 — Defined (Conditional)

Target

4

Evidence / Basis

FY2025 10-K states that SoFi published its third comprehensive ESG report in 2025 and communicates climate-related commitments in that report. The report's content and any TCFD alignment were not reviewed in this pass. The SEC climate disclosure rules have been stayed since April 2024 and rescission was proposed in May 2026, so no SEC climate filing obligation is treated as active. SFDR/CSRD not applicable.

GRC Category

11. Operational Risk

Current Maturity

3 — Defined (Likely)

Target

4

Evidence / Basis

Enterprise Risk Management program referenced in 10-K. Business continuity and disaster recovery details not public. Rapid balance sheet growth ($50.7B, +40%) and the $50B threshold create operational scaling risk. OCC proposed raising the heightened-standards threshold from $50B to $700B (December 23, 2025); proposed, not final.

Composite: 2.8 — Defined  →  Target 3.9 — Managed

How the composite is calculated: categories scored, 11. Sum of the scores, 31. 31 ÷ 11 = 2.82, shown as 2.8; the nearest whole level is Defined. Target: 43 ÷ 11 = 3.91, shown as 3.9; nearest level Managed. The target is illustrative, not a promised outcome.

Dominant uplift priorities: BSA/AML program documentation; SOC 2 scope confirmation; BCP/DR testing evidence; whistleblower and HR program detail; ESG report content review.

1B. Risk Appetite Conformance

External benchmarks: OCC Heightened Standards (12 CFR Part 30), CFPB Supervision and Examination Manual, FFIEC BSA/AML Examination Manual, SEC Regulation Best Interest / fiduciary standard (SoFi Wealth), NIST CSF 2.0. Verdicts are Conditional inferences from public evidence only.

Domain

BSA/AML / KYC

Inherent Risk

High

Within Tolerance?

Unresolved

Basis

FINRA $1.1M CIP/ITPP fine (May 2024, conduct December 2018–April 2019). Bank-level BSA program mandated; program quality not verifiable from public sources.

Domain

Capital Adequacy

Inherent Risk

Medium

Within Tolerance?

Within Tolerance

Basis

SoFi Bank "well capitalized" under all regulatory definitions at December 31, 2025 (10-K FY2025). $10B+ and $50B+ triggers active.

Domain

Consumer Protection / UDAAP

Inherent Risk

High

Within Tolerance?

Unresolved

Basis

CFPB supervision commenced January 1, 2024. FTC consent order (in force to 2039) on savings-claim advertising. No CFPB enforcement action found; examination outcomes are not public.

Domain

Cybersecurity / Data

Inherent Risk

Medium

Within Tolerance?

Conditional

Basis

ISO 27002 and NIST CSF referenced; no material incidents per 10-K. Zero Trust, SIEM and EDR maturity not publicly confirmable.

Domain

Fiduciary / Conflicts of Interest

Inherent Risk

Medium

Within Tolerance?

Non-Conformance (historical)

Basis

SEC $300K order (2021) against SoFi Wealth LLC for undisclosed proprietary-ETF conflicts. Undertakings ordered; current monitoring status Unresolved.

Domain

Operational Resilience

Inherent Risk

Medium

Within Tolerance?

Unresolved

Basis

BCP/DR testing not publicly disclosed. Rapid growth ($50.7B assets) increases operational complexity.

Domain

Model / Credit Risk

Inherent Risk

High

Within Tolerance?

Conditional

Basis

Loans at fair value of $36.4B at December 31, 2025 (Q4 2025 earnings release). Credit model details proprietary. 10-K cites model risk as a key risk factor.

Domain

ESG Disclosure

Inherent Risk

Low

Within Tolerance?

Conditional

Basis

Third comprehensive ESG report published in 2025 per 10-K; content not reviewed. SEC climate rules stayed and proposed for rescission; no active federal climate filing obligation.

Read-out: Three domains are Unresolved (BSA/AML, Consumer Protection, Operational Resilience) and one is a historical Non-Conformance (fiduciary/conflicts). Capital adequacy is Within Tolerance. Full conformance assessment requires client engagement and internal documentation review.

2. RCPS Classification Profile

Institution types assigned: Type 7 — National Bank / Bank Holding Company (PRIMARY) + Type 4 — Broker-Dealer (SECONDARY, SoFi Securities LLC) + Type 5 — Investment Adviser (SECONDARY, SoFi Wealth LLC / SoFi Capital Advisors LLC) + Type 16 — Fintech / Payments Platform (SECONDARY, Technology Platform segment: Galileo + Technisys)

RCPS Classification by Axis

RCPS Axis

1 — Listing Status

Code

PUB

Classification

Publicly listed

Basis / Note

NASDAQ: SOFI; CIK 0001818874; SEC reporting company (Exchange Act)

RCPS Axis

1A — Fund Overlay

Code

SPONSOR

Classification

Sponsor of registered ETFs; no adviser role

Basis / Note

Social Finance, Inc. sponsors the SoFi Select 500 ETF (SFY) and two other SoFi-branded ETFs advised by Tidal Investments LLC (485BPOS, June 26, 2026); the SoFi Next 500 ETF (SFYX) was liquidated February 2026. SoFi Wealth LLC robo-advisory does not constitute a fund complex.

RCPS Axis

2 — Company Size

Code

S5

Classification

Large Enterprise

Basis / Note

Total assets $50.7B (Dec 31, 2025); total net revenue $3.6B (FY2025); ~6,100 employees

RCPS Axis

3 — Industry

Code

I-FINTECH / I-BANK

Classification

Fintech + National Bank

Basis / Note

Nationally chartered bank (SoFi Bank, N.A.); bank holding company; financial holding company; technology platform (Galileo, Technisys) serving third-party institutions

RCPS Axis

4 — Geography

Code

US-PRIMARY / INTL-SECONDARY

Classification

US-primary with international operations

Basis / Note

Per 10-K: operates primarily in the United States, and internationally in Latin America, Canada and Switzerland (largely Technology Platform) and Hong Kong (SoFi Holdings (Hong Kong) Limited; SoFi Securities (Hong Kong) Limited launched crypto trading in 2025). No EU-regulated entity confirmed.

RCPS Axis

5 — Data Intensity

Code

D4

Classification

Maximum data intensity

Basis / Note

Consumer financial data (13.7M members); deposit, lending, investment and payment data; technology platform serves 128.5M accounts; crypto trading (November 2025) and a bank-issued stablecoin (December 2025)

RCPS Axis

6 — Ownership

Code

PUB-PARENT

Classification

Public corporate parent

Basis / Note

SoFi Technologies, Inc. is the publicly traded parent; SoFi Bank, N.A. is a wholly owned subsidiary; no PE or private ownership layer

RCPS Axis

7 — Growth Stage

Code

G4

Classification

Scale-up / Rapid Growth

Basis / Note

35% YoY member growth; 40% YoY total asset growth; adjusted EBITDA of $1.05B in 2025 (Q4 2025 earnings release); 2026 guidance issued January 30, 2026

Entity Profile — Key Attributes

Attribute

Legal Name

Value

SoFi Technologies, Inc.

Attribute

HQ

Value

234 1st Street, San Francisco, CA 94105

Attribute

Founded

Value

2011 (as Social Finance, Inc.); public 2021 via merger with Social Capital Hedosophia Holdings Corp. V

Attribute

CIK (SEC)

Value

0001818874

Attribute

NASDAQ Ticker

Value

SOFI

Attribute

Shares Outstanding (Jan 30, 2026)

Value

1,275,263,850 shares (common stock, $0.0001 par)

Attribute

Market Value Held by Non-Affiliates (June 30, 2025)

Value

~$20.0 billion (per 10-K cover)

Attribute

Bank Charter

Value

SoFi Bank, National Association — OCC-chartered national bank; conditionally approved January 18, 2022; merger closed February 2022; charter no. 20862; HQ 2750 East Cottonwood Parkway, Cottonwood Heights, UT (OCC national bank list, active as of August 31, 2026)

Attribute

Bank Holding Company

Value

Yes — regulated by the Federal Reserve under the BHCA; financial holding company elected under §4(l)

Attribute

CFPB Supervision

Value

SoFi Bank and its affiliates subject to CFPB supervision and examination from January 1, 2024

Attribute

Total Assets

Value

$50.7 billion (Dec 31, 2025)

Attribute

Total Deposits

Value

$37.5 billion (Dec 31, 2025)

Attribute

Total Net Revenue (FY2025)

Value

$3.6 billion (+35% YoY)

Attribute

Net Income (FY2025)

Value

$481.3 million

Attribute

Members

Value

13.7 million (Dec 31, 2025, +35% YoY)

Attribute

Products

Value

20.2 million (Dec 31, 2025, +37% YoY)

Attribute

Tech Platform Accounts

Value

128.5 million (Dec 31, 2025; 167.7 million a year earlier)

Attribute

Employees

Value

~6,100 (Dec 31, 2025; ~82% US, ~18% international)

Attribute

Three Business Segments

Value

Lending ($1.85B net revenue); Financial Services ($1.54B, +88% YoY); Technology Platform ($450.2M, +14% YoY)

Attribute

CEO

Value

Anthony Noto (age 57)

Attribute

CFO

Value

Chris Lapointe

Attribute

CRO

Value

Arun Pinto (since February 2024)

Attribute

General Counsel

Value

Rob Lavet

Attribute

CTO

Value

Jeremy Rishel

Attribute

Board Chair

Value

Tom Hutton (independent; separate from CEO)

Attribute

Auditor

Value

Deloitte & Touche LLP (since 2017)

Attribute

Key Subsidiaries

Value

SoFi Bank, N.A.; SoFi Securities LLC (CRD 151717); SoFi Wealth LLC (SEC-registered adviser); Galileo Financial Technologies; Technisys S.A. (Luxembourg); Wyndham Capital Mortgage (acquired 2023); SoFi Holdings (Hong Kong) Limited. SoFi Digital Assets LLC's legacy crypto structure was discontinued in 2023 and its accounts closed by Q1 2024.

Attribute

RuleboardAI Classification

Value

Type 7 National Bank/BHC (Primary) + Type 4 Broker-Dealer + Type 5 RIA + Type 16 Fintech Platform (Secondary)

3. Workflow Scope Determination

All applicable regulatory workflows evaluated, within the U.S. institution types the engine covers. Status: In Scope (confirmed applicable), Conditional (depends on trigger/confirmation), Suppressed (not applicable, with rationale).

Category 1 — SOC 2 Compliance

#

1.1

Workflow

Control Inventory Audit

Status

In Scope

Trigger / Rationale

10-K states SOC 2 applies to or is maintained by certain solutions; scope by entity and system is not public

#

1.2

Workflow

Evidence Collection Checklist

Status

In Scope

Trigger / Rationale

SOC 2 maintained for certain solutions per 10-K; Galileo/Technisys B2B clients are the likely drivers

#

1.3

Workflow

Gap Analysis Report

Status

In Scope

Trigger / Rationale

Referenced frameworks (NIST CSF, ISO 27002, FFIEC) confirm gap analysis applicability

#

1.4

Workflow

Vendor Risk Assessment

Status

In Scope

Trigger / Rationale

Third-Party Security Risk Management program confirmed in 10-K Item 1C

#

1.5

Workflow

Penetration Test Review Memo

Status

In Scope

Trigger / Rationale

Internal and external penetration tests confirmed per 10-K Item 1C

Category 2 — Financial Regulation

#

2.1

Workflow

Capital Adequacy Report

Status

In Scope

Trigger / Rationale

OCC and Federal Reserve capital requirements confirmed; SoFi Bank well capitalized at December 31, 2025

#

2.2

Workflow

AML Transaction Monitoring

Status

In Scope

Trigger / Rationale

BSA/AML obligations confirmed for SoFi Bank N.A. and affiliates; FinCEN investment adviser AML rule (effective January 1, 2028, under review) will apply to SoFi Wealth LLC

#

2.3

Workflow

SAR Draft

Status

In Scope

Trigger / Rationale

SoFi Bank SAR filing obligations under 31 CFR 1020.320; prior FINRA CIP/ITPP action heightens materiality

#

2.4

Workflow

SEC Filing Readiness Check

Status

In Scope

Trigger / Rationale

Public reporting company (10-K, 10-Q, 8-K, proxy); SoFi Wealth files Form ADV

#

2.5

Workflow

KYC Onboarding Audit

Status

In Scope

Trigger / Rationale

FINRA $1.1M CIP/ITPP action (May 2024) for December 2018–April 2019 conduct confirms a demonstrated gap area; high priority

Category 3 — International Frameworks (DORA / ISO 27001 / BCP)

#

3.1

Workflow

DORA ICT Risk Assessment

Status

Conditional

Trigger / Rationale

Technisys S.A. (Luxembourg) may serve EU-regulated entities; Unresolved from public sources

#

3.2

Workflow

ISO 27001 Gap Report

Status

In Scope

Trigger / Rationale

ISO 27002:2013 referenced in 10-K; ISO 27001 certification status not public

#

3.3

Workflow

BCP Review

Status

In Scope

Trigger / Rationale

OCC and FFIEC business continuity expectations apply to SoFi Bank; documentation not public

#

3.4

Workflow

IR Playbook Audit

Status

In Scope

Trigger / Rationale

SEC cyber incident disclosure (Reg S-K Item 106) applies; GDPR Art. 33 conditional

#

3.5

Workflow

Data Residency Check

Status

Conditional

Trigger / Rationale

Operations in Latin America, Canada, Switzerland and Hong Kong may implicate local data residency rules; Unresolved

Category 4 — Internal Governance

#

4.1

Workflow

Policy Library Review

Status

In Scope

Trigger / Rationale

Securities Trading and Section 16 Compliance Policy filed (Ex-19.1); full policy library not public

#

4.2

Workflow

Board Risk Report

Status

In Scope

Trigger / Rationale

Risk Committee (min. three members, meets at least four times a year; met six times in 2025) receives quarterly cybersecurity updates from the CISO

#

4.3

Workflow

Control Testing Schedule

Status

In Scope

Trigger / Rationale

Internal audit conducts annual IS/IT audits per 10-K Item 1C

#

4.4

Workflow

Remediation Tracker

Status

In Scope

Trigger / Rationale

Three settled actions (FTC 2019, SEC 2021, FINRA 2024) confirm the need for ongoing remediation tracking

#

4.5

Workflow

Audit Committee Prep Pack

Status

In Scope

Trigger / Rationale

Audit Committee chaired by Gary Meltzer; Deloitte & Touche LLP auditor; met seven times in 2025

Category 5 — Ongoing / Scheduled

#

5.1

Workflow

Regulatory Change Impact Review

Status

In Scope

Trigger / Rationale

OCC proposed $50B→$700B heightened-standards change (Dec 2025); CFPB supervision active; FinCEN adviser AML rule (2028, under review); GENIUS Act implementation; crypto guidance evolving

#

5.2

Workflow

Vendor Renewal Risk Flag

Status

In Scope

Trigger / Rationale

Third-party program includes contract review; 2025 Galileo client exit underscores concentration monitoring

#

5.3

Workflow

Training Compliance Tracker

Status

In Scope

Trigger / Rationale

Cybersecurity awareness training on hire and periodically, including phishing campaigns (10-K Item 1C); completion tracking not public

#

5.4

Workflow

Access Review Report

Status

In Scope

Trigger / Rationale

ISO 27002 and FFIEC expectations apply; access review details not public

Category 6 — Privacy & Data Protection

#

6.1

Workflow

GDPR Compliance Audit

Status

Conditional

Trigger / Rationale

10-K: GDPR obligations arise if services are offered into the EU/UK; Unresolved whether they are

#

6.2

Workflow

CCPA DSR Tracker

Status

In Scope

Trigger / Rationale

SoFi serves California consumers at scale; CCPA/CPRA cited in 10-K

#

6.3

Workflow

Data Retention Policy Review

Status

In Scope

Trigger / Rationale

SEC recordkeeping (17a-3/17a-4) applies to SoFi Securities; BSA recordkeeping applies to SoFi Bank

#

6.4

Workflow

Privacy Impact Assessment

Status

Conditional

Trigger / Rationale

SoFi Crypto (November 2025) and SoFiUSD (December 2025) involve new data processing; assessment status not public

Category 7 — Cybersecurity

#

7.1

Workflow

Vulnerability Management Review

Status

In Scope

Trigger / Rationale

ISO 27002 and NIST CSF confirmed in 10-K; penetration testing confirmed; scan cadence not public

#

7.2

Workflow

Security Awareness Training

Status

In Scope

Trigger / Rationale

Phishing training campaigns confirmed in 10-K Item 1C

#

7.3

Workflow

Endpoint Security Audit

Status

In Scope

Trigger / Rationale

FFIEC and NIST CSF scope confirmed; EDR coverage not public

#

7.4

Workflow

Zero Trust Architecture Gap

Status

Conditional

Trigger / Rationale

NIST SP 800-207 not cited; posture not publicly assessable

Category 8 — HR & People Risk

#

8.1

Workflow

Background Check Compliance

Status

In Scope

Trigger / Rationale

FINRA registration requirements for SoFi Securities personnel; bank officer standards for SoFi Bank

#

8.2

Workflow

Insider Threat Policy Review

Status

In Scope

Trigger / Rationale

Securities Trading and Section 16 Compliance Policy filed (Ex-19.1); SEC Rule 204A-1 code of ethics (SoFi Wealth)

#

8.3

Workflow

Offboarding Access Revocation

Status

In Scope

Trigger / Rationale

Standard expectation for a bank-regulated entity; details not public

#

8.4

Workflow

Whistleblower Program Assessment

Status

In Scope

Trigger / Rationale

SEC whistleblower program (Exchange Act §21F) applies to a public company; internal program details not public

Category 9 — Third-Party / Supply Chain Risk

#

9.1

Workflow

Vendor Onboarding Due Diligence

Status

In Scope

Trigger / Rationale

Risk-based due diligence during supplier onboarding confirmed in 10-K Item 1C

#

9.2

Workflow

Ongoing Vendor Monitoring

Status

In Scope

Trigger / Rationale

Ongoing monitoring, assessment and contract review confirmed in 10-K Item 1C

#

9.3

Workflow

Concentration Risk Assessment

Status

In Scope

Trigger / Rationale

A large Galileo client fully transitioned off in 2025; accounts fell 23% (10-K, Q4 2025 release)

#

9.4

Workflow

Vendor Exit & Termination Plan

Status

In Scope

Trigger / Rationale

The 2025 client exit demonstrates the need; exit plan details not public

Category 10 — ESG / Non-Financial Reporting

#

10.1

Workflow

ESG Program Readiness

Status

In Scope

Trigger / Rationale

Third comprehensive ESG report published 2025 per 10-K; content not reviewed in this pass

#

10.2

Workflow

Climate / TCFD Disclosure

Status

Conditional

Trigger / Rationale

10-K references climate-related commitments in the ESG report; SEC climate rules stayed since April 2024 with rescission proposed May 2026, so no active federal filing obligation

#

10.3

Workflow

SFDR Classification Review

Status

Suppressed

Trigger / Rationale

No EU-distributed investment products confirmed

#

10.4

Workflow

CSRD / ESRS Reporting Assessment

Status

Suppressed

Trigger / Rationale

No EU subsidiary triggering CSRD confirmed

Category 11 — Operational Risk

#

11.1

Workflow

Operational Risk Register Review

Status

In Scope

Trigger / Rationale

Enterprise Risk Management program referenced in 10-K; details not public

#

11.2

Workflow

DR Gap Report

Status

In Scope

Trigger / Rationale

FFIEC business continuity expectations apply; DR documentation not public

#

11.3

Workflow

BCP Test & Exercise Review

Status

In Scope

Trigger / Rationale

OCC heightened-standards implications at $50.7B; exercise results not public

#

11.4

Workflow

Process Resilience & Outsourcing Review

Status

In Scope

Trigger / Rationale

Galileo provides technology infrastructure to SoFi and to third parties; dual exposure confirmed

3B. Detailed Workflow Assessment — Selected In-Scope / Conditional Workflows

2.5 | KYC Onboarding Audit In Scope

Objective: Verify that SoFi's customer identification program (CIP) and identity theft prevention program (ITPP) meet BSA and FinCEN requirements across all regulated subsidiaries.

Frameworks: 31 CFR 1023.220 (broker-dealer CIP); 31 CFR 1020.220 and 1010.230 (bank CIP and CDD); FINRA Rule 3310; Regulation S-ID (17 CFR 248.201).

Observation: FINRA censured and fined SoFi Securities LLC $1.1 million on May 2, 2024 (AWC No. 2019062705801) for failing to establish and maintain a reasonable CIP and a reasonably designed ITPP for SoFi Money cash management accounts from December 2018 through April 2019. Approximately 800 accounts were opened using stolen or fictitious identities; about $8.6 million was transferred from customers of other institutions and about $2.5 million withdrawn; all injured parties were reimbursed. The largely automated approval process did not act on red flags such as invalid or mismatched Social Security numbers and addresses. SoFi self-reported the matter and undertook remediation beginning in February 2019, and closed SoFi Money to new customers in June 2022. Post-remediation program quality cannot be confirmed from public sources.

Next Action: Obtain current CIP/ITPP policy documentation and evidence of post-2019 program enhancements; validate current fraud-alert metrics against BSA examination standards.

2.2 | AML Transaction Monitoring In Scope

Objective: Confirm existence and adequacy of the BSA/AML transaction monitoring program at SoFi Bank, N.A.

Frameworks: Bank Secrecy Act (31 U.S.C. 5318); 31 CFR 1020.210; 12 CFR 21.21; FFIEC BSA/AML Examination Manual; FinCEN investment adviser AML rule (31 CFR Part 1032, effective January 1, 2028, under review).

Observation: SoFi Bank is subject to full BSA/AML program requirements as a national bank, and the 10-K acknowledges those obligations. No public enforcement action by FinCEN or the OCC on the AML program was found. With $37.5B in deposits, 13.7M members, crypto and stablecoin activity at the bank, and cross-border Technology Platform clients, transaction volume and complexity are material. FinCEN's investment adviser AML rule, delayed to January 1, 2028 and under review, would extend program obligations to SoFi Wealth LLC.

Next Action: Request BSA/AML program documentation, transaction monitoring system details, SAR filing statistics (if disclosable), and the BSA Officer's assessment of crypto-related controls.

9.3 | Concentration Risk Assessment In Scope

Objective: Assess client and vendor concentration risk in SoFi's Technology Platform segment.

Frameworks: OCC Bulletin 2023-17 (Interagency Guidance on Third-Party Relationships); FFIEC IT Handbook; DORA (Conditional for a U.S. entity); internal ERM.

Observation: In 2025 a large Galileo client fully transitioned off the platform, and Technology Platform total accounts fell from 167.7 million to 128.5 million, a 23% decline, per the 10-K and the Q4 2025 earnings release. The concentration of revenue from a small number of clients is a risk the 10-K itself identifies. Client identity, contractual terms and the concentration risk management framework are not public.

Next Action: Request client concentration analysis for the Technology Platform; review third-party risk management documentation; validate exit and termination planning per 9.4.

4. Detailed Risk Findings + Strategic Alternatives

F-001 | KYC / CIP Program — Prior Enforcement + Evolving Obligations

HIGH

Confidence: Confirmed (public enforcement record); Conditional (post-remediation status)

Regulatory Citation: FINRA AWC No. 2019062705801 (May 2, 2024); FINRA Rule 3310(b); Regulation S-ID Rule 201 (17 CFR 248.201); 31 U.S.C. 5318; 31 CFR 1010.230; FinCEN investment adviser AML rule (31 CFR Part 1032; effective January 1, 2028, under review)

FINRA censured and fined SoFi Securities LLC $1.1 million on May 2, 2024 for failing to maintain a reasonable CIP and a reasonably designed ITPP for SoFi Money cash management accounts from December 2018 through April 2019. Approximately 800 accounts were opened with stolen or fictitious identities; about $8.6 million was transferred from other institutions' customers and about $2.5 million withdrawn; all injured parties were reimbursed. Separately, FinCEN's investment adviser AML rule, delayed to January 1, 2028 and under review, would require SoFi Wealth LLC to implement an AML/CFT program.

Data gap / current gap: Post-remediation CIP/ITPP documentation and testing results are not confirmable from public sources. The adviser AML program for SoFi Wealth LLC is not yet required; planning status is not public.

Remediation: Obtain CIP/ITPP program documentation; conduct a gap assessment against current FFIEC and FinCEN standards; track the adviser AML rule and design SoFi Wealth's program for the effective date.

Owner: Chief Risk Officer; BSA/AML Officer

Deadline: Adviser AML rule: January 1, 2028 (under review); CIP validation: next examination cycle

Strategic Alternatives

Option

Option 1 — Internal

Action

Enhance BSA/Compliance team

Details

Owner: CRO + BSA Officer; internal AML program refresh and adviser AML readiness assessment. Est. Lift: Medium

Option

Option 2 — Vendor

Action

Engage AML regulatory consulting firm

Details

Pros: specialized expertise; benchmarking against banks at similar scale. Cons: cost; integration with existing transaction monitoring.

Option

Option 3 — Risk Acceptance

Action

Accept residual gap for pre-2028 adviser AML

Details

Viable when: only for the adviser rule timeline; not viable for bank CIP obligations. Approval: CRO + General Counsel

F-002 | CFPB Supervision — Commenced January 1, 2024

HIGH

Confidence: Confirmed

Regulatory Citation: 12 U.S.C. 5515 (Dodd-Frank §1025); 12 U.S.C. 5531 (UDAAP); CFPB Supervision and Examination Manual

The FY2025 10-K states that beginning January 1, 2024 SoFi Bank and its affiliates became subject to supervision and examination by the CFPB; 12 U.S.C. 5515 assigns that authority for insured depository institutions with more than $10 billion in total assets. This is a structural change in supervisory regime: as of this report date the CFPB has held examination authority for approximately 33 months.

Data gap / current gap: The outcome of any CFPB examination since January 1, 2024 is not public. UDAAP compliance posture under CFPB examination cannot be confirmed from public sources. The FTC consent order (in force to 2039) on advertising savings claims may inform examination scope.

Remediation: Engage counsel to review CFPB examination findings to date; conduct a UDAAP self-assessment across consumer-facing products; review advertising claims against the FTC order.

Owner: General Counsel; Chief Compliance Officer

Deadline: Ongoing; examination cycles under way since 2024

Strategic Alternatives

Option

Option 1 — Internal

Action

UDAAP self-assessment

Details

Owner: Compliance; map consumer-facing product flows to CFPB examination priorities. Est. Lift: Medium

Option

Option 2 — Vendor

Action

Engage CFPB-specialized regulatory counsel

Details

Pros: examination knowledge. Cons: cost; coordination across member-facing products.

Option

Option 3 — Risk Acceptance

Action

Not viable

Details

CFPB supervision applies by statute above $10B in assets. Approval: N/A

F-003 | FTC Consent Order — In Force Until 2039

MEDIUM

Confidence: Confirmed

Regulatory Citation: FTC Docket No. C-4673, Decision and Order (February 2019); In re Social Finance, Inc. and SoFi Lending Corp.; FTC Act §5 (15 U.S.C. 45)

The FTC approved a final consent order against Social Finance, Inc. and SoFi Lending Corp. in February 2019. The complaint alleged that since April 2016 SoFi's television, print and internet advertisements made false statements about student loan refinancing savings, with average-savings figures that excluded large categories of consumers and were sometimes double the actual figure. The order prohibits misrepresenting savings and requires that savings claims be substantiated by competent and reliable evidence. It terminates on February 22, 2039, or 20 years from the most recent federal complaint alleging a violation, whichever is later.

Data gap / current gap: Ongoing compliance with the order is not publicly verified. The order required a sworn compliance report one year after issuance and further reports on request; whether any were requested is not public.

Remediation: Confirm an advertising substantiation review process tied to the order; retain the records the order requires for ten years after issuance.

Owner: General Counsel; Chief Marketing Officer

Deadline: Ongoing through 2039

Strategic Alternatives

Option

Option 1 — Internal

Action

Advertising compliance review program

Details

Owner: Legal + Marketing; periodic review of savings-related claims against the order. Est. Lift: Low

Option

Option 2 — Vendor

Action

Engage advertising law specialist

Details

Pros: FTC substantiation expertise. Cons: cost; capability likely already built after seven years under the order.

Option

Option 3 — Risk Acceptance

Action

Accept residual compliance management risk

Details

Viable when: base program already established. Approval: General Counsel

F-004 | SEC Conflict-of-Interest Order — SoFi Wealth LLC (2021)

MEDIUM

Confidence: Confirmed

Regulatory Citation: SEC Investment Advisers Act Release No. 5826 (August 19, 2021); Advisers Act §206(2) and §206(4) (15 U.S.C. 80b-6); Rule 206(4)-7 (17 CFR 275.206(4)-7)

The SEC instituted settled charges against SoFi Wealth LLC on August 19, 2021 for breaching its fiduciary duty when, on April 12, 2019, it moved assets in approximately 20,000 automated accounts from third-party ETFs into two new SoFi-sponsored ETFs (SFY and SFYX) without disclosing SoFi's economic interest, and without considering tax consequences (over 15,000 clients incurred about $772,000 in short-term and $662,000 in long-term capital gains). SoFi Wealth agreed to a cease-and-desist order, a censure, a $300,000 penalty and undertakings, without admitting or denying the findings.

Data gap / current gap: Completion of the undertakings and current conflict-disclosure practice at SoFi Wealth are not publicly verifiable.

Remediation: Confirm the undertakings were certified as complete; review current conflict-of-interest disclosures against the fiduciary standard; verify no recurrence in later product rollouts, including SoFi Crypto and SoFiUSD.

Owner: SoFi Wealth Chief Compliance Officer; General Counsel

Deadline: Order compliance ongoing; crypto-related conflict review: immediate

Strategic Alternatives

Option

Option 1 — Internal

Action

Conflict review for new products

Details

Owner: SoFi Wealth CCO; pre-launch conflict review for all new products. Est. Lift: Low

Option

Option 2 — Vendor

Action

Third-party adviser compliance consultant

Details

Pros: independent review of Form ADV disclosures and conflicts policy. Cons: limited marginal value if already enhanced.

Option

Option 3 — Risk Acceptance

Action

Accept residual compliance management risk

Details

Viable when: undertakings confirmed complete. Approval: General Counsel

F-005 | $50 Billion Asset Threshold — OCC Heightened Standards

HIGH

Confidence: Confirmed (threshold crossed); Conditional (outcome of OCC rulemaking)

Regulatory Citation: 12 CFR Part 30, Appendix D; Dodd-Frank §165 (12 U.S.C. 5365); OCC NR 2025-134 (December 23, 2025), proposed amendment raising the threshold from $50 billion to $700 billion

At December 31, 2025 SoFi reported total assets of $50.7 billion, above the current $50 billion threshold at which the OCC's heightened standards guidelines apply to national banks. On December 23, 2025 the OCC proposed raising that threshold to $700 billion. The proposal is not final. Until it is, the current threshold governs.

Data gap / current gap: SoFi Bank's status under the current heightened standards guidelines is not public. The timing and outcome of the OCC rulemaking are not known.

Remediation: Track the OCC rulemaking; assess current obligations under Appendix D with regulatory counsel; document readiness for either outcome.

Owner: Chief Risk Officer; General Counsel

Deadline: OCC rulemaking (timing not known); interim: immediate counsel review

Strategic Alternatives

Option

Option 1 — Internal

Action

Regulatory tracking and threshold readiness

Details

Owner: CRO + Legal; track the rulemaking and maintain readiness materials. Est. Lift: Low

Option

Option 2 — Vendor

Action

Engage OCC-specialized bank regulatory counsel

Details

Pros: rulemaking intelligence; Appendix D applicability assessment. Cons: cost.

Option

Option 3 — Risk Acceptance

Action

Await regulatory clarity

Details

Viable when: the proposal advances; monitor before committing to a full program build. Approval: CRO

F-006 | Technology Platform Concentration Risk — Galileo Client Exit

MEDIUM

Confidence: Confirmed

Regulatory Citation: OCC Bulletin 2023-17 (Interagency Guidance on Third-Party Relationships); FFIEC IT Handbook

In 2025 a large Galileo client fully transitioned off the Technology Platform, and total accounts fell from 167.7 million to 128.5 million, a 23% decline, per the FY2025 10-K and the Q4 2025 earnings release. The 10-K states that Galileo and Technisys depend on a small number of clients. This is a confirmed public signal of single-client concentration risk in the B2B infrastructure business.

Data gap / current gap: Client concentration data, exit and termination plan details, and contractual protections are not public.

Remediation: Request client concentration analysis for the Technology Platform; review exit and termination plan documentation; assess diversification strategy.

Owner: Technology Platform business unit head; Chief Risk Officer

Deadline: Immediate

Strategic Alternatives

Option

Option 1 — Internal

Action

Client diversification and concentration monitoring

Details

Owner: Galileo leadership; set concentration thresholds and monitor quarterly. Est. Lift: Medium

Option

Option 2 — Vendor

Action

Third-party business continuity review

Details

Pros: independent assessment of resilience to large-client exits. Cons: client data sensitivity.

Option

Option 3 — Risk Acceptance

Action

Accept concentration as inherent to the platform model

Details

Viable when: the platform is diversifying. Approval: CEO + Board Risk Committee

F-007 | SOC 2 Attestation — Scope Not Public

MEDIUM

Confidence: Likely (attestation maintained for certain solutions); Conditional (scope)

Regulatory Citation: AICPA Trust Services Criteria; FFIEC IT Handbook; OCC Bulletin 2023-17

The FY2025 10-K states that PCI-DSS, AICPA standards and SOC 2 "apply to or are maintained by certain of our solutions" and that failure to maintain its SOC 2 could breach customer contracts; Item 1C adds that third-party attestations and assessments are conducted periodically. Galileo is the processing infrastructure for the B2B Technology Platform, whose institutional clients typically require SOC 2 Type II reports. Which entities and systems the attestation covers, its type and period, are not public.

Data gap / current gap: SOC 2 scope, report type and coverage of Galileo and SoFi Bank's core processing environment are not confirmable from public sources.

Remediation: Obtain the current SOC 2 report(s) and confirm scope against Galileo and SoFi Bank's critical control environment; scope additional examination if coverage gaps exist.

Owner: CISO; Galileo Head of Compliance

Deadline: 90 days (to confirm scope)

Strategic Alternatives

Option

Option 1 — Internal

Action

Scope confirmation with the existing service auditor

Details

Owner: CISO + Internal Audit. Est. Lift: Medium

Option

Option 2 — Vendor

Action

Engage a specialist SOC 2 readiness firm for uncovered systems

Details

Pros: faster gap-to-report timeline. Cons: cost; coordination with the existing auditor.

Option

Option 3 — Risk Acceptance

Action

Accept scope gap pending prioritization

Details

Viable when: no contractual SOC 2 requirement is outstanding from B2B clients. Approval: CISO + CRO

F-008 | ESG Reporting — Content Not Reviewed; Climate Rule Regime Unsettled

LOW

Confidence: Confirmed (report exists); Conditional (content and framework alignment)

Regulatory Citation: SoFi FY2025 10-K (ESG report and climate-related commitments); SEC press release 2026-49 (May 29, 2026), proposed rescission of the climate-related disclosure rules

The FY2025 10-K states that SoFi published its third comprehensive ESG report in 2025 and communicates climate-related commitments and governance metrics in it. The report's content and any alignment to a recognized climate framework were not reviewed in this pass. The SEC's climate-related disclosure rules were stayed in April 2024, the Commission ended its defense of them in March 2025, and rescission was proposed on May 29, 2026; no federal climate filing obligation is treated as active.

Data gap / current gap: ESG report content, framework alignment and assurance status are Unresolved from this pass.

Remediation: Review the 2025 ESG report against the disclosure expectations of SoFi's investors and counterparties; track the SEC rescission rulemaking.

Owner: General Counsel; Chief Financial Officer

Deadline: Next ESG report cycle

Strategic Alternatives

Option

Option 1 — Internal

Action

ESG report review and roadmap

Details

Owner: CFO + Legal. Est. Lift: Low

Option

Option 2 — Vendor

Action

Engage ESG advisory firm

Details

Pros: framework selection and benchmarking. Cons: cost.

Option

Option 3 — Risk Acceptance

Action

Maintain current voluntary reporting

Details

Viable when: no mandatory regime applies. Approval: CFO + General Counsel

F-009 | Crypto / Digital Asset Regulatory Position — SoFi Crypto + SoFiUSD

HIGH

Confidence: Confirmed (product launches at SoFi Bank); Conditional (OCC non-objection status)

Regulatory Citation: OCC Conditional Approval No. 1277 (January 18, 2022), condition 3; 12 U.S.C. 1818 (conditions enforceable); GENIUS Act, Pub. L. 119-27 (July 2025); SoFi FY2025 10-K; SoFi releases of November 11 and December 18, 2025

SoFi Bank, N.A. launched SoFi Crypto on November 11, 2025 and SoFiUSD on December 18, 2025. SoFi's releases state that SoFi Crypto products and services are offered by SoFi Bank, N.A. and that SoFiUSD is issued by SoFi Bank, N.A.; the FY2025 10-K states that members buy, sell and hold digital assets through SoFi Bank, that SoFi Bank launched SoFiUSD in December 2025, and that SoFi Crypto is designed to operate within the company's current regulatory framework. Condition 3 of the OCC's 2022 conditional approval provides that, while the Operating Agreement is in effect, the bank "shall not engage in any crypto-asset activities or services ... unless it has received prior written determination of no supervisory objection from the OCC." The condition is therefore not an absolute bar. The 10-K also notes that under the GENIUS Act an insured depository institution such as SoFi Bank cannot itself be a permitted stablecoin issuer, while a qualifying subsidiary can with OCC approval.

Data gap / current gap: Whether SoFi Bank sought and obtained the OCC's prior written determination of no supervisory objection before the 2025 launches, and whether the Operating Agreement remains in effect, is not stated in the 10-K or the launch releases. The regulatory pathway for SoFiUSD once the GENIUS Act takes effect is not public. This is an open verification question, not a finding of non-compliance.

Remediation: Confirm the OCC non-objection status for SoFi Crypto and SoFiUSD and whether the Operating Agreement remains in effect; document the OCC, FinCEN and SEC position for both products and the GENIUS Act pathway for SoFiUSD.

Owner: General Counsel; Chief Risk Officer; SoFi Bank compliance lead for digital assets

Deadline: Immediate (verification of a charter condition)

Strategic Alternatives

Option

Option 1 — Internal

Action

OCC condition review

Details

Owner: General Counsel; confirm non-objection status under the Operating Agreement. Est. Lift: Low–Medium

Option

Option 2 — Vendor

Action

Engage bank regulatory counsel with digital-asset experience

Details

Pros: OCC guidance and GENIUS Act implementation expertise. Cons: fast-moving landscape; cost.

Option

Option 3 — Risk Acceptance

Action

Not viable

Details

Charter conditions are enforceable under 12 U.S.C. 1818. Approval: N/A

5. Regulatory Obligation Map

Status: ✓ ACTIVE (confirmed obligation). ● LIKELY (strong inference, not fully confirmed). ● N/A (not applicable with rationale).

FrameworkJurisdictionStatusKey ObligationsPriority
OCC National Bank SupervisionFederal (US)✓ ACTIVESafety and soundness; capital adequacy; CRA; OCC examination; approvals for branches and acquisitions; heightened standards at the current $50B threshold (OCC proposal to raise it pending)High
Federal Reserve — BHCA / FHCFederal (US)✓ ACTIVEBank holding company regulation; financial holding company status (§4(l)); well capitalized and well managed requirements; affiliate transaction limits (§§23A/23B, Regulation W); Volcker Rule (the 10-K states the company and its subsidiaries are subject to it and do not qualify for the $10B exception)High
CFPB SupervisionFederal (US)✓ ACTIVESupervision and examination from Jan 1, 2024; UDAAP; fair lending (ECOA); TILA; EFTAHigh
FinCEN / BSAFederal (US)✓ ACTIVEBSA program; SAR and CTR filing; CDD/KYC; OFAC screening; investment adviser AML rule for SoFi Wealth LLC (effective Jan 1, 2028, under review)High
FDIC InsuranceFederal (US)✓ ACTIVEDeposit insurance assessments ($19.3M FDIC insurance expense for SoFi Bank in 2025); FDIA; secondary supervisory authorityMedium
SEC — Public Reporting CompanyFederal (US)✓ ACTIVE10-K, 10-Q, 8-K; proxy (DEF 14A); PCAOB audit; Reg FD; Reg S-K Item 106 cybersecurity disclosure; insider trading restrictionsHigh
SEC — Investment Advisers ActFederal (US)✓ ACTIVESoFi Wealth LLC: Form ADV; fiduciary duty; Rule 206(4)-7 compliance program; Rule 204A-1 code of ethicsMedium
FINRAFederal (US)✓ ACTIVESoFi Securities LLC (CRD 151717): FINRA Rule 3310 (AML program); Regulation S-ID; Exchange Act Rules 17a-3/17a-4 (recordkeeping); net capital; SIPC membershipHigh
FTC Consent Order (Docket C-4673)Federal (US)✓ ACTIVEProhibition on unsubstantiated savings claims; in force to Feb 22, 2039; compliance report one year after issuance and on request; ten-year recordkeepingMedium
OCC Conditional Approval #1277 (Jan 2022)Federal (US)✓ ACTIVE (status of Operating Agreement Unresolved)Crypto-asset activities at SoFi Bank N.A. barred while the Operating Agreement is in effect absent prior written OCC non-objection; capital contribution conditionHigh
GENIUS Act (Pub. L. 119-27)Federal (US)● LIKELYPayment stablecoin framework effective the earlier of Jan 18, 2027 or 120 days after final rules; insured depository institutions cannot be permitted issuers directly (per SoFi's 10-K summary)High
CCPA / CPRACalifornia (US)✓ ACTIVEConsumer data rights; privacy notice; opt-out rights; CPPA enforcement (cited in 10-K)Medium
State SupervisionMulti-state (US)● LIKELYThe 10-K states the company and its affiliates are subject to supervision and examination by various state regulatorsMedium
CRA (Community Reinvestment Act)Federal (US)✓ ACTIVEOCC evaluates SoFi Bank under the CRA; the 2022 approval release names the CRA expresslyMedium
EU DORAEU● LIKELY (Conditional)Technisys S.A. (Luxembourg) may serve DORA-regulated entities; requires confirmationLow
GDPREU● LIKELY (Conditional)Per 10-K, applies if services are offered into the EU/UK; entity-level mapping requiredLow
Basel III capital rulesFederal (US)✓ ACTIVECapital framework applies via the OCC and Federal Reserve; SoFi Bank well capitalized at Dec 31, 2025Medium
HIPAAFederal (US)● N/ANot a healthcare entity or business associate
SFDR / CSRDEU● N/ANo EU-distributed investment products confirmed; no EU parent

6. Workflow Linkage Map

Source Workflow

2.5 KYC Onboarding Audit

Linked To

2.2 AML Transaction Monitoring

Shared Artifact / Rationale

Customer identity data feeds the monitoring system; a CIP weakness is an AML blind spot

Link

✓ LINK

Source Workflow

2.5 KYC Onboarding Audit

Linked To

8.1 Background Check Compliance

Shared Artifact / Rationale

Identity verification protocols apply to both customer onboarding and employee screening

Link

● COND

Source Workflow

2.2 AML Transaction Monitoring

Linked To

2.3 SAR Draft

Shared Artifact / Rationale

Monitoring alerts feed the SAR decision workflow

Link

✓ LINK

Source Workflow

4.1 Policy Library Review

Linked To

8.2 Insider Threat Policy Review

Shared Artifact / Rationale

The Securities Trading and Section 16 Compliance Policy (Ex-19.1) is part of the policy library

Link

✓ LINK

Source Workflow

9.3 Concentration Risk Assessment

Linked To

11.4 Process Resilience & Outsourcing Review

Shared Artifact / Rationale

Galileo client concentration is both vendor dependency and outsourced-service concentration

Link

✓ LINK

Source Workflow

1.4 Vendor Risk Assessment

Linked To

9.1 Vendor Onboarding Due Diligence

Shared Artifact / Rationale

The Third-Party Security Risk Management program covers both

Link

✓ LINK

Source Workflow

F-009 Crypto Position

Linked To

5.1 Regulatory Change Impact Review

Shared Artifact / Rationale

OCC crypto guidance and GENIUS Act implementation must be tracked in horizon scanning

Link

✓ LINK

Source Workflow

F-008 ESG Reporting

Linked To

5.1 Regulatory Change Impact Review

Shared Artifact / Rationale

The SEC climate-rule rescission proceeding is a regulatory change to track

Link

✓ LINK

Source Workflow

7.1 Vulnerability Management

Linked To

7.3 Endpoint Security Audit

Shared Artifact / Rationale

Vulnerability scan results feed endpoint remediation prioritization

Link

✓ LINK

Source Workflow

4.2 Board Risk Report

Linked To

4.5 Audit Committee Prep Pack

Shared Artifact / Rationale

Risk and Audit Committees overlap (Freiberg, Meltzer); CISO reports quarterly to the Risk Committee

Link

● COND

7. Escalations — Items Requiring Review

E-01 | OCC Conditional Approval vs. SoFi Crypto / SoFiUSD — Non-Objection Status

Reason: Condition 3 of the OCC's January 2022 conditional approval bars crypto-asset activities at SoFi Bank, N.A. while the Operating Agreement is in effect absent the OCC's prior written determination of no supervisory objection. SoFi's own disclosures place SoFi Crypto (November 2025) and SoFiUSD (December 2025) at the bank. Whether non-objection was sought and obtained, and whether the Operating Agreement remains in effect, is not public. This is a verification question that public sources cannot resolve; it is not an allegation of non-compliance.

Who Must Review: General Counsel + Chief Risk Officer + OCC relationship contact

E-02 | CFPB Examination Findings — January 2024 Onwards

Reason: CFPB supervision began January 1, 2024. Examination findings are confidential. The FTC consent order and the FINRA CIP/ITPP action are relevant precedent for examination focus. Findings cannot be confirmed from public sources.

Who Must Review: General Counsel + Chief Compliance Officer + CFPB relationship contact

E-03 | BSA/AML Program Documentation — Post-Charter Quality

Reason: SoFi Bank N.A. was conditionally approved on January 18, 2022 and the bank merger closed in February 2022. A full BSA/AML program is required. The FINRA action (2024, for 2018–2019 conduct) relates to a pre-bank period. Post-charter program quality, including the monitoring system, SAR cadence and CDD compliance, cannot be verified from public sources.

Who Must Review: BSA/AML Compliance Officer + Chief Risk Officer + OCC/FinCEN relationship contact

E-04 | Non-U.S. Operations — Regulatory Obligations

Reason: Technisys S.A. is a Luxembourg société anonyme; the 10-K reports operations in Latin America, Canada, Switzerland and Hong Kong, including a Hong Kong crypto trading launch in 2025. DORA, GDPR and local obligations may attach. Cannot be determined from public sources.

Who Must Review: General Counsel + Technisys compliance lead + local regulatory counsel

8. Next Actions — Prioritized (Effort × Impact)

PriorityActionLinked Finding/WorkflowEffortImpactOwner
1Confirm OCC non-objection status for SoFi Crypto/SoFiUSD under the 2022 condition and the GENIUS Act pathway for SoFiUSDF-009, E-01LowHighGeneral Counsel
2Obtain post-2019 CIP/ITPP program documentation and current BSA/AML program assessmentF-001, E-03, 2.5, 2.2MediumHighCRO, BSA Officer
3Track the FinCEN adviser AML rule (2028, under review) and design SoFi Wealth LLC's programF-001, 2.2MediumHighCCO, CRO
4CFPB examination preparation: UDAAP self-assessment; FTC consent order compliance reviewF-002, F-003, E-02HighHighGeneral Counsel, CCO
5Confirm SOC 2 scope for Galileo and SoFi Bank's core processing environmentF-007, 1.1MediumMediumCISO, Internal Audit
6OCC $50B heightened standards: assess current Appendix D obligations pending the rulemakingF-005LowMediumCRO, General Counsel
7Galileo concentration risk: obtain client concentration data; review exit/termination planF-006, 9.3, 9.4MediumMediumGalileo leadership, CRO
8Review the 2025 ESG report against investor and counterparty expectations; track the SEC rescission rulemakingF-008, 10.1, 10.2LowLowCFO, General Counsel
9Non-U.S. regulatory mapping: DORA, GDPR and local obligations for Technisys and the Hong Kong entitiesE-04, 3.1, 3.5, 6.1MediumMediumGeneral Counsel, Technisys compliance lead

9. Peer Context

SoFi Peer Archetype: High-growth national bank with a fintech platform business

SoFi's closest archetype is a recently chartered national bank that grew through digital channels rather than a branch network, combined with a business-to-business technology platform. The archetype is used only to frame which control areas peers at this scale are generally expected to have documented; no figures for any other company are stated in this profile.

GRC Category

Financial Regulation

SoFi (This Profile)

Defined (3)

Basis

Enforcement history and rapid growth; expected to be at or above Defined at this scale

GRC Category

Cybersecurity

SoFi (This Profile)

Defined (3)

Basis

SOC 2 scope and Zero Trust posture not public

GRC Category

Internal Governance

SoFi (This Profile)

Defined (3)

Basis

Board structure strong; policy library depth not public

GRC Category

BSA/AML

SoFi (This Profile)

Defined (3)

Basis

Prior FINRA CIP/ITPP action; post-charter program quality not public

GRC Category

ESG / Disclosure

SoFi (This Profile)

Defined (3)

Basis

Voluntary ESG reporting in place; content not reviewed

GRC Category

Privacy & Data

SoFi (This Profile)

Defined (3)

Basis

Documented public privacy program

GRC Category

Third-Party Risk

SoFi (This Profile)

Defined (3)

Basis

Galileo concentration event is a public signal

Peer context is directional and based on public evidence about SoFi only. Not an audit.

10. RuleboardAI Engagements

The engagements above are the published engagement types as of September 26, 2026 and are shown for illustration. Current products, prices and turnarounds are on the Products page. Monitoring is not offered. See the Products page.

Verified Assessment — scoped per engagement

Scope: The upgrade from this preliminary profile. Under a signed Letter of Authorization, SoFi would provide the evidence this profile requests: BSA/AML program overview, post-2019 CIP/ITPP documentation, SOC 2 scope, OCC non-objection status for SoFi Crypto and SoFiUSD, and Technology Platform concentration data. RuleboardAI reviews the documents, records management responses, and updates each finding's label against verified evidence. Deliverable: an updated CompanyScope profile with confidence labels revised and escalations E-01 through E-04 addressed.

Ideal for: Closing the data gaps identified in this profile with the client's own evidence.

Custom Diligence — custom scope

Scope: Portfolio-scale diligence for deal teams and lenders: multiple targets or counterparties, custom category and framework scope, turnarounds set to the mandate's timeline, and a named point of contact.

Ideal for: PE deal teams, M&A advisors and lenders assessing several institutions at once.

11. Confidence Legend, Data Gaps & Disclaimers

Confidence Legend

Label

Confirmed

Meaning

Supported by verified or publicly observable evidence directly on point.

Label

Likely

Meaning

Supported by consistent indirect evidence; stated with its inference visible.

Label

Conditional

Meaning

Holds only under stated assumptions or pending specific evidence.

Label

Escalate

Meaning

Requires human judgment or professional advice beyond the report's scope.

Data Gaps

DG-1

SOC 2 scope, report type and period for Galileo Financial Technologies and SoFi Bank's core processing environment

Cannot confirm from public sources. The 10-K discloses that SOC 2 is maintained for certain solutions; which entities and systems are covered is not public

DG-2

Post-2019 CIP/ITPP program documentation and current BSA/AML program quality metrics

Cannot confirm from public sources. The FINRA action covered December 2018–April 2019 conduct; post-charter program quality cannot be verified from public sources

DG-3

CFPB examination findings since January 1, 2024

Cannot confirm from public sources. The CFPB has held supervision and examination authority for approximately 33 months; findings are confidential and are the most material regulator-facing item given UDAAP obligations and the FTC order

DG-4

OCC non-objection status for SoFi Crypto / SoFiUSD under the 2022 conditional approval, and the status of the Operating Agreement

Cannot confirm from public sources. SoFi's disclosures place both products at SoFi Bank N.A.; whether prior written non-objection was obtained, and whether the Operating Agreement remains in effect, cannot be confirmed from public sources

DG-5

Content, framework alignment and assurance of the 2025 ESG report

Cannot confirm from public sources. The 10-K confirms the report exists and references climate-related commitments; the report itself was not reviewed in this pass

DG-6

Non-U.S. regulatory obligations (Technisys S.A., Luxembourg; operations in Latin America, Canada, Switzerland and Hong Kong)

Cannot confirm from public sources. Public disclosures do not confirm or deny DORA, GDPR or local obligations for these operations

DG-7

Technology Platform client concentration (top clients as a share of segment revenue)

Cannot confirm from public sources. The 2025 large-client exit is confirmed; the current concentration profile, contractual protections and exit plans are not public

DG-8

Internal whistleblower program documentation

Cannot confirm from public sources. The public-company whistleblower regime applies; internal program structure, channels and non-retaliation policy are not public

DG-9

BCP/DR test results and exercise cadence for SoFi Bank N.A.

Cannot confirm from public sources. Regular testing is a supervisory expectation; results are not public; at $50.7B in assets operational resilience is a material supervisory focus

Disclaimers

  1. Public Sources Only. This profile was produced entirely from publicly available sources: SEC EDGAR filings, OCC releases, decisions and institution lists, FINRA disciplinary records, SEC and FTC orders, FinCEN releases, SoFi's own investor releases, and the text of the cited statutes and regulations. No client documentation, internal policies, examination reports or confidential supervisory information was reviewed. This is Gap Mode — Preliminary.
  2. No Client Engagement. SoFi Technologies, Inc. is not a client of RuleboardAI. This profile is a sample deliverable demonstrating the CompanyScope methodology applied to a public company. No confidential relationship exists.
  3. Not an Audit, Legal Opinion, or Attestation. Nothing in this document is an audit, legal advice, regulatory opinion or attestation. Findings are preliminary conclusions from public information and are subject to change on review of client documentation.
  4. Point-in-Time. All data and findings are as of September 26, 2026. Every source URL was re-verified on that date. SoFi's regulatory environment and financial profile change; the profile ages as facts change.
  5. Accuracy. Reasonable care was taken to cite primary sources, which may themselves contain errors or lag current regulatory status. Material facts should be verified directly with SoFi and its regulators before any business, investment or compliance decision.
  6. RuleboardAI Methodology. This profile applies RCPS Methodology v1.2 (effective September 28, 2026; the scoring rule is unchanged from v1.1, under which this profile was produced): finding labels Confirmed, Likely, Conditional and Escalate; evidence states including Unresolved; a 1–5 maturity scale whose composite is the mean of the scored categories and takes the name of the nearest whole level. Verified conclusions require a Verified Assessment engagement.

Source Appendix

Source

SEC EDGAR — SoFi Technologies (CIK 0001818874)

Description

EDGAR filing index for SoFi. Verified 2026-09-26

URL

View source

Source

SoFi Form 10-K FY2025 (filed February 17, 2026)

Description

Annual report for the year ended December 31, 2025; primary source for financial, regulatory, cybersecurity (Item 1C), crypto, stablecoin and ESG-report statements. Verified 2026-09-26

URL

View source

Source

SoFi DEF 14A 2026 Proxy Statement (April 30, 2026)

Description

Director and officer roster, ages, committee composition, chairs and 2025 meeting counts. Verified 2026-09-26

URL

View source

Source

SoFi Q4 2025 Earnings Release (Form 8-K exhibit, January 30, 2026)

Description

Members 13.7M, products 20.2M, Technology Platform accounts 128.5M vs 167.7M, loans at fair value $36.4B, adjusted EBITDA, 2026 guidance. Verified 2026-09-26

URL

View source

Source

OCC Conditional Approval #1277 — SoFi Bank, N.A. (January 18, 2022)

Description

Decision letter; conditions 1–3 including the crypto-asset condition with the prior written no-supervisory-objection carve-out. Verified 2026-09-26 at the resolving path

URL

View source

Source

OCC News Release 2022-4 (January 18, 2022)

Description

Press release on the conditional approval; names the Operating Agreement, capital conditions, crypto-asset condition and the CRA. Verified 2026-09-26

URL

View source

Source

OCC National Banks Active list (as of August 31, 2026)

Description

Confirms SoFi Bank, National Association, charter no. 20862, Cottonwood Heights, UT, active. Verified 2026-09-26

URL

View source

Source

OCC News Release 2025-134 (December 23, 2025)

Description

Proposal to raise the heightened-standards asset threshold from $50 billion to $700 billion; proposed, not final. Verified 2026-09-26

URL

View source

Source

OCC Bulletin 2023-17 — Interagency Guidance on Third-Party Relationships

Description

Current third-party risk management guidance (replaces OCC 2013-29). Verified 2026-09-26

URL

View source

Source

FINRA AWC No. 2019062705801 — SoFi Securities LLC (May 2, 2024)

Description

Letter of Acceptance, Waiver and Consent: censure and $1.1M fine; CIP and ITPP findings; conduct December 2018–April 2019. Verified 2026-09-26

URL

View source

Source

SEC Investment Advisers Act Release No. 5826 — SoFi Wealth LLC (August 19, 2021)

Description

Order instituting settled proceedings: ~20,000 accounts, SFY/SFYX, tax consequences, $300,000 penalty, undertakings. Verified 2026-09-26

URL

View source

Source

SEC adviser registry (IAPD) — firm search "SoFi"

Description

SoFi Wealth LLC registration active (801-78185); SoFi Capital Advisors LLC registration inactive. Verified 2026-09-26

URL

View source

Source

FTC Decision and Order — Docket No. C-4673, In re Social Finance, Inc. and SoFi Lending Corp. (February 2019)

Description

Order text: savings-claim substantiation, compliance reporting, recordkeeping, termination on February 22, 2039. Verified 2026-09-26

URL

View source

Source

FTC press release — FTC Approves Final Order with SoFi (February 2019)

Description

Summary of the complaint allegations (conduct since April 2016) and the final order. Verified 2026-09-26

URL

View source

Source

SoFi press release — SoFi Bank launches crypto trading (November 11, 2025)

Description

States that SoFi Crypto products and services are offered by SoFi Bank, N.A. Read in a browser on 2026-09-26; the page refuses automated requests

URL

View source

Source

SoFi press release — SoFiUSD stablecoin (December 18, 2025)

Description

States that SoFiUSD is issued by SoFi Bank, N.A. and fully reserved. Read in a browser on 2026-09-26; the page refuses automated requests

URL

View source

Source

Tidal Trust I — SoFi Next 500 ETF (SFYX) prospectus supplement (February 2, 2026)

Description

Liquidation of SFYX; Social Finance, Inc. named as sponsor. Verified 2026-09-26

URL

View source

Source

Tidal Trust I — post-effective amendment (June 26, 2026)

Description

SoFi Select 500 ETF (SFY) and two other SoFi-branded ETFs remain registered; Tidal Investments LLC adviser; SoFi sponsor. Verified 2026-09-26

URL

View source

Source

FinCEN — final rule postponing the investment adviser AML rule to January 1, 2028 (December 31, 2025)

Description

Effective date moved from January 1, 2026; rule under review. Verified 2026-09-26

URL

View source

Source

SEC press release 2026-49 — proposed rescission of climate-related disclosure rules (May 29, 2026)

Description

Rules stayed April 4, 2024; defense ended March 27, 2025; rescission proposed. Verified 2026-09-26

URL

View source

Source

OCC Bulletin 2019-47 — stress testing rule amendments

Description

Company-run stress test threshold raised to $250 billion (12 CFR 46). Verified 2026-09-26

URL

View source

Source

SoFi Leadership Team (sofi.com)

Description

Officer roster; secondary to the DEF 14A. Verified 2026-09-26

URL

View source

Source

12 CFR Part 30, Appendix D — OCC heightened standards

Description

Rule text

URL

View source

Source

12 CFR Part 46 — OCC stress testing

Description

Rule text

URL

View source

Source

12 CFR 21.21 — BSA compliance program (national banks)

Description

Rule text

URL

View source

Source

31 CFR 1020.210 — AML program requirements for banks

Description

Rule text

URL

View source

Source

31 CFR 1020.320 — Reports by banks of suspicious transactions

Description

Rule text

URL

View source

Source

31 CFR 1010.230 — Beneficial ownership (CDD)

Description

Rule text

URL

View source

Source

31 CFR 1023.220 — Broker-dealer customer identification program

Description

Rule text

URL

View source

Source

31 CFR Part 1032 — Investment advisers (AML)

Description

Rule text

URL

View source

Source

17 CFR 275.206(4)-7 — Adviser compliance procedures

Description

Rule text

URL

View source

Source

17 CFR 275.204A-1 — Adviser codes of ethics

Description

Rule text

URL

View source

Source

17 CFR 240.17a-3 — Broker-dealer records

Description

Rule text

URL

View source

Source

17 CFR 240.17a-4 — Broker-dealer record preservation

Description

Rule text

URL

View source

Source

17 CFR 229.106 — Regulation S-K Item 106 (cybersecurity)

Description

Rule text

URL

View source

Source

17 CFR 248.201 — Regulation S-ID identity theft red flags

Description

Rule text

URL

View source

Source

12 CFR Part 223 — Regulation W (§§23A/23B)

Description

Rule text

URL

View source

Source

12 CFR Part 44 — OCC Volcker rule

Description

Rule text

URL

View source

Source

12 CFR Part 25 — OCC Community Reinvestment Act rule

Description

Rule text

URL

View source

Source

12 U.S.C. 5515 — CFPB supervision of very large banks

Description

Statute text

URL

View source

Source

12 U.S.C. 5531 — UDAAP

Description

Statute text

URL

View source

Source

12 U.S.C. 5365 — Enhanced supervision and prudential standards

Description

Statute text

URL

View source

Source

12 U.S.C. 1843 — BHCA §4 (financial holding companies)

Description

Statute text

URL

View source

Source

12 U.S.C. 1851 — Volcker Rule

Description

Statute text

URL

View source

Source

12 U.S.C. 1818 — Enforcement (conditions imposed in writing)

Description

Statute text

URL

View source

Source

12 U.S.C. 2901 — Community Reinvestment Act

Description

Statute text

URL

View source

Source

31 U.S.C. 5318 — BSA compliance programs

Description

Statute text

URL

View source

Source

15 U.S.C. 45 — FTC Act §5

Description

Statute text

URL

View source

Source

15 U.S.C. 80b-6 — Advisers Act §206

Description

Statute text

URL

View source

Source

15 U.S.C. 78u-6 — Securities whistleblower incentives and protection

Description

Statute text

URL

View source

Source

GENIUS Act — Public Law 119-27

Description

Statute text (govinfo)

URL

View source

Source

FINRA Rule 3310 — Anti-Money Laundering Compliance Program

Description

Rule text

URL

View source

Source

31 CFR 1020.220 — Bank customer identification program

Description

Rule text

URL

View source

Source

17 CFR Part 243 — Regulation FD

Description

Rule text

URL

View source

Source

17 CFR 240.15c3-1 — Broker-dealer net capital

Description

Rule text

URL

View source

Source

31 CFR Part 501 — OFAC reporting, procedures and penalties

Description

Rule text

URL

View source

Source

15 U.S.C. 78ccc — Securities Investor Protection Corporation

Description

Statute text

URL

View source

Source

12 CFR Part 1002 — Regulation B (ECOA)

Description

Rule text

URL

View source

Source

12 CFR Part 1005 — Regulation E (EFTA)

Description

Rule text

URL

View source

Source

12 CFR Part 1026 — Regulation Z (TILA)

Description

Rule text

URL

View source

Source

NIST Cybersecurity Framework 2.0

Description

Framework text

URL

View source

Source

NIST SP 800-207 — Zero Trust Architecture

Description

Framework text

URL

View source

Source

FFIEC BSA/AML Examination Manual

Description

Manual home. Refuses automated requests (403); loaded in a browser 2026-09-26

URL

View source

Source

FFIEC IT Examination Handbook InfoBase

Description

Handbook home. Refuses automated requests (403); loaded in a browser 2026-09-26

URL

View source

Source

CFPB Supervision and Examination Manual

Description

Manual home

URL

View source

Source

AICPA — SOC 2

Description

Trust Services Criteria overview

URL

View source

Powered by RuleboardAI | Generated 09-26-2026 | Illustrative — SoFi Technologies (SAMPLE) — CompanyScope v1 2026 · RCPS Methodology v1.2 | Public Sources Only

RuleboardAI | ruleboardai.com | Ashwin Tatikola

SAMPLE DOCUMENT — ILLUSTRATIVE USE ONLY

This profile was produced entirely from public sources as a sample deliverable for the RuleboardAI marketing website. No client engagement exists between RuleboardAI and SoFi Technologies, Inc. No client documentation was reviewed. All data is sourced from public filings and regulatory records as cited below.

Not an audit, legal opinion, or attestation. Built from public sources only.

Want this for your company?

What a purchase covers. This sample shows the full report structure across every category. A CompanyScope profile ($500 one-time) covers one category you choose, in the same structure.

Request your CompanyScope profile See products & pricing Contact Us