Company: NEWTP
Filing Date: 2025-08-15
Form Type: 424B2
Source: 0001587987-25-000152
Chunk: 105

Company: NewtekOne, Inc.
Filing Date: 2025-08-15
Form: 424B2
Chunk 105
---
 other internal control procedures to assure the security of our and our customers’ data, we cannot guarantee that these measures will be sufficient for this purpose. If our and our IT provider’s security measures are breached as a result of third-party action, employee error or otherwise, and as a result our or our customers’ data becomes available to unauthorized parties, we could incur liability and our reputation would be damaged, which could lead to the loss of current and potential customers. If we experience any breaches of our network security or sabotage, we might be required to expend significant capital and other resources to detect, remedy, protect against or alleviate these and related problems, and we may not be able to remedy these problems in a timely manner, or at all. Because techniques used by outsiders to obtain unauthorized network access or to sabotage systems change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. For example, in early 2018, an unauthorized third-party misappropriated three of NTS’ domain names. NTS’ management and forensic investigators determined that attackers compromised a portion of NTS’ shared webhosting system, and may have acquired certain customer information limited to its shared webhosting customers, and/or gained access to certain of its shared webhosting servers. In response, NTS has taken a range of steps designed to further secure its systems, enhance its security protections, enhance access controls, and prevent future unauthorized activity.

As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Although we have insurance in place that covers such incidents, the cost of a breach or cyber-attack could well exceed any such insurance coverage.

If we are deemed to be an investment company under the Investment Company Act of 1940, we will not be able to successfully execute our business strategy.

Certain of our subsidiaries rely on Rule 3a-7 to exclude their securitization activities from the definition of an “investment company” under the 1940 Act. Additionally, the Company has determined that, after withdrawing its election to be treated as a business development company, it is not an “investment company” because it neither holds more than 40% of its assets in “investment securities,” nor is it primarily engaged in, or holding itself out as being primarily engaged in, the business of investing, reinvesting or trading in securities. As a part of its determination