Company: AFRM
Filing Date: 2025-08-28
Form Type: 10-K
Source: 0001820953-25-000080
Chunk: 69

Company: Affirm Holdings, Inc.
Filing Date: 2025-08-28
Form: 10-K
Item: Item 1A
Chunk 69
---
, and the failure of third parties to comply with legal or regulatory requirements or to provide various services that are important to our operations could have an adverse effect on our business, results of operations, financial condition, and future prospects.

We have significant third-party partners that, among other things, provide us with financial, technology, and other services to support our products and other activities, including, for example, credit ratings and reporting, cloud-based data storage and other IT solutions, and payment processing. The CFPB and prudential regulators have issued guidance stating that institutions under their supervision may be held responsible for the actions of the companies with which they contract. Accordingly, we could be adversely impacted to the extent our third-party partners fail to comply with the legal requirements applicable to the particular products or services being offered.

In some cases, third-party partners are the sole source, or one of a limited number of sources, of the services they provide to us. For example, we are solely reliant on our agreement with our cloud computing web services provider for the provision of cloud infrastructure services to support our platform. In addition, we rely on a single third-party partner to provide a number of issuing and processing services across several of our products.  

Most of our third-party partner agreements are terminable by the third-party on little or no notice, and if our current third-party partners were to terminate their agreements with us or otherwise stop providing services to us on acceptable terms, we may be unable to procure alternatives from other vendors in a timely and efficient manner and on acceptable terms (or at all). If any third-party partner fails to provide the services we require, fails to meet contractual requirements (including compliance with applicable laws and regulations), fails to maintain adequate data privacy controls and electronic security systems, or suffers a cyber-attack or other security breach, such as the Evolve Bank & Trust cybersecurity incident reported in June 2024, we could be subject to CFPB, FTC and other federal and state regulatory enforcement actions, claims from third parties, including our consumers, and suffer economic and reputational harm that could have an adverse effect on our business. Further, we may incur significant costs to resolve any such disruptions in service, which could adversely affect our business.

For example, certain installment loans are originated by our originating bank partners and then disbursed to merchants via one-time-use virtual cards facilitated through our partnership with an issuer processor. This issuer processor issues one-time-use virtual cards through an issuing bank partner, which allow loans facilitated through our platform to be processed over the