Company: AFRM
Filing Date: 2025-08-28
Form Type: 10-K
Source: 0001820953-25-000080
Chunk: 31

Company: Affirm Holdings, Inc.
Filing Date: 2025-08-28
Form: 10-K
Item: Item 1
Chunk 31
---
s Data Protection Act of 2018 and similar state laws such as the California Consumer Privacy Act (the “CCPA”), which includes limitations and requirements surrounding the use, disclosure, and other processing of certain personal information about California residents.

We are also subject to regulation by the Consumer Financial Protection Bureau (“CFPB”) under the Dodd-Frank Act and other acts described herein, and we are subject to the CFPB’s supervision and enforcement authority with respect to our compliance with these requirements as a facilitator, servicer, acquirer, or originator of consumer credit. As such, the CFPB has in the past requested reports concerning our organization, business conduct, markets, and activities, and the CFPB may continue to do so from time to time in the future. Additionally, the CFPB’s supervision of us enables it, among other things, to conduct comprehensive and rigorous examinations to assess our compliance with consumer financial protection laws, which could result in investigations, enforcement actions, regulatory fines and mandated changes to our business products, policies and procedures. 

The CFPB, through its supervision and enforcement authority, could increase our compliance costs, potentially hinder our ability to respond to marketplace changes, impose requirements to alter products and services that would make them less attractive to consumers and impair our ability to offer products and services profitably. The CFPB is authorized to pursue administrative proceedings or litigation for violations of federal consumer financial laws. In these proceedings, the CFPB can obtain cease and desist orders (which can include orders for restitution or rescission of contracts, as well as other kinds of affirmative relief) and monetary penalties.

Also, where a company has violated Title X of the Dodd-Frank Act or CFPB regulations under Title X, the Dodd-Frank Act empowers state attorneys general and state regulators to bring civil actions for the kind of cease and desist orders available to the CFPB (but not for civil penalties). In May 2022, the CFPB issued an Interpretive Rule to clarify the authority of states to enforce federal consumer financial protections laws under the Consumer Financial Protection Act of 2010. However, on May 15, 2025, the CFPB rescinded this interpretive rule.  

It is possible that federal regulators could promulgate rulemakings and bring enforcement actions that materially impact our business and the business of our originating bank partners. These regulators may augment requirements that apply to loans facilitated by our platform, or impose new programs and restrictions and could 

18