What changed in SHF Holdings, Inc.'s 10-K — 2024 vs 2025

Item 1. Business. Overview The Company is based in Golden, Colorado. Founded in 2015 by Partner Colorado Credit Union (“PCCU”), SHF was among the first companies to provide compliant banking and lending services to cannabis related businesses (“CRBs”).

Our mission is to provide reliable, compliant financial services to the legal cannabis, hemp, and related industries by enabling financial institution customers to offer compliant banking, lending, and other financial services to CRBs.

Through our proprietary technology platform, which currently operates across 41 states and territories, we enable our financial institution customers to compliantly provide the following services to CRBs: ● Business checking and savings accounts; ● Cash management accounts; ● Savings and investment options; ● Commercial lending; ● Courier services (via third-party relationships); ● Remote deposit services; ● Automatic Clearing House (“ACH”) payments and origination; and ● Wire payments.

Our core service offerings include: ● Regulatory compliance consulting and technology: We provide our financial institution customers with the tools and support needed to maintain “Know Your Customer” (“KYC”), Anti-Money Laundering (“ AML ”) and Bank Secrecy Act (“BSA”) compliance, principally delivered through our proprietary financial services platform.

Specific compliance services include initial customer due diligence, customer application management, program management support, compliance monitoring, and regulatory examination assistance. ● Cannabis-related deposit services: We originate, onboard, verify, and service cannabis-related deposit business for and on behalf of our financial institutions, primarily PCCU, and constitute obligations solely of those institutions; the Company is not a financial institution and does not hold customer deposits on its consolidated balance sheet.

Because most CRBs transact with high volumes of cash due to the limited availability of traditional banking services, our platform benefits both CRBs and financial institutions by providing CRBs access to compliant banking and giving financial institutions access to increased, compliantly monitored deposits. ● Lending services: We source, underwrite, service, and administer loans issued to cannabis businesses and related entities, many of which are also clients of our partner financial institutions.

We generate revenue through fee income, investment income, and loan program income earned by providing these compliance and lending services to financial institutions serving the cannabis industry. Financial Services Platform We have developed and commercialized a proprietary financial services platform, known as the Safe Harbor Program (the “Program”), which enables financial institutions to provide compliant banking services to CRBs.

Our platform is currently deployed across 41 states and territories and is designed to guide financial institution customers and CRBs through the full lifecycle of account onboarding, validation, and ongoing compliance monitoring in a manner consistent with applicable banking regulations and regulatory guidance.

It is intended to satisfy the compliance standards required by state and federal banking regulators, and since inception, we have assisted in the processing of approximately $35.4 billion in cannabis-related depository funds and successfully supported our financial institution clients through more than 25 state and federal banking examinations.

It is important to note that the Company is not a financial institution and does not include loans or customer deposits, which are associated with financial institutions, on its consolidated balance sheet. All deposit accounts are held by our financial institution customers, and all funds transmitted to and from those accounts are handled directly by those institutions.

Our role is to provide the compliance infrastructure, technology, and CRB client relationships that enable our financial institution partners to serve the cannabis industry. 7 We also license the Program to financial institutions that wish to independently provide compliant cannabis banking services.

Under these licensing arrangements, we provide: ● Initial customer due diligence (e.g., KYC); ● Program management support; ● Regulatory examination assistance; ● Customer application management; ● Compliance monitoring; and ● Regulatory examination assistance. We believe our platform and processes have been implemented in a manner that is consistent with applicable laws and regulations.

CRB Deposits We maintain relationships with PCCU and other financial institution partners in which CRB funds are deposited and monetary transactions are processed. Our proprietary platform connects with the core banking systems of these institutions, enabling us to monitor deposit accounts we have onboarded and to extract the data necessary to help ongoing compliance.

All fund transmissions including wires, ACH transactions, and other transfers are processed directly through our financial institution partners’ infrastructure. The Company itself is not a financial institution and does not hold customer deposits. How We Generate Revenue from Deposit Maintained at Financial Institutions? We generate revenue from deposit maintained at financial institutions in three primary ways.

First, we may assess an initial onboarding fee when a CRB or ancillary service provider begins banking through one of our financial institution partners. This fee reflects the time and complexity involved in completing the KYC and BSA due diligence that is required before an account can be opened.

Second, we earn monthly deposit and account activity fees that are based on business type, account size, and transaction activity. Third, we earn investment income when our financial institution partners invest CRB deposits in low-risk, liquid assets.

The amount of investment income we earn is directly influenced by the level of deposits under their management and the prevailing interest rate environment. 8 Our Relationship with PCCU PCCU is our primary financial institution partner and the holder of the majority of CRB deposit accounts we service, and this relationship is governed by the Second Amended CAA.

Under the Second Amended CAA, we provide PCCU with the compliance infrastructure, technology, and CRB client relationships needed to serve the cannabis industry, and in return we earn account servicing fees, investment income on CRB deposits, and a share of loan program income on CRB loans originated through PCCU.

We also pay PCCU a monthly asset hosting fee for access to its regulated banking platform and infrastructure. The Second Amended CAA will expire on December 31, 2031, afterwards the agreement will automatically renew for periods of two years unless we or PCCU provides a non-renewal notice twelve months prior to the expiration of the then-current period.

Because PCCU accounts for a significant portion of our revenue, the loss of or a material change to this relationship could have a material adverse impact on our results of operations and financial condition.

See Part 1, Item 1A., “Risk Factors––Risks Related to the Second Amended CAA,” Part II, Item 7., “Management’s Discussion and Analysis of Financial Condition and Results of Operations for the Years ended December 31, 2025 and 2024––Relationship with PCCU,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations for the Years ended December 31, 2025 and 2024––Related Party Relationship with PCCU” and Note 10 to the Company’s consolidated financial statements in this Form 10-K for additional detail on our relationship with PCCU and the terms of the Second Amended CAA.

Commercial Lending Program Commercial lending is a key component of our business and an important source of revenue. Our lending program is designed to specifically address the unique financing needs of CRBs, which often have limited access to traditional credit markets.

We assist, service, and administer loans on behalf of our financial institution partners, with the majority of lending currently funded through PCCU using CRB deposit balances that we have onboarded and continue to manage. Our lending program is focused primarily on senior secured loans, with collateral including real estate, equipment, accounts receivable, and other business assets.

Our loan operations team is directly involved in each step of the lending process, including initial due diligence, underwriting, loan closing and documentation, ongoing servicing, payment processing, borrower monitoring, risk rating, and workout and collections when necessary. PCCU’s loan committee retains final approval authority over all credit decisions, and PCCU is the legal lender of record under all loan agreements.

We earn a share of the loan program income on loans originated through PCCU under the terms of the Second Amended CAA. See “––CRB Deposits” above and Note 10 to the Company’s consolidated financial statements in this Form 10-K for additional information.

Our available lending capacity is directly tied to the size of our managed deposit base, as the amount we can arrange in loans through PCCU is based on a regulatorily stipulated percentage of average CRB deposits.

We are incentivized to deploy available lending capacity, as loan program income on funded loans generally exceeds the investment income that would otherwise be earned on the same deposits. Growing and retaining the CRB deposit base therefore remains central to our ability to expand the lending program.

In 2025, we executed lending program agreements with certain companies that provide us access to private capital sources, including family offices and private equity funds. These agreements provide additional funding channels for CRB loans outside of our PCCU relationship. These agreements are intended to diversify our lending capacity and reduce our dependence on a single funding source.

The Company did not have any revenue from these arrangements, we believe these agreements represent an important avenue for future growth as we continue to build and deploy the lending program.

Our Mission Our mission is to serve as the trusted financial partner to CRBs and the financial institutions that serve them by providing the compliance infrastructure, lending access, and operational support to allow them to operate, grow, and succeed in a highly regulated industry.

Item 1A. Risk Factors. We are subject to risks and uncertainties that could potentially negatively impact our business, financial conditions, results of operations and cash flows.

This section contains a description of certain risks and uncertainties identified by management that could, individually or in combination, harm our business, results of operations, liquidity and financial condition, as well as our financial instruments and our securities.

These disclosures reflect the Company’s beliefs and opinions as to factors that could materially and adversely affect the Company and its securities in the future.

References to past events are provided by way of example only and are not intended to be a complete listing or a representation as to whether or not such factors have occurred in the past or their likelihood of occurring in the future.

In evaluating us and our business and making or continuing an investment in our securities, you should carefully consider the risks described below as well as other information contained in this Form 10-K and any risk factors and uncertainties discussed in our other public filings with the SEC under the caption “Risk Factors.” We may face other risks that are not contained in this Form 10-K, including additional risk that are not presently known, or that we presently deem immaterial.

This Form 10-K and the risks discussed below also include forward-looking statements, and our actual results may differ substantially from those discussed in such forward-looking statements.

Please refer to the sections in this Form 10-K titled “Cautionary Note Regarding Forward-Looking Statements” for additional information regarding forward-looking statements and “Summary of Risk Factors” for additional information regarding the risks and uncertainties that could potentially negatively impact our business, financial conditions, results of operations and cash flows.

Risks Related to the Company’s Business Our revenue has declined significantly in recent periods, and we cannot guarantee that the economics of the Second Amended CAA will fully restore our financial performance. Our loan interest income declined sharply following the First Amended CAA, which reduced our income share to approximately 35%.

While the Second Amended CAA, increases our income share to up to 65%, this comes at the cost of an up to 65% loan loss indemnification obligation. As such, we cannot guarantee that the economics of the Second Amended CAA will fully restore our financial performance if we are required to fulfill our indemnification obligations.

Our revenue has declined due to account attrition, lower pricing, introduction of money market accounts that share interest earned with the depositor and reduced transaction activity within the cannabis industry.

The fees we earn from deposit accounts and transaction activity are directly tied to the number of active CRB accounts, the average balances those accounts maintain, and the volume of transactions processed through our platform.

Over recent periods, we have experienced account attrition and lower balances, reflecting broader economic pressures in the U.S. cannabis industry, including reduced wholesale pricing and constrained operator liquidity. These trends reduce both our account fee income and the deposit base on which we earn investment income.

We also introduced a money market account that shares the interest earned with depositors, which reduces the average revenue generate d from CRBs . We cannot predict when, or whether, conditions in the cannabis industry will improve, or whether accounts lost to attrition will be replaced by new customers.

Volatility in interest rates may adversely affect our revenues, profitability, and competitive position. Our investment income is earned on CRB deposits held at PCCU based on the Interest on Reserve Balances (IORB) paid by the Federal Reserve, which is sensitive to changes in prevailing interest rates and including policy decisions by the Federal Reserve.

When interest rates decline, the yield earned on CRB deposits decreases, and when interest rates rise, the yield earned on CRB deposits increases. A sustained low-rate environment could materially reduce our revenues and make it more difficult for us to achieve or maintain profitability.

In addition, lower interest rates could reduce the interest rates charged on new loans made to CRB borrowers. Our recurring operating losses and negative cash flows from operations raise substantial doubt about our ability to continue as a going concern.

The Company has incurred recurring losses from operations and negative cash flows from operations, including an operating loss of approximately $5.4 million and cash used in operating activities of approximately $3.4 million for the year ended December 31, 2025, which raise substantial doubt about the Company’s ability to continue as a going concern.

Management has taken steps to preserve liquidity, including restructuring revenue sharing under the Second Amended CAA to increase the Company’s share of loan program income from approximately 35% to 65%, seeking strategic partnerships, reducing operating expenses, maintaining access to a $150 million ELOC and monitoring its liquidity position.

Notwithstanding these measures, there is no assurance that management’s plans will be sufficient to sustain operations, and if the Company is unable to achieve profitability or access adequate capital on acceptable terms, it may be forced to reduce spending, liquidate assets, or curtail operations, any of which could materially harm the Company’s business and financial condition.

Furthermore, the independent auditors’ report on our consolidated financial statements for the year ended December 31, 2025 includes an explanatory paragraph that expresses substantial doubt about our ability to continue as a going concern. In addition, our future financial statements may include similar qualifications about our ability to continue as a going concern.

Our financial statements were prepared assuming that we will continue as a going concern and do not include any adjustments that may result from the outcome of this uncertainty.

See Part II, Item 7., “Management’s Discussion and Analysis of Financial Condition and Results of Operations for the Years ended December 31, 2025 and 2024––Liquidity” and Note 2 to the Company’s consolidated financial statements in this Form 10-K for further details. 22 Risks Related to the Second Amended CAA PCCU’s loan program is substantially dependent on the regulatory restrictions placed on PCCU, which may limit the types, terms, and amounts of loans offered.

PCCU is a federally chartered credit union subject to regulation by the National Credit Union Administration. PCCU is subject to regulatory capital requirements, portfolio concentration limits, currently capped at 60% of total assets in CRB-related deposits, and periodic examinations by applicable oversight authorities.

If PCCU’s regulators impose more restrictive requirements, reduce its concentration limit, or restrict its ability to make CRB loans, the size and composition of the loan portfolio from which we earn income could be materially reduced.

We have no ability to compel PCCU to originate loans or to maintain its current regulatory posture, and changes in PCCU’s regulatory environment could restrict the loan program we depend on for a significant portion of our revenue. The Second Amended CAA reinstates an indemnification obligation of up to 65% of loan loss.

Under the Second Amended CAA, we receive up to 65% of loan program income generated by PCCU’s CRB loan portfolio. In exchange, we are obligated to indemnify PCCU for up to 65% of net losses of a default on any loan covered by the Second Amended CAA.

This obligation has no maximum dollar limit and covers principal, accrued interest, fees, legal costs, collection costs, and collateral disposition costs, net of any recoveries. As of the date the Second Amended CAA was entered into, the total loan portfolio was approximately $52.1 million, giving us a theoretical maximum indemnification exposure of approximately $33.8 million.

If one or more significant loan defaults occur, our indemnification obligations could be substantial and could materially impair our financial condition and ability to operate.

See Part II, Item 7., “Management’s Discussion and Analysis of Financial Condition and Results of Operations for the Years ended December 31, 2025 and 2024––Relationship with PCCU.” We are required to maintain sufficient balance sheet resources to support our indemnification obligations under the Second Amended CAA.

The Second Amended CAA requires us to certify monthly to PCCU that we maintain adequate liquidity to support our 65% indemnification obligation. While we currently meet this requirement, there is no assurance that we will continue to do so. Our cash position may decline as a result of operating losses, capital expenditures, debt service, or indemnification payments.

If we are unable to certify adequate liquidity or if material indemnification claims are made against us, our ability to continue operating could be significantly impaired Our indemnification obligation is unlimited in amount, and our actual losses could exceed our current estimates and our available cash. The indemnification obligation under the Second Amended CAA has no dollar cap.

Our ability to satisfy indemnification claims depends entirely on our maintaining sufficient cash and liquidity at the time a claim arises. As of December 31, 2025, we held cash of $6.8 million; however, our cash position may decline due to operating losses, working capital needs, or prior indemnification payments.

If we are unable to fund an indemnification claim, PCCU would bear the full loss on the affected loan. Such a failure could severely damage our relationship with PCCU, result in a default under the Second Amended CAA, and jeopardize our ability to continue operating.

We are required to maintain sufficient cash and cash equivalents to support our indemnification obligations under the Second Amended CAA. The Second Amended CAA requires us to certify monthly to PCCU that we maintain adequate liquidity to support our 65% indemnification obligation. While we currently meet this requirement, there is no assurance that we will continue to do so.

Our cash position may decline as a result of operating losses, capital expenditures, debt service, or indemnification payments.

If we are unable to certify adequate liquidity or if material indemnification claims are made against us, our ability to continue operating could be significantly impaired. 23 PCCU retains final loan approval authority and may decline loans that meet our underwriting standards, which could limit our revenue growth.

We control the loan origination process and assist with underwriting, risk rating, and credit analysis, for these loans and determine which loan applications are submitted to PCCU for funding. However, PCCU’s loan committee retains final approval authority and may reject loans that we have underwritten and recommended for funding.

A pattern of rejections on loans we consider creditworthy could reduce the size of the loan portfolio, limit our loan program income, and constrain our ability to grow revenue under the Second Amended CAA. We cannot compel PCCU to approve any loan we originate, and disagreements over credit standards could adversely affect our relationship with PCCU and our financial results.

One borrower represents approximately 18% of the total loan portfolio and carries the second highest risk classification. As of December 31, 2025, one borrower had an outstanding loan balance of approximately $9.3 million, representing approximately 18% of our total CRB loan portfolio.

This loan carries the second highest risk rating under the risk rating classification system used in the loan program, and which indicates that collection or liquidation in full is highly questionable, doubtful and improbable, with anticipated losses ranging from 20% to 50% of the outstanding balance.

Our 65% indemnification exposure on this single loan could result in a loss to us of between approximately $2.2 million, net of estimated collateral value and $6.1 million, uncollateralized.

As of December 31, 2025, the Company has recorded provisions of $0.4 million and $0.3 million in the consolidated balance sheet for financial indemnification liability under ASC 326 and standby guarantee obligations under ASC 460, respectively. The realization of any portion of this loss could materially impair our liquidity and financial condition.

The CRB loan portfolio is concentrated entirely in the cannabis industry, and cannabis-specific collateral is subject to significant valuation discounts, legal uncertainties, and a limited buyer pool in a foreclosure or forced sale. All loans in the portfolio we indemnify are made to CRBs.

In the event of a default, the primary collateral securing these loans is typically real estate used in cannabis operations. PCCU eliminates the cannabis license premium (sometimes referred to as the “green tax”) from its collateral valuations and applies a further 60% reduction to estimate realizable value in a non-cannabis sale.

As a result, the effective collateral value available to offset loan losses in a foreclosure or forced sale is significantly lower than for comparable conventional commercial real estate. This means our actual loss for a given default, and therefore our indemnification payments under the Second Amended CAA, may be materially higher than we currently estimate.

Certain provisions in the Second Amended CAA create a direct link between our listing compliance and our revenue. The Second Amended CAA contains a provision that automatically reduces our loan program income share percentage if we determine that our indemnification percentage must be reduced in order to maintain our listing on The Nasdaq Stock Market (“Nasdaq”).

In the event of such a determination, our income split percentage will be reduced to match our indemnification percentage, with a retroactive true-up to the immediately preceding quarter that will be settled within ten days of our next filing with the SEC.

A reduction in the indemnity percentage would directly reduce our revenue and could signal financial distress to the market. This provision means that a Nasdaq compliance issue could simultaneously impair both our capital markets access and our operating income.

The initial fair value measurement of our stand-ready guarantee liability at inception under the Second Amended CAA involves significant estimates and judgment and is subject to material uncertainty. We are required under ASC 460, Guarantees , to recognize the fair value of our stand-ready guarantee obligation at inception.

We are finalizing this initial fair value measurement with the assistance of a third-party valuation specialist. This is a Level 3 measurement under the fair value hierarchy, meaning it relies on significant unobservable inputs, including assumed default probabilities, loss given default rates, cannabis-specific collateral discount assumptions, discount rates, and the timing of potential guarantee payments.

The fair value of this liability is fixed at inception and released over the remaining term of the Second Amended CAA as we are released from risk. Because this measurement depends entirely on management assumptions and unobservable market inputs, actual results could differ materially from our estimates.

Errors in this measurement, or changes in the assumptions used, could result in material charges to our income statement or require restatements of our financial statements. Our ongoing expected financial indemnification liability under the Current Expected Credit Loss (“CECL”) standard (ASC 326) requires quarterly ongoing remeasurement and is subject to material uncertainty.

Pursuant to ASC 326, Financial Instruments – Credit Losses , using the CECL methodology, coinciding with the first period in which the Company held financial assets within the scope of the standard. Our financial indemnification liability represents our estimate of 65% of the expected credit losses on the covered loan portfolio under the Second Amended CAA.

Unlike our ASC 460 stand-ready guarantee liability, which is fixed at inception, our financial indemnification liability is dynamic and remeasured every quarter to reflect current conditions, forward-looking economic forecasts, updated default probability assumptions, revised loss given default estimates, and changes in collateral values.

Because the cannabis commercial real estate lending market has limited historical loss data for reliable statistical calibration, our estimates for financial indemnification liability involve a higher-than-normal degree of management judgment.

Changes in these estimates in future periods, including as a result of borrower deterioration, collateral value declines, or changes in economic conditions, could result in material charges to credit loss expense in our income statement.

Errors in these measurements could also require restatements of our financial statements. 24 We are dependent on third parties, including PCCU and other service providers, for certain critical services, and disruptions at PCCU would directly and immediately impair our operations. PCCU provides the regulated banking infrastructure on which our entire service model depends.

We do not hold a bank or credit union charter and cannot directly offer deposit, lending, or payment services to CRB clients. Operational disruptions at PCCU whether caused by a regulatory action, a cybersecurity incident, a financial stress event, or an operational failure would directly and immediately impair our ability to serve our clients and generate revenue.

We have limited ability to transition our operations to an alternative financial institution partner on short notice, and the loss of PCCU’s operational infrastructure for any extended period could be fatal to our business. We are almost entirely dependent on PCCU as our banking partner.

Substantially all deposits from our CRB clients are held at PCCU, and substantially all of our revenue is generated through the services we provide under the Second Amended CAA. We currently have no other financial institution partner of comparable scope.

The loss of our relationship with PCCU, or a material adverse change to the terms of the CAA, would have a material adverse effect on our business, revenues, and operations.

Until we enter into agreements with one or more additional financial institution partners, our ability to grow our client base and diversify our revenue is significantly constrained Loan program income (formerly loan interest income) could decline under the Second Amended CAA if the indemnity reserve would cause our shareholders’ equity to drop below the Nasdaq Listing Requirements to maintain compliance.

The Second Amended CAA contains a provision that automatically reduces our loan program income (formerly loan interest income) share percentage if we determine that our indemnification percentage must be reduced in order to maintain our Nasdaq listing. In the event of such a determination, our income split percentage will be reduced to match our indemnification percentage.

Any such adjustment in our indemnification obligation would result in a corresponding decrease in the amount of loan program income generated by PCCU’s CRB loan portfolio that we receive pursuant to the Second Amended CAA.

The current listing requirement is a minimum of $2.5 million of shareholders’ equity, and if Nasdaq were to increase this requirement such that it exceeded the Company’s balance sheet equity, or the Company’s balance sheet equity decreases below $2.5 million, our loan program income could decline.

See “––Risks Related to the Second Amended CAA––Certain provisions in the Second Amended CAA create a direct link between our listing compliance and our revenue.” Risks Related to the Cannabis Industry and Regulatory Environment We have agreements with financial institutions that provide banking services to CRBs, which exposes us to additional liabilities, regulatory compliance costs, and reputational risk.

Our business is built on serving an industry that remains illegal under federal law.

This creates unique risks that do not apply to service providers operating in conventional industries, including potential federal enforcement actions, heightened regulatory scrutiny of our financial institution partners, difficulty obtaining banking services and insurance, and reputational harm that could affect our ability to attract investors, employees, and customers.

Any increase in federal enforcement activity targeting cannabis-related financial services could have an immediate and material adverse effect on our business. Cannabis remains a Schedule I controlled substance under federal law, and changes in federal enforcement policy or the scheduling status of cannabis could affect our business in unpredictable ways.

Cannabis is classified as a Schedule I controlled substance under the CSA and is illegal under federal law. While some federal administrations have adopted policies of non-enforcement with respect to state-licensed cannabis operations, those policies can change at any time.

Potential federal rescheduling of cannabis from Schedule I to Schedule III, while potentially reducing enforcement risk for CRBs, could also attract new competitors into the cannabis banking market, alter the regulatory framework governing financial institutions that serve CRBs, change the federal tax treatment of CRB operators, or otherwise disrupt the economics of the market we serve.

Item 1C. Cybersecurity. Risk Management and Strategy The Company has implemented a written information security program designed to address the confidentiality, integrity, and availability of information systems and the non-public personal information the Company holds on behalf of its clients and business partners.

The program is designed to comply with applicable requirements under Regulation S-P and the Federal Trade Commission Safeguards Rule. 32 Program Components.

The Company’s cybersecurity risk management program includes the following key elements: ● Threat Detection and Response: The Company uses a combination of automated tools and manual procedures to detect, contain, and respond to cybersecurity threats, including malicious code detection, network monitoring, and security incident response protocols ● Vulnerability Management: The Company engages a third-party cybersecurity service provider it believes is qualified to conduct periodic vulnerability assessments, penetration testing, and risk evaluations of the Company’s information systems. ● Third-Party Vendor Risk Management: Before engaging service providers that will access, transmit, or store Company or client data, management performs due diligence to evaluate their cybersecurity practices.

The Company seeks to engage vendors that maintain cybersecurity programs reasonably consistent with the Company’s own standards. ● Employee Training and Awareness: All officers and employees are subject to the Company’s information security policies and procedures and are required to participate in periodic cybersecurity education and awareness training. ● Integration with Enterprise Risk Management: The Company’s cybersecurity risk management program is integrated into its broader enterprise risk management framework and utilizes the same common reporting channels and governance processes and the broader framework. ● Third-Party Assessments.

The Company engages an external cybersecurity services provider to assist in assessing and managing cybersecurity risks. This provider supports threat monitoring, incident response planning, and periodic assessments of the effectiveness of the Company’s security controls. ● Material Cybersecurity Incidents.

See Part I, Item 1A., “Risk Factors––Risks Related to Legal Proceedings and Regulatory Compliance––An interruption in, or breach of security of, our information systems could adversely affect us.” Governance Board Oversight The Board of Directors recognizes that cybersecurity is an important component of the Company’s overall risk management framework.

The Board has delegated primary oversight responsibility for cybersecurity risk to management, which periodically briefs the Board on the status of the cybersecurity program, material developments, and the threat environment.

Management Responsibility Day-to-day responsibility for the cybersecurity program is managed by Jeremy Robinson, the Company’s Vice President of Information Technology, who oversees the design, implementation, and maintenance of the Company’s information security program , including: ● Monitoring the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents; ● Managing relationships with third-party cybersecurity service providers; and ● Reporting material cybersecurity threats or incidents to the Chief Executive Officer and, where appropriate, to the Board.

The Chief Executive Officer is responsible for ensuring that material cybersecurity matters are escalated to the Board in a timely manner , although Mr.

Robinson may also report material cybersecurity threats or incidents to the Board. 33 Incident Response The Company maintains cybersecurity incident response procedures that provide a framework for identifying, assessing, containing, and remediating cybersecurity incidents, including procedures for timely reporting to the Board and, where required, to regulators and affected individuals

During the year ended December 31, 2025, the property owner of the Golden, Colorado facility became subject to a court-appointed receivership. Throughout the receivership period, the Company continued to occupy the premises and made all rental payments in accordance with the existing lease terms.

During the fourth quarter of 2025, the receivership process concluded with the sale of the property to a new owner. The Company’s lease was assumed by the new property owner, and the lease continues in full force and effect under its existing terms and conditions.

The sale and change in ownership did not result in a lease modification, reassignment, or early termination of the lease, and had no material impact on the Company’s operations or financial position. No impairment of the related right-of-use asset was identified, and no remeasurement of the lease liability was required under ASC 842.

The Company has no other material properties and does not own any real property.

The lawsuit arises from a dispute over the terms of the Company’s October 2022 acquisition of Abaca pursuant to a merger agreement that was subsequently amended in November 2022 and in October 2023 (the “Second Amendment”). The Second Amendment restructured certain merger consideration, including introducing warrants and modifying payment timing.

The defendants contend the Second Amendment is invalid under Delaware law and seek to have it set aside, which would reinstate the original payment terms and potentially increase the Company’s obligations. The Company maintains that the Second Amendment was validly executed and is binding.

On April 18, 2025, the District Court issued an order denying the Company’s motion to dismiss most of the counterclaims, but the District Court did dismiss claims against the Company’s Chairman, Fred Niehaus, with prejudice.

The District Court also clarified that the Delaware statutes cited by the defendants govern pre-closing amendments and do not authorize post-merger amendments altering consideration, a finding that is consistent with the Company’s legal position. The case is currently in active discovery. A ruling on the summary judgement briefing is pending, and a court date is scheduled for May 2026.

Financial Exposure The Company has assessed its potential exposure under ASC 450, see Note 20 Commitments and Contingencies. If the District Court upholds the Second Amendment, which the Company believes was validly executed and is binding, its cash obligation is limited to the $3.0 million already deposited in the District Court’s registry, with additional exposure limited primarily to legal fees.

The Company currently considers an adverse outcome reasonably possible but not probable. Accordingly, no accrual has been recorded for this contingency beyond the $3.0 million already reflected in the financial statements. The estimated range of loss is $0 to $7.8 million.

Financial Statements and Supplementary Data 56 Item 9. Changes in and Disagreements With Accountants on Accounting and Financial Disclosure 56 Item 9A. Controls and Procedures 56 Item 9B. Other Information 58