Bread Financial Holdings

None of the warning signs we check for were found.

We look for five warning signs: doubt it can keep going, weak checks on its own accounts, a notice that its past accounts can't be relied on, a change of auditor, and one customer bringing in a big share of sales. We don't check lawsuits, investigations or debt yet.

We checked the auditor's report, internal controls, restatement notices, auditor changes and big customers in the 10-K filed 13 Feb 2026, plus the 10-Q filed 28 Jul 2026 and 17 later 8-Ks.

• Sales have shrunk: 3.2% a year.

Whether the price already reflects the risks is what the deep dive is for.

• The development and use of AI present risks and challenges that may adversely impact our business or customers.

  Could happen

  In addition, the adoption of agentic commerce, in which autonomous AI agents initiate and execute transactions on behalf of users, presents novel and complex regulatory, privacy and cybersecurity risks, as well as risks relating to potential integrations with other agentic commerce applications. Legal frameworks governing such autonomous agents remain nascent, with limited direct guidance specific to payments. The interplay between payments regulations, data privacy laws and evolving AI regulations may create uncertainty around compliance and disclosure obligations and potential liability exposure as more participants (including retailers, fintechs and AI developers) enter the agentic commerce ecosystem. The market is still assessing how regulators may apply existing consumer protection and other laws in the context of AI. As agentic commerce solutions scale, we may also see increased instances of erroneous or disputed payments and other adverse impacts.

  Read moreShow less

• Reductions in interchange fees, or changes in the laws and regulations governing such fees, could have various adverse impacts on our business and results of operations.

  Could happen

  Tabl e of Contents The court’s ruling against the plaintiffs will be appealed. Unless the plaintiffs obtain a stay or injunction during the appeal process or the legislature otherwise intervenes, the prohibition on charging interchange fees on sales tax and gratuities in Illinois will become effective July 1, 2026. Similar legislation has been introduced in other states and, absent a successful legal challenge, these bills would have a number of adverse impacts on us, including negatively impacting our interchange revenue and creating operational challenges. In addition, in November 2025, a proposed settlement was announced in the long-standing Visa/Mastercard litigation, which began in 2005 when a class of merchant plaintiffs alleged that Visa and Mastercard, along with their member banks, engaged in anti-competitive practices by collectively setting excessive interchange fees and imposing other restrictive rules on merchants. The proposed settlement would, among other items, reduce interchange fees and give merchants greater choice in accepting credit cards in various categories, which could have various adverse impacts on our business, including reduced interchange revenue and decreased acceptance of certain of our cards by retailers. The proposed settlement remains subject to court approval, and we can provide no assurance with respect to the timing or outcome of the court approval process or the effects on us of the settlement if approved.

  Read moreShow less

• Risk Management Roles and Responsibilities

  Could happen

  Beginning in 2025 we removed model risk as a unique, stand-alone risk pillar and have instead allocated model risk across the eight other risk pillars. Model Risk is the risk arising from decisions based on incorrect or misused model outputs and reports. Model risk occurs primarily for three reasons:

  Read moreShow less

• Business interruptions, including loss of data center capacity, interruption due to cyber-attacks, loss of network connectivity or inability to utilize proprietary software of third-party vendors, could affect our ability to timely meet the needs of our partners and customers and harm our business.

  Could happen

  We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information. Our ability, and that of our third-party service providers and brand partners, to protect our IT Systems and Confidential Information against damage, loss or performance degradation from power loss, network failure, cyber-attacks, including ransomware or denial of service attacks, social engineering/phishing, use of AI technologies by bad actors, deepfakes, insider threats, state-sponsored threats, hardware and software defects or malfunctions, human error, computer viruses or other malware, misconfigurations, bugs or other vulnerabilities, malicious code embedded in open-source software, disruptions in telecommunications services, fraud, fires and other disasters and other events, is critical. Because the tactics, techniques and procedures used to obtain unauthorized access, or to disable or degrade systems, change frequently, have become increasingly more complex and sophisticated, and may be difficult to detect for periods of time, we may not anticipate these acts or respond adequately or timely. For example, cybercriminals have increasingly demonstrated advanced capabilities, such as use of zero-day vulnerabilities, and rapid integration of new technology such as GenAI are being used by threat actors to create sophisticated attacks that are increasingly automated, targeted and more difficult to defend against.

  Read moreShow less

• The development and use of AI present risks and challenges that may adversely impact our business or customers.

  Could happen

  We or our third-party vendors, clients or counterparties have developed or incorporated, or may in the future develop or incorporate, AI technology in certain business processes, services or products. For example, we have developed an AI powered knowledge management solution for our customer care associates designed to achieve the highest possible customer service standards and customer experience. The development and use of AI, however, presents a number of risks and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the United States and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer and data protection, employment and other laws applicable to the use of AI. Several states have already adopted AI-specific frameworks or are considering applying existing consumer and data protection laws to regulate AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take actions that are incorrect, that result in the release of private, confidential or Tabl e of Contents proprietary information, that reflect biases included in the data on which they are trained, infringe on the intellectual property rights of others or that are otherwise harmful. In addition, certain uses of AI technology may be subject to regulation, such as requirements to explain how the AI model works and why it generates a particular output, eliminate biases built into the AI model, reduce erroneous outputs, and comply with regulations requiring watermarking AI-generated content and disclosures when consumers are interacting with AI or when decisions are made by AI, as well as requiring documentation or explanation of the basis on which decisions are made. These additional requirements may impose increased costs on our technology and compliance functions, which could put us at a competitive disadvantage and have an adverse effect on our results of operations and financial condition. Further, we may rely on AI models developed by third parties, and would be dependent in part on the manner in which those third parties develop, train and deploy their models, including risks arising from the inclusion of any unauthorized material in the training data for their models, the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models and other matters over which we may have limited visibility. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures. Further, if we increase our reliance on AI, our relationships with our associates or their retention may be adversely impacted.

  Read moreShow less