Upbound Group

None of the serious warning signs we check for were found. 1 thing worth knowing.

We look for five warning signs: doubt it can keep going, weak checks on its own accounts, a notice that its past accounts can't be relied on, a change of auditor, and one customer bringing in a big share of sales. We don't check lawsuits, investigations or debt yet.

We checked the auditor's report, internal controls, restatement notices, auditor changes and big customers in the 10-K filed 23 Feb 2026, plus the 10-Q filed 31 Jul 2026 and 6 later 8-Ks.

• Changed auditor

  Worth knowing

  The company changed its auditor (the firm that checks its books) in the last two years.

  “On February 24, 2025, the Audit and Risk Committee of the Board of Directors of Upbound Group, Inc. (the “Company”) decided to (i) dismiss Ernst & Young LLP (“E&Y”) as the Company’s independent registered public accounting firm and (ii) appoint Deloitte & Touche LLP (“Deloitte”) to serve as the Company’s new independent registered public accounting firm”

  From an 8-K filed 28 February 2025: Change of auditor. Read it in the filing

Cheap for a reason is the question the numbers cannot answer.

Whether the price already reflects the risks is what the deep dive is for.

• The integration and use of AI and similar technology in our business presents risks and challenges that could adversely affect our business, reputation, and results of operations.

  Could happen

  Our competitors or other third parties may incorporate AI into their products more quickly or more successfully than us, which could impair our ability to compete effectively. The rapid development and adoption of AI and AI-adjacent technology, and of AI’s competitive use cases, may make it more difficult for us to compete in our industry. Emerging forms of autonomous or “agentic” AI, capable of taking independent actions to pursue goals, may amplify these risks by enabling competitors to operate faster, more efficiently or more creatively at scale. Failure to keep pace with or properly govern such technologies could materially disadvantage us in innovation, customer engagement and operational performance.

  Read moreShow less

• Laws and regulations regarding information security and data collection, use and privacy are increasingly rigorous and subject to change, which may cause us to incur significant compliance costs and subject us to adverse impacts in the event of actual or alleged compliance failures.

  Already happened

  The regulatory environment related to information security and data collection, use and privacy is increasingly rigorous, with new and constantly-changing requirements applicable to certain aspects of our business, including our collection practices (as well as those of third parties), the manner in which we contact our customers, our decisioning process regarding whether to lease merchandise to customers or otherwise approve customers for our products or services, any payment information we may decide to furnish to consumer reporting agencies, our credit reporting practices, our ability to share customer information between our affiliated businesses and with third parties, and the manner in which we process and store certain customer, employee and other information. All states have adopted laws requiring the timely notification to individuals and, at times, regulators, the media or credit reporting agencies, if a company experiences the unauthorized access or acquisition of PII. Many states have enacted additional data privacy and security laws and regulations that govern the collection, use, disclosure, transfer, storage, disposal, and protection of PII and other information. For instance, the California Consumer Privacy Act of 2018 (the “CCPA”), which became effective on January 1, 2020, contains, among other things, new disclosure obligations for businesses that collect PII from California residents and affords those individuals numerous rights relating to their PII. The CCPA has changed the manner in which we collect, store and use consumer data and has resulted in increased regulatory oversight, litigation risks and costs of compliance. Furthermore, the California Privacy Rights Act (the “CPRA”) was passed in November 2020 and is intended to augment and expand the CCPA, and many of the CPRA's provisions became effective on January 1, 2023 (with respect to information collected from and after January 2022). The CPRA significantly modified the CCPA, including by expanding consumers' rights with respect to certain personal information and creating a new state agency that is vested with authority to implement and enforce the CCPA and the CPRA. On September 23, 2025, the California Privacy Protection Agency approved another major update to the CCPA/CPRA regulations. These rules expand compliance obligations, particularly around automated decision-making technology, risk assessments, and cybersecurity audits, with most provisions effective on or after January 1, 2026. Moreover, other states have adopted and may continue to adopt privacy-related laws whose restrictions and requirements differ from those of California, which could require us to design, implement and maintain different types of state-based, privacy-related compliance controls and programs simultaneously in multiple states, thereby further increasing the complexity and cost of compliance. Furthermore, various jurisdictions are considering various frameworks for AI and have passed, or may in the future pass, laws and regulations that impact existing privacy and data protection requirements. These costs, including others relating to increased regulatory oversight and compliance, could materially and adversely affect our business. In addition, given that privacy and customer data protection laws may be interpreted and applied inconsistently and are in a state of flux that varies by jurisdiction, our data protection policies and practices may not be consistent with the most recent interpretations and applications of such laws at all times. Complying with these varying requirements could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business. Any failure, or perceived failure, by us to comply with our own privacy policies or with any legal or regulatory requirements or orders or other privacy or consumer protection related laws and regulations could result in proceedings or actions against us by

  Read moreShow less

• Federal and state regulatory authorities are increasingly focused on the EWA industry, and any negative change in these laws or regulations or the passage of unfavorable new laws or regulations or the manner in which any of these are enforced or interpreted could expose Brigit to significant additional costs or compliance-related burdens and could require Brigit to alter its business practices in a manner that may be materially adverse to Brigit.

  Could happen

  Although there is currently no comprehensive federal legislation regulating EWA products, such as Brigit’s EWA product, the CFPB under the previous Presidential Administration proposed an interpretative rule that would have potentially treated many EWA products as extensions of credit for the purposes of applying certain federal consumer financial laws and regulations and the potential regulation of unfair, deceptive, or abusive practices with respect to EWA products. In December 2025, the CFPB withdrew that proposed interpretative rule and issued an advisory opinion stating that certain “covered” EWA products, structured to provide access to earned wages without creating a debt obligation and subject to specified conditions, generally are not credit under the Truth in Lending Act or Regulation Z, and that optional expedited funding fees and tips paid by consumers in connection with EWA products are not finance charges under that statute or regulation.

  Read moreShow less

• Our businesses and industries are heavily regulated and subject to active enforcement including legal and regulatory proceedings that have in the past and may in the future result in damages, penalties or other significant monetary obligations and restrictions on our business operations.

  Could happen

  We may also become subject to significant restrictions on or changes to our business practices, operations or methods, including pricing, account management, or similar terms, as a result of existing or future governmental or other proceedings or settlements, any of which could significantly harm our reputation and competitiveness with consumers as well as with third-party retailers, bank partners and other commercial counterparties, and could materially and adversely affect our business, prospects, results of operations and financial condition. For example, in connection with the Multistate and District of Columbia Attorneys’ General matters described in Note M to our consolidated financial statements included in this Annual Report on Form 10-K, if we are able to reach final binding settlement agreements, we expect that any potential settlement of such matters would include injunctive relief regarding various aspects of Acima’s business. By way of further example, as discussed below, our Brigit segment previously entered into and remains subject to a settlement with the FTC which includes various injunctive requirements.

  Read moreShow less

• Federal and state regulatory authorities are increasingly focused on the EWA industry, and any negative change in these laws or regulations or the passage of unfavorable new laws or regulations or the manner in which any of these are enforced or interpreted could expose Brigit to significant additional costs or compliance-related burdens and could require Brigit to alter its business practices in a manner that may be materially adverse to Brigit.

  Could happen

  While this advisory opinion provides additional federal regulatory clarity for certain EWA products, it does not have the force of law, may be subject to future revision, reinterpretation, or rescission, and does not apply to other federal or state consumer protection laws. In addition, the advisory opinion applies only to EWA products meeting specific structural criteria, and the structure of Brigit’s products or business model, future changes to Brigit’s products or business model, or evolving regulatory interpretations, could affect its applicability. Federal and state regulators may continue to scrutinize EWA products, and future rulemaking, guidance, or enforcement actions could require Brigit to modify product features or pricing, enhance disclosures or compliance infrastructure, or otherwise alter its operations, any of which could materially adversely affect Brigit’s business, financial condition, and results of operations.

  Read moreShow less