Risk factor changes · MA

What changed in Mastercard's risk factors

Item 1A (Risk Factors) of Mastercard's FY2025 10-K compared with its FY2024 10-K, sentence by sentence.

Newer: 10-K filed 2026-02-11 · Older: 10-K filed 2025-02-12

New in the latest 10-K 14

• Moreover, because of various concerns jurisdictions may have with respect to our business, including any decisions we may make relating to entering or exiting a 28 MASTERCARD 2025 FORM 10-K PART I ITEM 1A.
• With respect to information security, any single breach could require parallel notifications to data protection authorities, cyber authorities and/or law-enforcement, often requiring different thresholds, reporting deadlines and formats.
• This could impact the products and services we offer and other aspects of our business, such as fraud MASTERCARD 2025 FORM 10-K 29 PART I ITEM 1A.
• Participants may also withhold rights to data we use to power our solutions in order to support their own potential future solutions, potentially impacting the effectiveness of our solutions.
• The widespread use of AI, and its increasing capabilities, is enhancing the frequency and effectiveness of threat actors.
• In addition, the current or future listing of Recorded Future as an undesirable or unreliable entity by certain jurisdictions could further increase our risks in this area.
• We switch a high percentage of domestic (or in-country) transactions conducted using cards with our brands.
• However, there are several jurisdictions in which domestic transactions are switched by our customers or other processors.
• These include or have included: MASTERCARD 2025 FORM 10-K 37 PART I ITEM 1A.
• Additionally, we or our customers could take (or be perceived to take) actions related to these industries, which could be viewed negatively and result in threats or other retaliatory actions.
• The market for specialized skill-sets remains highly competitive, particularly in emerging technologies.
• In addition, Brazil recently enacted regulation requiring PSOs in Brazil (including Mastercard and Visa) to extend their responsibility for the financial and settlement integrity of payments to merchants.
• As we continue to be subject to increased regulation across the globe, more jurisdictions may enact similar approaches from time to time.
• Any such changes could increase complexity and may impact our cost of operations and financial condition.

Reworded 72

Removed words are struck through; added words are highlighted.

• Risk factors RISK HIGHLIGHTS Legal and Regulatory Business and Operations Payments Industry Regulation Competition and Technology Brand, Reputational Impact and Environmental, Social and Governance Preferential or Protective Government Actions Information Security and Operational Resilience Talent and Culture Privacy, Data Protection, Data, AI and Information Security Stakeholder Relationships Acquisitions and Strategic Investments Other Regulation Global Economic and Political Environment Settlement and Third-Party Obligations Litigation Class A Common Stock and Governance Structure Legal and Regulatory Payments Industry Regulation Global regulatory and legislative activity related to the payments industry may have a material adverse impact on our overall business and results of operations.
• Regulators could also require us to obtain prior approval for changes to our system rules, procedures or operations, or could require customization with regard to such MASTERCARD 2024 2025 FORM 10-K 25 27 PART I ITEM 1A.
• See Business - Government Regulation in Part I, Item 1 and Note 21 19 (Legal and Regulatory Proceedings) to the consolidated financial statements included in Part II, Item 8 for more details.
• RISK FACTORS jurisdictions may have with respect to our business, including our decision to suspend business operations in Russia, particular market, such jurisdictions may decide to begin to or increase their focus on growing local payment networks and other solutions.
• Privacy, Data Protection, Data, AI and Information Security Regulation and enforcement of privacy, data, AI, information security and the digital economy could increase our costs and lead to legal claims and fines, as well as negatively impact our growth and reputation.
• We are subject to increasingly complex, fragmented and fragmented, overlapping and/or divergent laws and regulations related to privacy and data protection, data use and governance, AI and information security (including with respect to cybersecurity and cyber-risk) in the jurisdictions in which we do business.
• As a result, new New or updated privacy and data protection and information security laws and regulations have led, and may continue to lead, to similar, stricter or at times conflicting requirements, creating an uncertain regulatory environment.
• For example, some jurisdictions have implemented or are otherwise considering requirements to collect, store and/or process data within their borders, as well as prohibitions on the transfer of and access to data abroad, leading to technological and operational implications.
• Failure to comply with any of these laws, regulations and requirements (including as a result of conflicting regulations) could result in fines, sanctions or other enforcement actions or penalties, penalties (both civil and criminal), which could materially and adversely affect our results of operations and overall business, as well as have an impact on our reputation.
• How our use and deployment of AI will be regulated is still developing as policymakers around the world consider how to regulate AI, and uncertainty remains as to how AI technology or its application (such as in agentic commerce) will continue to advance.
• Our implementation of robust AI governance and risk management frameworks aimed at complying frameworks, designed to ensure our responsible use of AI and help us to comply with emerging laws and regulations regulations, may not be sufficient protection against these emerging risks.
• For example, our acquisition of Recorded Future, as a provider of global threat intelligence company, increases our services through Recorded Future, we are subject to increased exposure to certain laws and regulations, including global cybercrime and other laws and regulations in various jurisdictions.
• We also need to provide increased care in our data management, governance and governance, quality and accuracy practices, particularly as it relates to the use of data in products leveraging AI.
• This could impact the products and services we offer and other aspects of our business, such as fraud RISK FACTORS monitoring, the need for improved data management, governance and governance, quality and accuracy practices, the development of information-based products and solutions, and technology operations.
• RISK FACTORS In addition, these requirements may increase the costs to our customers of issuing payment products or using information products, which may, in turn, decrease the number of our products that they offer.
• Certain regulations or legislation that do or could impact our issuers and acquirers (such as caps on issuer interest rates) may impact various aspects of our business.
• For example, Additionally, strong authentication requirements within the EU s Payment Services Directive in the EEA could increase the number of transactions consumers abandon if we are unable to secure a frictionless authentication experience under these standards.
• Jurisdictions around the globe have also increased tax-related audits, which require time and resources to resolve. 30 MASTERCARD 2025 FORM 10-K PART I ITEM 1A.
• RISK FACTORS Any changes in enacted tax laws, rules, regulatory or judicial interpretations or guidance; any adverse outcome in connection with tax audits in any jurisdiction; or any changes in the pronouncements relating to accounting for income taxes could materially and adversely impact our effective income tax rate, tax payments, financial condition and results of operations. 28 MASTERCARD 2024 FORM 10-K PART I ITEM 1A.
• RISK FACTORS Litigation Liabilities or business limitations resulting from litigation could materially and adversely affect our results of operations.
• We are a defendant in a number of civil litigations and regulatory proceedings and investigations, including among others, those alleging violations of competition and antitrust law and those involving intellectual property claims (as described in Note 21 19 (Legal and Regulatory Proceedings) to the consolidated financial statements included in Part II, Item 8).
• Any future limitations resulting from the outcomes of any litigation and litigation settlements (such as the Rules Relief Class settlement as described in Note 19 (Legal and Regulatory Proceedings) to the consolidated financial statements included in Part II, Item 8) or regulatory proceeding, including any changes to our rules or business practices, could impact our relationships with our customers, including reducing the volume of business that we do with them, which may materially and adversely affect our overall business and results of operations.
• RISK FACTORS Disintermediation from stakeholders both within and outside of the payments value chain could harm our business.
• MASTERCARD 2024 2025 FORM 10-K 29 39 PART I ITEM 1A.
• RISK FACTORS Payments industry participants may develop their own products and services to support our switched transaction and payments offerings, forcing us to change our pricing or practices for our own offerings in order to compete.
• As a result, we may not be able to grow our volume and/or services enough to the extent necessary to compensate for the additional costs related to these increased incentives and pricing discounts.
• Any of these factors could have a material adverse impact on our overall business and results of operations. 32 MASTERCARD 2025 FORM 10-K PART I ITEM 1A.
• RISK FACTORS Rapid and significant technological developments and changes could negatively impact our overall business and results of operations or limit our future growth.
• The payments industry is subject to rapid and significant technological changes, including new technologies and changes to existing technologies (such as cryptocurrency digital assets and blockchain, AI, machine learning, privacy enhancement and cybersecurity).
• RISK FACTORS These include: the inability of third parties on which we rely for the development of and access to new technologies to keep pace with technological changes (including with regard to AI); potential action from third-party patent holders, including notices or inquiries threatening litigation against us or our customers for alleged patent infringement or demanding significant license fees; the scope of, as well as customer and merchant resistance to, industry-wide solutions and standards (such as those related to tokenization or other safety and security technologies); any difficulty we may experience in attracting and retaining employees with technology expertise; and the need to invest resources for new technologies, which could lead to further additional expenses.
• RISK FACTORS Information Security and Operational Resilience Information security incidents or account data compromise events could disrupt our business, damage our reputation, increase our costs and cause losses.
• Information security risks for payments and technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies, technologies (including AI), the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, hacktivists , terrorists, nation-states, state-sponsored actors and other external parties.
• These types of threats have risen MASTERCARD 2024 2025 FORM 10-K 31 PART I ITEM 1A.
• RISK FACTORS These types of threats have risen significantly due to a significant portion of our workforce working in a hybrid environment.
• Such events could have a material adverse impact on our transaction volumes, results of operations and prospects for future growth, or increase our costs by leading to additional regulatory burdens being imposed on us. 34 MASTERCARD 2025 FORM 10-K PART I ITEM 1A.
• RISK FACTORS In addition, companies have generally experienced in recent years an increase in fraudulent activity and cyber-attacks. cyber-attacks, which has been further exacerbated by the increased use of AI.
• See Risk Factors - Privacy, Data Protection, Data, AI and Information Security Compliance in this Part I, Item 1A for more detail concerning related legal risks and obligations.
• RISK FACTORS In addition, we cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or at all, or that our insurers will not deny coverage as to any future claim.
• Our transaction switching systems and other offerings may experience interruptions as a result of technology malfunctions, network degradation, updates and migrations to new technology and platforms, supply-chain attacks, fire, floods, earthquakes, weather events, power outages, telecommunications disruptions, terrorism, workplace violence, accidents or other catastrophic events (including those related to climate change).
• If one of our service providers fails to provide the communications capacity or services we require, as a result of natural disaster, disasters, operational disruptions, cybersecurity-related disruptions or failures, terrorism, hacking or any other reason, the failure could interrupt our services.

Removed since the previous 10-K 12

• Moreover, because of various concerns 26 MASTERCARD 2024 FORM 10-K PART I ITEM 1A.
• While policymakers around the globe often look to the EU and the GDPR when adopting new or updated privacy and data protection laws, divergences have occurred and continue to occur.
• In addition, these requirements may increase the costs to our customers of MASTERCARD 2024 FORM 10-K 27 PART I ITEM 1A.
• These include: the inability of third parties on which we rely for the development of and access to new technologies to keep pace with technological changes; potential action from third-party patent holders, including notices or inquiries threatening litigation against us or our customers for alleged 30 MASTERCARD 2024 FORM 10-K PART I ITEM 1A.
• These threats also may be further enhanced in frequency or effectiveness through threat actors use of AI.
• In addition, we cannot be sure 32 MASTERCARD 2024 FORM 10-K PART I ITEM 1A.
• Consolidation could also produce a smaller number of large customers, which could increase their MASTERCARD 2024 FORM 10-K 33 PART I ITEM 1A.
• With the exception of the U.S. and a select number of other jurisdictions, most in-country (as opposed to cross-border) transactions conducted using cards with our brands are switched by our customers or other processors.
• The market for specialized skill-sets remains highly competitive, particularly in technology and other areas that are important to the growth of our business.
• Moreover, we have spent, and may continue to spend, time and money on acquisitions or projects that do MASTERCARD 2024 FORM 10-K 37 PART I ITEM 1A.
• In addition, as we are subject to increased regulation across the globe, jurisdictions could require us to extend our guarantee to additional obligations, which could have an impact on our cost of operations.
• RISK FACTORS period, while committing to remain a long-term Mastercard stockholder and retaining a significant holding of Mastercard shares in its portfolio.

Source: SEC EDGAR filings, compared sentence by sentence by EdgarStack. Sentence matching is automated and may pair or split passages imperfectly; check the linked filings before relying on any passage. A software tool, not financial advice. Not affiliated with the U.S. Securities and Exchange Commission.