Risk factor changes · V

What changed in Visa's risk factors

Item 1A (Risk Factors) of Visa's FY2025 10-K compared with its FY2024 10-K, sentence by sentence.

Newer: 10-K filed 2025-11-06 · Older: 10-K filed 2024-11-13

New in the latest 10-K 63

• Such regulations may increase in quantity, complexity and scope in response to heightened geopolitical tensions.
• Finally, in August 2025, the District Court for the District of North Dakota ruled that the Federal Reserve exceeded its authori ty in implementing Regulation II, which sets debit card interchange fees.
• The court found the Federal Reserve improperly included various costs beyond what the Durbin Amendment allows, such as fraud losses, network fees and other fixed costs, when setting the debit interchange fee standard.
• As a result, the court vacated Regulation II s debit interchange fee 21 Table of Contents standard.
• Subsequently, however, the District Court in Kentucky ruled that the Federal Reserve acted within its discretion in setting the debit interchange cap.
• If the District Court of North Dakota s decision is affirmed on appeal and ultimately prevails, it could potentially result in the Federal Reserve setting a significantly lower interchange cap for relevant debit transactions in the U.S.
• It is possible that the Credit Card Competition Act may be reintroduced in Congress or attempted to be offered as an amendment to unrelated legislation.
• While the Illinois law remains subject to legal challenge, if such laws are allowed to go into effect, they may also impose significant technical and compliance burdens on our business.
• In Asia Pacific, the Reserve Bank of Australia (RBA) which already regulates interchange, recently proposed reducing existing interchange caps on domestic credit and debit transactions and not allowing differential interchange treatment for consumer and commercial transactions.
• Similarly, in New Zealand, the Commerce Commission recently lowered existing caps on domestic credit transactions.
• Most recently, in July 2025, New Zealand adopted interchange caps on cross-border transactions including commercial credit transactions.
• Australia has also proposed adopting caps for cross-border transactions.
• Recent political developments around the world, including recent shifts in trade policy, have added additional uncertainty with respect to new laws and regulations or changes in the interpretations or enforcement of existing laws and regulations, and increased risk of financial regulatory fragmentation.
• Government-imposed obligations and/or restrictions on international payments systems may prevent us from competing against providers in certain countries, including significant markets such as China and India.
• Although the PBOC has permitted Visa and UnionPay s cooperation on upgrading magstripe dual-branded cards to chip cards, these modernization efforts are limited to existing cards and not new issuances.
• In Europe, the European Central Bank has announced initiatives to reduce reliance on international payment networks.
• More recently, the European Central Bank has embarked on a multi-year effort to explore a digital euro, an alternative to foreign digital currency and payment service providers.
• Legislators and regulators around the world are increasingly adopting or revising privacy, data protection, data management, data transfer, AI and cybersecurity laws and regulations.
• In addition, privacy laws in numerous jurisdictions, including but not limited to the U.S., China, India, Australia, New Zealand, Brazil, Kingdom of Saudi Arabia, Hong Kong and Japan, have established specific legal requirements for cross-border transfers of personal information and substantial compliance and audit obligations.
• Certain countries have also established specific legal requirements for data localization, such as where personal data must remain stored in the country.
• The increased risk of inadvertent disclosure of confidential information or personal data in connection with the utilization of AI technologies may result in stronger regulatory scrutiny, leading to legal and regulatory investigations and 25 Table of Contents enforcement actions that may negatively affect our business, even if unfounded.
• In particular, the adoption of agentic commerce, in which autonomous AI agents initiate and execute transactions on behalf of users, presents novel and complex regulatory, privacy and cybersecurity risks.
• Legal frameworks governing such autonomous agents remain nascent, with limited direct guidance specific to payments.
• The interplay between payments regulations, data privacy laws and evolving AI regulations may create uncertainty around compliance obligations and potential liability exposure as more participants (including sellers, fintechs, AI developers and enablers) enter the agentic commerce ecosystem.
• For example, as agentic commerce solutions scale, we may see increased instances of erroneous or disputed payments, increased chargebacks and reputational harm.
• Furthermore, reliance on agentic AI introduces challenges in monitoring cross-border, prohibited or high-risk transactions, where conflicting regulatory requirements may apply.
• The fragmented regulatory landscape for emerging technologies such as AI and inconsistent requirements across legal frameworks may amplify difficulties in identifying, preventing or mitigating risk with a single global approach, potentially increasing our compliance costs or stratifying our ability to leverage certain data or technologies for innovation.
• For instance, the EU has adopted a comprehensive AI Act that establishes harmonized rules across Europe, with key provisions for high-risk AI systems taking effect in August 2026.
• Meanwhile, several U.S. states, including California, Colorado and Utah, have adopted AI-specific frameworks or are considering applying existing consumer and data protection laws to regulate AI.
• Depending on how these different regulations are interpreted and enforced, they may limit the ability to develop and deploy AI systems or significantly increase associated compliance costs.
• We expect to face more competition as AI continues to advance and GenAI and agentic AI capabilities become integrated into payments and related services in two main ways: first, by competitors successfully enhancing their products, services and external offerings with AI to achieve greater and faster product adoption; and second, by competitors providing internal AI tools to upskill their employees for greater operational efficiencies and impact.
• In addition, our competitors may have, or in the future may obtain, proprietary rights that would prevent, limit or interfere with our ability to design, use or sell our own AI-based offerings or services to our clients and other third parties.
• If we do not continue to invest in developing and supporting our AI-based initiatives, we may fall behind technological developments and evolving industry standards, which would likewise harm our reputation and ability to effectively compete, retain clients or grow our business.
• For more information on government actions, initiatives or regulations that could impact competition, please see Item 1 Government Regulation and Item 1A Regulatory Risks above.
• In July 2025, the U.S. enacted the Guiding and Establishing National Innovation for U.S.
• Stablecoins Act (GENIUS Act), establishing a comprehensive framework for regulating stablecoins.
• Similarly, the European Union has adopted its own legal framework for crypto assets.
• Many other countries, including the U.K., Japan, United Arab Emirates, Hong Kong and Singapore, are at varying stages of adopting stablecoin and digital assets-related regulatory frameworks.
• With more regulatory certainty and permissive or favorable regulations, stablecoins could potentially disrupt existing payment networks, including in cross-border and B2B transactions.
• In countries facing currency instability and controls, stablecoins could increasingly be used as an alternative to preserve and transfer asset value.

Reworded 158

Removed words are struck through; added words are highlighted.

• The impact of these regulations on us, our clients, and other third parties could limit our ability to enforce our payments system rules; require us to adopt new rules or change existing rules; affect our existing contractual arrangements; and increase our compliance costs; and require us to make our technology or intellectual property available to third parties, including competitors, in an undesirable manner. costs.
• As discussed in more detail below, we may face differing rules and regulations in matters like interchange reimbursement rates, preferred routing, domestic processing and localization requirements, currency conversion, point-of-sale transaction rules and practices, privacy, data use and protection, licensing requirements, requirements and associated product technology.
• As a result, the Visa operating rules and our other contractual commitments may differ from country to country, state to state, or by products. product to product.
• Our compliance programs and policies are designed to support our compliance with a wide array of regulations and laws, such as regulations regarding anti-money laundering, anti-corruption, competition, money transfer services, privacy, privacy and sanctions, and we continually adjust our compliance programs as regulations evolve.
• Furthermore, the The evolving and increased increasing regulatory focus on the payments industry could negatively impact or reduce the number of Visa products our clients issue, the volume of payments we process, our net revenue, our brands, our competitive positioning, our ability to use our intellectual property to differentiate our products and services, the quality and types of products and services we offer, the countries in which our products and services are used, and the types of consumers and merchants sellers who can obtain or accept our products, products and services, all of which could harm our business and financial results.
• In the U.S. and many other jurisdictions, we have historically set default interchange reimbursement fees. IRFs.
• Even though we generally do not receive any revenue related to interchange reimbursement fees IRFs in a payment transaction (in the context of credit and debit transactions, those fees are paid by the acquirers to the issuers; the reverse is true for certain transactions like ATM), interchange reimbursement fees ATM transactions), IRFs are a factor on which we compete with other payments providers and are therefore an important determinant of the volume of transactions we process.
• Consequently, changes to these fees, whether voluntarily or by mandate, can substantially affect our overall payments volumes volume and net revenue.
• Interchange reimbursement fees, certain operating rules and related practices continue to be subject to increased government regulation globally, and regulatory authorities and central banks in a number of jurisdictions have reviewed or are reviewing these fees, rules, rules and practices.
• In response to merchant seller requests, the Federal Reserve has recently taken actions to revisit its regulations that implement these aspects of the Dodd-Frank Act.
• For example, in October 2022, the Federal Reserve published a final rule effectively requiring issuers to ensure that at least two unaffiliated networks 19 Table of Contents are available for routing CNP ecommerce debit transactions by July 1, 2023.
• In October 2023, the Federal Reserve issued a proposal for comment which would that further lower lowers debit interchange rates, with a mechanism for automatic adjustment every two years.
• Separately, there continues to be interest in regulation of credit interchange fees and routing practices by members of Congress and state legislators in the U.S. legislators.
• In June July 2023, legislation was reintroduced in the U.S.
• House Previous versions of Representatives the legislation were introduced in 2022 and Senate, which 2023, and required among other things, would require that large issuing banks to offer a choice of at least two unaffiliated networks over which electronic credit transactions may be processed.
• Finally, some states in the U.S. have passed or are considering passing laws that regulate how interchange can be set and assessed.
• In Europe, the EU s IFR places an effective cap on consumer credit and consumer debit interchange fees for both domestic and cross-border transactions within the EEA (30 European Economic Area of 30 basis points and 20 basis points, respectively). respectively.
• While the focus of interchange and MDR regulation has primarily been on domestic rates historically, there are several examples of increasing focus rates, interest on cross-border rates in recent years. has been growing.
• For example, in 2019, we agreed to limit certain cross-border interchange rates in a settlement with the European Commission. Commission in 2019, which was extended through 2029.
• In June 2022, the UK s PSR initiated a market review focusing on post-Brexit increases in interchange rates for e-commerce transactions between the UK and Europe. Europe and is proposing to cap cross-border interchange on certain transactions in that geographic corridor.
• As referenced above, with With increased lobbying by merchants sellers and other industry participants, we are also beginning to see regulatory interest in network fees.
• In its interim report, the PSR indicated that it is reviewing possible remedies, remedies in the areas of governance, reporting and transparency, any of which, if adopted, could impose additional complexity and burdens on our business in the UK.
• Other regulators, for example, those in Australia, the EU, Chile and Chile, New Zealand have expressed an interest in network fees, including issues related to transparency.
• Finally, in 2024, the Greek Parliament limited acquirer fees for certain small ticket transactions in some merchant seller categories for a period of three years.
• In addition, industry participants in some countries, including Argentina, Chile, Colombia, the Dominican Republic, Paraguay, Peru and Peru, South Africa and Turkey have sought intervention from competition regulators or filed claims relating to certain network rules, including Visa s restrictions on cross-border acquiring.
• The Central Bank Banks of Chile and the Dominican Republic recently enacted regulation that will permit cross-border acquiring for CNP ecommerce transactions under certain conditions.
• Other countries, like Brazil, have adopted regulations that require us to seek government pre-approval for certain of our network rules, which could also impact the way we operate in certain those markets. 22 Table of Contents Government regulations or pressure may also impact our rules and practices and require us to allow other payments networks to support Visa products or services, to have the other networks functionality or brand marks on our products, or to share our intellectual property with other networks.
• In addition, the EU s 20 Table of Contents requirement to separate scheme and processing adds costs and impacts the execution of our commercial, innovation and product strategies.
• These types of designations generally result in oversight of authorization, clearing and settlement activities, including policies, procedures and requirements related to governance, client and seller access to our payment systems, reporting, cybersecurity, processing infrastructure, capital, capital and/or credit risk management.
• For instance, new products and capabilities, including tokenization, push payments, payments and new flows (e.g., Visa B2B Connect) cross-border money movement solutions could bring increased licensing or authorization requirements in the countries where the product or capability is offered.
• Furthermore, certain portions of our business are regulated as payment institutions or as money transmitters, subjecting us to various licensing, supervisory, supervisory and other requirements.
• As we continue to expand our capabilities and offerings in furtherance of our network of networks multi-year growth strategy, we will need to obtain new types of licenses.
• Consequently, a development in one jurisdiction may influence regulatory approaches in another.
• For example, our settlement with the European Commission on cross-border interchange rates has drawn preliminary attention from some regulators in other parts of the world.
• This may increase the attractiveness of other payments systems, such as our competitors closed-loop payments systems with direct connections to both merchants sellers and consumers.
• We believe some issuers may react to such regulations by charging new or higher fees, or reducing certain benefits to consumers, which make makes our products less appealing to consumers.
• Some acquirers may elect to charge higher MDR regardless of the Visa interchange reimbursement rate, causing merchants sellers not to accept our products or to steer customers consumers to alternative payments systems or forms of payment.
• Finally, policymakers and regulatory bodies in the U.S., Europe, Europe and other parts of the world are exploring ways to reform existing competition laws to meet the needs of the digital economy, including restricting large technology companies from engaging in mergers and acquisitions, requiring them to interoperate with potential competitors, and prohibiting certain kinds of self-preferencing behaviors.
• While the focus of these efforts remains primarily on increasing regulation of large technology, ecommerce and social media companies, they could also have implications for other types of companies including payments networks, which could constrain our ability to effectively manage our business or potentially limit how we make our products and services available. 21 23 Table of Contents Government-imposed obligations and/or restrictions on international payments systems may prevent us from competing against providers in certain countries, including significant markets such as China and India. effectively manage our business.
• In China, UnionPay remains the predominant processor of domestic payment card transactions and operates the predominant domestic acceptance mark. market.

Removed since the previous 10-K 46

• Similar legislation was introduced in the previous Congress in 2022 but failed to advance.
• The current legislation has additional bipartisan support, and while the ultimate outcome of the legislation remains unclear, its sponsors continue to strongly advocate for its passage.
• Such laws may also impose significant technical and compliance burdens on our business.
• In Asia Pacific, the Reserve Bank of Australia (RBA) which already regulates interchange, continues to monitor issues related to the cost of acceptance, the potential merits of mandating merchant choice routing on dual network debit cards and competition in digital wallet payments.
• In 2022, the New Zealand Parliament passed legislation capping domestic interchange rates for debit and credit products, and the government remains focused on lowering costs of digital payments to businesses and consumers.
• That agreement has been extended through 2029.
• Government regulations or pressure may also impact our rules and practices and require us to allow other payments networks to support Visa products or services, to have the other networks functionality or brand marks on our products, or to share our intellectual property with other networks.
• Increased oversight could also include new criteria for member participation and merchant access to our payment systems.
• Furthermore, as governments increase their focus on cybersecurity, parts of our business have become considered significant or critical infrastructure by certain central banks.
• While EPI subsequently announced a focus on account-to-account instant payments across a range of use cases, the purported motivation behind EPI is to reduce the risks of disintermediation of European providers by international technology companies and continued reliance on international payments networks for intra-Europe card transactions.
• Legal requirements relating to the collection, storage, handling, use, disclosure, transfer, disposal and security of personal data continue to evolve, and we are subject to an increasing number of privacy, data protection, cybersecurity and AI requirements around the world.
• Additionally, privacy laws in other regions, such as China s Personal Information Protection Law and India s Personal Data Protection Act, may have extraterritorial application and include restrictions on cross-border data transfers, extensive notification and localization requirements, and substantial compliance and audit obligations.
• There is thus uncertainty on what new laws will look like and how existing laws will apply to our development, use, and deployment of AI.
• In the midst of this uncertainty, we may face challenges due to the complexity and rapidly changing nature of AI technology and applicable laws.
• The EU has adopted a comprehensive AI Act that applies harmonized rules across Europe with the aim of fostering innovation and respecting fundamental rights.
• The EU AI Act comes into force in stages with the key provisions related to high risk AI coming into force in August 2026.
• There is still limited guidance on the EU AI Act, but it could, depending on how provisions are interpreted and enforced, limit the ability to create and deploy AI systems for uses deemed high-risk in the EU or add increased compliance costs associated with these systems.
• Government actions or initiatives such as the Dodd-Frank Act, the IFR in Europe, or RTP initiatives by governments such as the U.S.
• Federal Reserve s FedNow or the Central Bank of Brazil s Pix system may provide competitors with increased opportunities to derive competitive advantages from these business models, and may create new competitors, including in some cases the government itself.
• Similarly, regulation in Europe under PSD2 and the IFR may require us to open up access to, and allow participation in, our network to additional participants, and reduce the infrastructure investment and regulatory burden on competitors.
• In addition to the open banking provisions under PSD2, efforts to implement or facilitate open banking and open finance requirements are underway across a number of countries, including Australia, Brazil, Canada and the U.S., which could impose additional requirements on financial institutions or others regarding access to and use of financial data.
• We also run the risk of disintermediation due to factors such as emerging technologies and platforms, including mobile payments, alternative payment credentials, other ledger technologies or payment forms, and by virtue of increasing bilateral agreements between entities that prefer not to use our payments network for processing transactions.
• For example, merchants could process transactions directly with issuers, or processors could process transactions directly with issuers and acquirers.
• Many countries or regions are developing or promoting domestic networks, switches and RTP systems (e.g., U.S., Brazil, India and Europe) and in some countries the government itself owns and operates these RTP systems (e.g., Brazil).
• To the extent these governments mandate local banks and merchants to use and accept these systems for domestic or other transactions, prohibit international payments networks, like Visa, from participating on those systems, and/or impose restrictions or prohibitions on international payments networks from offering payment services on such transactions, we could face the risk of our business being disintermediated in those countries.
• For example, in some regions (Latin America, Southeast Asia and the Middle East), including through intergovernmental organizations such as the 25 Table of Contents Association of Southeast Asian Nations and the GCC, some countries are at varying stages of exploring or operationalizing the cross-border connectivity of such domestic systems.
• Similarly, India has expressed interest in expanding its digital public infrastructure, which includes its RTP system, Unified Payments Interface (UPI), outside the country and for cross-border payments.
• Currently, international payment networks like Visa are unable to participate in UPI.
• Parties that process our transactions may try to minimize or eliminate our position in the payments value chain.
• In addition, we face intense competitive pressure on the prices we charge our financial institution clients.
• During fiscal 2022, economic sanctions were imposed on Russia by the U.S., the EU, United Kingdom and other jurisdictions and authorities, impacting Visa and its clients.
• The war in Ukraine and any further actions by, or in response to such actions by, Russia or its allies could have lasting impacts on Ukraine as well as other regional and global economies, any or all of which could adversely affect our business.
• The ongoing military conflict in the Middle East, and any resulting conflicts in the region, could potentially have similar negative impacts.
• Any events or conditions that impair the functioning of the financial markets, tighten the credit market, or lead to a downgrade of our current credit rating could increase our future borrowing costs and impair our ability to access the capital and credit markets on favorable terms, which could affect our liquidity and capital resources, or significantly increase our cost of capital. 28 Table of Contents Finally, as governments, investors and other stakeholders face additional pressures to accelerate actions to address climate change and other environmental, governance and social topics, governments are implementing regulations and investors and other stakeholders are imposing new expectations or focusing investments in ways that may cause significant shifts in disclosure, commerce and consumption behaviors that may have negative impacts on our business.
• We are subject to laws, regulations and other measures that govern a wide range of topics, including those that are related to matters beyond our core products and services, such as matters that touch upon sustainability, climate change, human capital, inclusion and diversity, and human rights.
• A wide range of stakeholders, including governments, customers, employees, and investors, are increasingly focused on and are developing expectations regarding these corporate responsibility matters.
• We have established CRS-related initiatives, adopted reporting frameworks, and announced several related goals.
• Certain of our regulators have proposed or adopted, or may propose or adopt, rules or standards related to these matters that would apply to our business.
• New regulations have been enacted and/or are expected in several jurisdictions, including the EU s Corporate Sustainability Reporting Directive, the SEC climate-related disclosures that could require disclosure of climate-related information and the State of California s legislation requiring broad disclosure of greenhouse gas emissions and other climate-related information.
• Prevailing CRS standards and expectations may also reflect conflicting values or objectives, which can result in our practices being judged by standards that are continually evolving and are not always clear.

Source: SEC EDGAR filings, compared sentence by sentence by EdgarStack. Sentence matching is automated and may pair or split passages imperfectly; check the linked filings before relying on any passage. A software tool, not financial advice. Not affiliated with the U.S. Securities and Exchange Commission.