EQUIFAX INC

Previous wording

The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems are constantly evolving and often are not recognized until launched against a target, or even some time after. We may be unable to anticipate these techniques, implement adequate preventative measures or remediate any intrusion on a timely or effective basis even if our security measures are appropriate, reasonable, and/or comply with applicable legal requirements. Certain efforts may be state-sponsored and supported by significant financial and technological resources, making them even more sophisticated and difficult to detect. Further, we are in the process of transforming our applications and infrastructure technologies, and this transition to cloud-based technologies may expose us to additional cyber threats as we migrate our data from our legacy systems to cloud-based solutions hosted by third parties. Although we have developed systems and processes that are designed to protect our data and customer data and to prevent data loss and other security breaches, and expect to continue to expend significant additional resources to bolster these protections, these security measures cannot provide absolute security.

Current wording

The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems are constantly evolving and often are not recognized until launched against a target, or even some time after. We may be unable to anticipate these techniques, implement adequate preventative measures or remediate any intrusion on a timely or effective basis even if our security measures are appropriate, reasonable and/or comply with applicable legal requirements. Certain efforts may be state-sponsored and supported by significant financial and technological resources, making them even more sophisticated and difficult to detect. Further, the transition of our applications and systems infrastructure to cloud-based technologies may expose us to additional cyber threats, as most of our data has migrated from legacy Equifax systems to cloud-based solutions hosted by third parties. Although we have developed systems and processes that are designed to protect our data and customer data and to prevent data loss and other security breaches, and expect to continue to expend significant additional resources to bolster these protections, these security measures cannot provide absolute security.

Previous wording

Security breaches and attacks, and the adverse publicity that may follow, can have a negative impact on our reputation and our relationship with our customers. For example, our reputation with consumers and other stakeholders and our customer relationships were damaged following the cybersecurity incident in 2017, resulting in a negative impact on our revenue for a period of time. If we experience another material cybersecurity incident or are otherwise unable to demonstrate the security of our systems and the data we maintain and retain the trust of our customers, consumers and data suppliers, we could experience a substantial negative impact on our business.

Current wording

Security breaches and attacks (including those that impact our third-party vendors and other service providers) and the adverse publicity that may follow, can have a negative impact on our reputation and our relationship with our customers. For example, our reputation with consumers and other stakeholders and our customer relationships were damaged following the cybersecurity incident in 2017, resulting in a negative impact on our revenue for a period of time. If we experience another material cybersecurity incident or are otherwise unable to demonstrate the security of our systems and the data we maintain and retain the trust of our customers, consumers and data suppliers, we could experience a substantial negative impact on our business.

Previous wording

The failure to realize the anticipated benefits of our technology transformation strategy could adversely impact our business and financial results.

Current wording

The failure to realize the anticipated benefits of our technology transformation could adversely impact our business and financial results.

Previous wording

We expect our technology transformation strategy, including our transition to cloud-based technologies, will significantly increase our efficiency, our productivity, and the stability and functionality of our products and services, as well as decrease the cost of our overall systems infrastructure, all of which we expect will drive growth and have a positive effect on our business, competitive position and results of operations. This initiative is a major undertaking as we replace many of our previous operating systems with cloud-based systems. This complex, multifaceted and extensive initiative is expensive and has caused, and may cause in the future, unanticipated problems and expenses. If the transition causes errors or adversely impacts system processes, our new systems do not operate as expected, or the data we transition to the cloud changes in a material way, we may have to incur significant additional costs to make modifications and could lose customers and we may suffer reputational harm as a result. Moreover, we have experienced issues with customer migration, as some of our customers may not migrate to cloud-based technologies on a timely basis or at all or may choose not to utilize our products and services during and after our transition to cloud-based technologies, which could negatively impact our revenue.

Current wording

We are in the final stages of migrating the vast majority of our applications and systems infrastructure from legacy on-premises systems to cloud-based solutions hosted by third parties. We expect that our cloud technology transformation will significantly increase our efficiency and productivity, improve the stability and functionality of our products and services, and decrease the cost of our overall systems infrastructure, all of which we expect will drive growth and have a positive effect on our business, competitive position and results of operations. This initiative has been a major undertaking as we have replaced most of our previous operating systems with cloud-based systems. This complex, multifaceted and extensive initiative has been expensive and has caused, and may cause in the future, unanticipated problems and expenses. If we are unable to complete the remaining migrations or, if our new cloud-based systems do not operate as expected, we may have to incur significant additional costs to make modifications and could lose customers and we may suffer reputational harm as a result.

Previous wording

We cannot assure you that our technology transformation strategy will be beneficial to the extent, or within the timeframes expected, or that the estimated efficiency, cost savings and other improvements will be realized as anticipated or at all. Market acceptance of cloud-based offerings is affected by a variety of factors, including information security, reliability, performance, the sufficiency of technological infrastructure to support our products and services in certain geographies, customer and data provider concerns with entrusting a third party to store and manage its data as well as the customer’s ability to access this data once a contract has expired, and consumer concerns regarding data privacy and the enactment of laws or regulations that restrict our ability to provide such services to customers. If we are unable to correctly respond to these issues, we may experience business disruptions, damage to our reputation, negative publicity, diminished customer trust and relationships and other adverse effects on our business. Even if the anticipated benefits and savings are substantially realized, there may be consequences, internal control issues or business impacts that were not expected. Our transition and migration to cloud-based technologies may increase our risk of liability and cause us to incur significant technical, legal, regulatory or other costs.

Current wording

We cannot assure you that our technology transformation will be beneficial to the extent, or within the timeframes expected, or that the estimated efficiency, cost savings and other improvements will be realized as anticipated or at all. Market acceptance of cloud-based offerings is affected by a variety of factors, including information security, reliability, performance, the sufficiency of technological infrastructure to support our products and services in certain geographies, customer and data provider concerns with entrusting a third party to store and manage its data as well as the customer’s ability to access this data once a contract has expired, and consumer concerns regarding data privacy and the enactment of laws or regulations that restrict our ability to provide such services to customers. If we are unable to correctly respond to these issues, we may experience business disruptions, damage to our reputation, negative publicity, diminished customer trust and relationships and other adverse effects on our business. Even if the anticipated benefits and savings of our technology transformation are substantially realized, there may be consequences, internal control issues or business impacts that were not expected. We have made significant investments in our technology transformation, and if we were to change cloud-based service providers, we may incur additional costs in connection with a transition.

Previous wording

We rely extensively upon data from external sources to maintain our proprietary and non-proprietary databases, including data received from customers, licensors, furnishers, strategic partners and various government and public record sources. This data includes the widespread and voluntary contribution of credit data from most lenders in the U.S. and many other markets as well as the contribution of data under proprietary contractual agreements, such as employers’ contribution of employment and income data to The Work Number® and telecommunications, cable and utility companies’ contribution of payment and fraud data to the National Cable, Telecommunications and Utility Exchange (NCTUE). For a variety of reasons, including concerns of data furnishers arising out of legislatively or judicially imposed restrictions on use, security breaches or competitive reasons, our data sources could withdraw, delay receipt of or increase the cost of the data they provide to us. Where we currently have exclusive use of data, the providers of the data sources could elect to make the information available to competitors. We also compete with several of our third-party data suppliers. If a substantial number of data sources or certain key data sources were to withdraw or be unable to provide their data, if we were to lose access to data due to government regulation, if we lose our right to the use of data, or if the collection, disclosure or use of data becomes uneconomical, our ability to provide products and services to our customers could be adversely affected, which could result in decreased revenue, net income and earnings per share and reputational loss. There can be no assurance that we would be able to obtain data from alternative sources if our current sources become unavailable.

Current wording

We rely extensively on data from external sources to maintain our proprietary and non-proprietary databases, including data received from customers, licensors, furnishers, strategic partners and various government and public record sources. This data includes the widespread and voluntary contribution of credit data from most lenders in the U.S. and many other markets as well as the contribution of data under proprietary contractual agreements, such as employers’ contribution of employment and income data to The Work Number® and telecommunications, cable and utility companies’ contribution of payment and fraud data to the National Cable, Telecommunications and Utility Exchange (NCTUE). For a variety of reasons, including concerns of data furnishers arising out of legislatively or judicially imposed restrictions on use, security breaches or competitive reasons, our data sources could withdraw, delay receipt of or increase the cost of the data they provide to us. Where we currently have exclusive use of data, the providers of the data sources could elect to make the information available to competitors. We also compete with several of our third-party data suppliers. If a substantial number of data sources or certain key data sources were to withdraw or be unable to provide their data, if we were to lose access to data due to government regulation, if we lose our right to the use of data, or if the collection, disclosure or use of data becomes uneconomical, our ability to provide products and services to our customers could be adversely affected, which could result in decreased revenue, net income and earnings per share and reputational loss. There can be no assurance that we would be able to obtain data from alternative sources if our current sources become unavailable.

Previous wording

Our customer base suffers when financial markets experience volatility, illiquidity and disruption, and the potential for disruptions going forward presents considerable risks to our business and revenue. High or rising rates of unemployment and interest, declines in income, home prices or investment values, lower consumer confidence and reduced access to credit adversely affect demand for many of our products and services, and consequently our revenue and results of operations, as consumers may postpone or reduce their spending and use of credit, and lenders may reduce the amount of credit offered or available.

Current wording

Our customer base generally suffers when financial markets experience volatility, illiquidity and disruption, and the potential for disruptions going forward presents considerable risks to our business and revenue. High or rising rates of unemployment and interest, declines in income, home prices or investment values, lower consumer confidence and reduced access to credit adversely affect demand for many of our products and services, and consequently our revenue and results of operations, as consumers may postpone or reduce their spending and use of credit, and lenders may reduce the amount of credit offered or available. Conversely, certain of our businesses, such as our unemployment claims management business within the Workforce Solutions segment, are countercyclical and may experience negative impacts on revenue and operating profit during periods of improving economic conditions or lower unemployment.

Previous wording

In 2024, we expect the U.S. mortgage market, as measured by credit inquiries, to decline by approximately 16% compared to 2023. Any weakening in the U.S. mortgage market resulting in a significant reduction in mortgage originations could have a corresponding negative impact on revenue and operating profit for our business, primarily within the Workforce Solutions and USIS operating segments. To the extent inflation results in higher interest rates and has other adverse effects upon the securities markets and upon the value of financial instruments, it may adversely affect our financial position and profitability.

Current wording

We expect U.S. mortgage credit activity in 2025 to be below the levels of activity seen in 2024. Any weakening in the U.S. mortgage market resulting in a significant reduction in mortgage originations could have a corresponding negative impact on revenue and operating profit for our business, primarily within the Workforce Solutions and USIS operating segments. To the extent inflation results in higher interest rates and has other adverse effects upon the securities markets and upon the value of financial instruments, it may adversely affect our financial position and profitability.

Previous wording

Some of our competitors may choose to sell products that compete with ours at lower prices by accepting lower margins and profitability, or may be able to sell products competitive to ours at lower prices, individually or as a part of integrated suites, given proprietary ownership of data, technological superiority or economies of scale. Price reductions by our competitors could negatively impact our revenue and operating margins and results of operations and could also harm our ability to obtain new customers on favorable terms. Historically, certain of our key products have experienced declines in per unit pricing due to competitive factors and customer demand. Since a significant portion of our operating expenses is relatively fixed in nature due to sales, information technology and development and other costs, if we were unable to respond quickly enough to changes in competition or customer demand, we could experience further reductions in our operating margins.

Current wording

Some of our competitors sell products that compete with ours at lower prices by accepting lower margins and profitability, or may be able to sell products competitive to ours at lower prices, individually or as a part of integrated suites, given proprietary ownership of data, technological superiority or economies of scale. Price reductions by our competitors could negatively impact our revenue and operating margins and results of operations and could also harm our ability to obtain new customers on favorable terms. Historically, certain of our key products have experienced declines in per unit pricing due to competitive factors and customer demand. If we were unable to respond quickly enough to changes in competition or customer demand we could experience reductions in our operating margins.

Previous wording

If our relationships with key customers are materially diminished or terminated, our business could suffer.

Current wording

If our relationships with key customers and business partners are materially diminished or terminated, our business could suffer.

Previous wording

We have long-standing relationships with a number of our customers, many of whom could unilaterally terminate their relationship with us or materially reduce the amount of business they conduct with us at any time. Many of our material customer agreements can be terminated by the customer for convenience on limited advance written notice, which provides our customers with the opportunity to renegotiate their contracts with us or to award more business to our competitors. There is no guarantee that we will be able to retain or renew existing agreements, maintain relationships with any of our customers or business partners on acceptable terms or at all, or collect amounts owed to us from insolvent customers or business partners. The loss of one or more of our major customers or business partners could adversely affect our business, financial condition and results of operations.

Current wording

We have long-standing relationships with a number of our customers and business partners, many of whom could unilaterally terminate their relationship with us or materially reduce the amount of business they conduct with us at any time. Many of our material customer agreements can be terminated by the customer for convenience on limited advance written notice, which provides our customers with the opportunity to renegotiate their contracts with us or to award more business to our competitors. There is no guarantee that we will be able to retain or renew existing agreements, maintain relationships with any of our customers or business partners on acceptable terms or at all, or collect amounts owed to us from insolvent customers or business partners. The loss of one or more of our major customers or business partners could adversely affect our business, financial condition and results of operations.

Previous wording

We generally sell our products in industries that are characterized by rapid technological changes, including the introduction of new innovative technologies, frequent new product and service introductions and changing industry standards. In addition, certain of the markets in which we operate are seasonal and cyclical. Without the timely introduction of new technologies, products, services and enhancements, our products and services will become technologically or commercially obsolete over time, in which case our revenue and operating results would suffer. The success of our new products and services will depend on several factors, including our ability to properly identify customer needs; innovate and develop new technologies, services and applications; successfully commercialize new technologies in a timely manner; produce and deliver our products in sufficient volumes on time; differentiate our offerings from competitor offerings; price our products competitively; anticipate our competitors’ development of new products, services or technological innovations; and control product quality in our product development process. Our resources have to be committed to any new products and services before knowing whether the market will adopt the new offerings.

Current wording

We generally sell our products in industries that are characterized by rapid technological changes, including the introduction of new innovative technologies, frequent new product and service introductions and changing industry standards. In addition, certain of the markets in which we operate are seasonal and cyclical. Without the timely introduction of new technologies, products, services and enhancements, our products and services will become technologically or commercially obsolete over time, in which case our revenue and operating results would suffer. The success of our new products and services will depend on several factors, including our ability to: (i) properly identify customer needs; (ii) innovate and develop new technologies, services and applications; (iii) successfully commercialize new technologies in a timely manner; (iv) produce and deliver our products in sufficient volumes on time; (v) differentiate our offerings from competitor offerings; (vi) price our products competitively; (vii) anticipate our competitors’ development of new products, services or technological innovations; and (viii) control product quality in our product development process. Our resources have to be committed to any new products and services before knowing whether the market will adopt the new offerings.

Previous wording

We may face risks associated with our use of certain artificial intelligence and machine learning models.

Current wording

We may face risks associated with our use of certain artificial intelligence and machine learning models and systems.

Previous wording

We use artificial intelligence and machine learning models in the development of some of our products. The models that we use are developed or trained using various data sets. If the models are incorrectly designed, the data we use to train them is incomplete, inadequate, or biased in some way, or if we do not have sufficient rights to use the data on which our models rely, the performance of our products and business, as well as our reputation, could suffer or we could incur liability through the violation of laws, third-party privacy, or other rights, or contracts to which we are a party. In addition, these risks include the possibility of new or enhanced governmental or regulatory scrutiny, litigation, or other legal liability, ethical concerns, negative consumer perceptions as to artificial intelligence, or other complications that could adversely affect our business, reputation, or financial results. In particular, our use of artificial intelligence in credit decisioning could lead to enhanced scrutiny. Further, our competitors or other third parties may incorporate artificial intelligence into their products more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations.

Current wording

We use artificial intelligence and machine learning models in the development of some of our products and artificial intelligence systems to support the deployment of new applications and to improve the efficiency of our business operations. For new products, the models that we use are developed or trained using various data sets. If the models are incorrectly designed, if the data we use to train them is incomplete, inadequate or biased in some way, or if we do not have sufficient rights to use the data on which our models rely, the performance of our products and business, as well as our reputation, could suffer or we could incur liability through the violation of laws, third-party privacy or other rights, or contracts to which we are a party. Similarly, if the artificial intelligence systems used for deploying new applications or improving operational processes are incorrectly configured, if the data we use to train them is incomplete or inadequate, or if sufficient testing is not completed, the performance of our business operations, as well as our reputation, could suffer.

Previous wording

Public or commercial sources of free or relatively inexpensive consumer credit, credit score and other information have become increasingly available, and this trend is expected to continue. Free sources of consumer employment and income information, such as paystubs, have always existed and could impact demand for our products and services in the event that customers determine such data is sufficient to meet their needs. In addition, governmental agencies in particular have increased the amount of information to which they provide free public access and these or other sources of free or relatively inexpensive consumer information from competitors or other commercial sources may reduce demand for our services. Recently, there also has been an increase in companies offering free or low-cost direct-to-consumer credit services (such as credit scores, reports and monitoring) as part of alternative business models that use such services as a means to introduce consumers to other products and services. To the extent that our customers choose not to obtain services from us and instead rely on information obtained at no cost or relatively inexpensively from these other sources, our business, financial condition and results of operations may be adversely affected.

Current wording

Public or commercial sources of free or relatively inexpensive consumer credit, credit score and other information have become increasingly available, including sources that utilize artificial intelligence or machine learning, and this trend is expected to continue. Free sources of consumer employment and income information, such as paystubs, have always existed and could impact demand for our products and services in the event that customers determine such data is sufficient to meet their needs. In addition, governmental agencies in particular have increased the amount of information to which they provide free public access and these or other sources of free or relatively inexpensive consumer information from competitors or other commercial sources may reduce demand for our services. In recent years, there also has been an increase in companies offering free or low-cost direct-to-consumer credit services (such as credit scores, reports and monitoring) as part of alternative business models that use such services as a means to introduce consumers to other products and services. To the extent that our customers choose not to obtain services from us and instead rely on information obtained at no cost or relatively inexpensively from these other sources, our business, financial condition and results of operations may be adversely affected.

Previous wording

Despite our past experience, opportunities to grow our business through acquisitions, joint ventures and other alliances may not be available to us in the future. In addition, our focus on data security and our technology transformation strategy, including our migration to cloud-based technologies, may limit our ability to identify and complete acquisitions as our stringent technological criteria and standards for acquisition candidates may continue to increase.

Current wording

Despite our past experience, opportunities to grow our business through acquisitions, joint ventures and other alliances may not be available to us in the future. In addition, our focus on data security and our transition to cloud-based technologies may limit our ability to identify and complete acquisitions as our stringent technological criteria and standards for acquisition candidates may continue to increase.

Previous wording

We derive a portion of our revenue from direct and indirect sales to U.S. federal, state and local governments and their respective agencies. We also derive a portion of our revenue from sales to foreign governments and related agencies. Such contracts are subject to various procurement laws and regulations, and contract provisions relating to their formation, administration and performance. Failure to comply with these laws, regulations or provisions in our government contracts could result in the imposition of various civil and criminal penalties, termination of contracts, forfeiture of profits, suspension of payments or suspension of future government contracting. A number of our U.S. federal and state government contracts receive enhanced scrutiny and media attention due to the sensitive nature of the data we handle and due to the importance of the government programs we support. If we experience another material cybersecurity incident, if public or legislative scrutiny and pressure leads to reduced use of data by government agencies, or if we experience uptime issues or performance problems, our ability to maintain existing or acquire new government contracts may be substantially impacted.

Current wording

We derive a meaningful portion of our revenue from direct and indirect sales to U.S. federal, state and local governments, as well as foreign governments, and their respective agencies. Such contracts are subject to various procurement laws and regulations, and contract provisions relating to their formation, administration and performance. Failure to comply with these laws, regulations or provisions in our government contracts could result in the imposition of various civil and criminal penalties, termination or non-renewal of contracts, forfeiture of profits, suspension of payments or suspension of future government contracting. A number of our government contracts receive enhanced scrutiny and media attention due to the sensitive nature of the data we handle and due to the importance of the government programs we support. If we experience another material cybersecurity incident, if public or legislative scrutiny and pressure leads to reduced use of data by government agencies, or if we experience uptime issues or performance problems, our ability to maintain existing or acquire new government contracts may be substantially impacted.

Previous wording

If our government contracts are terminated, if we are suspended from government work, if the services we provide are no longer needed due to government program change or termination, or if our ability to compete for new contracts is adversely affected, including by our failure to achieve certain government certifications, our business could suffer.

Current wording

If our government contracts are terminated or not funded, if we are suspended from government work, if the services we provide are no longer needed due to government program change or termination, or if our ability to compete for new contracts is adversely affected, including by our failure to achieve certain government certifications, our business and financial performance could suffer.

Previous wording

Over the past several years, regulators, certain investors, and other stakeholders have focused on various environmental, social and governance ("ESG") matters, both in the United States and internationally. We communicate certain ESG-related initiatives, goals and commitments regarding climate, diversity, responsible sourcing and social investments, and other matters, on our website, in our filings with the SEC and elsewhere. These initiatives, goals and commitments could be difficult to achieve and costly to implement. For example, we have announced our commitments to reduce our greenhouse gas emissions, the achievement of which relies, in large part, on the accuracy of our estimates and assumptions around the availability and cost of renewable energy sources and technologies, the availability of suppliers that can meet our sustainability and other standards, and other factors. We could fail to achieve, or be perceived to fail to achieve, our greenhouse gas reduction commitments or other ESG-related initiatives, goals and commitments. In addition, we could be criticized for the timing, scope or nature of these initiatives, goals and commitments, or for any revisions to them. To the extent that our required and voluntary disclosures about ESG matters increase, we could be criticized for the accuracy, adequacy or completeness of such disclosures. Our actual or perceived failure to achieve our ESG-related initiatives, goals and commitments could negatively impact our reputation or otherwise materially harm our business.

Current wording

Over the past several years, regulators, investors, customers, employees and other stakeholders have focused on various environmental, social and governance ("ESG") matters, both in the United States and internationally. In response to stakeholder feedback, we communicate certain information regarding our responsible business priorities, including initiatives, goals and commitments related to climate, inclusion and diversity, responsible sourcing and social investments, in public disclosures. These initiatives, goals and commitments could be difficult to achieve and costly to implement. For example, we have announced our commitments to reduce our greenhouse gas emissions, the achievement of which relies, in large part, on the accuracy of our estimates and assumptions around the availability and cost of renewable energy sources and technologies, the availability of suppliers that can meet our sustainability and other standards, and other factors. We could fail to achieve, or be perceived to fail to achieve, our greenhouse gas reduction commitments or other responsible business initiatives, goals and commitments. In addition, we could be criticized for the timing, scope or nature of these initiatives, goals and commitments, or for any revisions to them. Our actual or perceived failure to achieve our responsible business-related initiatives, goals and commitments could negatively impact our reputation or otherwise materially harm our business.

Previous wording

Our transition to cloud-based technologies could expose us to operational disruptions.

Current wording

Our use of cloud-based and other technologies that are outsourced to third parties could expose us to operational disruptions.

Previous wording

Upon implementation of the new cloud-based solutions, much of our information technology systems will consist of outsourced, cloud-based infrastructure, platform and software-as-a-service solutions not under our direct management or control. Any disruption to either the outsourced systems or the communication links between us and the outsourced supplier could negatively affect our ability to operate our data systems and could impair our ability to provide services to our customers. We may incur additional costs to remedy the damages caused by these disruptions.

Current wording

We rely on the efficient and uninterrupted operation of complex information technology systems and networks, some of which are managed internally within the Company and some of which are outsourced to third parties. As part of our technology transformation, we upgraded a significant portion of the information technology systems used to operate our business and replaced them with cloud-based solutions. Our information technology applications and systems consist primarily of outsourced, cloud-based infrastructure, platforms and software-as-a-service solutions not under our direct management or control. Any disruption to either the outsourced systems or the communication links between us and the outsourced supplier could negatively affect our ability to operate our data systems and could impair our ability to provide services to our customers. We may incur additional costs to remedy the damages caused by these disruptions.

Previous wording

Data accuracy is an essential component of data quality and is the foundation of our business model. Accurate data increases predictive ability and improves confidence in decisions for our customers. Inaccurate or unreliable data could adversely affect customer decisioning and poses reputational, compliance and financial risk to our company. Although we have developed internal processes and controls to maintain and continually improve data accuracy, these processes and controls cannot ensure absolute accuracy and the complexity of our technology transformation may introduce additional risk until it is completed. We have experienced data accuracy issues, including errors in connection with our technology transformation. To date, none of these issues have had a material impact on our operations or financial results. However, any future data accuracy issues arising during the technology transformation or otherwise could have a material adverse effect on our business or results of operations, including through the incurrence of additional costs or the loss of customers and harm to our reputation.

Current wording

Data accuracy is an essential component of data quality and is the foundation of our business model. Accurate data increases predictive ability and improves confidence in decisions for our customers. Inaccurate or unreliable data could adversely affect customer decisioning and poses reputational, regulatory compliance, litigation and financial risk to our company. Although we have developed internal processes and controls to maintain and continually improve data accuracy, these processes and controls cannot ensure absolute accuracy and the complexity of our technology transformation may introduce additional risk. We have experienced data accuracy issues, including errors in connection with our technology transformation. To date, none of these issues have had a material impact on our operations or financial results. However, any future data accuracy issues arising in connection with our technology transformation or otherwise could have a material adverse effect on our business or results of operations, including through the incurrence of additional costs or the loss of customers and harm to our reputation.

Previous wording

If our systems do not meet customer requirements for response time or high availability, or we experience system constraints or failures, or our customers do not migrate to the cloud or modify and/or upgrade their systems to accept new releases of our products and services, our services to our customers could be delayed or interrupted, which could result in lost revenues or customers, lower margins, service level penalties or other harm to our business and reputation.

Current wording

If our systems do not meet customer requirements for response time or high availability, or we experience system constraints or failures, or if our customers do not modify and/or upgrade their systems to accept new releases of our products and services, our services to our customers could be delayed or interrupted, which could result in lost revenues or customers, lower margins, service level penalties or other harm to our business and reputation.

Previous wording

Our customers expect high system availability and response time performance, as well as a very high degree of system resilience. We depend on reliable, stable, efficient and uninterrupted operation of our technology network, systems and data centers to provide service to our customers. Many of the services and systems upon which we rely have been outsourced to third parties. In addition, many of our revenue streams are dependent on links to third party telecommunications providers. These systems and operations, and the personnel that support, service and operate these systems, could be exposed to interruption, damage or destruction from power loss, telecommunication failures, computer viruses, denial-of-service or other cyber attacks, employee or insider malfeasance, human error, fire, natural disasters, war, terrorist acts or civil unrest. We may not have sufficient disaster recovery or redundant operations in place to cover a loss or failure of systems or telecommunications links in a timely manner, which may be exacerbated by any delays in obtaining equipment due to supply chain or other impacts.

Current wording

Our customers expect high system availability and response time performance, as well as a very high degree of system resilience. We depend on reliable, stable, efficient and uninterrupted operation of our technology network, systems and data centers to provide service to our customers. Many of the services and systems upon which we rely have been outsourced to third parties. In addition, many of our revenue streams are dependent on links to third party telecommunications providers. These systems and operations, and the personnel that support, service and operate these systems, could be exposed to interruption, damage or destruction from power loss, telecommunication failures, computer viruses, denial-of-service or other cyber attacks, employee or insider malfeasance, human error, fire, natural disasters, war, terrorist acts or civil unrest. We may not have sufficient disaster recovery or redundant operations in place to cover a loss or failure of systems or telecommunications links in a timely manner, which may be exacerbated by any delays in obtaining equipment due to supply chain or other impacts. Any significant system interruption or series of minor interruptions could result in the loss of customers and/or lost revenues, lower margins, service level penalties or other significant harm to our business or reputation.

Previous wording

As part of our technology transformation, we have outsourced various components of our application development, information technology, operational support and administrative functions and will continue to evaluate additional outsourcing. If our outsourcing vendors fail to perform their obligations in a timely manner or at satisfactory quality levels including with respect to data and system security, or increase prices for their services to unreasonable levels, our ability to bring products to market and support our customers and our reputation could suffer. Any failure to perform on the part of these third-party providers could impair our ability to operate effectively and could result in lower future revenue, unrealized efficiencies and adversely impact our results of operations and our financial condition. Some of our outsourcing takes place in developing countries and, as a result, may be subject to geopolitical uncertainty.

Current wording

We have outsourced various components of our application development, information technology, operational support and administrative functions and will continue to evaluate additional outsourcing. If our outsourcing vendors fail to perform their obligations in a timely manner or at satisfactory quality levels including with respect to data and system security, or increase prices for their services to unreasonable levels, our ability to bring products to market and support our customers and our reputation could suffer. Any failure to perform on the part of these third-party providers could impair our ability to operate effectively and could result in lower future revenue, unrealized efficiencies and adversely impact our results of operations and our financial condition. Some of our outsourcing takes place in developing countries and, as a result, may be subject to geopolitical uncertainty.

Previous wording

Our future success, including our ability to implement our technology transformation strategy, depends partly on the continued service of our key development, sales, marketing, executive and administrative personnel. Increased retention risk exists in certain key areas of our operations, such as IT and data security, which require specialized skills, such as migrating legacy computer systems to the cloud, data security expertise and analytical modeling. If we fail to retain and hire a sufficient number of these personnel, we will not be able to maintain or expand our business. As part of our technology transformation strategy, we have hired or contracted with a significant number of new employees and contract workers. Hiring, on-boarding training, motivating, retaining and managing employees with the skills required is time-consuming and expensive. There is intense competition for certain highly technical specialties in geographic areas where we continue to recruit, and it may become more difficult to retain our key employees. If we are not able to hire sufficient employees to support our business, including our technology transformation, or to train, motivate, retain and manage the employees we do hire, it could have a material adverse effect on our business operations or financial results.

Current wording

Our future success depends partly on the continued service of our key development, sales, marketing, executive and administrative personnel. Increased retention risk exists in certain key areas of our operations, such as data and analytics, IT and data security, which require specialized skills, including cloud security, application development and maintenance and artificial intelligence expertise and analytical modeling. If we fail to retain and hire a sufficient number of these personnel, we will not be able to maintain or expand our business. Hiring, on-boarding training, motivating, retaining and managing employees with the skills required is time-consuming and expensive. There is intense competition for certain highly technical specialties in geographic areas where we continue to recruit, and it may become more difficult to retain our key employees. If we are not able to hire sufficient employees to support our business or to train, motivate, retain and manage the employees we do hire, it could have a material adverse effect on our business operations or financial results.

Previous wording

Sales outside the U.S. comprised 23% of our total revenue in 2023. As a result, our business is subject to various risks associated with doing business internationally and these risks may differ in each jurisdiction where we operate depending on the particular product or service we offer in the jurisdiction. In addition, many of our employees, suppliers, job functions and facilities are located outside the U.S. Accordingly, our future results could be harmed by a variety of factors including:

Current wording

Sales outside the U.S. comprised 24% of our total revenue in 2024. As a result, our business is subject to various risks associated with doing business internationally and these risks may differ in each jurisdiction where we operate. In addition, many of our employees, suppliers, job functions and facilities are located outside the U.S. Accordingly, our future results could be harmed by a variety of factors including:

Previous wording

•geopolitical instability, including terrorism and war and international conflict, including the Russia-Ukraine war and the Israel-Palestine conflict;

Current wording

•geopolitical instability, including terrorism and war and international conflict;

Previous wording

•the presence and acceptance of varying level of business corruption in international markets; and

Current wording

•the presence and acceptance of varying levels of business corruption in international markets; and

Previous wording

As part of a global settlement, we entered into agreements with various parties to settle the U.S. Consumer MDL Litigation and certain federal and state government investigations arising out a material cybersecurity incident in 2017. If we are unable to comply with our obligations under these agreements, it could have a material adverse effect on our financial condition.

Current wording

As part of a global settlement, we entered into agreements with various parties to settle the U.S. Consumer MDL Litigation and certain federal and state government investigations arising out of a material cybersecurity incident in 2017. If we are unable to comply with our obligations under these agreements, it could have a material adverse effect on our financial condition.

Previous wording

In July 2019, the Company entered into multiple agreements that resolve the U.S. consolidated consumer class action cases, captioned In re: Equifax, Inc. Customer Data Security Breach Litigation, MDL No. 2800 (Consumer Cases) (the “U.S. Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the Attorneys General of 48 states, the District of Columbia and Puerto Rico (the “MSAG Group”) and the NYDFS (collectively, the “Consumer Settlement”) relating to a material cybersecurity incident in 2017. The Consumer Settlement became effective on January 11, 2022.

Current wording

In July 2019, the Company entered into multiple agreements that resolved the U.S. consolidated consumer class action cases, captioned In re: Equifax, Inc. Customer Data Security Breach Litigation, MDL No. 2800 (Consumer Cases), and the investigations of the FTC, the CFPB, the Attorneys General of 48 states, the District of Columbia and Puerto Rico and the NYDFS (collectively, the “Consumer Settlement”) relating to a material cybersecurity incident in 2017. The Consumer Settlement became effective on January 11, 2022.

Previous wording

We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy, cybersecurity, data and financial protection. See “Item 1. Business—Governmental Regulation” in this Form 10-K for a summary of the U.S. and foreign consumer and data protection laws and regulations to which we are subject. These regulations are complex, change frequently, have tended to become more stringent over time, and are subject to administrative interpretation and judicial construction in ways that could harm our business. In addition, new laws and regulations at the state and federal level are enacted frequently, such as amendments to the FCRA, cybersecurity and other requirements promulgated by the FTC, New York Department of Financial Services and SEC, and data privacy laws in several U.S. states.

Current wording

As a data, analytics and technology company and credit reporting agency, we are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer financial protection, data protection, data privacy, artificial intelligence and cybersecurity. See “Item 1. Business—Governmental Regulation” in this Form 10-K for a summary of the U.S. and foreign consumer and data protection laws and regulations to which we are subject. These regulations are complex, change frequently, have tended to become more stringent over time, and are subject to administrative interpretation and judicial construction in ways that could harm our business. In addition, new laws and regulations at the state and federal level are enacted frequently, such as amendments to the FCRA, cybersecurity and other requirements promulgated by the FTC, the NYDFS and the SEC, and data privacy laws in several U.S. states.

Previous wording

There are a number of legislative proposals pending before the U.S. Congress, various state legislative bodies and foreign governments concerning privacy or cybersecurity that could affect us. The Canadian and Australian governments have initiated reviews of their consumer privacy laws, and several U.S. states have introduced varying comprehensive privacy laws modeled to some degree on the CCPA and/or the GDPR. In the U.S. and other countries, there have also been new legislative proposals to regulate business use and development of artificial intelligence and machine learning technologies which, if enacted, could impose new legal requirements addressing among other issues, privacy, discrimination and human rights. The specifics of such legislation and the number of jurisdictions that will introduce legislation in this area remain unclear at this time. In addition, a growing number of legislative and regulatory bodies have adopted consumer notification and other requirements in the event that consumer information is accessed or acquired by unauthorized persons and additional regulations regarding the use, access, accuracy and security of such data are possible. In the U.S., state laws provide for disparate notification regimes, all of which we are subject to. Further, any perception that our practices or products are an invasion of privacy, whether or not consistent with current or future regulations and industry practices, may subject us to public criticism, private class actions, reputational harm, or claims by regulators, which could disrupt our business and expose us to increased liability.

Current wording

In addition, there are laws and legislative proposals in the U.S. and abroad concerning privacy and cybersecurity that have implications for our business. For example, the Canadian and Australian governments have initiated reviews of their consumer privacy laws, and several U.S. states have introduced varying comprehensive privacy laws modeled to some degree on the CCPA and/or the GDPR. More recently, regulators and legislators have been increasingly focused on the use of algorithms, artificial intelligence and machine learning in business processes. Multiple jurisdictions, including the EU and at least one U.S. state, have adopted laws related to the development and use of artificial intelligence. There have also been new legislative proposals to regulate business use and development of artificial intelligence and machine learning technologies which, if enacted, could impose new legal requirements addressing among other issues, privacy, discrimination and human rights. The specifics of such legislation and the number of other jurisdictions that will introduce legislation in this area remain unclear at this time.

Previous wording

We devote substantial compliance, legal and operational business resources to strive for compliance with applicable regulations and requirements. In the future, we may be subject to significant additional expenses related to compliance with applicable laws and regulations, including new laws and evolving interpretations that have varying requirements and/or are difficult to predict, and to the investigation, defense or remedy of actual or alleged violations. Additionally, we cooperate with CFPB supervisory examinations and respond to other state, federal and foreign government examinations of, or inquiries into, our business practices. In particular, legislative activity in the privacy area may result in new laws that are applicable to us and that may hinder our business, for example, by restricting use or sharing of consumer data, including for marketing or advertising or limiting the use of, limiting our ability to provide certain consumer data to our customers, or otherwise regulating artificial intelligence and machine learning, including the use of algorithms and automated processing in ways that could materially affect our business, or which may lead to significant increases in the cost of compliance. Any failure by us to comply with, or remedy any violations of, applicable laws and regulations, could result in new costs for our operations, the curtailment of certain of our operations, the imposition of fines and penalties, liability to private plaintiffs as a result of individual or class action litigation, restrictions on the operation of our business and reputational harm. It is difficult to predict the impact on our business if we were subject to allegations of having violated existing laws. For example, in Europe, the GDPR, which includes extensive regulations for certain security incidents, could result in fines of up to four percent of annual worldwide “turnover” (a measure similar to revenues in the U.S.). In addition, because many of our products are regulated or sold to customers in various industries, we must comply with additional regulations in marketing our products. Moreover, our compliance with privacy laws and regulations and our reputation depend in part on suppliers’ or customers’ adherence to privacy laws and regulations and their use of our services in ways consistent with consumer expectations and regulatory requirements. Additionally, we may not succeed in adapting our products to changes in the regulatory environment in an efficient, cost effective manner. We cannot predict the ultimate impact on our business of new or proposed rules, supervisory examinations or government investigations or enforcement actions.

Current wording

Any failure by us to comply with, or remedy any violations of, applicable laws and regulations could result in new costs for our operations, the curtailment of certain of our operations, the imposition of fines and penalties, liability to private plaintiffs as a result of individual or class action litigation, restrictions on the operation of our business and reputational harm. It is difficult to predict the impact on our business if we were subject to allegations of having violated existing laws. For example, in Europe, the GDPR, which includes extensive regulations for certain security incidents, could result in fines of up to 4% of annual worldwide “turnover” (a measure similar to revenues in the U.S.). In addition, because many of our products are regulated or sold to customers in various industries, we must comply with additional regulations in marketing our products. Moreover, our compliance with privacy laws and regulations and our reputation depend in part on suppliers’ or customers’ adherence to privacy laws and regulations and their use of our services in ways consistent with consumer expectations and regulatory requirements. Additionally, we may not succeed in adapting our products to changes in the regulatory environment in an efficient, cost effective manner. We cannot predict the ultimate impact on our business of new or proposed rules, supervisory examinations or government investigations or enforcement actions.

Previous wording

The CFPB conducts examinations and investigations, issues requests for information and subpoenas and brings civil actions in federal court for violations of the federal consumer financial laws, including the FCRA. In these proceedings, the CFPB can seek relief that includes: rescission or reformation of contracts, restitution, disgorgement of profits, payment of damages, limits on activities and civil money penalties of up to $1.0 million per day for known violations. The CFPB conducts periodic examinations of our business and the consumer reporting industry, which could result in new regulations or enforcement actions or proceedings. Actions by the CFPB could result in requirements to alter or cease offering affected products and services, making them less attractive and restricting our ability to offer them.

Current wording

The CFPB conducts examinations and investigations, issues requests for information and subpoenas, and brings civil actions in federal court for violations of the federal consumer financial laws, including the FCRA. In these proceedings, the CFPB can seek relief that includes: rescission or reformation of contracts, restitution, disgorgement of profits, payment of damages, limits on activities and civil money penalties of up to $1.0 million per day for known violations. The CFPB conducts periodic examinations of our business and the consumer reporting industry and issues requests for information or subpoenas to us from time to time. The CFPB has in the past, and may in the future, initiate enforcement actions against us with regard to our compliance with federal consumer financial protection laws. Actions by the CFPB against us can result, and have in the past resulted, in monetary penalties and requirements to alter or cease offering affected products and services, making them less attractive and restricting our ability to offer them.

Previous wording

Although we have committed resources to enhancing our compliance programs, actions by the CFPB or other regulators against us could result in financial or reputational harm. Our compliance costs and legal and regulatory exposure could increase materially if the CFPB or other regulators enact new regulations, change regulations that were previously adopted, modify through supervision or enforcement past regulatory guidance, or interpret existing regulations in a manner different or stricter than have been previously interpreted.

Current wording

Although we have committed resources to enhancing our compliance programs, actions by the CFPB or other regulators against us could result in financial or reputational harm. Our compliance costs and legal and regulatory exposure could increase materially if the CFPB or other regulators enact new regulations, change existing regulations, modify through supervision or enforcement past regulatory guidance, or interpret existing regulations in a manner different or stricter than have been previously interpreted.

Previous wording

The federal banking agencies, including the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System and the CFPB, as well as many state banking agencies have issued guidance to insured depository institutions and other providers of financial services on assessing and managing risks associated with third-party relationships, which include all business arrangements between a financial services provider and another entity, by contract or otherwise, and generally requires banks and financial services providers to exercise comprehensive oversight throughout each phase of a bank or financial service provider’s business arrangement with third-party service providers, and instructs banks and financial service providers to adopt risk management processes commensurate with the level of risk and complexity of their third-party relationships. This guidance requires more rigorous oversight of third-party relationships that involve certain “critical activities.” In light of this guidance, our existing or potential bank and financial services customers subject to this guidance may continue to revise their third-party risk management policies and processes and the terms on which they do business with us, which may adversely affect our relationships with such customers and/or increase our expenses in servicing such customers.

Current wording

The federal banking agencies, including the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System and the CFPB, as well as many state and foreign banking agencies have issued guidance to insured depository institutions and other providers of financial services on assessing and managing risks associated with third-party relationships, which include all business arrangements between a financial services provider and another entity, by contract or otherwise, and generally requires banks and financial services providers to exercise comprehensive oversight throughout each phase of a bank or financial service provider’s business arrangement with third-party service providers, and instructs banks and financial service providers to adopt risk management processes commensurate with the level of risk and complexity of their third-party relationships. This guidance requires more rigorous oversight of third-party relationships that involve certain “critical activities.” In light of this guidance, our existing or potential bank and financial services customers subject to this guidance may continue to revise their third-party risk management policies and processes and the terms on which they do business with us, which may adversely affect our relationships with such customers and/or increase our expenses in servicing such customers.

Previous wording

There has been substantial litigation in the U.S. regarding intellectual property rights in the information technology industry. From time to time, third parties may make claims that one or more of our products or services infringe their intellectual property rights. We analyze and take action in response to each such claim on a case by case basis. A dispute or litigation regarding patents or other intellectual property can be costly and time-consuming due to the complexity of our technology and the inherent uncertainty of intellectual property litigation, could divert our management and key personnel from our business operations, and we may not prevail. A claim of intellectual property infringement could force us to enter into a costly or restrictive license agreement, which might not be available under acceptable terms or at all, or could subject us to significant damages or to an injunction against development and sale of certain of our products or services. Our intellectual property portfolio may not be useful in asserting a counterclaim, or providing commercial leverage for negotiating a license, in response to a claim of intellectual property infringement. In certain of our businesses we rely on third-party intellectual property licenses and we cannot ensure that these licenses will be available to us in the future on favorable terms or at all. Although our policy is to obtain licenses or other rights where necessary, we cannot provide assurance that we have obtained all required licenses or rights.

Current wording

There is substantial litigation, both in the U.S. and more recently the Unified Patent Court in Europe, regarding intellectual property rights in the information technology industry. From time to time, third parties may make claims that one or more of our products or services infringe their intellectual property rights. We analyze and take action in response to each such claim on a case by case basis. A dispute or litigation regarding patents or other intellectual property can be costly and time-consuming due to the complexity of our technology and the inherent uncertainty of intellectual property litigation, could divert our management and key personnel from our business operations, and we may not prevail. A claim of intellectual property infringement could force us to enter into a costly or restrictive license agreement, which might not be available under acceptable terms or at all, or could subject us to significant damages or to an injunction against development and sale of certain of our products or services. Our intellectual property portfolio may not be useful in asserting a counterclaim, or providing commercial leverage for negotiating a license, in response to a claim of intellectual property infringement. In certain of our businesses we rely on third-party intellectual property licenses and we cannot ensure that these licenses will be available to us in the future on favorable terms or at all. Although our policy is to obtain licenses or other rights where necessary, we cannot provide assurance that we have obtained all required licenses or rights.

Previous wording

Third parties may misappropriate or infringe on our intellectual property and we may suffer competitive injury or expend significant resources enforcing our rights.

Current wording

Third parties may misappropriate or infringe our intellectual property and we may suffer competitive injury or expend significant resources enforcing our rights.

Previous wording

Our success increasingly depends on our proprietary technology and its ability to differentiate us from our competitors. We rely on various intellectual property rights, including patents, copyrights, database rights, trademarks and trade secrets, as well as contract restrictions, confidentiality provisions and licensing arrangements, to establish and protect our proprietary rights. The extent to which such rights can be protected varies in different jurisdictions. If we do not protect and enforce our intellectual property rights successfully, our competitive position may suffer which could harm our operating results. Our pending patent and trademark applications may not be allowed or competitors may challenge the validity or scope of our intellectual property rights. In addition, our patents, copyrights, trademarks and other intellectual property rights may not provide us a significant competitive advantage.

Current wording

Our success increasingly depends on our proprietary technology and its ability to differentiate us from our competitors. We rely on various intellectual property rights, including patents, copyrights, database rights, trademarks and trade secrets, as well as contract restrictions, confidentiality provisions and licensing arrangements, to establish and protect our proprietary rights. The extent to which such rights can be protected varies in different jurisdictions and is rapidly evolving with respect to artificial intelligence. If we do not protect and enforce our intellectual property rights successfully, our competitive position may suffer which could harm our operating results. Our pending patent and trademark applications may not be allowed or competitors may challenge the validity or scope of our intellectual property rights. In addition, our patents, copyrights, trademarks and other intellectual property rights may not provide us a significant competitive advantage.