MARSH & MCLENNAN COMPANIES, INC.

Previous wording

•Increasing scrutiny and changing laws and expectations from regulators, investors, clients and our colleagues with respect to our environmental, social and governance (ESG) practices and disclosure may impose additional costs on us or expose us to new or additional risks;

Current wording

•Increasing scrutiny and changing laws and expectations from regulators, investors, clients and our colleagues with respect to our business responsibility practices and disclosure may impose additional costs on us or expose us to new or additional risks;

Previous wording

•Adverse legal developments and future regulations concerning how intermediaries are compensated by insurers or clients, as well as allegations of anti-competitive behavior or conflicts of interest, could have a material adverse effect on Marsh’s business, results of operations and financial condition;

Current wording

•Adverse legal developments and future regulations concerning how intermediaries are compensated by insurers or clients, as well as allegations of anti-competitive behavior or conflicts of interest, could have a material adverse effect on Marsh Risk’s business, results of operations and financial condition;

Previous wording

•Mercer’s Wealth business is subject to a number of risks, including risks related to public and private capital market fluctuations, third-party asset managers and custodians, operations and technology risks, trading and execution risks, conflicts of interest, ESG and greenwashing, asset performance and regulatory compliance, that, if realized, could result in significant damage to our business;

Current wording

•Mercer’s Wealth business is subject to a number of risks, including risks related to public and private capital market fluctuations, third-party asset managers and custodians, operations and technology risks, trading and execution risks, conflicts of interest, sustainability and greenwashing, asset performance and regulatory compliance, that, if realized, could result in significant damage to our business;

Previous wording

Geopolitical and macroeconomic conditions, including from multiple major wars and global conflicts, slower GDP growth or recession, lower interest rates, capital markets volatility, inflation and changes in insurance premium rates affect our clients' businesses and the markets they serve. These conditions, including inflationary expense pressure with our clients, may reduce demand for our services or depress pricing for those services, which could have a material adverse effect on our results of operations.

Current wording

Geopolitical and macroeconomic conditions, including from multiple major wars and global conflicts, social unrest, tariffs or changes in trade policies, slower GDP growth or recession, fluctuations in foreign exchange rates, lower interest rates, capital markets volatility, inflation and changes in insurance premium rates affect our clients' businesses and the markets they serve. These conditions, including inflationary expense pressure with our clients, may reduce demand for our services or depress pricing for those services, which could have a material adverse effect on our results of operations.

Previous wording

For example, the war in Ukraine and the conflict throughout the Middle East have resulted in worldwide geopolitical and macroeconomic uncertainty and may negatively impact other regional and global economic markets (including Europe, the Middle East and the U.S.), companies in other countries (particularly those that have done business with Russia or have substantial exposure to, or operations in, impacted countries) and various sectors, industries and markets for securities and commodities globally, such as oil and natural gas, and may increase financial market volatility and adversely impact regional and global economic markets, industries and companies.

Current wording

For example, the war in Ukraine, the conflict throughout the Middle East, including heightened regional instability and tensions involving Iran, and recent developments in Latin America, have resulted in worldwide geopolitical and macroeconomic uncertainty and may negatively impact other regional and global economic markets (including Europe, the Middle East, Latin America and the U.S.), companies in other countries and various sectors, industries and markets for securities and commodities globally, such as oil and natural gas, and may increase financial market volatility and adversely impact regional and global economic markets, industries and companies.

Previous wording

More generally, our investments, including our minority investments in other companies as well as our cash investments and those held in a fiduciary capacity, are subject to general credit, liquidity, counterparty, foreign exchange, market and interest rate risks. For example, fluctuations in interest rates and foreign exchange rates between the U.S. dollar and foreign currencies may adversely affect our results of operations. Lower interest rates may lead to a decline in our fiduciary income.

Current wording

More generally, our investments, including our minority investments in other companies as well as our cash investments and those held in a fiduciary capacity, are subject to general credit, liquidity, counterparty, foreign exchange, market and interest rate risks. For example, fluctuations in interest rates and foreign exchange rates between the U.S. dollar and foreign currencies may adversely affect our results of operations. Lower interest rates have led to a decline in our fiduciary income.

Previous wording

Our activities are subject to extensive regulation under the laws of the U.S. and its various states, the United Kingdom, the European Union and its member states, Australia and the other jurisdictions in which we operate. We are also subject to trade sanctions laws relating to countries such as Afghanistan, Belarus, Cuba, Iran, North Korea, Russia, Syria, Ukraine (Russia-controlled territories) and Venezuela, and anti-corruption laws such as the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act. We are subject to numerous other laws on matters as diverse as internal control over financial reporting and disclosure controls and procedures, securities regulation, data privacy and protection, cybersecurity, taxation, anti-trust and competition, immigration, wage-and-hour standards and employment and labor relations.

Current wording

Our activities are subject to extensive regulation under the laws of the U.S. and its various states, the United Kingdom, the European Union and its member states, Australia and the other jurisdictions in which we operate. We are also subject to trade sanctions laws relating to countries such as Afghanistan, Belarus, Cuba, Iran, North Korea, Russia, Syria, Ukraine (Russia-controlled territories) and Venezuela, and anti-corruption laws such as the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act. We are subject to numerous other laws on matters as diverse as internal control over financial reporting and disclosure controls and procedures, securities regulation, data privacy and protection, cybersecurity, taxation, anti-trust and competition, anti-money laundering, immigration, wage-and-hour standards and employment and labor relations.

Previous wording

The U.S. and foreign laws and regulations that apply to our operations are complex and may change rapidly, and our efforts to comply and keep up with them require significant resources. In some cases, these laws and regulations may decrease the need for our services, increase our costs, negatively impact our revenues or impose operational limitations on our business, including on the products and services we may offer or on the amount or type of compensation we may collect. In particular, the financial and operational impact of complying with laws and regulations has increased in the current global environment of increased regulatory activity and enforcement. In addition, in the United States, shifts in regulatory priorities, policy approaches or interpretations of existing laws by federal, state or local governments occur following changes in U.S. presidential administrations, which often leads to changes involving the level of regulatory oversight and focus on businesses and certain industries, particularly financial services. Changes or uncertainty with respect to the applicable laws and regulations may impose additional and unforeseen costs on us or pose new or previously immaterial risks to us. There can be no assurance that current and future government regulations will not adversely affect our business, and we cannot predict new regulatory priorities, the form, content or timing of regulatory actions, and their impact on our business and operations. In addition, geopolitical conflict, such as the war in Ukraine and the conflict throughout the Middle East, has resulted in, and may continue to result in, new and rapidly evolving trade sanctions, which may increase our costs, negatively impact our revenues or impose additional operational limitations on our businesses. Changes to tax laws, trade agreements, tariffs, labor policies, or environmental standards could also result in increased costs or operational changes.

Current wording

The U.S. and foreign laws and regulations that apply to our operations are complex and may change rapidly, and our efforts to comply and keep up with them require significant resources. In some cases, these laws and regulations may decrease the need for our services, increase our costs, negatively impact our revenues or impose operational limitations on our business, including on the products and services we may offer or on the amount or type of compensation we may collect. In particular, the financial and operational impact of complying with laws and regulations has increased in the current global environment of increased regulatory activity and enforcement. Changes or uncertainty with respect to the applicable laws and regulations may impose additional and unforeseen costs on us or pose new or previously immaterial risks to us. There can be no assurance that current and future government regulations will not adversely affect our business, and we cannot predict new regulatory priorities, the form, content or timing of regulatory actions, and their impact on our business and operations. In addition, geopolitical conflict, such as the war in Ukraine and the conflict throughout the Middle East, has resulted in, and may continue to result in, new and rapidly evolving trade sanctions, which may increase our costs, negatively impact our revenues or impose additional operational limitations on our businesses. Changes to tax laws, trade agreements, tariffs, labor policies, or environmental standards could also result in increased costs or operational changes.

Previous wording

In operating our business and providing services and solutions to clients, we collect, use, store, transmit and otherwise process certain electronic information, including personal, confidential, proprietary and sensitive data such as financial records, health care, mergers and acquisitions and personal data of our clients, colleagues and vendors. We rely on the efficient, uninterrupted and secure operation of complex information technology systems and networks to operate our business and securely process, transmit and store electronic information. In the normal course of business, we also share electronic information with our vendors and other third parties, which in some cases is critical to our ability to deliver services to our clients. This electronic information comprises sensitive and confidential data, including information related to financial records, health care, mergers and acquisitions and clients’ personal data. Our information technology systems and information security control systems, and those of our numerous third-party providers, as well as the control systems of critical infrastructure they rely on, such as power grids, and undersea cables, are potentially vulnerable to unauthorized access, damage or interruption from a variety of external threats, including software bugs, physical attack, cyberattacks, computer viruses and other malware, malicious or destructive code, ransomware, social engineering attacks (including phishing, business e-mail compromise and digital or telephonic impersonation), hacking theft, denial-of-service attacks and other types of data and systems-related modes of attack. The techniques used to achieve such unauthorized access, damage or interruption change frequently and new techniques may not be identified until they are launched against a target, and we may be unable to anticipate these techniques or implement adequate preventative or remedial measures, resulting in potential data loss, data unavailability, data corruption or other damage to information technology systems. In addition, remote and hybrid work arrangements have increased the risk of phishing and other cybersecurity attacks, unauthorized dissemination of personal, confidential, proprietary or sensitive data, and unauthorized access to company computing assets. Further, a disruption of physical infrastructure could impact our ability to conduct business and service clients. This may include deliberate or unintentional disruption of service to electrical systems, satellite communications, undersea or terrestrial cable systems, Internet services, or other systems our colleagues or third parties rely on us to conduct business in a multitude of jurisdictions across the globe. Disruptions may be the result of weather, natural disaster, war, terrorism, pandemic, or other natural or geopolitical events. Our systems are also subject to compromise from internal threats such as fraud, mistakes, misconduct or other improper action by employees, ve…

Excerpt shortened here; the source contains the full paragraph.

Current wording

In operating our business and providing services and solutions to clients, we collect, use, store, transmit and otherwise process certain electronic information, including personal, confidential, proprietary and sensitive data such as financial records, health care, mergers and acquisitions and personal data of our clients, colleagues and vendors. We rely on the efficient, uninterrupted and secure operation of complex information technology systems and networks to operate our business and securely process, transmit and store electronic information. In the normal course of business, we also share electronic information with our vendors and other third parties, which in some cases is critical to our ability to deliver services to our clients. This electronic information comprises sensitive and confidential data, including information related to financial records, health care, mergers and acquisitions and clients’ personal data. Our information technology systems and information security control systems, and those of our numerous third-party providers, as well as the control systems of critical infrastructure they rely on, such as power grids, and undersea cables, are potentially vulnerable to unauthorized access, damage or interruption from a variety of external threats, including software bugs, physical attack, cyberattacks, computer viruses and other malware, malicious or destructive code, ransomware, social engineering attacks (including phishing, business e-mail compromise and digital or telephonic impersonation), hacking theft, denial-of-service attacks and other types of data and systems-related modes of attack. The techniques used to achieve such unauthorized access, damage or interruption change frequently and new techniques may not be identified until they are launched against a target, and we may be unable to anticipate these techniques or implement adequate preventative or remedial measures, resulting in potential data loss, data unavailability, data corruption or other damage to information technology systems. In addition, remote and hybrid work arrangements have increased the risk of phishing and other cybersecurity attacks, unauthorized dissemination of personal, confidential, proprietary or sensitive data, and unauthorized access to company computing assets. Further, a disruption of physical infrastructure could impact our ability to conduct business and service clients. This may include deliberate or unintentional disruption of service to electrical systems, satellite communications, undersea or terrestrial cable systems, Internet services, or other systems our colleagues or third parties rely on us to conduct business in a multitude of jurisdictions across the globe. Disruptions may be the result of weather, natural disaster, war, terrorism, pandemic, or other natural or geopolitical events. Our systems are also subject to compromise from internal threats such as fraud, mistakes, misconduct or other improper action by employees, ve…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Cyberattacks are increasing in frequency and evolving in nature. We are at risk of attack by a variety of adversaries, including nation states, state-sponsored organizations, opportunistic attacks, and organized crime and hackers, through use of increasingly sophisticated methods of attack, including the deployment of AI to find and exploit vulnerabilities, "deep fakes", long-term, persistent attacks (referred to as advanced persistent threats) and the use of the IT supply chain to introduce malware through software updates or compromised suppliers accounts or hardware. In particular, the advance of AI and large language models has given rise to additional vulnerabilities and potential entry points for cyber threats. With generative AI tools, threat actors may have additional tools to automate breaches or persistent attacks, evade detection, or generate sophisticated phishing emails or other forms of digital impersonation, doing so quickly and without requiring deep technical understanding of potential exploits. In addition, increasing use of generative AI models in our internal systems may create new attack methods for adversaries. Because generative AI is a new field, understanding of cybersecurity risks and protection methods continues to develop, and features that rely on generative AI, including in services provided to us by third parties, may be susceptible to unanticipated cybersecurity threats from sophisticated adversaries and other cybersecurity incidents. Further, we are at increased risk of a cyberattack during periods of heightened geopolitical conflict, such as the war in Ukraine and the conflict throughout the Middle East, as diplomatic events and economic policies may trigger espionage or retaliatory cyber incidents. Additionally, nation states may deploy threat actors masquerading as potential candidates for hire at target companies to perform corporate espionage or execute internal cyber threat activities. Despite our efforts to comply with applicable cybersecurity requirements and mitigate risks of cybersecurity threats, we cannot be certain that our security measures will definitively prevent, contain, detect, or remediate all cybersecurity threats or incidents or other instructions from malware currently in existence or developed in the future.

Current wording

Cyberattacks are increasing in frequency and evolving in nature. We are at risk of attack by a variety of adversaries, including nation states, state-sponsored organizations, opportunistic attacks, and organized crime and hackers, through use of increasingly sophisticated methods of attack, including the deployment of AI to find and exploit vulnerabilities, "deep fakes", long-term, persistent attacks (referred to as advanced persistent threats) and the use of the IT supply chain to introduce malware through software updates or compromised suppliers accounts or hardware. In particular, the advance of AI and large language models has given rise to additional vulnerabilities and potential entry points for cyber threats. With generative AI, threat actors may have additional tools to automate breaches or persistent attacks, evade detection, or generate sophisticated phishing emails or other forms of digital impersonation, doing so quickly and without requiring deep technical understanding of potential exploits. Attackers may develop AI agents to fully automate the attack cycle, which could discover new and unexploited applications and dynamically create ways to exploit these weaknesses faster than security tools can adapt to and detect these new attack methods. In addition, increasing use of generative AI models, including new capabilities offered through Model Context Protocol (MCP) Servers, in our internal systems may create new attack methods for adversaries. Because generative AI is a constantly evolving field, understanding of cybersecurity risks and protection methods continues to develop, and features that rely on generative AI, including in services provided to us by third parties, may be susceptible to unanticipated cybersecurity threats from sophisticated adversaries and other cybersecurity incidents. Further, we are at increased risk of a cyberattack during periods of heightened geopolitical conflict, such as the war in Ukraine and the conflict throughout the Middle East, as diplomatic events and economic policies may trigger espionage or retaliatory cyber incidents. Additionally, nation states may deploy threat actors masquerading as potential candidates for hire at target companies to perform corporate espionage or execute internal cyber threat activities. Despite our efforts to comply with applicable cybersecurity requirements and mitigate risks of cybersecurity threats, we cannot be certain that our security measures will definitively prevent, contain, detect, or remediate all cybersecurity threats or incidents or other instructions from malware currently in existence or developed in the future.

Previous wording

We have numerous vendors and other third parties who receive personal information from us in connection with the services we offer our clients and our employees. We also use hundreds of IT vendors and software providers to maintain and secure our global information systems infrastructure. In addition, we have migrated certain data, and may increasingly migrate data, to the cloud where it is hosted by third-party providers. Some of these vendors and third parties also have direct access to our systems or data. We are at risk of a cyberattack involving a vendor or other third parties, which could result in a breakdown of such third party’s data protection processes or the cyberattackers gaining access to our infrastructure or data through a supply chain attack. Highly publicized data security breaches, such as the October 2023 attack on Okta, may embolden malicious actors to target the IT supply chain and providers of business software. In addition, we depend on our third-party vendors to keep software current. Our systems’ availability could be impacted by poor or improperly tested software code and updates deployed to our environment by a third-party through normal and expected processes, which occurred with the CrowdStrike event in July 2024. Our control over and ability to monitor the cybersecurity practices of our third-party vendors and service providers, and other third parties with whom we do business, remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the development processes or cybersecurity infrastructure or IT controls owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

Current wording

We have numerous vendors and other third parties who receive personal information from us in connection with the services we offer our clients and our employees. We also use hundreds of IT vendors and software providers to maintain and secure our global information systems infrastructure. In addition, we have migrated certain data, and may increasingly migrate data, to the cloud where it is hosted by third-party providers. Some of these vendors and third parties also have direct access to our systems or data. We are at risk of a cyberattack involving a vendor or other third parties, which could result in a breakdown of such third party’s data protection processes or the cyberattackers gaining access to our infrastructure or data through a supply chain attack. Highly publicized data security breaches, such as the October 2025 Salesloft/Drift attack, may embolden malicious actors to target the IT supply chain and providers of business software. In addition, we depend on our third-party vendors to keep software current. Our systems’ availability could be impacted by poor or improperly tested software code and updates deployed to our environment by a third-party through normal and expected processes, which occurred with the CrowdStrike event in July 2024. Our reliance on third-party software components and open-source libraries as part of our software supply chain exposes us to significant cybersecurity risks, including malicious code insertion, vulnerabilities and compromised updates. Incidents such as the Shai Hulud NPM Worm, which spread through widely used JavaScript packages by exploiting trust in open-source dependencies, illustrate how supply chain attacks can lead to unauthorized access, data breaches, or disruption of critical applications, sometimes evading traditional security controls. The complexity and scale of modern software supply chains make it difficult to fully vet and monitor all dependencies, increasing the likelihood that similar incidents could affect our systems and operations and result in business disruption, reputational damage and regulatory or legal consequences. Our control over and ability to monitor the cybersecurity practices of our third-party and fourth-party vendors and service providers, and other third parties with whom we do business, remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the development processes or cybersecurity infrastructure or IT controls owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

Previous wording

At the international level, we are subject to an increasing number of comprehensive privacy laws including, for example, those passed in Indonesia, the Kingdom of Saudi Arabia, India and Australia. Many of these laws, which are modeled after the GDPR, have greatly increased the jurisdictional reach of privacy laws and added a broad array of requirements for handling personal data, such as the public disclosure of data breaches, data protection impact assessments, data portability and the appointment of data protection officers in some cases. Given the breadth and depth of changes in data protection obligations, including classifying data and committing to a range of administrative, technical and physical controls to protect data and enable data transfers across borders, our compliance with such laws will continue to require time, resources and review of the technology and systems we use. Despite a proliferation of regulatory guidance papers, there remains uncertainty in key areas related to these laws, and that uncertainty could result in potential liability for our failure to meet our obligations, including the possibility of significant fines some of which can amount to 4% or more of our global revenue. Further, despite developments such as the U.S.- EU Data Privacy Framework and the U.S.- U.K. Data Bridge, there remains a high level of uncertainty concerning the flow of personal information between the U.S. and EU, between the U.S. and the U.K. and between the U.K. and the EU. This uncertainty may impair our ability to offer our existing and planned products and services or increase our cost of doing business. Some of the global laws enacted in recent years, including those in China and the Kingdom of Saudi Arabia, also include data localization elements that will require that certain personal data stay within their borders. These requirements are complex and our efforts to comply with them require significant resources, and we cannot guarantee we are or will be in full compliance with such laws at all times.

Current wording

At the international level, we are subject to an increasing number of comprehensive privacy laws including, for example, those passed in Indonesia, the Kingdom of Saudi Arabia, India and Australia. Many of these laws, which are modeled after the GDPR, have greatly increased the jurisdictional reach of privacy laws and added a broad array of requirements for handling personal data, such as the public disclosure of data breaches, data protection impact assessments, data portability and the appointment of data protection officers in some cases. Given the breadth and depth of changes in data protection obligations, including classifying data and committing to a range of administrative, technical and physical controls to protect data and enable data transfers across borders, our compliance with such laws will continue to require time, resources and review of the technology and systems we use. Despite a proliferation of regulatory guidance papers, there remains uncertainty in key areas related to these laws, and that uncertainty could result in potential liability for our failure to meet our obligations, including the possibility of significant fines some of which can amount to 4% or more of our global revenue. Further, despite developments such as the U.S.- E.U. Data Privacy Framework and the U.S.- U.K. Data Bridge, there remains a high level of uncertainty concerning the flow of personal information between the U.S. and EU, between the U.S. and the U.K. and between the U.K. and the EU. This uncertainty may impair our ability to offer our existing and planned products and services or increase our cost of doing business. Some of the global laws enacted in recent years, including those in China and the Kingdom of Saudi Arabia, also include data localization elements that will require that certain personal data stay within their borders. These requirements are complex and our efforts to comply with them require significant resources, and we cannot guarantee we are or will be in full compliance with such laws at all times.

Previous wording

In addition to data protection and data privacy laws, foreign countries and U.S. states are enacting cybersecurity laws and regulations. For example, in late 2023 the New York State Department of Financial Services (NYDFS) issued amendments to its previous cybersecurity regulations which imposed obligations on companies such as Marsh McLennan, including for example, requiring companies to provide evidence of how they are implementing their data retention, data governance and data classifications policies and procedures. A number of states have also adopted laws covering data collected by insurance licensees that include security and breach notification requirements. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may divert resources from other initiatives and projects and could restrict the way services involving data are offered, all of which may adversely affect our results of operations. Failure to comply with some of these obligations, especially those related to data retention requirements, could expose us to regulatory fines and other penalties.

Current wording

In addition to data protection and data privacy laws, foreign countries and U.S. states are enacting cybersecurity laws and regulations. For example, in November 2025, the final amendments made by the New York State Department of Financial Services (NYDFS) to its previous cybersecurity regulations came into effect, which imposed obligations on companies such as Marsh, including for example, requiring companies to provide evidence of how they are implementing their data retention, data governance and data classifications policies and procedures. In addition, the U.S. Department of Justice Bulk Data Transfer Rule recently effected rules restricting the sending of certain data to "countries of concern" and requiring regular compliance monitoring around such transfers. A number of states have also adopted laws covering data collected by insurance licensees that include security and breach notification requirements. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may divert resources from other initiatives and projects and could restrict the way services involving data are offered, all of which may adversely affect our results of operations. Failure to comply with some of these obligations, especially those related to data retention requirements, could expose us to regulatory fines and other penalties.

Previous wording

Additionally, certain foreign, U.S. federal and U.S. state governments are increasingly enacting, or are considering enacting, AI-related laws and regulations, such as the EU's AI Act, the AI Transparency Act of California and the AI Act of Colorado, which impose complex new obligations on developers and providers of AI systems. Given the emerging nature of AI technology, the lack of legal or regulatory precedent, and the ambiguity surrounding key definitions, complying with these evolving legal and regulatory frameworks is likely to be both challenging and costly. There is a risk that we may not fully meet the requirements set forth by these laws and regulations, potentially exposing us to legal, regulatory or financial penalties. Furthermore, as new and divergent AI laws and regulations continue to emerge globally, they could significantly increase our risk of liability and fines, impact our ability to deploy and utilize AI tools across different jurisdictions, disrupt operations and prospective business and increase our compliance burdens.

Current wording

Additionally, certain foreign, U.S. federal and U.S. state governments are increasingly enacting, or are considering enacting, AI-related laws and regulations, such as the EU's AI Act, the AI Transparency Act of California and the AI Act of Colorado, which impose complex new obligations on developers and providers of AI systems. Given the rapid expansion of AI technology capabilities, the lack of legal or regulatory precedent, and the ambiguity surrounding key definitions, complying with these evolving legal and regulatory frameworks is likely to be both challenging and costly. There is a risk that we may not fully meet the requirements set forth by these laws and regulations, potentially exposing us to legal, regulatory or financial penalties. Furthermore, as new and divergent AI laws and regulations continue to emerge globally, they could significantly increase our risk of liability and fines, impact our ability to deploy and utilize AI tools across different jurisdictions, disrupt operations and prospective business and increase our compliance burdens.

Previous wording

Across all of our businesses, our colleagues are critical to developing and retaining client relationships as well as performing the services on which our revenues are earned. It is therefore important for us to attract, incentivize and retain significant revenue-producing employees and the key managerial and other professionals who support them. We face numerous challenges in this regard, including the intense competition for talent, which has accelerated in recent years. Such challenges include the increased mobility of colleagues in light of more flexible working models, market dislocation resulting from proposed and actual combinations in the industry, raids by competitors, and fostering an inclusive workplace.

Current wording

Across all of our businesses, our colleagues are critical to developing and retaining client relationships as well as performing the services on which our revenues are earned. It is therefore important for us to attract, incentivize and retain significant revenue-producing employees and the key managerial and other professionals who support them. We face numerous challenges in this regard, including the intense competition for talent, which has accelerated in recent years. Such challenges include the increased mobility of colleagues in light of more flexible working models, market dislocation resulting from proposed and actual combinations in the industry, raids by competitors, and fostering an inclusive workplace. In some cases, competitors have used increasingly aggressive tactics to recruit talent across the industry, including orchestrated team lifts and the theft or misuse of confidential information. We have pursued, and continue to pursue, litigation and other remedies in response to such conduct. However, we cannot guarantee that such efforts will effectively deter future conduct.

Previous wording

Losing colleagues who manage or support substantial client relationships or possess substantial experience or expertise could adversely affect our ability to secure and complete client engagements, which could adversely affect our results of operations. If a key employee were to join an existing competitor or form a competing company, some of our clients could choose to use the services of a competitor instead of our services. If a colleague joins us from a competitor and is subject to enforceable restrictive covenants, we may not be able to secure client engagements or maximize the colleague's potential. In addition, regulation or legislation impacting the workforce, such as the proposed U.S. Federal Trade Commission rule regarding noncompete clauses, may lead to increased uncertainty and competition for talent.

Current wording

Losing colleagues who manage or support substantial client relationships or possess substantial experience or expertise could adversely affect our ability to secure and complete client engagements, which could adversely affect our results of operations. If a key employee were to join an existing competitor or form a competing company, some of our clients could choose to use the services of a competitor instead of our services. If a colleague joins us from a competitor and is subject to enforceable restrictive covenants, we may not be able to secure client engagements or maximize the colleague's potential. In addition, regulation or legislation impacting the workforce may lead to increased uncertainty and competition for talent.

Previous wording

We strive to foster a culture in which our colleagues act with integrity and feel comfortable speaking up about potential misconduct. We are a people business, and a well-defined and consistently reinforced corporate culture, starting with a strong “tone from the top,” is critical to ensuring compliance with laws and regulations, attracting and retaining top talent and maintaining the trust of our clients, business partners and other stakeholders. As a multinational company operating across many geographies, failure to effectively align our workforce with our core values and ethical principles may impair our ability to achieve our strategic objectives, particularly as we execute operational model changes and integrate acquisitions. If we fail to maintain our corporate culture, there is an increased risk of unethical behavior or regulatory violations, which could result in legal penalties, reputational damage and financial harm.

Current wording

We strive to foster a culture in which our colleagues act with integrity and feel comfortable speaking up about potential misconduct. We are a people business, and a well-defined and consistently reinforced corporate culture, starting with a strong “tone from the top,” is critical to ensuring compliance with laws and regulations, attracting and retaining top talent and maintaining the trust of our clients, business partners and other stakeholders. As a multinational company operating across many geographies, failure to effectively align our workforce with our core values and ethical principles may impair our ability to achieve our strategic objectives, particularly as we execute our brand strategy, operational model changes and integrate acquisitions. If we fail to maintain our corporate culture, there is an increased risk of unethical behavior or regulatory violations, which could result in legal penalties, reputational damage and financial harm.

Previous wording

Increasing scrutiny and changing laws and expectations from regulators, investors, clients and our colleagues with respect to our environmental, social and governance (ESG) practices and disclosure may impose additional costs on us or expose us to new or additional risks.

Current wording

Increasing scrutiny and changing laws and expectations from regulators, investors, clients and our colleagues with respect to our business responsibility practices and disclosure may impose additional costs on us or expose us to new or additional risks.

Previous wording

There is continued focus, including from governmental organizations, regulators, investors, colleagues and clients, on ESG and sustainability issues. The regulatory landscape related to these issues continues to evolve, with new laws and reporting requirements introduced across various jurisdictions, including in the U.S., the U.K., the European Union (E.U.) and Australia. These laws and regulations may impose additional compliance or disclosure obligations on us. Inconsistent or even conflicting requirements across jurisdictions may also increase compliance challenges, add operational costs, or lead to stakeholder dissatisfaction.

Current wording

There is continued focus, including from governmental organizations, regulators, investors, colleagues and clients, on matters related to environmental stewardship and sustainability, strategies to foster a vibrant and inclusive culture, and responsible business practices, including government relations and public affairs initiatives. We refer to these matters collectively as business responsibility. The regulatory landscape related to these issues continues to evolve, with new laws and reporting requirements introduced across various jurisdictions, including in the U.S., the U.K., the European Union (E.U.) and Australia. These laws and regulations may impose additional compliance or disclosure obligations on us. Inconsistent or even conflicting requirements across jurisdictions may also increase compliance challenges, add operational costs, or lead to stakeholder dissatisfaction.

Previous wording

As these ESG reporting requirements and standards evolve, we continue to evaluate and update our public disclosures in these areas, including refining our disclosure of metrics and sustainability goals in accordance with the guidance and our own ESG assessments and priorities. These disclosures, metrics and sustainability goals and any failure to accurately report or comply with federal, state or international ESG laws and regulations, or achieve progress on our metrics and sustainability goals on a timely basis, or at all, may result in legal and regulatory proceedings against us and negatively impact our reputation. Implementation of our ESG initiatives also depends in part on third-party performance or data that is outside the Company's control. In addition, heightened regulatory scrutiny of ESG and sustainability-related products, funds, investment strategies and advice has increased the risk that we could be perceived as, or accused of, making inaccurate or misleading statements, or that we have otherwise run afoul of regulation. Such perceptions or accusations could damage our reputation, result in litigation or regulatory enforcement actions, and adversely affect our business.

Current wording

As these reporting requirements and standards evolve, we continue to evaluate and update our public disclosures in these areas, including refining our disclosure of metrics and sustainability goals in accordance with the guidance and our own business responsibility assessments and priorities. These disclosures, metrics and sustainability goals and any failure to accurately report or comply with federal, state or international laws and regulations, or achieve progress on our metrics and sustainability goals on a timely basis, or at all, may result in legal and regulatory proceedings against us and negatively impact our reputation. Implementation of our business responsibility initiatives also depends in part on third-party performance or data that is outside the Company's control. In addition, heightened regulatory scrutiny of environmental and sustainability-related products, funds, investment strategies and advice has increased the risk that we could be perceived as, or accused of, making inaccurate or misleading statements, or that we have otherwise run afoul of regulation. Such perceptions or accusations could damage our reputation, result in litigation or regulatory enforcement actions, and adversely affect our business.

Previous wording

Organizations that provide information to investors on corporate governance and related matters have also developed ratings processes for evaluating companies on their approach to ESG matters, and unfavorable ratings of our company or our industries may lead to negative investor sentiment and the diversion of investment to other companies or industries, exclusion of our stock from ESG-oriented indices or investment funds or harm our relationships with regulators and the communities in which we operate.

Current wording

Organizations that provide information to investors on corporate governance and related matters have also developed ratings processes for evaluating companies on their approach to business responsibility, and unfavorable ratings of our company or our industries may lead to negative investor sentiment and the diversion of investment to other companies or industries, exclusion of our stock from business responsibility-oriented indices or investment funds or harm our relationships with regulators and the communities in which we operate.

Previous wording

Moreover, public opinion and potential legal actions regarding ESG-related initiatives remain highly dynamic and can vary across stakeholders and geographies. Balancing these competing expectations globally is complex.

Current wording

Moreover, public opinion and potential legal actions regarding business responsibility initiatives remain highly dynamic and can vary across stakeholders and geographies. Balancing these competing expectations globally is complex.

Previous wording

Across our Risk and Insurance Services segment, we operate in a variety of markets and face different competitive landscapes. In addition to the challenges posed by capital market alternatives to traditional insurance and reinsurance, we compete against a wide range of other insurance and reinsurance brokerage and risk advisory firms that operate on a global, regional, national or local scale for both client business and employee talent. In recent years, private equity sponsors have invested tens of billions of dollars into the insurance brokerage sector, transforming existing players and creating new ones to compete with large brokers. We also compete with insurance companies that market and service their insurance products directly to consumers and reinsurance companies that market and service their products directly to insurance companies, in each case without the assistance of brokers or other market intermediaries, and with various other companies that provide risk-related services or alternatives to traditional brokerage services, including those that rely almost exclusively on technological solutions or platforms. This competition is intensified by an often "syndicated" or "distributed" approach to the purchase of insurance and reinsurance brokerage services, where a client engages multiple brokers to service different portions of the client's account. In addition, third party capital providers have entered the insurance and reinsurance risk transfer market offering products and capital directly to our clients that serve as substitutes for traditional insurance.

Current wording

Across our Risk and Insurance Services segment, we operate in a variety of markets and face different competitive landscapes. In addition to the challenges posed by capital market alternatives to traditional insurance and reinsurance, we compete against a wide range of other insurance and reinsurance brokerage and risk advisory and consultancy firms that operate on a global, regional, national or local scale for both client business and employee talent. In recent years, private equity sponsors have invested tens of billions of dollars into the insurance brokerage sector, transforming existing players and creating new ones to compete with large brokers. We also compete with insurance companies that market and service their insurance products directly to consumers and reinsurance companies that market and service their products directly to insurance companies, in each case without the assistance of brokers or other market intermediaries, and with various other companies that provide risk-related services or alternatives to traditional brokerage services, including those that rely almost exclusively on technological solutions or platforms. This competition is intensified by an often "syndicated" or "distributed" approach to the purchase of insurance and reinsurance brokerage services, where a client engages multiple brokers to service different portions of the client's account. In addition, third party capital providers have entered the insurance and reinsurance risk transfer market offering products and capital directly to our clients that serve as substitutes for traditional insurance.

Previous wording

In our Consulting segment, we compete for business with numerous consulting firms and similar organizations, many of which also provide, or are affiliated with firms that provide, accounting, information systems, technology and financial services. Such competitors may be able to offer more comprehensive products and services to potential clients, which may give them a competitive advantage. Some of our competitors also may be able to invest more significant capital in technology and digital solutions. In certain sub-segments, we compete in highly fragmented markets or with start-ups that may be able to offer solutions at a lower price or on more favorable conditions.

Current wording

In our Consulting segment, we compete for business with numerous consulting firms, technology firms and similar organizations, many of which also provide, or are affiliated with firms that provide, accounting, information systems, technology and financial services. Such competitors may be able to offer more comprehensive products and services to potential clients, which may give them a competitive advantage. Some of our competitors also may be able to invest more significant capital in technology and digital solutions. In certain sub-segments, we compete in highly fragmented markets or with start-ups that may be able to offer solutions at a lower price or on more favorable conditions.

Previous wording

If we experience a local or regional disaster or other business continuity event, such as an earthquake, hurricane, flood, terrorist attack, pandemic, war or other geopolitical tensions, protests or riots, security breach, cyberattack (including manipulating the control systems of critical infrastructure), power loss or telecommunications failure, our ability to operate will depend, in part, on the continued availability of our personnel, our office facilities and the proper functioning of our computer, telecommunication and other related systems and operations. In such an event, we could experience operational challenges that could have a material adverse effect on our business. The risk of business disruption is more pronounced in certain geographic areas, including major metropolitan centers, like New York or London, where we have significant operations andapproximately 3,900 and 5,800 colleagues inthose respective locations, and in certain countries and regions, such as India, in which we operate or are investing additional capabilities that are subject to higher potential threat of terrorist attacks or military conflicts.

Current wording

If we experience a local or regional disaster or other business continuity event, such as an earthquake, hurricane, flood, terrorist attack, pandemic, war or other geopolitical tensions, protests or riots, security breach, cyberattack (including manipulating the control systems of critical infrastructure), power loss or telecommunications failure, our ability to operate will depend, in part, on the continued availability of our personnel, our office facilities and the proper functioning of our computer, telecommunication and other related systems and operations. In such an event, we could experience operational challenges that could have a material adverse effect on our business. The risk of business disruption is more pronounced in certain geographic areas, including major metropolitan centers, like New York or London, where we have significant operations and approximately 3,800 and 5,700 colleagues inthose respective locations, and in certain countries and regions, such as India, Colombia, Eastern Europe and

Previous wording

Cardano. Subject to standard contractual protections, we may also be responsible for legacy liabilities of companies that we acquire. Moreover, if we acquire a business operating in regions or industries subject to heightened regulatory scrutiny, we may face significant costs or risks in bringing their operations into compliance with applicable laws and our internal policies. Failure to address these compliance risks could result in regulatory enforcement actions, fines or damage to our reputation.

Current wording

We have a history of making acquisitions and investments, including a total of 102 in the period from 2021 to 2025, including our acquisitions of McGriff Insurance Services, LLC ("McGriff") and Gerolamo Holding S.À.R.L. ("Cardano"). We may not be able to successfully integrate the businesses that we acquire into our own business, or achieve any expected cost savings or synergies from the integration of such businesses, including McGriff and Cardano. Subject to standard contractual protections, we may also be responsible for legacy liabilities of companies that we acquire. Moreover, if we acquire a business operating in regions or industries subject to heightened regulatory scrutiny, we may face significant costs or risks in bringing their operations into compliance with applicable laws and our internal policies. Failure to address these compliance risks could result in regulatory enforcement actions, fines or damage to our reputation.

Previous wording

Our business depends on our ability to obtain payment from our clients of the amounts they owe us for the work we perform. As of December 31, 2024, our receivables for our commissions and fees were approximately $6.5 billion, or approximately one-quarter of our total annual revenues, and portions of our receivables are increasingly concentrated in certain businesses and geographies.

Current wording

Our business depends on our ability to obtain payment from our clients of the amounts they owe us for the work we perform. At December 31, 2025, our receivables for our commissions and fees were approximately $7.0 billion, or approximately one-quarter of our total annual revenues, and portions of our receivables are increasingly concentrated in certain businesses and geographies.

Previous wording

The Company has significant defined benefit pension obligations to its current and former employees, totaling approximately $11.4 billion, and related plan assets of approximately $12.6 billion, at December 31, 2024 in accordance with U.S. GAAP. The Company's policy for funding its defined benefit pension plans is to contribute amounts at least sufficient to meet the funding requirements set forth by law. In the U.S., contributions to these plans are based on ERISA guidelines. Outside the U.S., contributions are generally based on statutory requirements and local funding practices, which may differ from measurements in accordance with U.S. GAAP. In the U.K., for example, the assumptions used to determine pension contributions are the result of legally- prescribed negotiations between the Company and the plan trustees. Currently, the use of these assumptions results in a lower funded status than determined in accordance with U.S. GAAP and may result in contributions irrespective of the U.S. GAAP funded status.

Current wording

The Company has significant defined benefit pension obligations to its current and former employees, totaling approximately $11.7 billion, and related plan assets of approximately $13.1 billion, at December 31, 2025 in accordance with U.S. GAAP. The Company's policy for funding its defined benefit pension plans is to contribute amounts at least sufficient to meet the funding requirements set forth by law. In the U.S., contributions to these plans are based on ERISA guidelines. Outside the U.S., contributions are generally based on statutory requirements and local funding practices, which may differ from measurements in accordance with U.S. GAAP. In the U.K., for example, the assumptions used to determine pension contributions are the result of legally-prescribed negotiations between the Company and the plan trustees. Currently, the use of these assumptions results in a lower funded status than determined in accordance with U.S. GAAP and may result in contributions irrespective of the U.S. GAAP funded status.

Previous wording

Approximately 52%of our total revenue reported in 2024 was from business outside of the U.S. We are subject to exchange rate movement because we must translate the financial results of our foreign subsidiaries into U.S. dollars and also because some of our subsidiaries receive revenue other than in their functional currencies. Exchange rate movements may change over time, and they could have a material adverse impact on our financial results and cash flows reported in U.S. dollars. For additional discussion, see "Market Risk and Credit Risk-Foreign Currency Risk" in Part II, Item 7A ("Quantitative and Qualitative Disclosures about Market Risk") of this report.

Current wording

Approximately 51%of our total revenue reported in 2025 was from business outside of the U.S. We are subject to exchange rate movement because we must translate the financial results of our foreign subsidiaries into U.S. dollars and also because some of our subsidiaries receive revenue other than in their functional currencies. Exchange rate movements may change over time, and they could have a material adverse impact on our financial results and cash flows reported in U.S. dollars. For additional discussion, see "Market Risk and Credit Risk-

Previous wording

•potential limitations on the clients or industries we serve resulting from increased regulation or changing stakeholder expectations on ESG issues;

Current wording

•potential limitations on the clients or industries we serve resulting from increased regulation or changing stakeholder expectations on sustainability issues;

Previous wording

At December 31, 2024, we had total consolidated debt outstanding of approximately $19.9 billion.

Current wording

At December 31, 2025, we had total consolidated debt outstanding of approximately $19.6 billion.

Previous wording

Our effective tax rate may fluctuate in the future as a result of the current U.S. tax regime and the continuing issuance of interpretive guidance related to the operations of U.S.-based multinational corporations. These include significant provisions in U.S. income tax law that may have a meaningful impact on our income tax expense and require significant judgments and estimates in interpretation and calculations. Current tax legislation includes, among other provisions, limitations on the deductibility of net interest expense, a minimum tax on most non-U.S. income called Global Intangible Low-Taxed Income ("GILTI"), and the Base Erosion and Anti-Abuse Tax ("BEAT"). In addition, a recently enacted book minimum tax could increase the impact of these provisions on our income tax expense. Given the significant complexity of the rules, and the potential for additional guidance from the U.S. Treasury, the Securities and Exchange Commission, the Financial Accounting Standards Board or other regulatory authorities, recognized impacts in future periods could be significantly different from our current estimates. Such uncertainty may also result in increased scrutiny from, or disagreements with, tax authorities. As a U.S.-domiciled company, any such increases would likely have a disproportionate impact on us compared to our foreign-based competitors.

Current wording

Our effective tax rate may fluctuate in the future as a result of the current U.S. tax regime and the continuing issuance of interpretive guidance related to the operations of U.S.-based multinational corporations. These include significant provisions in U.S. income tax law that may have a meaningful impact on our income tax expense and require significant judgments and estimates in interpretation and calculations. Current tax legislation includes, among other provisions, limitations on the deductibility of net interest expense, a minimum tax on most non-U.S. income called Net Controlled Foreign Corporation Tested Income ("NCTI") (formerly known as Global Intangible Low-Taxed Income (“GILTI”), the Base Erosion and Anti-Abuse Tax ("BEAT") and a corporate book minimum tax ("CAMT"). Given the significant complexity of the rules, and the potential for additional guidance from the U.S. Treasury, the Securities and Exchange Commission, the Financial Accounting Standards Board or other regulatory authorities, recognized impacts in future periods could be significantly different from our current estimates. Such uncertainty may also result in increased scrutiny from, or disagreements with, tax authorities. As a U.S.-domiciled company, any such increases would likely have a disproportionate impact on us compared to our foreign-based competitors.

Previous wording

We conduct business globally. In 2024, approximately 52% of the Company's total revenue was generated from operations outside the U.S., and over one-half of our employees were located outside the U.S. In addition, we conduct our operations through four separate businesses. Potential conflicts of interest may arise across our businesses given the significant volume of our engagements.

Current wording

We conduct business globally. In 2025, approximately 51% of the Company's total revenue was generated from operations outside the U.S., and over one-half of our employees were located outside the U.S. In addition, we conduct our operations through four separate businesses. Potential conflicts of interest may arise across our businesses given the significant volume of our engagements.

Previous wording

•unexpected increases in taxes or changes in U.S. or foreign tax laws, rulings, policies or related legal and regulatory interpretations, including recent changes to the U.K. statutory rate;

Current wording

•unexpected increases in taxes or changes in U.S. or foreign tax laws, rulings, policies or related legal and regulatory interpretations;

Previous wording

•the implementation of the Organization for Economic Cooperation and Development (OECD) international tax framework, including the implementation of the Pillar 2 minimum tax regime and the Pillar 1 profit reallocation regime, potentially resulting in an adverse effect on our effective tax rate, tax payments and results of operations, particularly as key jurisdictions adopt these changes, either partially or in full, alongside potential shifts in tax laws in response to such implementation;

Current wording

•the implementation of the Organization for Economic Cooperation and Development (OECD) international tax framework, including the implementation of the Pillar Two minimum tax regime (and the "side-by-side" arrangement for U.S. companies), and the Pillar One profit reallocation regime (or compensating digital services taxes), potentially resulting in an adverse effect on our effective tax rate, tax payments and results of operations, particularly as key jurisdictions adopt these changes, either partially or in full, alongside potential shifts in tax laws in response to such implementation;

Previous wording

•our ability to obtain dividends or repatriate funds from our non-U.S. subsidiaries, including as a result of the imposition of currency controls and other government restrictions on repatriation in the jurisdictions in which our subsidiaries operate, fluctuations in foreign exchange rates and the imposition of withholding and other taxes on such payments;

Current wording

•our ability to obtain dividends or repatriate funds from our non-U.S. subsidiaries, including because of the imposition of currency controls and other government restrictions on repatriation in the jurisdictions in which our subsidiaries operate, fluctuations in foreign exchange rates and the imposition of withholding and other taxes on such payments;

Previous wording

Our Risk and Insurance Services segment, conducted through Marsh and Guy Carpenter, represented 63% of the Company's total revenue in 2024. Our business in this segment is subject to particular risks.

Current wording

Our Risk and Insurance Services segment, conducted through Marsh Risk and Guy Carpenter, represented 64% of the Company's total revenue in 2025. Our business in this segment is subject to particular risks.

Previous wording

Demand for many types of insurance and reinsurance generally rises or falls as economic growth expands or slows. This dynamic affects the level of commissions and fees generated by Marsh and Guy Carpenter. To the extent our clients become adversely affected by declining business conditions, they may choose to limit their purchases of risk services and insurance and reinsurance coverage, as applicable, which would adversely impact our commission revenue and other revenue based on premiums placed and services provided by us. Also, the insurance they seek to obtain through us may be impacted by changes in their assets, property values, sales or number of employees, which may reduce our commission revenue, and they may decide not to purchase our risk advisory or other services, which would inhibit our ability to generate fee revenue. Moreover, insolvencies and combinations associated with an economic downturn, especially insolvencies and combinations in the insurance industry, could adversely affect our brokerage business through the loss of clients or by limiting our ability to place insurance and reinsurance business, as well as our revenues from insurers. Guy Carpenter is especially susceptible to this risk given the limited number of insurance company clients and reinsurers in the marketplace.

Current wording

Demand for many types of insurance and reinsurance generally rises or falls as economic growth expands or slows. This dynamic affects the level of commissions and fees generated by Marsh Risk and Guy Carpenter. To the extent our clients become adversely affected by declining business conditions, they may choose to limit their purchases of risk services and insurance and reinsurance coverage, for example, by choosing to retain more risk, which would adversely impact our commission revenue and other revenue based on premiums placed and services provided by us. Also, the insurance they seek to obtain through us may be impacted by changes in their assets, property values, sales or number of employees, which may reduce our commission revenue, and they may decide not to purchase our risk advisory or other services, which would inhibit our ability to generate fee revenue. Moreover, insolvencies and combinations associated with an economic downturn, especially insolvencies and combinations in the insurance industry, could adversely affect our brokerage business through the loss of clients or by limiting our ability to place insurance and reinsurance business, as well as our revenues from insurers. Guy Carpenter is especially susceptible to this risk given the limited number of insurance company clients and reinsurers in the marketplace.

Previous wording

A significant portion of our Risk and Insurance Services revenue consists of commissions paid to us out of the premiums that insurers and reinsurers charge our clients for coverage. We do not determine the insurance premiums on which our commissions are generally based. Our revenues and profitability are subject to change to the extent that premium rates fluctuate or trend in a particular direction. The potential for changes in premium rates is significant, due to the normal cycles of pricing in the commercial insurance and reinsurance markets.

Current wording

A significant portion of our Risk and Insurance Services revenue consists of commissions paid to us out of the premiums that insurers and reinsurers charge our clients for coverage. We do not determine the insurance premiums on which our commissions are generally based. Our revenues and profitability are subject to change to the extent that premium rates fluctuate or trend in a particular direction. The potential for changes in premium rates is significant, due to the normal cycles of pricing in the commercial insurance and reinsurance markets. For example, the property and casualty insurance market has seen softer pricing recently, which may continue to impact profitability.

Previous wording

The ways in which insurance intermediaries are compensated receive scrutiny from regulators in part because of the potential for anti-competitive behavior and conflicts of interest. The vast majority of the compensation that Marsh receives is in the form of retail fees and commissions that are paid by the client or paid from premium that is paid by the client. The amount of other compensation that we receive from insurance companies, separate from retail fees and commissions, has increased in the last several years, both on an underlying basis and through acquisition and represented approximately 6%of Marsh's revenue in 2024. This other compensation includes payment for (i) consulting and analytics services provided to insurers; (ii) administrative and other services provided to insurers (including underwriting services and services relating to the administration and management of quota shares, panels and other facilities); and (iii) contingent commissions, primarily at MMA and outside the

Current wording

The ways in which insurance intermediaries are compensated receive scrutiny from regulators in part because of the potential for anti-competitive behavior and conflicts of interest. The vast majority of the compensation that Marsh Risk receives is in the form of retail fees and commissions that are paid by the client or paid from carriers. The amount of other compensation that we receive from insurance companies, separate from retail fees and commissions, has increased in the last several years, both on an underlying basis and through acquisition, and represented approximately 7%of Marsh Risk's revenue in 2025. This other compensation includes payment for (i) consulting and analytics services provided to insurers; (ii) administrative and other services provided to insurers (including underwriting services and services relating to the administration and management of quota shares, panels and other facilities); and (iii) contingent commissions, primarily at MMA and outside the U.S., paid by insurers based on factors such as volume or profitability. These other revenue streams present potentially heightened regulatory, litigation and reputational risks that may arise from alleged anti-competitive behavior or conflicts of interest, (including those arising from Guy Carpenter’s role as intermediary and advisor for insurance companies), and future changes in the regulatory environment may impact our ability to collect such revenue. Adverse regulatory, legal or other developments could have a material adverse effect on our business and expose the Company to negative publicity and reputational harm.