Fidelity National Information Services Inc

Previous wording

In addition to the normal risks of business, we are subject to significant risks and uncertainties, including those listed below and others described elsewhere in this Annual Report on Form 10-K. Any of the risks described herein could result in a significant adverse effect on our business, financial condition or results of operations.

Current wording

In addition to the normal risks of business, we are subject to significant risks and uncertainties, including those listed below and others described elsewhere in this Annual Report on Form 10-K. Any of the risks described herein, as well as risks currently unknown or immaterial, could result in a significant adverse effect on our business, financial condition or results of operations.

Previous wording

Security breaches, privacy breaches, cyberattacks, unintentional disclosures of confidential information, third-party breaches, or a failure to comply with information security laws or regulations, contractual provisions or industry security requirements by FIS, or our vendors, or technology partners, could harm our business by disrupting delivery of services, damaging our reputation and resulting in a breach of one or more client contracts or regulatory investigations, enforcement actions or fines.

Current wording

Security breaches, privacy breaches, cyberattacks, unintentional disclosures of confidential information, third-party breaches, service outages, or a failure to comply with information security laws or regulations, contractual provisions, or industry security requirements by us, our vendors, clients, or technology partners could harm our business by disrupting delivery of services, exposing sensitive or confidential information, or damaging our reputation, any of which could result in a breach of one or more client contracts or regulatory investigations, enforcement actions, fines or litigation.

Previous wording

Cybersecurity is fundamental to FIS' complex, global business. FIS and its vendors and technology partners electronically receive, process, store and transmit sensitive and confidential information of FIS' clients, such clients' customers and business partners. FIS collects consumer personal data, such as names and addresses, Social Security Numbers, driver’s license numbers, financial account numbers, transactional history, cardholder data and payment history records. Such information is necessary to support our clients' transaction processing and to conduct our check authorization and collection businesses. Our information systems are dependent upon hardware, software, and other technological components that are both developed by FIS and provided by third parties. These components sometimes require patches, updates, or remediation of known or potential vulnerabilities. Implementation challenges in timely completing these tasks can lead to security vulnerabilities that expose FIS, its systems and data to potential compromise or interruption. The uninterrupted operation of information systems operated by FIS and others, as well as the confidentiality of the customer/consumer information that resides on such systems, is critical to the successful operation of FIS. For that reason, security or privacy breaches are some of the principal operational risks FIS faces as a provider of services to financial institutions and businesses, and, like other such providers, FIS is a regular target of third-party attempts to identify and exploit system vulnerabilities and/or penetrate or bypass our security measures in order to gain unauthorized access to our networks and systems. If FIS fails to maintain an adequate security infrastructure, adapt to emerging security threats (such as the use of artificial intelligence by threat actors in furtherance of cyber attacks), identify security vulnerabilities, prevent unauthorized access, identity theft or other cybersecurity risks (e.g., distributed denial of service, ransomware, and other cyber attacks), manage vendor or supply chain cybersecurity risks, or implement sufficient security standards and technology to protect against security or privacy breaches, the confidentiality of the information FIS secures could be compromised. Unauthorized access to or abuse of authorized access to the computer systems or databases of FIS or our vendors could result in the theft or publication of confidential information and personal data, the deletion or modification of records, disruption of service delivery, installation of malware, and the potential need to pay ransom, or otherwise cause interruptions in FIS’ operations. These issues in turn could give rise to legal actions from clients and/or such clients' customers, regulatory investigation or enforcement activity, losses and expenses associated with such events, and damage to FIS' reputation. Because FIS serves a diverse client base with different technology and service ne…

Excerpt shortened here; the source contains the full paragraph.

Current wording

The uninterrupted operation of information systems operated by us, our vendors and service providers, and other third parties, as well as the confidentiality of the customer or consumer information that resides on such systems, is critical to the successful operation of our Company. For that reason, security or privacy breaches are some of the principal operational risks we face as a provider of services to financial institutions and businesses. Like other such providers, we are a regular target of attempts to identify and exploit system vulnerabilities and/or penetrate or bypass our security measures to gain unauthorized access to our networks and systems. If we fail to maintain an adequate security infrastructure, adapt to emerging security threats (such as the use of artificial intelligence by threat actors in furtherance of cyber attacks), regularly identify security vulnerabilities, prevent unauthorized access, identity theft or other cybersecurity risks (e.g., distributed denial of service, ransomware, and other cyber attacks), manage vendor or supply chain cybersecurity risks, adequately train users of our information systems, or implement sufficient security standards and technology to protect against security or privacy breaches, then the confidentiality, integrity or availability of the information we secure could be compromised. Unauthorized access to, or abuse of authorized access to, our computer systems or databases or our vendors' computer systems or databases could result in the theft or publication of confidential information and personal data, the deletion or modification of records, disruption of service delivery, installation of malware, and the potential need to pay ransom or otherwise cause interruptions in our operations. These issues could give rise to legal actions from clients and/or such clients' customers, regulatory investigations or enforcement activity, losses and expenses associated with such events, and damage to our reputation. Because we serve a diverse client base with different technology and service needs, we must continue to enhance our ability to manage the risks from the resulting diversity in potential security attacks.

Previous wording

As a provider of services to financial institutions and businesses, FIS is bound by many of the same limitations on disclosure of the information FIS receives from clients as apply to the clients themselves. If FIS fails to comply with these regulations and industry security requirements, including those imposed by the payment card industry through its digital security standards and other rules, it could be exposed to damages from legal actions from clients and/or their customers, governmental proceedings, governmental notice requirements, and the imposition of significant fines or prohibitions on providing services. FIS is a highly regulated entity and is subject to a myriad of complex, evolving regulations and standards, including cybersecurity and privacy laws, regulations and industry standards. In addition, if more restrictive privacy laws, data protection rules or industry security requirements are adopted in the future on the federal or state level, or by a non-U.S. jurisdiction in or from which we serve clients, or by a specific industry body, those changes could have an adverse impact on FIS through increased costs or by imposing changes or inefficiencies on business processes.

Current wording

As a provider of services to financial institutions and businesses, we are bound by many of the same limitations on disclosure of the information we receive from clients that apply to the clients themselves. If we fail to comply with these regulations and industry security requirements, including those imposed by the payment card industry through its digital security standards and other rules, we could be exposed to damages from legal actions from clients and/or their customers, governmental proceedings, public disclosure and consumer notification requirements, and the imposition of significant fines or prohibitions on providing services. We operate in a highly regulated environment and are subject to a myriad of complex, evolving regulations and standards, including cybersecurity and privacy laws, regulations and industry standards. In addition, if more restrictive privacy laws, data protection rules or industry security requirements are adopted in the future on the federal or state level, or by a non-U.S. jurisdiction in or from which we serve clients, or by a specific industry body, those changes could have an adverse impact on our Company through increased costs or by imposing changes or inefficiencies on business processes.

Previous wording

A material privacy or security incident may trigger SEC disclosure obligations, other applicable disclosure requirements, or be disclosed publicly even if there is no legally required disclosure. Incident disclosure may increase the risks of lawsuits or government enforcement action related to incidents, increase attention to malicious actors, and lead to greater regulatory scrutiny more generally. The occurrence of any such incidents, and the related responses (if any) by regulators or third parties, may result in adverse publicity and reputational harm to us.

Current wording

A material privacy or security incident would trigger SEC disclosure obligations and could trigger other applicable disclosure requirements, or be disclosed publicly, even if there is no legally required disclosure. Incident disclosure may increase the risks of private lawsuits or government enforcement action related to incidents, increase attention from malicious actors, and lead to greater regulatory scrutiny. The occurrence of any such incidents, and the related responses (if any) by regulators or third parties, may result in adverse publicity and reputational harm to us.

Previous wording

If FIS is unable, or appears to be unable, to prevent cybersecurity or privacy breaches, we risk reputational damage. Our existing clients could lose confidence in FIS' systems and thus choose to terminate their agreements with FIS. Such reputational harm could also inhibit FIS' ability to attract new clients; potentially increase government, regulatory, or media scrutiny; or give rise to new regulatory requirements that adversely affect FIS' ability to do business in one or more parts of the world.

Current wording

If we are unable, or appears to be unable, to prevent cybersecurity or privacy breaches, we risk reputational damage. Our existing clients could lose confidence in our information systems and consequently choose to terminate their agreements with us. Such reputational harm could also inhibit our ability to attract new clients; potentially increase government, regulatory, or media scrutiny; or give rise to new regulatory requirements that adversely affect our ability to do business in one or more parts of the world.

Previous wording

The market for our solutions is intensely competitive. Our competitors in Banking and Capital Markets vary in size and in the scope and breadth of the solutions and services they offer. Some of our competitors have substantial resources. We face direct competition from third parties, and because many of our larger potential clients have historically developed their key applications in-house and therefore view their system requirements from a make-versus-buy perspective, we also often compete against our potential clients' in-house capacities. In addition, the markets in which we compete have recently attracted increasing competition from smaller start-ups with emerging technologies which are receiving increasing investments as well as global banks (and businesses controlled by combinations of global banks) and global internet companies that are introducing competitive solutions and services into the marketplace, particularly in the payments area. Emerging technologies and increased competition may also have the effect of unbundling bank solutions and result in displacing solutions we are currently providing from our legacy systems. International competitors are also now targeting and entering the U.S. market with greater force. There can be no assurance that we will be able to compete successfully against current or future competitors or that the competitive pressures we face in the markets in which we operate will not materially adversely affect our business, financial condition, or results of operations.

Current wording

The market for our solutions is intensely competitive. Our competitors in Banking and Capital Markets vary in size and in the scope and breadth of the solutions and services they offer. Some of our competitors have substantial resources. We face direct competition from third parties, and because many of our larger potential clients have historically developed their key applications in-house and, therefore, view their system requirements from a make-versus-buy perspective, we also often compete against our potential clients' in-house capacities. In addition, the markets in which we compete have recently attracted increasing competition from smaller start-ups with emerging technologies which are receiving increasing investments, as well as global banks (and businesses controlled by combinations of global banks) and global internet companies that are introducing competitive solutions and services into the marketplace, particularly in the payments area. Emerging technologies and increased competition may also have the effect of unbundling bank solutions and may result in displacing solutions that we are currently providing from our legacy systems. International competitors are also now targeting and entering the U.S. market with greater force. There can be no assurance that we will be able to compete successfully against current or future competitors or that the competitive pressures we face in the markets in which we operate will not materially adversely affect our business, financial condition, or results of operations.

Previous wording

A significant portion of our revenue is derived from transaction processing fees. The global transaction processing industries depend heavily upon the overall level of consumer, business and government spending. Any change in economic factors, including a sustained deterioration in general economic conditions or consumer confidence, particularly in the U.S., or inflation and increases in interest rates in key countries in which we operate may adversely affect consumer spending, consumer debt levels and credit and debit card usage, and as a result, adversely affect our financial performance by reducing the number or average purchase amount of transactions that we service. In addition, the direct and indirect effects of geopolitical conflicts, such as the Russia-Ukraine war and the conflict between Israel and Hamas, have adversely affected, and worsening or future conflicts could materially adversely affect, global economic activity and transaction processing volumes.

Current wording

A significant portion of our revenue is derived from transaction processing fees. The global transaction processing industries depend heavily upon the overall level of consumer, business and government spending. Any change in economic factors, including a sustained deterioration in general economic conditions or consumer confidence, particularly in the U.S., or inflation and increases in interest rates in key countries in which we operate may adversely affect consumer spending, consumer debt levels and credit and debit card usage, and as a result, adversely affect our financial performance by reducing the number or average purchase amount of transactions that we service. In addition, the direct and indirect effects of geopolitical conflicts, such as the Russia-Ukraine war and conflicts in the Middle East, have adversely affected global economic activity and transaction processing volumes (particularly in our former Merchant segment). Worsening, or future, geopolitical conflicts could materially adversely affect global economic activity and our transaction volumes in the future.

Previous wording

When there is a slowdown or downturn in the economy, a drop in stock market levels or trading volumes, or an event that disrupts the financial markets, our business and financial results may suffer for a number of reasons. Customers may react to worsening conditions by reducing or delaying their capital expenditures in general or by specifically reducing or delaying their information technology spending. In addition, customers may seek to curtail trading operations or to lower their costs by renegotiating vendor contracts. Moreover, competitors may respond to market conditions by lowering prices and attempting to lure away our customers to lower-cost solutions. Any further protective trade policies or actions taken by the U.S. may also result in other countries reducing, or making more expensive, services permitted to be provided by U.S.-based companies. Lengthening sales cycles observed in 2022, particularly for large Banking transactions with a total contract value in excess of $50 million, persisted during most of 2023, which we believe resulted from economic uncertainty, and have had, and may continue to have, an adverse effect on our results of operations. If any of these circumstances remain in effect for an extended period of time, there could be a material adverse effect on our business, financial condition or results of operations.

Current wording

When there is a slowdown or downturn in the economy, a drop in stock market levels or trading volumes, or an event that disrupts the financial markets, our business, financial condition or results of operations may suffer for a number of reasons. Customers may react to worsening conditions by reducing or delaying their capital expenditures in general or by specifically reducing or delaying their information technology spending. In addition, customers may seek to curtail trading operations or to lower their costs by renegotiating vendor contracts. Moreover, competitors may respond to market conditions and attempt to lure away our customers by lowering prices on existing solutions or by offering new, lower-cost solutions. Any further protective trade policies or actions taken by the U.S. may also result in other countries reducing, or making more expensive, services permitted to be provided by U.S.-based companies. If any of these circumstances remain in effect for an extended period of time, there could be a material adverse effect on our business, financial condition or results of operations.

Previous wording

Our business, financial condition or results of operations could be adversely affected if we experience business interruptions, errors or failure in connection with our or third-party information technology and communication systems and other software and hardware used in connection with our business, if we experience defects or design errors in the software solutions we offer, or more generally, if the third-party vendors we rely upon are unwilling or unable to provide the services we need to operate our business effectively.

Current wording

Our business, financial condition or results of operations could be adversely affected by business interruptions, errors or failures in connection with our or third-party information technology and communication systems and other software and hardware used in connection with our business, or by design errors in the software solutions we offer, or more generally, by the unavailability of third-party vendors' services that we need to operate our business effectively.

Previous wording

Many of our services are based on sophisticated software and computing systems, and we may encounter delays when developing new technology solutions and services. Further, the technology solutions underlying our services have occasionally contained, and may in the future contain, undetected errors or defects when first introduced or when new versions are released. In addition, we may experience difficulties in installing or integrating our technologies on platforms used by our clients, or our clients may cancel a project after we have expended significant effort and resources to complete an installation. Finally, our systems and operations could be exposed to damage or interruption from fire, floods, hurricanes, earthquakes, tornadoes, typhoons, drought, high-winds, severe weather events, other natural disasters, power loss, telecommunications failure, unauthorized entry and computer viruses. Defects in our technology solutions, errors or delays in the processing of electronic transactions, or other difficulties could result in (i) interruption of business operations; (ii) delay in market acceptance; (iii) additional development and remediation costs; (iv) diversion of technical and other resources; (v) loss of clients; (vi) negative publicity; or (vii) exposure to liability claims. Any one or more of the foregoing could have an adverse effect on our business, financial condition or results of operations. Although we attempt to limit our potential liability through controls, including system redundancies, security controls, application development and testing controls, and disclaimers and limitation-of-liability provisions in our license and client agreements, we cannot be certain that these measures will always be successful in preventing disruption or limiting our liability.

Current wording

Many of our services are based on sophisticated software and computing systems, and we may encounter delays when developing new technology solutions and services. Further, the technology solutions underlying our services have occasionally contained, and may in the future contain, undetected errors or defects when first introduced or when new versions are released. In addition, we may experience difficulties in installing or integrating our technologies on platforms used by our clients, or our clients may cancel a project after we have expended significant effort and resources to complete an installation. Finally, our systems and operations have been, and in the future could be, exposed to damage or interruption from fire, floods, severe weather events, natural disasters, power loss, telecommunications failure, unauthorized entry and computer viruses. Defects in our technology solutions or those of our third-party partners or elsewhere in the global cyber environment, errors or delays in the processing of electronic transactions, or other difficulties have resulted, and in the future could result, in (i) interruption of business operations; (ii) delay in market acceptance; (iii) additional development and remediation costs; (iv) diversion of technical and other resources; (v) loss of clients; (vi) negative publicity; or (vii) exposure to liability claims. Any one or more of the foregoing could have an adverse effect on our business, financial condition or results of operations. We cannot be certain that control measures, including system redundancies, security controls, and application development and testing controls, will be successful in preventing disruption or limiting our exposure.

Previous wording

Further, most of the solutions we offer are very complex software systems that are regularly updated. No matter how careful the design and development, complex software often contains errors and defects when first introduced and when major new updates or enhancements are released. If errors or defects are discovered in current or future solutions, then we may not be able to correct them in a timely manner, if at all. In our development of updates and enhancements to our software solutions, we may make a major design error that makes the solution operate incorrectly or less efficiently. The failure of software to properly perform could result in the Company and its clients being subjected to losses or liability, including censures, fines, or other sanctions by the applicable regulatory authorities, and we could be liable to parties who are financially harmed by those errors. In addition, such errors could cause the Company to lose revenue, lose clients or damage its reputation.

Current wording

Further, most of the solutions we offer are very complex software systems that are regularly updated. No matter how careful the design and development, complex software often contains errors and defects when first introduced and when major new updates or enhancements are released. If errors or defects are discovered in current or future solutions, then we may not be able to correct them in a timely manner, if at all. In our development of updates and enhancements to our software solutions, we may make a major design error that causes the solution to operate incorrectly or less efficiently. The failure of software to perform properly could result in the Company and its clients being subjected to losses or liability, including censures, fines, or other sanctions by the applicable regulatory authorities, and we could be liable to parties who are financially harmed by those errors. In addition, such errors could cause the Company to lose revenue, lose clients or suffer damage to its reputation.

Previous wording

In addition, we generally depend on a number of third parties, both in the United States and internationally, to supply elements of our systems, computers, research and market data, connectivity, communication network infrastructure, other equipment and related support and maintenance. We cannot be certain that any of these third parties will be able to continue providing these services to meet our evolving needs effectively. If our vendors, or in certain cases vendors of our customers, fail to meet their obligations, provide poor or untimely service, or we are unable to make alternative arrangements for the provision of these services, then we may in turn fail to provide our services or to meet our obligations to our customers, and our business, financial condition or results of operations could be adversely affected.

Current wording

In addition, we generally depend on a number of third parties, both in the United States and internationally, to supply elements of our systems, computers, research and market data, connectivity, communication network infrastructure, other equipment and related support and maintenance. We cannot be certain that any of these third parties will be able to continue providing these services to meet our evolving needs effectively. If our vendors, or in certain cases vendors of our customers, fail to meet their obligations, provide poor or untimely service or suffer operational disruptions, and we are unable to make alternative arrangements for the provision of these services, then we may in turn fail to provide our services or to meet our obligations to our customers, and our business, financial condition or results of operations could be adversely affected.

Previous wording

There has been and may continue to be substantial consolidation activity in the banking and financial services industry. In addition, certain financial institutions that experienced negative operating results, including some of our clients, have failed, leading to further consolidation. These consolidations, including those spurred by failures, reduce our number of potential clients and may reduce our number of existing clients, which could adversely affect our revenue, even if the events do not reduce the aggregate activities of the consolidated entities. Further, if our clients or our partners across any of our businesses fail and/or merge with or are acquired by other entities that are not our clients or our partners, or that use fewer of our services, they may discontinue or reduce use of our services. It is also possible that larger financial institutions resulting from consolidations would have greater leverage in negotiating terms or could decide to perform in-house some or all of the services we currently provide or could provide. Any of these developments could have an adverse effect on our business, financial condition or results of operations.

Current wording

There has been, and may continue to be, substantial consolidation activity in the banking and financial services industry. In addition, certain financial institutions that experienced negative operating results, including some of our clients, have failed, leading to further consolidation. These consolidations, including those spurred by failures, reduce our number of potential clients and may reduce our number of existing clients, which could adversely affect our revenue, even if the events do not reduce the aggregate activities of the consolidated entities. Further, if our clients or our partners across any of our businesses fail, merge with or are acquired by other entities that are not our clients or our partners, or that use fewer of our services, they may discontinue or reduce use of our services. It is also possible that larger financial institutions resulting from consolidations would have greater leverage in negotiating terms or could decide to perform in-house some or all of the services we currently provide or could provide. Any of these developments could have an adverse effect on our business, financial condition or results of operations.

Previous wording

We may face pricing pressure in obtaining and retaining our clients. Larger clients in particular may use their negotiating leverage to seek price reductions from us when they renew a contract, when a contract is extended, or when the client's business has significant volume changes. Larger clients may also reduce services if they decide to move services in-house. Further, our smaller and mid-size clients may also exert pricing pressure, particularly upon renewal, due to competition or other economic needs or pressures being experienced by the client. On some occasions, this pricing pressure results in lower revenue from a client than we had anticipated based on our previous agreement with that client. This reduction in revenue could adversely affect our business, financial condition or results of operations.

Current wording

We may face pricing pressure in obtaining and retaining our clients. Larger clients may use their negotiating leverage to seek price reductions from us when they renew a contract, when a contract is extended, or when the client's business has significant volume changes. Larger clients may also reduce services if they decide to move services in-house. Further, our smaller and mid-size clients may also exert pricing pressure, particularly upon renewal, due to competition or other economic needs or pressures being experienced by the client. On some occasions, this pricing pressure results in lower revenue from a client than we had anticipated based on our previous agreement with that client. This reduction in revenue could adversely affect our business, financial condition or results of operations.

Previous wording

Our clients, including those of our clients that are banks, may be similarly adversely affected by any bank failure or other event affecting financial institutions. Any resulting adverse effects to our clients' liquidity or financial performance could reduce the demand for our services or affect our allowance for credit losses and collectability of trade receivables. A significant change in the liquidity or financial position of our clients could cause unfavorable trends in receivable collections and cash flows and additional allowances for anticipated losses may be required. These additional allowances could materially adversely affect our future financial results.

Current wording

Our clients, including those of our clients that are banks, may be similarly adversely affected by any bank failure or other event affecting financial institutions. Any resulting adverse effects to our clients' liquidity or financial performance could reduce the demand for our services or affect our allowance for credit losses and collectability of trade receivables. A significant change in the liquidity or financial position of our clients could cause unfavorable trends in receivable collections and cash flows and may necessitate additional allowances for anticipated losses. Any such additional allowances could materially and adversely affect our business, financial condition or results of operations.

Previous wording

Because the Company is a technology service provider to U.S. financial institutions, it is subject to regular oversight and examination by the FBA, each agency of which is a member of the FFIEC, an interagency body of federal banking regulators. The FBA have broad discretion in the implementation, interpretation and enforcement of banking and consumer protection laws and use the FFIEC's uniform principles, standards and report forms in their review of bank service providers like FIS. A failure to comply with these laws, or a failure to meet the supervisory expectations of the banking regulators, could result in adverse action against the Company. The regulators have the power to, among other things, enjoin "unsafe or unsound" practices; require affirmative actions to correct any violation or practice; issue administrative orders that can be judicially enforced; direct the sale of subsidiaries or other assets; and assess civil money penalties.

Current wording

Because the Company is a technology service provider to U.S. financial institutions, it is subject to regular oversight and examination by the FBA, each agency of which is a member of the FFIEC, an interagency body of federal banking regulators. The FBA have broad discretion in the implementation, interpretation and enforcement of banking and consumer protection laws and use the FFIEC's uniform principles, standards and report forms in their review of bank service providers like FIS. A failure to comply with these laws, or a failure to meet the supervisory expectations of the banking regulators, could result in adverse action against the Company. The regulators have the authority to, among other things, enjoin "unsafe or unsound" practices; require affirmative actions to correct any violation or practice; issue administrative orders that can be judicially enforced; direct the sale of subsidiaries or other assets; and assess civil money penalties.

Previous wording

The Company is also subject to ongoing supervision by regulatory and governmental bodies across the world, including economic and conduct regulators, such as OFAC, BIS, FinCEN in the U.S., the FCA and OFSI in the U.K., and regulatory and governmental bodies responsible for issuing anti-money laundering, anti-bribery, and global economic sanctions and export control regulations. These various regulatory regimes require compliance across many aspects of our activities. Among other things, such regulatory and financial crime compliance obligations require certain capital requirements, safeguarding, training, authorization and supervision of personnel, systems, processes and documentation and reporting to government entities. As we continue to grow our global business around the world, we will become subject to additional countries' regulations governing critical third-party service providers, financial crime and other regulatory areas. The failure of FIS to comply with any of these requirements could result in the suspension or revocation of a license, loss of consumer confidence, and/or the imposition of civil or criminal penalties.

Current wording

The Company is also subject to ongoing supervision by regulatory and governmental bodies across the world, including economic and conduct regulators, such as OFAC, BIS and FinCEN in the U.S., the FCA, OFSI and OTSI in the U.K., and regulatory and governmental bodies responsible for issuing anti-money laundering, anti-bribery, and global economic sanctions and export control regulations. These various regulatory regimes require compliance across many aspects of our activities. Among other things, such regulatory and financial crime compliance obligations require certain capital requirements; safeguarding, training, authorization, supervision and oversight of personnel, systems, processes, controls, and documentation; and reporting to government entities. As we continue to grow our global business around the world, we will become subject to additional countries' regulations governing critical third-party service providers, financial crime and other regulatory areas. Our failure to comply with any of these requirements could result in the suspension or revocation of a license, loss of consumer confidence, and/or the imposition of civil or criminal penalties.

Previous wording

We also have business operations that store, process or transmit consumer information or have direct relationships with consumers that are obligated to comply with regulations, including, but not limited to, the FCRA, the Federal Fair Debt Collection Practices Act and applicable privacy requirements and are subject to examination and oversight by the CFPB. In addition, our wealth and retirement business holds a charter in the state of Georgia, which exposes us to further regulatory compliance requirements of the Georgia Department of Banking and Finance. The U.S. wealth and retirement business is required to hold certain levels of regulatory capital as defined by the state banking regulator in Georgia. In the U.K., our Platform Securities and broker-dealer businesses are regulated by the FCA and are also subject to further regulatory capital requirements.

Current wording

We also have business operations that store, process or transmit consumer information or have direct relationships with consumers. As such, we are obligated to comply with regulations, including, but not limited to, the FCRA, the Federal Fair Debt Collection Practices Act and applicable privacy requirements, and we are subject to examination and oversight by the CFPB. In addition, our wealth and retirement business holds a charter in the state of Georgia, which obligates us to comply with regulatory compliance requirements of the Georgia Department of Banking and Finance. Our U.S. wealth and retirement business is required to hold certain levels of regulatory capital as defined by the state banking regulator in Georgia. In the U.K., our Platform Securities and broker-dealer businesses are regulated by the FCA and are also subject to further regulatory capital requirements.

Previous wording

The Consumer Financial Protection Bureau ("CFPB") continues to establish rules and regulations for regulating financial and non-financial institutions and providers to those institutions to ensure adequate protection of consumer privacy and to ensure consumers are not impacted by deceptive business practices, as well as provide examination and supervisory authority over consumer reporting agencies, including ChexSystems. These rules and regulations govern our clients or potential clients and also govern certain of our businesses. These regulations have resulted, and may further result, in the need for FIS to make capital investments to modify our solutions to facilitate our clients' and potential clients' compliance, as well as to deploy additional processes or reporting to comply with these regulations. In the future, we may be subject to additional expense to ensure continued compliance with applicable laws and regulations and to investigate, defend and/or remedy actual or alleged violations. Further, requirements of these regulations have resulted, and could further result, in changes in our business practices, our clients' business practices and those of other marketplace participants that may alter the delivery of services to consumers, which have impacted, and could further impact, the demand for our solutions and services as well as alter the types or volume of transactions that we process on behalf of our clients. As a result, these requirements, or proposed or future requirements, could have an adverse impact on our financial condition, revenue, results of operations, prospects for future growth and overall business.

Current wording

The Consumer Financial Protection Bureau ("CFPB") continues to establish rules and regulations for regulating financial and non-financial institutions and providers to those institutions to ensure adequate protection of consumer privacy and to ensure consumers are not impacted by deceptive business practices, as well as to provide examination and supervisory authority over consumer reporting agencies, including ChexSystems. These rules and regulations govern our clients or potential clients and also govern certain of our businesses. These regulations have resulted, and may further result, in the need for us to make capital investments to modify our solutions to facilitate our clients' and potential clients' compliance, as well as to deploy additional processes or reporting to comply with these regulations. In the future, we may need to incur additional expenses to ensure continued compliance with applicable laws and regulations and to investigate, defend and/or remedy actual or alleged violations. Further, requirements of these regulations have resulted, and could further result, in changes in our business practices, our clients' business practices and those of other marketplace participants that may alter the delivery of services to consumers, which have impacted, and could further impact, the demand for our solutions and services, as well as alter the types or volume of transactions that we process on behalf of our clients. As a result, these requirements, or proposed or future requirements, could have an adverse impact on our financial condition, revenue, results of operations, prospects for future growth and overall business.

Previous wording

The New York Department of Financial Services has enacted rules that require covered financial institutions to establish and maintain cybersecurity programs. These rules subject FIS to additional regulation and require us to adopt additional business practices that could also require additional capital expenditures or impact our operating results. Changes to state money transmission laws and regulations, including changing interpretations and the implementation of new or varying regulatory requirements, may result in the need for additional money transmitter licenses. These changes could result in increased costs of compliance, as well as fines or penalties.

Current wording

The New York Department of Financial Services has enacted rules that require covered financial institutions to establish and maintain cybersecurity programs. Other states also have data security laws that vary in several respects, including with regard to specificity and detail of requirements and the extent to which such requirements apply to the data we collect from individuals. These rules subject us to additional regulation and require us to adopt additional business practices that could also require additional capital expenditures or impact our operating results. Changes to state money transmission laws and regulations, including changing interpretations and the implementation of new or varying regulatory requirements, may result in the need for additional money transmitter licenses. These changes could result in increased costs of compliance, as well as fines or penalties.

Previous wording

We are exposed to certain risks relating to the execution services provided by our brokerage operations to our customers and counterparties, which include other broker-dealers, active traders, hedge funds, asset managers, and other institutional and non-institutional clients. These risks include, but are not limited to, customers or counterparties failing to pay for or deliver securities, trading errors, the inability or failure to settle trades, and trade execution system failures. As trading in the U.S. securities markets has become more automated, the potential impact of a trading error or a rapid series of errors caused by a computer or human error or a malicious act has become greater. In our other businesses, we generally can disclaim liability for trading losses that may be caused by our software, but in our brokerage operations, we may not be able to limit our liability for trading losses or failed trades even when we are not at fault. As a result, we may suffer losses that are disproportionately large compared to the relatively modest profit contributions of our brokerage operations.

Current wording

We are exposed to certain risks relating to the execution services provided by our brokerage operations to our customers and counterparties, which include other broker-dealers, active traders, hedge funds, asset managers, and other institutional and non-institutional clients. These risks include, but are not limited to, customers or counterparties failing to pay for or deliver securities, trading errors, the inability or failure to settle trades, and trade execution system failures. As trading in the U.S. securities markets has become more automated, the potential impact of a trading error or a rapid series of errors caused by a computer or human error or a malicious act has increased. In our other businesses, we generally can disclaim liability for trading losses that may be caused by our software, but in our brokerage operations, we may not be able to limit our liability for trading losses or failed trades, even when we are not at fault. As a result, we may suffer losses that are disproportionately large compared to the relatively modest profit contributions of our brokerage operations.

Previous wording

Moreover, the legislative and regulatory landscape continues to evolve, and we expect that it may cover alternative payment types, including digital/crypto currency. Any failure to comply with such laws and regulations could expose us to liability, regulatory scrutiny and/or reputational damage. Financial crimes laws may be interpreted and applied inconsistently from country to country and impose inconsistent or conflicting requirements. Complying with varying jurisdictional requirements could increase the costs and complexity of compliance and associated recordkeeping costs or require us to change our business practices in a manner adverse to our business.

Current wording

Moreover, the legislative and regulatory landscape continues to evolve, and we expect that it may cover alternative payment types, including digital and crypto currencies. Any failure to comply with such laws and regulations could expose us to liability, regulatory scrutiny and/or reputational damage. Financial crimes laws may be interpreted and applied inconsistently from country to country and may impose inconsistent or conflicting requirements. Complying with varying jurisdictional requirements could increase the costs and complexity of compliance, including associated recordkeeping costs, or could require us to change our business practices in a manner adverse to our business.

Previous wording

Further, our business may be constrained by current and future laws and regulations governing the development, use and deployment of artificial intelligence (including machine learning) (“AI”) technologies. These laws and regulations are continuously and rapidly evolving, and there is no single global regulatory framework for AI, creating further uncertainties regarding compliance with such laws and regulations. As a result, our ability to leverage AI could be restricted by burdensome and costly legal requirements.

Current wording

Further, our business may be constrained by current and future laws and regulations governing the development, use and deployment of artificial intelligence (including machine learning) ("AI") technologies. These laws and regulations are continuously and rapidly evolving, and there is no single global regulatory framework for AI, creating further uncertainties regarding compliance with such laws and regulations. As a result, our ability to leverage AI could be restricted by burdensome and costly regulatory requirements.

Previous wording

If we fail to comply with relevant laws or regulations, then we risk reputational damage, potential civil and criminal sanctions, fines or other action imposed by regulatory or governmental authorities, including the potential suspension or revocation of the permission-based regulatory licenses which authorize the Company to provide core services to customers. Regulatory authorities subject our businesses, from time to time, to regulatory investigations, reviews and proceedings (both formal and informal), certain of which may result in adverse settlements, fines, penalties, injunctions or other relief. This could result in an adverse effect on FIS' business, reputation and customer relationships, which in turn could adversely affect its financial position and performance.

Current wording

If we fail to comply with relevant laws or regulations, then we risk reputational damage, potential civil and criminal sanctions, fines or other action imposed by regulatory or governmental authorities, including the potential suspension or revocation of the permission-based regulatory licenses which authorize the Company to provide core services to customers. Regulatory authorities subject our businesses, from time to time, to regulatory investigations, reviews, examinations and proceedings (both formal and informal), some of which have the potential to result in settlements, fines, penalties, injunctions or other adverse consequences to us. This could result in an adverse effect on FIS' business, reputation and customer relationships, which in turn could adversely affect its financial position and performance.

Previous wording

Many of our clients are subject to a regulatory environment and to industry standards that may change in a manner that reduces the types or volume of solutions or services we provide or may reduce the type or number of transactions in which our clients engage, and therefore reduce our revenue.

Current wording

Many of our clients are subject to a regulatory environment and to industry standards that may change in a manner that reduces the types or volume of solutions or services we provide or may reduce the types or number of transactions in which our clients engage, and therefore reduce our revenue.

Previous wording

Constantly evolving global privacy, data protection and cybersecurity laws require the Company to adopt new business practices, update contractual provisions in existing and new contracts, and constantly update our global Privacy and Data Protection Program and our global Information Security Program, which may require transitional and incremental expenses and may impact our future operating results.

Current wording

Constantly evolving global privacy, data protection, cybersecurity, cyber resilience, and AI laws and regulations require the Company to adopt new business practices, update contractual provisions in existing and new contracts, and constantly update our global Privacy and Data Protection Program and our global Information Security Program, which may require transitional and incremental expenses and may impact our future operating results.

Previous wording

The Company is subject to numerous global privacy, data protection and cybersecurity laws, which are continuing to change in ways that impose increasingly complex and costly compliance obligations on FIS and that have had, and are expected to continue to have, a significant impact on FIS' operations. Failure to comply with new and evolving laws in these areas could result in significant penalties, damage to our brand, and loss of business. FIS has incurred, and will continue to incur, costs to comply with these new laws. There are also several additional laws being considered by state legislatures, the U.S. Congress, and governments around the world. As a result, a more substantial compliance effort with varying regimes in different jurisdictions is expected to continue in the future, which has the potential to further increase the costs and complexities of FIS' business. Moreover, privacy, data protection and cybersecurity laws may be interpreted and applied inconsistently from country to country and impose inconsistent or conflicting requirements. Complying with varying jurisdictional requirements could increase the costs and complexity of compliance and associated recordkeeping costs or require us to change our business practices in a manner adverse to our business and to incur additional costs. Data localization requirements in evolving privacy, data protection and cybersecurity laws could also increase the cost and alter the approach to housing data around the world. In addition, our businesses are increasingly subject to laws and regulations relating to digital transformation, surveillance, cyber resilience, encryption, and data onshoring in the jurisdictions in which we operate. In particular, U.K. and European regulators are increasingly seeking to mitigate cyber threats and enhance digital resilience within the financial system through new regulations targeting the provision of critical third-party technology services. Compliance with these laws and regulations may require us to change our technology for information security, operational infrastructure, policies, and procedures, which could be time-consuming and costly and may result in additional regulatory burdens for the Company. Furthermore, compliance with these laws and regulations may indirectly impact the Company in circumstances where it acts as a third-party service provider to clients, who are themselves subject to these laws and regulations, and will expect the Company to take appropriate steps to support them in achieving compliance.

Current wording

The Company is subject to numerous global privacy, data protection, cybersecurity, cyber resilience, and AI laws and regulations, which are continuing to change in ways that impose increasingly complex and costly compliance obligations on us and that have had, and are expected to continue to have, a significant impact on our operations. Failure to comply with new and evolving laws and regulations in these areas could result in significant penalties, damage to our reputation, and loss of business. We have incurred, and will continue to incur, costs to comply with these new laws and regulations. There are also several additional laws being considered by state legislatures, the U.S. Congress, and governments around the world. As a result, we expect that a more substantial compliance effort with varying regimes in different jurisdictions will continue to be necessary in the future, which has the potential to further increase the cost and complexity of our business. Moreover, privacy, data protection, cybersecurity, cyber resilience, and AI laws may be interpreted and applied inconsistently from country to country and may impose inconsistent or conflicting requirements. Complying with varying jurisdictional requirements could increase the costs and complexity of compliance and associated recordkeeping costs or require us to change our business practices in a manner adverse to our business and to incur additional costs. Data localization requirements in evolving privacy, data protection, cybersecurity, cyber resilience, and AI laws could also increase the cost and alter the approach to housing data around the world. In addition, our businesses are increasingly subject to laws and regulations relating to digital transformation, surveillance, encryption, and data onshoring in the jurisdictions in which we operate. For example, under DORA, E.U. regulators are increasingly seeking to mitigate cyber threats and enhance digital resilience within the financial system through new regulations targeting the provision of critical third-party technology services. Compliance with these laws and regulations may require us to change our technology for information security, operational infrastructure, policies, and procedures, which could be time-consuming and costly and may result in additional regulatory burdens for the Company. Furthermore, compliance with these laws and regulations may indirectly impact us in circumstances where we act as a third-party service provider to clients, who are themselves subject to these laws and regulations and who will expect us to take appropriate steps to support them in achieving compliance.

Previous wording

High profile digital banking security breaches could impact consumer payment behavior patterns in the future and reduce our transaction volumes.

Current wording

High profile digital banking security breaches or information system failures could impact consumer payment behavior patterns in the future and reduce our transaction volumes.

Previous wording

We are unable to predict whether or when high profile digital banking security breaches will occur and if they occur, whether consumers will reduce their digital banking service. If consumers reduce digital banking services, and we are not able to adapt to offer our clients alternative technologies, then our revenue and related earnings could be adversely affected.

Current wording

We are unable to predict whether or when high profile digital banking security breaches or other information system failures will occur and, if they occur, whether consumers will reduce their digital banking service. If consumers reduce digital banking services, and we are not able to adapt to offer our clients alternative technologies, then our revenue and related earnings could be adversely affected.

Previous wording

Misappropriation of our intellectual property and proprietary rights or a finding that our patents are invalid could impair our competitive position.

Current wording

Misappropriation of and infringement on our intellectual property and proprietary rights, or a finding that our patents are invalid, could impair our competitive position.

Previous wording

Our ability to compete depends in some part upon our proprietary solutions and technology. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our solutions or to obtain and use information that we regard as proprietary or challenge the validity of our patents with governmental authorities. Policing unauthorized use of our proprietary rights is difficult. We cannot make any assurances that the steps we have taken will prevent misappropriation of technology or that the agreements entered into for that purpose will be enforceable. Effective patent, trademark, service mark, copyright, and trade secret protection may not be available in every country in which our applications and services are made available online. Misappropriation of our intellectual property or potential litigation concerning such matters could have an adverse effect on our business, financial condition or results of operations. As we increase our international business, we are subject to further risks of misappropriation of our intellectual property in countries which have laws which are less protective of intellectual property or are enforced in a less protective manner.

Current wording

Our ability to compete depends in some part upon our proprietary solutions and technology. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our solutions or to obtain and use information that we regard as proprietary or challenge the validity of our patents with governmental authorities. Policing unauthorized use of our proprietary rights is difficult. We cannot make any assurances that the steps we have taken will prevent misappropriation of, or infringement upon, technology or that the agreements entered into for that purpose will be enforceable. Effective patent, trademark, service mark, copyright, and trade secret protection may not be available in every country in which our applications and services are made available. Misappropriation of our intellectual property or potential litigation concerning such matters could have an adverse effect on our business, financial condition or results of operations. As we increase our international business, we are subject to further risks of misappropriation of, or infringement on, our intellectual property in countries which have laws that are less protective of intellectual property or are enforced in a less protective manner.

Previous wording

We use a limited amount of software licensed by its authors or other third parties under so-called "open source" licenses and may continue to use such software in the future. Some of these licenses contain requirements that we make available source code for modifications or derivative works we create based upon the open source software and that we license such modifications or derivative works under the terms of a particular open source license or other license granting third parties certain rights of further use. By the terms of certain open source licenses, we could be required to release the source code of our proprietary software if we combine our proprietary software with open source software in a certain manner. Additionally, the terms of many open source licenses have not been interpreted by U.S. or other courts, and there is a risk that these licenses could be construed in a manner that could impose unanticipated conditions or restrictions on our ability to commercialize our solutions. In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on origin of the software. We have established processes to help alleviate these risks, including a review process for screening requests from our development organizations for the use of open source, but we cannot be sure that all open source is submitted for approval prior to use in our solutions. In addition, many of the risks associated with usage of open source cannot be eliminated, and could, if not properly addressed, adversely affect our business.

Current wording

We use a limited amount of software licensed by its authors or other third parties under so-called "open source" licenses, and we may continue to use such software in the future. Some of these licenses contain requirements that we make available source code for modifications or derivative works we create based upon the open source software and that we license such modifications or derivative works under the terms of a particular open source license or other license granting third parties certain rights of further use. By the terms of certain open source licenses, we could be required to release the source code of our proprietary software if we combine our proprietary software with open source software in a certain manner. Additionally, the terms of many open source licenses have not been interpreted by U.S. or other courts, and there is a risk that these licenses could be construed in a manner that could impose unanticipated conditions or restrictions on our ability to commercialize our solutions. In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software. We have established processes to help alleviate these risks, including a review process for screening requests from our development organizations for the use of open source, but we cannot be sure that all open source is submitted for approval prior to use in our solutions. In addition, many of the risks associated with the use of open source cannot be eliminated, and could, if not properly addressed, adversely affect our business.

Previous wording

Using and/or incorporating AI technologies into our business poses additional risks and uncertainties that could have the potential to harm our reputation and could have a material adverse effect on our business, financial condition or results of operations.

Current wording

Using and/or incorporating AI technologies into our business poses additional risks and uncertainties that have the potential to harm our reputation and could have a material adverse effect on our business, financial condition or results of operations.

Previous wording

Further, if we are unsuccessful in identifying opportunities to expand our portfolio with artificial intelligence capabilities to strengthen or maintain our market position or enhance our customers’ experiences, we may have a competitive disadvantage in developing new products and operating our business and our customers may prefer different solutions.

Current wording

Incorporating AI technologies into our business offers significant potential to enhance the value of the solutions and services we provide to our clients. If we are unsuccessful in identifying opportunities to expand our portfolio with AI capabilities to strengthen or maintain our market position or enhance our customers' experiences, we may have a competitive disadvantage in developing new products and operating our business. However, AI algorithms may produce unfair, unintended, inaccurate, biased or discriminatory outcomes which could be difficult to detect or explain. Further, the training data underlying third-party AI models may also inadvertently breach intellectual property, privacy or other rights and result in the unauthorized use of confidential information. The integration of AI introduces a variety of risks and uncertainties that may harm our reputation, expose us to lawsuits from consumers or other third parties, introduce security vulnerabilities to our information systems, or have other unintended consequences if we are not successful in mitigating such risks. AI systems may have unintended societal impacts and negative outcomes, such as algorithmic errors that result in inadvertent discrimination or bias. Ensuring that our AI systems are used ethically and in a way that aligns with societal values is critical to maintaining trust with our clients, their customers, and regulators, and will likely be required under laws and regulations governing AI systems.

Previous wording

We settle funds on behalf of financial institutions, other businesses and consumers and receive funds from clients, card issuers, payment networks and consumers on a daily basis for a variety of transaction types. Transactions facilitated by us include debit card, credit card, electronic bill payment transactions, banking payments and check clearing that supports consumers, financial institutions and other businesses. These payment activities rely upon the technology infrastructure that facilitates the verification of activity with counterparties, the facilitation of the payment as well as the detection or prevention of fraudulent payments. A compromise of our continuity of operations, integrity of processing, or ability to detect or prevent fraudulent payments could result in a financial loss to us. In addition, we rely on various financial institutions to provide Automated Clearing House ("ACH") services in support of funds settlement for certain of our solutions. An inability to obtain such ACH services in the future could have a material adverse effect on our business, financial condition or results of operations. In addition, we may issue credit to consumers, financial institutions or other businesses as part of the funds settlement. A default on this credit by a counterparty could result in a financial loss to us. Furthermore, if one of our clients for which we facilitate settlement suffers a fraudulent event due to a deficiency in their controls, then we may suffer a financial loss if the client does not have sufficient capital to cover the loss.

Current wording

We settle funds on behalf of financial institutions, other businesses and consumers and receive funds from clients, card issuers, payment networks and consumers on a daily basis for a variety of transaction types. Transactions facilitated by us include debit card, credit card, electronic bill payment transactions, banking payments and check clearing that supports consumers, financial institutions and other businesses. These payment activities rely upon the technology infrastructure that facilitates the verification of activity with counterparties, the facilitation of the payment and the detection or prevention of fraudulent payments. A compromise of our continuity of operations, integrity of processing, or ability to detect or prevent fraudulent payments could result in a financial loss to us. In addition, we rely on various financial institutions to provide treasury services in support of funds settlement for certain of our solutions. An inability to obtain such treasury services in the future could have a material adverse effect on our business, financial condition or results of operations. Furthermore, if one of our clients, for which we facilitate settlement, defaults on settlement or suffers a fraudulent event due to a deficiency in their controls, then we may suffer a financial loss if the client does not have sufficient capital to cover the loss.

Previous wording

The international operations of FIS represented approximately 22% of our total 2023 revenue and are largely conducted in currencies other than the U.S. Dollar, including the British Pound Sterling, Euro, Brazilian Real, Swedish Krona, Australian

Current wording

Our international operations represented approximately 22% of our total 2024 revenue and are largely conducted in currencies other than the U.S. Dollar, including the British Pound Sterling, Euro, Brazilian Real, Australian Dollar, Swedish Krona, Swiss Franc and Indian Rupee. Our business, financial condition or results of operations could be adversely affected due to a variety of factors, including the following:

Previous wording

•changes in a specific country or region's political and cultural climate or economic condition, including change in governmental regime;

Current wording

•changes in a specific country or region's political and cultural climate or economic condition, including a change in governmental regime;

Previous wording

•trade treaties, tariffs or agreements that could adversely affect our ability to do business in affected countries; and

Current wording

•trade treaties, tariffs or agreements that could increase our costs or otherwise adversely affect our ability to do business in affected countries; and

Previous wording

•compliance with the FCPA and OFAC regulations, particularly in emerging markets.

Current wording

•compliance with the FCPA and OFAC regulations and other applicable anti-corruption and sanctions laws and regulations, particularly in emerging markets.