CRAWFORD & CO
For the period ended Dec 31, 2025. Filed Mar 2, 2026.
View on SEC.govAbout this filing
A company's yearly report to the SEC, with audited financial statements. It is the fullest account a company gives of its business, its finances and the risks it sees.
FY2025 · Filed Mar 2, 2026
CRD-A$11.53-0.9%Stored close · as of Nov 6, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-K
Period ended 2024-12-31; filed 2025-03-03.
0000950170-25-030894
Item 1A. Risk FactorsCurrent report: 10-K
Period ended 2025-12-31; filed 2026-03-02.
0001193125-26-085465
Item 1A. Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 74 previous paragraphs and 80 current paragraphs.
60 unchanged; 13 reworded; 7 added; 1 removed; 0 previous and 0 current paragraphs rearranged.
Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (7)
Current report
Artificial intelligence and machine learning (together, “AI”) may not perform as intended in our solutions or operations and expose us to significant legal, regulatory, contractual and operational risks.
Current report
We use, and plan to expand the use of, artificial intelligence and machine learning in our services with the goal of improving efficiency and reducing costs. AI initiatives are complex, costly and uncertain. They may not achieve anticipated performance, accuracy, efficiency or financial outcomes, and could adversely affect our business, results of operations and financial condition.
Current report
Model performance, explainability, and fairness. AI outputs may be inaccurate, incomplete, biased, or otherwise unreliable, which could contribute to errors in claims handling support, misalignment of work, missed fraud signals, or inaccurate data provided to clients. Where AI is used in HR, errors or bias could lead to employment claims. Failures to document model design, training data, testing, monitoring and human oversight could impede explainability and remediation, invite client disputes, or lead to adverse regulatory scrutiny.
Current report
Data governance, privacy and security. AI systems rely on large volumes of data, including personal, sensitive, and client‑confidential information. Inadequate data governance (including provenance, minimization, quality, retention, access controls, and vendor controls) may result in privacy or data protection violations, cross border transfer non-compliance, or contractual breaches. Use of third‑party AI tools can increase risk of data leakage, prompt‑injection, model exfiltration and other cyber threats. Any such incident could result in service disruption, regulatory investigations, litigation, fines, contractual liability, and reputational harm.
Current report
Emerging and evolving AI regulation. Multiple jurisdictions have adopted or proposed AI specific frameworks that may classify certain uses as higher risk and impose obligations such as risk management systems, testing and validation, technical documentation, transparency notices, impact/risk assessments, incident reporting, human oversight, and vendor/processor due diligence. We may also face requirements under general consumer protection, unfair practices, anti-discrimination and sectoral rules (including scrutiny of AI used in claims processes by insurance market stakeholders). Divergent or rapidly changing obligations can increase compliance costs, require product or process changes, delay deployments, and affect cross-border operations.
Current report
Contractual and client assurance pressures. Clients are increasingly requiring AI related representations, warranties, audit rights, transparency, impact assessments, and indemnities. Failure to meet client standards or disagreements over the scope of AI use, data rights, performance, bias, or audit findings could lead to lost business, disputes, or liabilities.
Current report
If any of these risks materialize, we could face investigations, enforcement actions, fines or penalties; private litigation; contractual liability to clients and partners; increased compliance and assurance costs; constraints on data use or model deployment; and loss of customers or market reputation. Compliance with new or differing AI requirements across jurisdictions could be costly and complex, and we may be unable to timely adapt our systems, processes and vendor arrangements.
Removed paragraphs (1)
Previous report
While we do not anticipate any contributions in 2025, we intend to comply with any future funding requirements through the use of cash from operations. However, there can be no assurance that we will generate enough cash to do so. Our inability to fund these obligations through cash from operations could require us to seek funding from other sources, including through additional borrowings under our Credit Facility (defined below), if available, proceeds from debt or equity financings, or asset sales. There can be no assurance that we would be able to obtain any such external funding in amounts, at times and on terms that we deem commercially reasonable, in order for us to meet these obligations. Furthermore, any of the foregoing could materially increase our outstanding debt or debt service requirements or dilute the value of the holdings of our current shareholders, as the case may be. Our inability to comply with any funding obligations in a timely manner could materially adversely affect our financial condition.
Reworded paragraphs (13)
Previous wording
From time to time, we derive a material portion of our revenues from a limited number of clients. No single customer accounts for 10% or more of our consolidated revenues for the years ended December 31, 2024, 2023, or 2022. However, for each of the years ended December 31, 2024, 2023, and 2022, three customers in our Platform Solutions segment each represented in excess of 10% of its revenue. For each of the years ended December 31, 2023 and 2022, our International Operations segment derived in excess of 10% of its revenue from one customer.
Current wording
From time to time, we derive a material portion of our revenues from a limited number of clients. No single customer accounts for 10% or more of our consolidated revenues for the years ended December 31, 2025, 2024, or 2023. However, for the year ended December 31, 2025, two customers in our Platform Solutions segment represented in excess of 10% of its revenues, and for each of the years ended December 31, 2024 and 2023, three customers in our Platform Solutions segment each represented in excess of 10% of its revenues. For the year ended December 31, 2023, our International Operations segment derived in excess of 10% of its revenues from one customer.
Previous wording
We manage a large amount of highly sensitive and confidential consumer information including personal data, medical/health information and financial information. A security or privacy incident impacting data processed or stored in our own facilities or data maintained, processed or stored by our service providers, including cloud service providers, could compromise the confidentiality, integrity or availability of this information. Unauthorized access to or disclosure of sensitive and confidential information stored by us or our service providers may occur through break-ins, breaches of a secure network by an unauthorized party, systems and technology failures, failed internet processes, theft or misuse or other misconduct. It is also possible that unauthorized access to or disclosure of such sensitive and confidential information may be obtained through accidental or malicious failure to follow security policies or controls by us or our employees or our service providers. If there were an inadvertent disclosure of confidential consumer information, or if a third party were to gain unauthorized access to the confidential information, our operations could be disrupted, our reputation could be damaged and we could be subject to claims or other liabilities, regulatory investigations, or fines. These incidents, if successful, could also materially disrupt operational systems and result in loss of intellectual property, trade secrets, other proprietary or competitively sensitive information. In addition, such perceived or actual unauthorized disclosure of the information we collect or breach of our security could damage our reputation, result in the loss of customers and harm our business.
Current wording
We manage a large amount of highly sensitive and confidential consumer information including personal data, medical/health information and financial information. A security or privacy incident impacting data processed or stored in our own facilities or data maintained, processed or stored by our service providers, including cloud service providers, could compromise the confidentiality, integrity or availability of this information. Unauthorized access to or disclosure of sensitive and confidential information stored by us or our service providers may occur through break-ins, breaches of a secure network by an unauthorized party, systems and technology failures, failed internet processes, theft or misuse or other misconduct. It is also possible that unauthorized access to or disclosure of such sensitive and confidential information may be obtained through accidental or malicious failure to follow security policies or controls by us, our employees, or our service providers. If there were an inadvertent disclosure of confidential consumer information, or if a third party were to gain unauthorized access to the confidential information, our operations could be disrupted, our reputation could be damaged and we could be subject to claims or other liabilities, regulatory investigations, or fines. These incidents, if successful, could also materially disrupt operational systems and result in loss of intellectual property, trade secrets, other proprietary or competitively sensitive information. In addition, such perceived or actual unauthorized disclosure of the information we process or breach of our security could damage our reputation, result in the loss of customers and harm our business.
Previous wording
Malicious technology-related events, such as cyberattacks, computer hacking, computer viruses, ransomware, worms and other destructive or disruptive software and other attempts to gain access to confidential or personal data, denial of service attacks and other malicious activities are becoming increasingly diverse and sophisticated and the incidence of these events is on the rise worldwide and highlights the need for continual and effective cybersecurity awareness and education. Our business, which involves the collection, use, transmission and other processing of data, makes us and our clients and business partners attractive targets of hackers, denial of service attacks, malicious code, phishing attacks, ransomware attacks, and other threat actors, including malicious insiders (such as employees and prior employees), which have resulted in security incidents. Types of cybersecurity incidents may include unauthorized access, misuse, loss, corruption, inaccessibility, or destruction of data (including personal, confidential and sensitive data), unavailability of services, or other adverse events.
Current wording
Malicious technology-related events, such as cyberattacks, computer hacking, computer viruses, ransomware, worms and other destructive or disruptive software and other attempts to gain access to confidential or personal data, denial of service attacks and other malicious activities are becoming increasingly diverse and sophisticated and the incidence of these events is on the rise worldwide and highlights the need for continual and effective cybersecurity awareness and education. Our business, which involves the collection, use, transmission and other processing of data, makes us and our clients and business partners attractive targets for threat actors such as hackers, denial-of-service attacks, malicious code distributors, perpetrators of phishing and ransomware attacks, and malicious insiders (including current and former employees), which may result in security incidents. Types of cybersecurity incidents may include unauthorized access, misuse, loss, corruption, inaccessibility, or destruction of data (including personal, confidential and sensitive data), unavailability of services, or other adverse events.
Previous wording
In the past three years, we have faced cyberattacks, and we expect to continue to face cyberattacks in the future. Some of these attacks have been successful, although none have been material. We have made investments in our information security policies, procedures and technical controls and routinely engage a third party to assess the maturity of our information security program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. However, we do not believe it is possible to protect our systems or third-party systems against every attempt at a malicious breach due to the increasing sophistication and frequency of such attacks. All employees receive security awareness training including communication of processes for reporting a potential security incident. We have a robust Cyber Incident Response Plan in place which provides a documented framework for handling high severity security and privacy incidents and facilitates coordination across multiple parts of the Company and with external expertise when necessary. Additionally, we have existing procedures to determine the potential materiality of a cybersecurity incident. These procedures include reporting protocols to and oversight from our Board of Directors. We also have disclosure controls and insider trading restrictions that would apply in the event of a material cybersecurity incident, and we routinely perform simulations and drills at both a technical and management level. Notwithstanding these measures, we cannot provide any assurance that we will always be able to prevent or mitigate a cybersecurity attack. These types of cybersecurity attacks and incidents can give rise to a variety of losses and costs, including legal exposure and regulatory fines, damages to reputation, and others.
Current wording
In the past three years, we have faced cyberattacks, and we expect to continue to face cyberattacks in the future. Some of these attacks have been successful, though none have been material. We have made investments in our information security policies, procedures and technical controls and routinely engage a third party to assess the maturity of our information security program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. However, we do not believe it is possible to protect our systems or third-party systems against every attempt at a malicious breach due to the increasing sophistication and frequency of such attacks. All employees receive security awareness training including communication of processes for reporting a potential security incident. We have a robust Cybersecurity and Privacy Incident Response Policy in place which provides a documented framework for handling high severity security and privacy incidents and facilitates coordination across multiple parts of the Company and with external expertise when necessary. Additionally, we have existing procedures to determine the potential materiality of a cybersecurity incident. These procedures include reporting protocols to and oversight from our Board of Directors. We also have disclosure controls and insider trading restrictions that would apply in the event of a material cybersecurity incident, and we routinely perform simulations and drills at both a technical and management level. Notwithstanding these measures, we cannot provide any assurance that we will always be able to prevent or mitigate a cybersecurity attack. These types of cybersecurity attacks and incidents can give rise to a variety of losses and costs, including legal exposure and regulatory fines, damages to reputation, and others.
Previous wording
Any perception of our practices, products or services as a violation of individual privacy rights may subject us to public criticism, class action lawsuits, reputational harm, or investigations or claims by regulators, industry groups or other third parties, all of which could disrupt our business and expose us to increased liability. Additionally, we collect, process and store information at the direction of and on behalf of our customers and if our customers fail to comply with their own contractual obligations or applicable laws, it could result in litigation or reputational harm to us.
Current wording
Any perception of our practices, products or services as a violation of individual privacy rights may subject us to public criticism, class action lawsuits, reputational harm, or investigations or claims by regulators, industry groups or other third parties, all of which could disrupt our business and expose us to increased liability. Additionally, we collect, process and store information at the direction of and on behalf of our customers and if our customers fail to comply with their own obligations or applicable laws, it could result in litigation or reputational harm to us.
Previous wording
Transferring personal information across international borders is increasingly complex and subject to a growing body of enforcement decisions. The increased focus on cross-border data transfers in various countries, in addition to new data protection and privacy laws, means our clients are also more attune to data sharing and requiring data transfer impact assessments for countries which are not deemed to provide an adequate level of protection as the data-originating country. These requirements are often complex, conflicting, unclear or ever changing, all of which can make compliance challenging and may result in an increase in the obligations required to provide our services in the U.K. and EU or in sanctions and fines for non-compliance. Several other countries, including Brazil, China, Canada and Australia, have also established specific legal requirements for cross-border transfers of personal information. These ongoing developments in the U.K. and EU and elsewhere could increase our operating costs in these jurisdictions and impact the way we operationalize our business models, with effects on results of operations and financial condition.
Current wording
Transferring personal information across international borders is increasingly complex and subject to a growing body of enforcement decisions. The increased focus on cross-border data transfers in various countries, in addition to new data protection and privacy laws, means our clients are also more attune to data sharing and requiring data transfer impact assessments for countries which are not deemed to provide an adequate level of protection as the data-originating country. These requirements are often complex, conflicting, unclear or ever changing, all of which can make compliance challenging and may result in an increase in the obligations required to provide our services in the U.K. and EU or in sanctions and fines for non-compliance. Several other countries, including Brazil, China, Canada and Australia, have also established specific legal requirements for cross-border transfers of personal information. These ongoing developments around the world could increase our operating costs as well as impact how we function across borders.
Previous wording
Our international operations subject us to political, legal, operational, financial, exchange rate and other risks that we do not face in our domestic operations. Many of these operations are substantially smaller than our U.S. operations and as such are at risk of generating operating losses due to lack of scale. We face, among other risks, the risk of discriminatory regulation; nationalization or expropriation of assets; changes in both domestic and foreign laws regarding taxation, trade and investment abroad; pandemics such as coronavirus; potential loss of proprietary information due to piracy, misappropriation or laws that may be less protective of our intellectual property rights; or price controls and exchange controls or other restrictions that could prevent us from transferring funds from these operations out of the countries in which they were earned or converting local currencies we hold into U.S. dollars or other currencies.
Current wording
Our international operations subject us to political, legal, operational, financial, exchange rate and other risks that we do not face in our domestic operations. Many of these operations are substantially smaller than our U.S. operations and as such are at risk of generating operating losses due to lack of scale. We face, among other risks, the risk of discriminatory regulation; nationalization or expropriation of assets; changes in both domestic and foreign laws regarding taxation, trade and investment abroad; pandemics; potential loss of proprietary information due to piracy, misappropriation or laws that may be less protective of our intellectual property rights; or price controls and exchange controls or other restrictions that could prevent us from transferring funds from these operations out of the countries in which they were earned or converting local currencies we hold into U.S. dollars or other currencies.
Previous wording
Although we do not have direct exposure from the conflicts in Russia/Ukraine and Israel, we are aware of their potential negative impact to adjacent economies which could lower claim activity across our network of offices and increase our exposure to cyberattacks.
Current wording
Although we do not have direct exposure from the ongoing and potential global conflicts including Russia and the Ukraine, the Middle East, and growing tensions in the Asia Pacific region, we are aware of their potential negative impact to adjacent economies which could lower claim activity across our network of offices and increase our exposure to cyberattacks.
Previous wording
Natural or manmade disasters or other acts of violence may affect the markets in which we operate, our clients and our service delivery.
Current wording
Natural or man-made disasters or other acts of violence may affect the markets in which we operate, our clients and our service delivery.
Previous wording
Our business may be negatively affected by instability, disruption or destruction in the many geographic regions where we operate. Natural or manmade disasters, including storm, flood, fire, earthquake, pandemics and other regional or global health crises, as well as war, terrorism, riot, civil insurrection or social unrest, may cause damage to our facilities or disrupt our services. This includes our shared services centers which exist in international geographies. Specifically, we continue to increase employees and processes performed by our Global Business Service Centers located in the Philippines. Our crisis management procedures, business continuity plans and disaster recovery capabilities may not be effective at preventing or mitigating the effects of such disasters, particularly in the case of a catastrophic event. These events may pose significant security risks to our employees, the facilities where they work, our operations, electricity and other utilities, communications, travel and network services and the disruption of any or all of them could materially adversely affect our financial results.
Current wording
Our business may be negatively affected by instability, disruption or destruction in the many geographic regions where we operate. Natural or man-made disasters, including storm, flood, fire, earthquake, pandemics and other regional or global health crises, as well as war, terrorism, riot, civil insurrection or social unrest, may cause damage to our facilities or disrupt our services. This includes our shared services centers which exist in international geographies. Specifically, we continue to increase employees and processes performed by our Global Business Service Centers located in the Philippines. Our crisis management procedures, business continuity plans and disaster recovery capabilities may not be effective at preventing or mitigating the effects of such disasters, particularly in the case of a catastrophic event. These events may pose significant security risks to our employees, the facilities where they work, our operations, electricity and other utilities, communications, travel and network services and the disruption of any or all of them could materially adversely affect our financial results.
Previous wording
At the end of the most recent measurement period for our U.S. Qualified Plan, the projected benefit obligation was underfunded by $19.0 million. We did not make any voluntary contributions to this plan in 2022, 2023, or 2024, and do not expect to make any discretionary contributions to the U.S. Qualified Plan in the next fiscal year. Volatility in the capital markets, mortality changes and future legislation may have a negative impact on our pension plan, which may further increase the underfunded portion and our attendant funding obligations. Any future contributions to our underfunded defined benefit pension plan could reduce our liquidity, restrict available cash for our operating, financing, and investing needs and may materially adversely affect our financial condition and our ability to deploy capital to other opportunities. Any decision to terminate the plan and settle the defined-benefit pension obligation would result in a non-cash charge within the Consolidated Statements of Operations related to unrecognized actuarial losses in accumulated other comprehensive income, which totals $178.9 million as of December 31, 2024.
Current wording
At the end of the most recent measurement period for our U.S. Qualified Plan, the projected benefit obligation was underfunded by $15.4 million. We did not make any voluntary contributions to this plan in 2023, 2024, or 2025. In 2026, we expect to make discretionary contributions of $3.0 million to minimize future required contributions. Volatility in the capital markets, mortality changes and future legislation may have a negative impact on our pension plan, which may further increase the underfunded portion and our attendant funding obligations. Any future contributions to our underfunded defined benefit pension plan could reduce our liquidity, restrict available cash for our operating, financing, and investing needs and may materially adversely affect our financial condition and our ability to deploy capital to other opportunities. Any decision to terminate the plan and settle the defined-benefit pension obligation would result in a non-cash charge within the Consolidated Statements of Operations related to unrecognized actuarial losses in accumulated other comprehensive income, which totals $167.2 million as of December 31, 2025.
Previous wording
We are party to a credit facility, effective as of November 5, 2021, with Bank of America, N.A., Wells Fargo Bank, N.A., Truist Bank, and the other lenders a party thereto, (the "Credit Facility"). The Credit Facility consists of a $450 million revolving credit facility, with a letter of credit sub-commitment of $125 million. The available borrowing capacity under the Credit Facility totaled $219.4 million on December 31, 2024. The Credit Facility contains various representations, warranties and covenants, including covenants limiting liens, indebtedness, guarantees, mergers and consolidations, substantial asset sales, investments and loans, sale and leasebacks, restrictions on dividends and distributions, and other fundamental changes in our business. Additionally, the Credit Facility contains covenants requiring us to remain in compliance with a maximum leverage ratio and a minimum interest coverage ratio.
Current wording
We are party to a credit facility, effective as of December 2, 2025, with Bank of America, N.A., Wells Fargo Bank, N.A., Truist Bank, and the other lenders a party thereto, (the "Credit Facility"). The Credit Facility consists of a $500 million revolving credit facility, with a letter of credit sub-commitment of $125 million. The available borrowing capacity under the Credit Facility totaled $290.7 million on December 31, 2025. The Credit Facility contains various representations, warranties and covenants, including covenants limiting liens, indebtedness, guarantees, mergers and consolidations, substantial asset sales, investments and loans, sale and leasebacks, restrictions on dividends and distributions, and other fundamental changes in our business. Additionally, the Credit Facility contains covenants requiring us to remain in compliance with maximum leverage ratio and a minimum interest coverage ratio.
Previous wording
In recent periods we have incurred impairment charges that reduced the carrying value of our intangible assets and goodwill; in the future we may be required to incur additional impairment charges on a portion of or all of the carrying value of our intangible assets and goodwill, which may adversely affect our financial condition and results of operations.
Current wording
In prior periods we have incurred impairment charges that reduced the carrying value of our intangible assets and goodwill; in the future we may be required to incur additional impairment charges on a portion of or all of the carrying value of our intangible assets and goodwill, which may adversely affect our financial condition and results of operations.