VISA INC.

Previous wording

As a global payments technology company, we are subject to complex and evolving regulations that govern our operations. Such regulations may increase in quantity, complexity and scope in response to heightened geopolitical tensions. See Item 1—Government Regulation for more information on the most significant areas of regulation that affect our business. The impact of these regulations on us, our clients, and other third parties could limit our ability to enforce our payments system rules; require us to adopt new rules or change existing rules; affect our existing contractual arrangements; and increase our compliance costs. As discussed in more detail below, we may face differing rules and regulations in matters like interchange reimbursement rates, preferred routing, domestic processing and localization requirements, currency conversion, point-of-sale transaction rules and practices, privacy, data use and protection, licensing requirements and associated product technology. As a result, the Visa operating rules and our other contractual commitments may differ from country to country, state to state, or product to product. Complying with these and other regulations increases our costs and operational complexity, and reduces our revenue opportunities.

Current wording

As a global payments technology company, we are subject to complex and evolving regulations governing our operations, including, but not limited to, authorization, clearing and settlement activities. Such regulations may increase in quantity, complexity and scope in response to, among other things, changes in the competitive landscape, emergence of new technologies and geopolitical developments. See Item 1—Government Regulation of this report for more information on the most significant areas of regulation affecting our business. These regulations, and their impact on us, our clients, and other third parties could limit our ability to enforce our payments system rules; require us to adopt new or modified rules; affect existing contractual arrangements; require us to maintain additional capital or financial resources; increase the complexity and cost of our operations or compliance; and adversely affect our financial condition.

Previous wording

If widely varying regulations come into existence worldwide, we may have difficulty rapidly adjusting our products, services, fees and other important aspects of our business to comply with the regulations. Our compliance programs and policies are designed to support our compliance with a wide array of regulations and laws, such as regulations regarding anti-money laundering, anti-corruption, competition, money transfer services, privacy and sanctions, and we continually adjust our compliance programs as regulations evolve. However, we cannot guarantee that our practices will be deemed compliant by all applicable regulatory authorities. In the event our controls should fail or we are found to be out of compliance for other reasons, we could be subject to monetary damages, civil and criminal penalties, litigation, investigations and proceedings, and damage to our global brands and reputation.

Current wording

If widely varying regulations emerge worldwide, we may have difficulty rapidly adjusting our products, services, fees and other important aspects of our business to comply with regulatory requirements, including those related to anti-money laundering, anti-corruption, competition, money transfer services, privacy, cybersecurity, and trade and economic sanctions. Increasing fragmentation of regulatory requirements in these and other areas may further increase the complexity and cost of compliance and require us to make jurisdiction-specific changes to our products, services and business practices. We cannot guarantee that our practices will be deemed compliant by all applicable regulatory authorities. In the event our controls should fail or we are found to be out of compliance, we could be subject to monetary damages, civil and criminal penalties, litigation, investigations and proceedings and damage to our global brands and reputation.

Previous wording

Increased scrutiny and regulation of the global payments industry, including with respect to interchange reimbursement fees, merchant discount rates, operating rules, risk management protocols and other related practices, could harm our business.

Current wording

Increased scrutiny and regulation of fees, operating rules and related practices of the global payments industry, could harm our business.

Previous wording

Government-imposed obligations and/or restrictions on international payments systems may prevent us from competing against providers in certain countries, including significant markets such as China and India.

Current wording

Government-imposed obligations and/or restrictions on international payments systems may prevent us from competing against providers in certain markets.

Previous wording

In particular, the adoption of agentic commerce, in which autonomous AI agents initiate and execute transactions on behalf of users, presents novel and complex regulatory, privacy and cybersecurity risks. Legal frameworks governing such autonomous agents remain nascent, with limited direct guidance specific to payments. The interplay between payments regulations, data privacy laws and evolving AI regulations may create uncertainty around compliance obligations and potential liability exposure as more participants (including sellers, fintechs, AI developers and enablers) enter the agentic commerce ecosystem. The market is still assessing how regulators may apply existing consumer protection and other laws in the context of AI. For example, as agentic commerce solutions scale, we may see increased instances of erroneous or disputed payments, increased chargebacks and reputational harm. Furthermore, reliance on agentic AI introduces challenges in monitoring cross-border, prohibited or high-risk transactions, where conflicting regulatory requirements may apply. The fragmented regulatory landscape for emerging technologies such as AI and inconsistent requirements across legal frameworks may amplify difficulties in identifying, preventing or mitigating risk with a single global approach, potentially increasing our compliance costs or stratifying our ability to leverage certain data or technologies for innovation. For instance, the EU has adopted a comprehensive AI Act that establishes harmonized rules across Europe, with key provisions for high-risk AI systems taking effect in August 2026. Meanwhile, several U.S. states, including California, Colorado and Utah, have adopted AI-specific frameworks or are considering applying existing consumer and data protection laws to regulate AI. Depending on how these different regulations are interpreted and enforced, they may limit the ability to develop and deploy AI systems or significantly increase associated compliance costs. Our development and implementation of governance frameworks aimed at complying with emerging laws and regulations applicable to our AI and machine learning systems may not be successful in mitigating all of these emerging risks.

Current wording

The emergence of agentic commerce, in which autonomous AI agents initiate and execute transactions on behalf of users, presents novel regulatory, privacy, cybersecurity and fraud risks. Legal frameworks governing autonomous agents remain nascent, and the interplay between payments regulations, data privacy laws and evolving AI rules creates uncertainty around compliance obligations and liability exposure. As agentic commerce scales, there could be increased instances of unauthorized, erroneous or disputed payments, or fraud. Agentic commerce may also introduce challenges in monitoring cross-border, prohibited or high-risk transactions subject to conflicting regulatory requirements.

Previous wording

The application of tax laws requires significant judgment and can be subject to uncertainty and differing interpretations. We are currently under examination by, or in disputes with, the U.S. Internal Revenue Service as well as tax authorities in other jurisdictions, and we may be subject to additional examinations or disputes in the future. We exercise significant judgment and make estimates that we believe to be reasonable in calculating our worldwide provision for income taxes and other tax liabilities. However, relevant tax authorities may disagree with our estimates, interpretations or tax treatment of certain material items. Failure to sustain our position in these matters could adversely affect our cash flows and financial position. In addition, changes in existing laws in the U.S. or foreign jurisdictions, including unilateral actions of foreign jurisdictions to introduce digital services taxes, or changes resulting from the Organization for Economic Cooperation and Development’s proposals for the international tax system, including the introduction of a global minimum tax with widespread implementation by member countries, may also materially affect our effective tax rate and could increase our tax payments. Please see Item 7 and Note 19—Income Taxes to our consolidated financial statements included in Item 8 of this report.

Current wording

We exercise significant judgment in the application of tax laws, which can be subject to uncertainty and differing interpretations, and make estimates that we believe to be reasonable in calculating our worldwide provision for income taxes and other tax liabilities. Relevant tax authorities may disagree with our estimates, interpretations or tax treatment of certain material items. We are currently under examination by, or in disputes with, the U.S. Internal Revenue Service as well as tax authorities and governments in various other jurisdictions, and we may be subject to additional examinations, disputes or assessments in the future, including those involving the availability of deductions or credits, transfer pricing, permanent establishment assertions, or indirect and other non-income taxes. An adverse outcome in any of these matters could adversely affect our cash flows and financial position. As we expand our business operations, we may be subject to new or additional tax reporting and compliance requirements, which could increase tax uncertainty and operational costs.

Previous wording

We are subject to numerous litigation matters, investigations, claims, examinations, information gathering requests, subpoenas, government and regulatory proceedings asserted by civil litigants, governments and enforcement bodies investigating or alleging, among other things, violations of competition and antitrust law, consumer protection law, privacy law and intellectual property law (these are referred to as “actions” in this section). Details of the most significant actions we face are described more fully in Note 20—Legal Matters to our consolidated financial statements included in Item 8 of this report. These actions are inherently uncertain, expensive and disruptive to our operations. In the event we are found liable or reach a settlement in any action, particularly in a large class action lawsuit, such as one involving an antitrust claim entitling the plaintiff to treble damages in the U.S., or we incur liability arising from a government investigation, we may be required to pay significant awards or judgments, settlements, costs or fines. In addition, settlement terms, judgments, orders, pressures or events in or resulting from actions have impacted and may continue to impact our business by creating uncertainty for our business or by influencing or requiring us to modify, among other things, the default interchange reimbursement rates we set, the Visa operating rules or the way in which we enforce those rules, our fees or pricing, or the way we do business. These actions or their outcomes may also influence regulators, investigators, governments or civil litigants in the same or other jurisdictions, which may lead to additional actions against Visa. Finally, we are required by some of our commercial agreements to indemnify other entities for litigation brought against them, even if Visa is not a defendant. For certain actions like those that are U.S. covered litigation or VE territory covered litigation, as described in Note 5—U.S. and Europe Retrospective Responsibility Plans and Note 20—Legal Matters to our consolidated financial statements included in Item 8 of this report, we have certain financial protections pursuant to the respective retrospective responsibility plans. The two retrospective responsibility plans are different in the protections they provide and the mechanisms by which we are protected. The failure of one or both of the retrospective responsibility plans to adequately insulate us from the impact of such settlements, judgments, losses or liabilities could materially harm our financial condition or cash flows, or even cause us to become insolvent.

Current wording

We are subject to numerous litigation matters, investigations, claims, examinations, information gathering requests, subpoenas, government and regulatory proceedings asserted by civil litigants, as well as governments and enforcement bodies investigating or alleging, among other things, violations of competition and antitrust law, consumer protection law, privacy law and intellectual property law (these are referred to as “actions” in this section). Details of the most significant actions we face are described more fully in Note 20—Legal Matters to our consolidated financial statements included in Item 8 of this report. Regardless of the merit of particular claims, defending against litigation or responding to government investigations can be inherently uncertain, expensive and disruptive to our operations. In the event we are found liable or reach a settlement in any action, particularly in a large class action lawsuit, such as one involving an antitrust claim entitling the plaintiff to treble damages in the U.S., or we incur liability arising from a government investigation, we may be required to pay significant awards or judgments, settlements, costs or fines. In addition, settlement terms, judgments, orders, pressures or events in or resulting from actions have impacted and may continue to impact our business by creating uncertainty for our business or by influencing or requiring us to modify, among other things, the default IRFs we set, the Visa operating rules or the way in which we enforce those rules, our fees or pricing, or the way we do business. These actions or their outcomes may also influence regulators, investigators, governments or civil litigants in the same or other jurisdictions, which may lead to additional actions against Visa. Finally, we are required by some of our commercial agreements to indemnify other entities for litigation brought against them, even if Visa is not a defendant. For certain actions like those that are U.S. covered litigation or VE territory covered litigation, as described in Note 5—U.S. and Europe Retrospective Responsibility Plans and Note 20—Legal Matters to our consolidated financial statements included in Item 8 of this report, we have certain financial protections pursuant to the respective retrospective responsibility plans. The two retrospective responsibility plans are different in the protections they provide and the mechanisms by which we are protected. The failure of one or both of the retrospective responsibility plans to adequately insulate us from the impact of such settlements, judgments, losses or liabilities could materially harm our financial condition or cash flows, or even cause us to become insolvent.

Previous wording

Our financial institution clients and sellers can reassess their commitments to us at any time or develop their own competitive services. While we have certain contractual protections, our clients, including some of our largest clients, generally have flexibility to issue non-Visa products. In certain circumstances, our financial institution clients may decide to terminate our contractual relationship on relatively short notice without paying significant early termination fees. Because a significant portion of our net revenue is concentrated among our largest clients, the loss of business from any one of these larger clients could harm our business, results of operations and financial condition. For more information, please see Note 14—Segment Information to our consolidated financial statements included in Item 8 of this report. It may also be difficult or costly for us to acquire or conduct business with financial institutions or sellers that have longstanding exclusive, or nearly exclusive, relationships with our competitors. These financial institutions or sellers may be more successful and may grow more quickly than our existing clients or sellers. If there is a consolidation or acquisition of one or more of our largest clients or co-brand partners by a financial institution client or seller with a strong relationship with one of our competitors, it could result in our business shifting to a competitor, which could put us at a competitive disadvantage and harm our business.

Current wording

Our financial institution clients and sellers can reassess their commitments to us at any time or develop their own competing products and services. While we have certain contractual protections, our clients, including some of our largest clients, generally have flexibility to issue non-Visa products. In certain circumstances, our financial institution clients may terminate our contractual relationship on relatively short notice without paying significant early termination fees. Because a significant portion of our net revenue is concentrated among our largest clients, the loss of business from any one of them could materially harm our business, results of operations and financial condition. For more information, please see Note 14—Segment Information to our consolidated financial statements included in Item 8 of this report. It may also be difficult or costly for us to acquire or conduct business with financial institutions or sellers that have longstanding exclusive, or nearly exclusive, relationships with our competitors. These financial institutions or sellers may be more successful and may grow more quickly than our existing clients or sellers. If there is a consolidation or acquisition of one or more of our largest clients or co-brand partners by a financial institution client or seller with a strong relationship with one of our competitors, it could result in our business shifting to a competitor or less favorable pricing or terms, which could put us at a competitive disadvantage and harm our business.

Previous wording

In addition, we face intense competitive pressure on the prices we charge our financial institution clients. In certain regions, we are increasingly facing competition from RTP networks, other payment facilitators offering lower pricing, and government involvement in domestic and cross-border payments. In order to stay competitive, we may need to adjust our pricing or offer incentives to our clients to grow payments volume, enter new market segments, adapt to regulatory changes, and expand their use and acceptance of Visa products and services. These include up-front cash payments, fee discounts, rebates, credits, performance-based incentives, marketing and other support payments that impact our net revenue and profitability. In addition, we offer incentives to certain sellers and acquirers to encourage them to route transactions to Visa. Pressures on pricing, incentives, fee discounts and rebates could moderate our growth. If we are not able to implement cost containment and productivity initiatives in other areas of our business or grow our volume in other ways to offset or absorb the financial impact of these incentives, fee discounts and rebates, it may harm our net revenue and profits.

Current wording

We also face intense competitive pressure on the prices we charge our financial institution clients. In certain regions, we increasingly compete with RTP networks, other payment facilitators offering lower pricing, and government-sponsored domestic and cross-border payment initiatives. To remain competitive, we may need to adjust our pricing or offer incentives to our clients to maintain or grow payments volume, enter new market segments, adapt to regulatory changes, and expand their use and acceptance of Visa products and services. These include up-front cash payments, fee discounts, rebates, performance-based incentives, marketing and other support payments, all of which impact our net revenue and profitability. We may also offer incentives to certain sellers and acquirers to encourage them to route transactions to Visa. Continued pressures on pricing, incentives, fee discounts and rebates could moderate our growth. If we are unable to implement cost containment and productivity initiatives or grow volume in other areas to offset or absorb the financial impact of these incentives, it may adversely affect our net revenue and profits.

Previous wording

We rely in part on sellers and their relationships with our clients or their agents to maintain and expand the use and acceptance of Visa products. Certain sellers and seller-affiliated groups have been exerting their influence in the global payments system in certain jurisdictions, such as the U.S., Australia, Canada and Europe, to attempt to lower acceptance costs paid by sellers to acquirers or their agents to accept payment products or services, by lobbying for new legislation, seeking regulatory intervention, filing lawsuits and in some cases, surcharging or refusing to accept Visa products. If they are successful in their efforts, we may face increased compliance and litigation expenses, issuers may decrease their issuance of our products, and consumer usage of our products could be adversely impacted. For example, in the U.S., certain stakeholders have raised concerns regarding how payment security standards and rules may impact debit routing choice and the cost of payment card acceptance. U.S. seller-affiliated groups and processors have expressed concerns regarding the EMV certification process and the roles of industry bodies such as EMVCo and the Payment Card Industry Security Standards Council in the development of payment card standards. Moreover, many sellers have advocated for lower acceptance costs in the form of reduced interchange rates, which could result in some issuers eliminating or reducing their promotion or use of Visa’s products and services, eliminating or reducing cardholder benefits such as rewards programs, or charging account holders increased or new fees for using Visa-branded products, all of which could negatively impact Visa’s payments volume and related revenue. Finally, some sellers and processors have advocated for changes to industry practices and Visa acceptance requirements at the point of sale, including the ability for sellers to accept only certain types of Visa products, to mandate only PIN authenticated transactions, to differentiate or steer among Visa product types issued by different financial institutions, and to impose surcharges on consumers presenting Visa products as their form of payment. A number of the issues flagged in this risk factor are subject to pending litigation. For more information, please see Note 20—Legal Matters to our consolidated financial statements included in Item 8 of this report. If successful, these efforts could adversely impact consumers’ usage of our products and decrease our overall payments volume and net revenue, lead to regulatory enforcement and/or litigation that increases our compliance and litigation expenses, and ultimately harm our business.

Current wording

We rely in part on sellers and their relationships with our clients or their agents to maintain and expand the use and acceptance of Visa products. In certain jurisdictions, including the U.S., Australia, Canada and Europe, sellers and seller-affiliated groups have exerted significant influence in the global payments system to lower acceptance costs paid by sellers to acquirers or their agents to accept payment products or services by lobbying for new legislation, seeking regulatory intervention, filing lawsuits and in some cases, surcharging or refusing to accept Visa products. If these efforts succeed, we may face increased compliance and litigation expenses, issuers may decrease their issuance of our products, and consumer usage of our products could be adversely impacted. For example, in the U.S., certain stakeholders have raised concerns regarding how payment security standards and rules may impact debit routing choice and the cost of payment card acceptance. Seller-affiliated groups and processors have also expressed concerns regarding the Europay, Mastercard and Visa (EMV) certification process and the roles of industry bodies such as EMVCo and the Payment Card Industry Security Standards Council in developing payment card standards. Moreover, many sellers have advocated for lower acceptance costs in the form of reduced interchange rates, which could lead some issuers to eliminate or reduce their promotion or use of Visa’s products and services, eliminate or reduce cardholder benefits such as rewards programs, or impose increased or new fees on account holders, all of which could negatively impact our payments volume and related revenue. In addition, some sellers and processors have advocated for changes to industry practices and Visa acceptance requirements at the point of sale, including the ability for sellers to accept only certain types of Visa products, to mandate only PIN authenticated transactions, to differentiate or steer among Visa product types issued by different financial institutions, and to impose surcharges on consumers presenting Visa products as their form of payment. A number of the issues flagged in this risk factor are subject to pending litigation. For more information, please see Note 20—Legal Matters to our consolidated financial statements included in Item 8 of this report. If successful, these efforts could adversely impact consumer usage of our products, decrease our overall payments volume and net revenue, lead to regulatory enforcement and/or litigation that increases our compliance and litigation expenses, and ultimately harm our business.

Previous wording

Our relationships with industry participants are complex and require us to balance the interests of multiple third parties. For instance, we depend significantly on relationships with our financial institution clients and on their relationships with account holders and sellers to provide our products and services, and thereby compete effectively in the marketplace. We offer incentives to sellers, acquirers, ecommerce platforms and processors to encourage routing preference and acceptance growth. We also engage in many payment card co-branding efforts with sellers, who receive incentives from us. As emerging participants such as fintechs enter the payments industry, we engage in discussions to address the role they may play in the ecosystem, whether as, for example, an issuer, seller, ecommerce platform or digital wallet provider. As these and other relationships become more prevalent and take on a greater importance to our business, our success will increasingly depend on our ability to sustain and grow these relationships. In addition, we depend on our clients and third parties, including network partners, vendors and suppliers, to submit, facilitate and process transactions properly, provide various services associated with our payments network on our behalf, and otherwise adhere to our operating rules and applicable laws. As our clients expand their global footprint, their legal and regulatory obligations can become even more complex. From time to time, our relationships may be affected by actions of our clients and industry participants that may materially and adversely impact our business, products or services, and to the extent we or such parties fail to perform or deliver adequate services or comply with regulatory obligations, it may result in negative experiences for account holders or others when using their Visa-branded payment products, which could harm our business and reputation.

Current wording

Our relationships with industry participants are complex and require us to balance the interests of multiple third parties. We depend significantly on relationships with our financial institution clients and on their relationships with account holders and sellers to provide our products and services, and compete effectively in the marketplace. We offer incentives to sellers, acquirers, ecommerce platforms and processors to encourage routing preference and acceptance growth, and we engage in payment card co-branding efforts with sellers who receive incentives from us. As emerging participants such as fintechs enter the payments industry, we engage with them to address the roles they may play in the ecosystem, whether as issuers, sellers, ecommerce platforms or digital wallet providers. As these and other relationships become more prevalent and take on greater importance to our business, our success will increasingly depend on our ability to sustain and grow these relationships. We also depend on our clients and third parties, including network partners, vendors and suppliers, to submit, facilitate and process transactions properly, provide various services associated with our payments network on our behalf, and adhere to our operating rules and applicable laws. As our clients expand their global footprint, their legal and regulatory obligations can become increasingly complex. From time to time, actions of our clients and industry participants may materially and adversely impact our business, products or services. To the extent we or such parties fail to perform or deliver adequately or comply with regulatory obligations, it may result in negative experiences for account holders or others using their Visa-branded payment products, which could harm our business and reputation.

Previous wording

Our brand is globally recognized and is a key asset of our business. We believe that our clients and their account holders associate our brand with acceptance, security, convenience, speed and reliability. Our success depends in large part on our ability to maintain the value of our brand and reputation of our products and services in the payments ecosystem, elevate the brand through new and existing products, services and partnerships, and uphold our corporate reputation. The popularity of products that we have developed in partnership with technology companies and financial institutions as well as government actions that mandate other networks to process Visa-branded card transactions may have the potential to cause brand disintermediation at the point of sale, in ecommerce and mobile channels, and decrease the presence of our brand. Our brand reputation may also be negatively impacted by a number of factors, including authorization, clearing and settlement service disruptions; data security breaches; compliance failures by Visa, including by our employees, agents, clients, partners or suppliers; failure to meet expectations of our clients, consumers or other stakeholders; negative perception of our industry, the industries of our clients, Visa-accepting sellers, or our clients’ customers and agents, including third-party payments providers; ill-perceived actions or affiliations by clients, partners or other third parties, such as sponsorship or co-brand partners; and fraudulent, or illegal activities using our payment products or services, and which we may not always be in a position to detect and/or prevent from occurring over our network. Our brand could also be negatively impacted when our products are used to facilitate payment for legal, but controversial, products and services, including adult content, firearms and gambling activities. Additionally, these risks could be exacerbated if our financial institution partners and/or sellers fail to maintain necessary controls to ensure the legality of these transactions, if any legal liability associated with such goods or services is extended to ancillary participants in the value chain like payments networks, or if our network and industry become entangled in political or social debates concerning such legal, but controversial, commerce. If we are unable to maintain our reputation, the value of our brand may be impaired, which could harm our relationships with clients, account holders, employees, prospective employees, governments and the public, as well as impact our business.

Current wording

Our brand is globally recognized and is a key asset of our business. We believe that our clients and their account holders associate our brand with acceptance, security, convenience, speed, reliability and trust. Our success depends in large part on our ability to maintain and enhance the value of our brand, uphold the reputation of our products and services in the payments ecosystem, and elevate our brand through new and existing products, services and partnerships. The popularity of products we have developed in partnership with technology companies and financial institutions as well as government actions that mandate other networks to process Visa-branded card transactions, may cause brand disintermediation at the point of sale, in ecommerce and mobile channels, and decrease the presence and visibility of our brand. Our brand and reputation may also be negatively impacted by a number of factors, including authorization, clearing and settlement service disruptions; data security breaches; compliance failures by Visa or by our employees, agents, clients, partners or suppliers; failure to meet expectations of our clients, consumers or other stakeholders; negative perception of our industry, the industries of our clients, Visa-accepting sellers, or our clients’ customers and agents, including third-party payments providers; ill-perceived actions or affiliations by clients, partners or other third parties, such as sponsorship or co-brand partners; and fraudulent, or illegal activities using our payment products or services, and which we may not always be in a position to detect and/or prevent from occurring over our network. Our brand could also be negatively impacted when our products are used to facilitate payment for legal, but controversial, products and services, including adult content, firearms and gambling activities. Negative developments in these or other high-risk merchant categories may, by association, harm our reputation or result in greater public, regulatory, or legislative scrutiny, as well as litigation. The actions we or our customers take related to these industries could be viewed negatively and result in retaliatory actions. Additionally, these risks could be exacerbated if our financial institution partners and/or sellers fail to maintain necessary controls to ensure the legality of these transactions, if any legal liability associated with such goods or services is extended to ancillary participants in the value chain like payments networks, or if our network and industry become entangled in political or social debates concerning such legally permissible, but controversial, commerce. If we are unable to maintain our reputation, the value of our brand may be impaired, which could harm our relationships with clients, sellers, account holders, employees, prospective employees, governments and the public, and materially affect our business.

Previous wording

More than half of our net revenue is earned outside the U.S. In addition, international cross-border transaction revenue represents a significant part of our net revenue and is an important part of our growth strategy. Our net revenue is dependent on the volume and number of payment transactions made by consumers, governments, and businesses whose spending patterns may be affected by economic, political, market, health and social events or conditions. Adverse macroeconomic conditions within the U.S. or internationally, including but not limited to recessions, inflation, rising interest rates, increase in tariff rates, high unemployment, currency fluctuations, actual or anticipated large-scale defaults or failures, rising energy prices, a slowdown or disruption of global trade, trade retaliation, government shutdowns, and reduced consumer, small business, government, and corporate spending, have a direct impact on international commerce. Our business depends on the smooth functioning of international financial systems and the free flow of commerce across borders. Any restrictions on the activities of multinational businesses, disruptions to global trade, or deterioration in international relations could materially and adversely affect our payments volume, transactions, client relationships, and net revenue. Any events or conditions that impair the functioning of the financial markets, tighten the credit market, or lead to a downgrade of our current credit rating could increase our future borrowing costs and impair our ability to access the capital and credit markets on favorable terms, which could affect our liquidity and capital resources, or significantly increase our cost of capital. Furthermore, in efforts to deal with adverse macroeconomic conditions, governments may introduce new or additional initiatives or requests to reduce or eliminate payment fees or other costs. In an overall soft global economy, such pricing measures could result in additional financial pressures on our business.

Current wording

More than half of our net revenue is earned outside the U.S., and international cross-border transaction revenue represents a significant part of our net revenue and growth strategy. Our net revenue is dependent on the volume and number of payment transactions made by consumers, governments and businesses whose spending patterns may be affected by economic, political, market, health and social events or conditions. Adverse macroeconomic conditions within the U.S. or internationally, including but not limited to recessions, inflation, rising interest rates, increased tariff rates, high unemployment, currency fluctuations, actual or anticipated large-scale defaults or failures, rising energy prices, slowdowns or disruptions in global trade, trade retaliation, government shutdowns, and reduced consumer, small business, government and corporate spending, have a direct impact on international commerce. Our business depends on the smooth functioning of international financial systems and the free flow of cross-border commerce. Restrictions on multinational business activities, disruptions to global trade or deterioration in international relations could materially and adversely affect our payments volume, transactions, client relationships and net revenue. Events or conditions that impair the functioning of the financial markets, tighten credit markets or lead to a downgrade of our credit rating could increase our borrowing costs and impair our ability to access the capital and credit markets on favorable terms, which could adversely affect our liquidity, capital resources or cost of capital. In addition, governments responding to adverse macroeconomic conditions may introduce initiatives or requirements to reduce or eliminate payment fees or other costs, which could create additional financial pressures on our business.

Previous wording

Geopolitical trends towards nationalism, protectionism and restrictive visa requirements, as well as continued activity and uncertainty around economic sanctions, tariffs or trade restrictions, including restrictions on the cross-border flow of data, the potential or threat of retaliatory international and domestic policies and actions, changing perceptions of U.S.-based companies in the regions where we operate or plan to operate, could impact the expansion of our business in certain regions and have resulted in us suspending our operations in other regions. In March 2022, we suspended our operations in Russia due to economic sanctions imposed on Russia, impacting Visa and its clients. As a result, we are no longer generating revenue from domestic and cross-border activities related to Russia. The war in Ukraine and the ongoing instability in the Middle East, and any resulting conflicts in the region, could have lasting impacts on the region and its economies, which could adversely affect our business. Changes in geopolitical conditions also increase the security risks described elsewhere in these risk factors.

Current wording

Geopolitical trends towards nationalism, protectionism and restrictive visa requirements, as well as continued activity and uncertainty around economic sanctions, tariffs and trade restrictions, including restrictions on the cross- border flow of data, the potential for retaliatory domestic and international policies, have added uncertainty regarding new laws and regulations or changes in the interpretation or enforcement of existing ones, and have increased the risk of regulatory fragmentation. Changing perceptions of U.S.-based companies in markets where we operate or plan to operate compound these risks. These trends could impede the expansion of our business in certain regions and have resulted in our suspension of operations in other regions. In March 2022, we suspended our operations in Russia in response to economic sanctions, and we no longer generate revenue from domestic or cross-border activities related to Russia. The war in Ukraine and the ongoing instability in the Middle East, including any resulting regional conflicts, could have lasting impacts on the region, its economies, and our business. Changes in geopolitical conditions also heighten the security risks described elsewhere in these risk factors.

Previous wording

In addition, outbreaks of illnesses, pandemics like COVID-19, or other local or global health issues, political uncertainties, international hostilities, armed conflicts, wars, civil unrest, climate-related events, including the increasing frequency of extreme weather events, impacts on or failures of the power grid, and natural disasters have to varying degrees negatively impacted our operations, clients, third-party suppliers, activities, and cross-border travel and spend. Any decline in cross-border travel and spend would impact our cross-border volume, the number of cross-border transactions we process and our currency exchange activities, which in turn would reduce our international transaction revenue. These events or conditions could impact our clients as well, and their decisions could reduce the number of cards, accounts, and credit lines of their account holders, and impact overall consumption by consumers and businesses, which would ultimately impact our net revenue. In addition, our clients may implement cost-reduction initiatives that reduce or eliminate marketing budgets, and decrease spending on our value-added services.

Current wording

Outbreaks of illnesses, pandemics or other local or global health emergencies, political instability, international hostilities, armed conflicts, wars, civil unrest, climate-related events, including the increasing frequency of extreme weather events, impacts on or failures of the power grid, and natural disasters have, to varying degrees, negatively impacted our operations, clients, third-party suppliers, activities, and cross-border travel and spend. Any decline in cross-border travel and spend would reduce our cross-border volume, the number of cross-border transactions we process and our currency exchange activities, which in turn would reduce our international transaction revenue. These events or conditions could also impact our clients, whose decisions could reduce the number of cards, accounts and credit lines available to their account holders, and impact overall consumption by consumers and businesses, which would ultimately reduce our net revenue. Our clients may also implement cost-reduction measures that reduce or eliminate marketing budgets, and decrease spending on our value-added services.

Previous wording

Our ability to adjust to evolving corporate responsibility and sustainability (CRS) matters and related regulations could adversely affect our business and financial results or negatively impact our reputation.

Current wording

Our ability to adjust to evolving corporate responsibility and sustainability matters and related regulations could adversely affect our business and financial results or negatively impact our reputation.

Previous wording

We are subject to dynamic, and sometimes conflicting laws, regulations and other directives that govern a wide array of issues, including some that extend beyond our core products and services. This includes, but is not limited to, matters that touch upon sustainability, climate change, people and talent management, equal opportunity and inclusion, supply chain management and human rights. A wide range of stakeholders, including governments, NGOs, consumers, partners, employees and investors, are increasingly attentive to these corporate responsibility matters and are developing expectations which at times may be discordant with each other and with Visa’s existing strategies and disclosure practices. For example, certain regulators have proposed or adopted, or plan to propose or adopt, rules or standards related to these matters that would apply to our business, including the EU’s Corporate Sustainability Reporting Directive and Corporate Sustainability Due Diligence Directive and the State of California’s legislation requiring broad disclosure of greenhouse gas emissions and other climate-related information.

Current wording

We are subject to dynamic and at times, conflicting laws, regulations and other directives that govern a broad range of issues extending beyond our core products and services, including sustainability, climate change, people and talent management, equal opportunity and inclusion, supply chain management and human rights. For example, certain regulators have proposed, adopted or plan to adopt rules or standards that may be or may become applicable to our business, including the EU’s Corporate Sustainability Reporting Directive and Corporate Sustainability Due Diligence Directive and the State of California’s legislation requiring broad disclosure of greenhouse gas emissions and other climate-related information. As governments worldwide continue to adopt CRS-related laws and regulations, we may face additional or more stringent requirements.

Previous wording

Our ability to achieve, or make sufficient progress towards any of our CRS objectives is subject to numerous risks, many of which are outside of our control, including the evolving legal environment and regulatory requirements for the tracking and reporting of CRS standards or disclosures and the actions of suppliers, partners, and other third parties. Accordingly, our goals may evolve from time to time, implementation of these goals may require considerable investments, and ultimately, we cannot guarantee our ability to achieve or to make sufficient progress toward, any or all of our publicly stated goals. From time to time, we may restate previously reported data to reflect updated methodologies for reporting our CRS data, an improvement in the availability and quality of data, changing assumptions, changes in the nature and scope of our operations, or other changes in circumstances. This may result in a lack of consistent or meaningful comparative data from period to period or between us and other companies in the same industry. Furthermore, where new laws or regulations are more stringent than current legal or regulatory requirements, we may experience increased compliance burdens and costs to meet such obligations. Because our stakeholders often hold differing views on our CRS-related goals and initiatives and we face conflicting directives from U.S. and international regulatory authorities, any failure, or perceived failure, to meet these evolving and varied stakeholder expectations and standards may result in negative attention in the media, reputational impacts, including an inaccurate perception or misrepresentation of our actual CRS practices, diversion of management’s attention and resources, and proxy fights, among other material adverse impacts on our business. Additionally, the goals or initiatives themselves could potentially subject us to litigation or investigations initiated by government authorities or private actors alleging that our activities related to CRS are anti-competitive, discriminatory or otherwise unlawful.

Current wording

Our ability to achieve, or make sufficient progress toward, any of our CRS objectives is subject to numerous risks, many of which are outside of our control, including the evolving legal and regulatory landscape for CRS tracking, reporting and disclosure as well as the actions of suppliers, partners and other third parties. Accordingly, our goals may evolve over time, their implementation may require considerable investment, and we cannot guarantee our ability to achieve, or make sufficient progress toward, any or all of our publicly stated goals. From time to time, we may restate previously reported data to reflect updated methodologies, improvements in data availability and quality, changing assumptions, changes in the nature and scope of our operations, or other changes in circumstances, which may limit the consistency or comparability of our data across periods or relative to industry peers.

Previous wording

Our indemnification obligation to fund settlement losses of our clients exposes us to significant risk of loss and may reduce our liquidity.

Current wording

Our indemnification obligation to fund settlement losses of our clients, and in some cases other third parties, exposes us to significant risk of loss and may adversely impact our liquidity.

Previous wording

We indemnify issuers and acquirers for settlement losses they may suffer due to the failure of another issuer or acquirer to honor its settlement obligations in accordance with the Visa operating rules. This indemnification creates settlement risk for us due to the timing difference between the date of a payment transaction and the date of subsequent settlement. Our indemnification exposure is generally limited to the amount of unsettled Visa card payment transactions at any point in time and any subsequent amounts that may fall due to adjustments for previously processed transactions. In addition, changes in the credit standing of our clients or concurrent settlement failures or insolvencies involving more than one of our largest clients, several of our smaller clients, significant sponsor banks through which non-financial institutions participate in the Visa network, or systemic operational failures could expose us to liquidity risk, and negatively impact our financial position. In certain instances, we may indemnify issuers or acquirers in situations in which a transaction is not processed by our system. Even if we have sufficient liquidity to cover a settlement failure or insolvency, we may be unable to recover the amount of such payment. This could expose us to significant losses and harm our business. See Note 12—Settlement Guarantee Management to our consolidated financial statements included in Item 8 of this report.

Current wording

We indemnify issuers and acquirers for settlement losses they may suffer due to the failure of another issuer or acquirer to honor its settlement obligations in accordance with the Visa operating rules. This indemnification creates settlement risk for us due to the difference in timing between the payment transaction date and subsequent settlement date. Our indemnification exposure is generally limited to the amount of unsettled Visa card payment transactions at any point in time and any subsequent amounts arising from adjustments to previously processed transactions. In addition, changes in the credit standing of our clients, concurrent settlement failures or insolvencies involving more than one of our largest clients or several smaller clients, or significant sponsor banks through which non-financial institutions participate in the Visa network, or systemic operational failures could expose us to liquidity risk, and negatively impact our financial position. In certain instances, we may indemnify issuers or acquirers in situations in which a transaction is not processed by our system. In addition, the Central Bank of Brazil has adopted regulations applicable to payment networks like Visa that impose enhanced prudential requirements, including requirements that would obligate Visa to absorb certain settlement related losses for certain transactions involving sellers in Brazil when settlement failures occur and our risk mitigation measures do not fully protect against the resulting exposure. The evolving regulatory landscape and new regulatory framework create additional risk, uncertainty and operational challenges for Visa. In response to these regulations, we have submitted to the Central Bank of Brazil enhanced operating rule provisions, which, when approved, are expected to increase our settlement exposure and related collateral requirements. Even if we have sufficient liquidity to cover a settlement failure, insolvency or other settlement-related exposure we may be unable to recover the full amount of such payment. This could expose us to significant losses and adversely affect our financial condition and results of operations. See Note 12—Settlement Guarantee Management to our consolidated financial statements included in Item 8 of this report.

Previous wording

The global payments industry is undergoing significant and rapid technological change, including increased proliferation of mobile and other proximity and in-app payment technologies, ecommerce, tokenization, cryptocurrencies, distributed ledger and blockchain technologies, cloud-based encryption and authorization, and new authentication technologies such as biometrics, FIDO 2.0, 3D Secure 2.0 and dynamic cardholder verification values or dCVV2. As a result, we expect new services and technologies to continue to emerge and evolve. For example, GenAI and agentic commerce solutions have emerged as an opportunity for Visa, its clients, suppliers, sellers and partners to innovate more quickly and better serve consumers. Rapid adoption and novel uses of GenAI and agentic commerce across the marketplace may also introduce unique and unpredictable security risks to our systems, information, and the payments ecosystem. In addition to our own initiatives and innovations, we work closely with third parties, including potential competitors, for the development of, and access to, new technologies. It is difficult, however, to predict which technological developments or innovations will become widely adopted and how those technologies may be regulated. Moreover, some of the new technologies could be subject to intellectual property-related lawsuits or claims, potentially impacting our development efforts and/or requiring us to obtain licenses, implement design changes or discontinue our use. If we or our partners fail to adapt and keep pace with new technologies in the payments space in a timely manner, it could harm our ability to compete, decrease the value of our products and services to our clients, impact our intellectual property or licensing rights, harm our business and impact our future growth.

Current wording

The global payments industry is undergoing significant and rapid technological change, including developments in mobile and other proximity and in-app payment technologies, AI and agentic commerce, machine payments, tokenization, cryptocurrencies, stablecoins, tokenized deposits, distributed ledger and blockchain technologies, cloud-based encryption and authorization, and new digital identity and authentication technologies. We expect new services and technologies to continue to emerge and evolve. For example, GenAI and agentic commerce solutions have emerged as an opportunity for Visa, its clients, suppliers, sellers and partners to innovate more quickly and better serve consumers. In addition to our own initiatives and innovations, we work closely with third parties, including potential competitors, for the development of, and access to, new technologies. It is difficult, however, to predict which technological developments or innovations will become widely adopted and how those technologies may be regulated. Moreover, some new technologies could be subject to intellectual property-related lawsuits or claims, potentially impacting our development efforts and/or requiring us to obtain licenses, implement design changes or discontinue our use. Our and our partners’ use of AI depends in part on third-party large language models that we do not control, whose models may generate inaccurate, biased, hallucinated or unexpected outputs that conflict with our business objectives or brand standards. Consumer and societal attitudes towards AI are evolving, and customers, regulators or the public may perceive AI negatively, which could reduce trust in our AI-powered products and solutions or deter adoption of AI-enabled features. If AI outputs are, or are perceived to be, inaccurate, biased, unexplained or flawed, we could face reputational harm, regulatory scrutiny, enforcement actions or liability claims that may materially and adversely affect our business, financial condition and results of operations. If we or our partners fail to adapt and keep pace with new technologies in the payments space in a timely manner, it could harm our ability to compete, decrease the value of our products and services to our clients, impact our intellectual property or licensing rights, harm our business and impact our future growth. In addition, because intellectual property and license rights surrounding AI are not fully addressed by courts or regulators, output using AI may not be subject to copyright or other protection, which may adversely affect our intellectual property or other proprietary rights in, or ability to commercialize, such output.

Previous wording

Our cybersecurity and processing systems, as well as those of financial institutions, sellers and third-party service providers, have experienced and may continue to experience errors, interruptions, delays or damage from a number of causes including but not limited to, hardware, software and network failures, computer viruses, ransomware, malware or other destructive software, use of AI technologies by bad actors, internal design, manual or user errors, advanced or persistent cyber attacks, social engineering threats, such as phishing or deepfake schemes, including those using synthetic media, insider threats, terrorism, political tensions, war or other military conflicts, or civil unrest, security breaches of our physical premises, workplace violence or wrongdoing, catastrophic events, natural disasters, severe weather conditions and other effects from climate change. Because the tactics, techniques and procedures used to obtain unauthorized access, or to disable or degrade systems change frequently, have become increasingly more complex and sophisticated, and may be difficult to detect for periods of time, we may not anticipate these acts or respond adequately or timely. For example, cybercriminals have increasingly demonstrated advanced capabilities, such as use of zero-day vulnerabilities, and rapid integration of new technology such as GenAI are being used by threat actors to create sophisticated attacks that are increasingly automated, targeted and more difficult to defend against. Our own use and deployment of GenAI technologies could expand our cybersecurity attack surface, increasing exposure to breaches, fraud, unauthorized transactions and other vulnerabilities. In addition, third-party suppliers of hardware and infrastructure that operate our data centers and support employee productivity could be impacted by supply chain disruptions, such as manufacturing, shipping delays, and service disruption due to cyber attacks. An extended supply chain or service disruption could also impact processing or delivery of technology services. Moreover, due to the interconnectivity and complexity of information systems and their reliance on common systems, software and vendors, disruptions or degradations have had, and will likely continue to have, wide-reaching consequences, including the potential to disrupt the overall financial system and other key systems in the global economy. Such attacks and breaches have resulted and may continue to result in fraudulent activity and financial losses to Visa’s financial institution clients, sellers or third-party service providers.

Current wording

Our cybersecurity and processing systems, as well as those of financial institutions, sellers and third-party service providers, have experienced and may continue to experience errors, interruptions, delays or damage from a number of causes including but not limited to, hardware, software and network failures, updates and migrations to new technology and platforms, software and network releases or enhancements, computer viruses, ransomware, malware or other destructive software, use of emerging technologies by bad actors, internal design, manual or user errors, advanced or persistent cyber attacks, social engineering threats, such as phishing or deepfake schemes, including those using synthetic media, insider threats, terrorism, political tensions, war or other military conflicts, or civil unrest, security breaches of our physical premises, workplace violence or wrongdoing, catastrophic events, natural disasters, severe weather conditions and other effects from climate change. Because the tactics, techniques and procedures used to obtain unauthorized access, or to disable or degrade systems change frequently, have become increasingly more complex and sophisticated, and may be difficult to detect for periods of time, we may not anticipate these acts or respond adequately or timely. New and emerging technologies, such as AI and quantum computing, could strengthen threat actor capabilities and cybersecurity risks in ways that are difficult to anticipate, detect or mitigate. For example, cybercriminals have increasingly demonstrated advanced capabilities, such as use of zero-day vulnerabilities, and rapid integration of new technology (such as GenAI and agentic AI) are being used by threat actors to create sophisticated attacks that are increasingly automated, targeted, coordinated and more difficult to defend against. Rapid adoption and novel uses of GenAI and agentic commerce across the marketplace may also introduce unique and unpredictable security risks to our systems, data and the payments ecosystem. Our own use and deployment of AI technologies could expand our cybersecurity attack surface, increasing exposure to breaches, fraud, unauthorized transactions and other vulnerabilities. For example, frontier AI labs have reported instances of AI agents conducting unauthorized cyber exploitation without direction. Such agents deployed by our Company, clients, partners, vendors, and others could circumvent cybersecurity controls and compromise our systems, data, operations and the payments ecosystem. Advances in quantum computing may introduce cryptography risks that could threaten the security of our information and systems or could require significant investment in technology to effectively mitigate these risks.

Previous wording

Our visibility and role in the global payments industry also puts our company at a greater risk of being targeted by hackers. In the normal course of our business, we have been the target of malicious cyber activity. We have been, and may continue to be, impacted by attacks and data security breaches of financial institutions, sellers, and third-party service providers. We are also aware of instances where governments have directed or sponsored attacks against some of our financial institution clients, and other instances where sellers and issuers have encountered substantial data security breaches affecting their customers, some of whom were Visa account holders. Given the increase in payments through ecommerce, social media and mobile channels, we continue to see increased cyber and payment fraud activity, as cybercriminals attempt phishing and social engineering scams, distributed denial of service attacks and other disruptive actions.

Current wording

Our visibility and role in the global payments industry also put our Company at a greater risk of being targeted by cyber threat actors. We have been, and may continue to be, affected by malicious cyber activity as well as attacks and data security breaches of financial institutions, sellers, and third-party service providers. We are also aware of instances where governments have directed or sponsored attacks against some of our financial institution clients, and instances where sellers and issuers have encountered substantial data security breaches affecting their customers, some of whom were Visa account holders. Given the growth in payments through ecommerce, social media and mobile channels, we continue to see increased cyber and payment fraud activity, as cybercriminals attempt phishing and social engineering scams, distributed denial of service attacks and other disruptive actions.

Previous wording

The security measures and procedures we, our financial institution and seller clients, other sellers and third-party service providers in the payments ecosystem have in place to protect sensitive consumer data and other information may not be implemented effectively, may differ in scope and complexity across different ecosystem participants, or may not be successful or sufficient to counter all data security breaches, cyber incidents and attacks or system failures. In some cases, the mitigation efforts may be dependent on third parties who may not follow the required contractual standards, who may not be able to timely patch vulnerabilities or fix security defects, or whose hardware, software or network services may be subject to error, defect, delay, outage or lack appropriate security measures to prevent breaches or data exfiltration incidents. Cyber incidents and attacks can have cascading impacts that unfold with increasing speed across our internal networks and systems and those of our partners and clients.

Current wording

The security measures and procedures we, our financial institution and seller clients, other sellers and third-party service providers in the payments ecosystem have in place to protect sensitive consumer data and other information may not be implemented effectively, may differ in scope and complexity across ecosystem participants, or may not be successful or sufficient to counter all data security breaches, cyber incidents and attacks or system failures. In some cases, the mitigation efforts may depend on third parties who may not adhere to required contractual standards, who may not be able to timely patch vulnerabilities or fix security defects, or whose hardware, software or network services may be subject to error, defect, delay, outage or lack appropriate security measures to prevent breaches or data exfiltration incidents. Any such transition may not be completed before relevant threats become operational, and our interconnectedness with third parties who may be slower to adopt such protections could further increase vulnerability to data compromises. Cyber incidents and attacks and other technology incidents can have cascading impacts that unfold with increasing speed across our internal networks and systems and those of our partners and clients.

Previous wording

Furthermore, as a global financial services company, Visa is increasingly subject to complex, varied, and rapidly evolving cybersecurity regulations and cyber incident reporting requirements across numerous jurisdictions. For example, governments around the world have recently passed or are considering new critical infrastructure cybersecurity laws and regulations, some of which may apply to Visa. With the often short timeframes required for cyber incident reporting, there is a risk that Visa or its third-party service providers will fail to meet the reporting deadlines for any given incident. It may take considerable time for us to investigate and evaluate the full impact of cyber incidents, particularly for sophisticated attacks. These factors may inhibit our ability to provide prompt, full and reliable information about the cyber incident to our clients, partners and regulators, as well as to the public. In the event we are found to be out of compliance, we could be subject to monetary damages, civil and criminal penalties, litigation, investigations and proceedings, and damage to our reputation and brand.

Current wording

Furthermore, as a global financial services company, Visa is increasingly subject to complex, varied, and rapidly evolving cybersecurity regulations and cyber incident reporting requirements across numerous jurisdictions. For example, governments around the world have recently passed or are considering new critical infrastructure cybersecurity laws and regulations, some of which may apply to Visa. Any single incident may require parallel notifications to data protection authorities, cyber authorities and law enforcement, often with differing reporting thresholds, deadlines and formats. With the often short timeframes required for cyber incident reporting, there is a risk that Visa or its third-party service providers will fail to meet the reporting deadlines and requirements for any given incident. It may take considerable time for us to investigate and evaluate the full impact of cyber incidents, particularly for sophisticated attacks. These factors may inhibit our ability to provide prompt, full and reliable information about the cyber incident to our clients, partners and regulators, as well as to the public. In the event we are found to be out of compliance, we could be subject to monetary damages, civil and criminal penalties, litigation, investigations and proceedings, and damage to our reputation and brand.

Previous wording

Any of these events, individually or in the aggregate, could significantly disrupt our operations; impact the availability and integrity of our systems, applications, or the systems of our third-party service providers; result in the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary, sensitive and personal information (including account data information) or data security compromises; impact our clients and consumers; increase the risk of fraudulent transactions; damage our reputation and brand; result in litigation or claims, violations of applicable privacy and other laws, and increased regulatory review or scrutiny, investigations, actions, fines or penalties; result in damages or changes to our business practices; decrease the overall use and acceptance of our products; decrease our volume, net revenue and future growth prospects; financial losses to Visa’s financial institution clients, sellers or third-party service providers, and be costly, time consuming and difficult to remedy. There can be no assurance that our efforts will prevent all such threats. In the event of damage or disruption to our business due to these occurrences, we may not be able to successfully and quickly recover all of our critical business functions, assets, and data through our business continuity program and we may not be able to notify affected third parties when appropriate. Furthermore, while we maintain insurance, our coverage may not sufficiently cover all types of losses or claims that may arise. In addition, in the case of any cyber-attack or other security incident information or security breach or technology failure arising from third-party systems impacting us, any third-party indemnification may not be applicable or sufficient to address the impact of such incidents.

Current wording

Any of these events, individually or in the aggregate, could significantly disrupt our operations; impact the availability and integrity of our systems, applications or the systems of our third-party service providers; result in the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary, sensitive and personal information (including account data information) or data security compromises; result in unauthorized access to, retention of, replication of or cross-border transfer of sensitive data through AI-enabled tools, third-party models, infrastructure, or derivative data stores; impact our clients and consumers; impact the magnitude of our settlement exposure; increase the risk of fraudulent transactions; damage our reputation and brand; result in litigation or claims, violations of applicable privacy and other laws, and increased regulatory review or scrutiny, investigations, actions, fines or penalties; result in damages or changes to our business practices; decrease the overall use and acceptance of our products; decrease our volume, net revenue, and future growth prospects; cause financial losses to Visa’s financial institution clients, sellers, or third-party service providers, and be costly, time consuming and difficult to remedy. There can be no assurance that our efforts will prevent all such threats. In the event of damage or disruption to our business due to these occurrences, we may not be able to successfully and quickly recover all of our critical business functions, assets and data through our business continuity program and we may not be able to notify affected third parties when appropriate. Furthermore, while we maintain insurance, our coverage may not sufficiently cover all types of losses or claims that may arise. In addition, in the case of any cyber-attack or other security incident information or security breach or technology failure arising from third-party systems impacting us, any third-party indemnification may not be applicable or sufficient to address the impact of such incidents.

Previous wording

As part of our overall business strategy, we make acquisitions and strategic investments, and enter into joint ventures. We may not achieve the anticipated benefits of our current and future acquisitions, joint ventures or strategic investments and they may involve significant risks and uncertainties, including:

Current wording

As part of our overall business strategy, we make acquisitions and strategic investments, and enter into joint ventures. We may not achieve the anticipated benefits of our current and future acquisitions, joint ventures, strategic investments or other strategic objectives and they may involve significant risks and uncertainties, including:

Previous wording

•disruption to our ongoing business, including diversion of resources and management’s attention from our existing business;

Current wording

•disruption to our ongoing business, including diversion of resources and management’s attention;

Previous wording

•failure to adequately develop or integrate our acquired entities or joint ventures;

Current wording

•difficulty, expense or failure to adequately develop, maintain or integrate our acquired entities or joint ventures, including the development and retention of employees, clients or partners, the integration of employees, business cultures, operations, business systems and technologies, and the implementation of appropriate controls, procedures and policies, in some cases, across different cultures and languages;

Previous wording

•the data security, cybersecurity and operational resilience posture of our acquired entities, joint ventures or companies we invest in or partner with, may not be adequate and may be more susceptible to a system failure, service disruption or cyber incident or attack;

Current wording

•inadequate data security, cybersecurity or operational resilience posture of our acquired entities, joint ventures or companies we invest in or partner with, which may lead to increased risk of system failures, service disruptions or cyber incidents or attacks;

Previous wording

•disruptions, costs, liabilities, judgments, settlements or business pressures resulting from litigation matters, investigations or legal proceedings involving our acquisitions, joint ventures or strategic investments;

Current wording

•disruptions, costs, liabilities, judgments, settlements or business pressures resulting from litigation, investigations or legal proceedings involving our acquisitions, joint ventures or strategic investments, including the inability to pursue certain aspects of such transactions;

Previous wording

•failure to obtain the necessary government or other approvals at all, on a timely basis or without the imposition of burdensome conditions or restrictions;

Current wording

•failure to obtain the necessary government or other approvals at all, on a timely basis or without the imposition of burdensome conditions or restrictions, including as a result of increased scrutiny with respect to antitrust, national security and other considerations;

Previous wording

•the economic, political, regulatory and compliance risks associated with our acquisitions, joint ventures or strategic investments, including when entering into a new business or operating in new regions or countries. For more information on regulatory risks, please see Item 1—Government Regulation and Item 1A—Regulatory Risks above;

Current wording

•economic, political, regulatory and compliance risks, including when entering into new businesses, regions or countries. See Item 1—Government Regulation and Item 1A—Regulatory Risks of this report for more information on regulatory risks;

Previous wording

•discovery of unidentified issues and related liabilities after our acquisitions, joint ventures or investments were made;

Current wording

•discovery of unidentified issues and related liabilities after such transactions were made;

Previous wording

•negative impact on our financial position and/or statement of operations; and

Current wording

•negative impact on our financial position and/or results of operations; and

Previous wording

•anticipated benefits, synergies or value of our acquisitions, joint ventures or investments not materializing or taking longer than expected to materialize.

Current wording

•anticipated benefits, synergies or value not materializing or taking longer than expected to materialize.

Previous wording

We may be unable to attract, hire and retain a highly qualified workforce, including key management.

Current wording

We may be unable to attract, hire, develop, motivate and retain a highly qualified workforce, including key members of management.

Previous wording

The talents and efforts of our employees, particularly our key management, are vital to our success. The market for highly skilled workers and leaders in our industry, especially in fintech, technology, AI, cybersecurity and other specialized areas, is extremely competitive. Our management team has significant industry experience and would be difficult to replace. We may be unable to retain them or to attract, hire or retain other highly qualified employees, particularly if we do not offer employment terms that are competitive with the rest of the labor market. Ongoing changes in laws and policies regarding immigration, travel and work authorizations have made it more difficult for employees to work in, or transfer among, jurisdictions in which we have operations and could continue to impair our ability to attract, hire and retain qualified employees. Failure to attract, hire, develop, motivate and retain highly qualified employee talent, especially in light of changing worker expectations and talent marketplace variability; to adequately address potential increased scrutiny of our talent-related programs and initiatives; to develop and implement an adequate succession plan for the management team; or to maintain our strong corporate culture of fostering innovation and collaboration could impact our workforce development goals, impact our ability to achieve our business objectives, and adversely affect our business and our future success.

Current wording

The talents and efforts of our employees, particularly our key members of management, are vital to our success. The market for highly skilled workers and leaders in our industry, especially in fintech, technology, AI, cybersecurity and other specialized areas, is extremely competitive. Our management team has significant industry experience and would be difficult to replace. We may be unable to retain them or to attract, hire or retain other highly qualified employees, particularly if we do not offer employment terms that are competitive with the broader labor market. Ongoing changes in laws and policies regarding immigration, travel and work authorizations have made it more difficult for employees to work in, or transfer among, jurisdictions in which we operate and could continue to impair our ability to attract, hire and retain qualified talent.

Previous wording

The conversions of our class B-1, B-2 and class C common stock or series A, B and C preferred stock into shares of class A common stock would result in voting dilution to, and could adversely impact the market price of our existing class A common stock.

Current wording

The conversions of our class B-1, B-2 and B-3 (class B) and class C common stock or series A, B and C preferred stock into shares of class A common stock would result in voting dilution to, and could adversely impact the market price of our existing class A common stock.

Previous wording

The market price of our class A common stock could fall as a result of many factors. The value of our class B-1, B-2 and C common stock and series A, B and C preferred stock is tied to the value of the class A common stock. Under our U.S. retrospective responsibility plan, upon final resolution of our U.S. covered litigation, all class B-1 and B-2 common stock will become convertible into class A common stock. Under our Europe retrospective responsibility plan, Visa will continue to release value from the series B and series C preferred stock in stages based on developments in current and potential litigation. The series B and series C preferred stock will become fully convertible to series A preferred stock or class A common stock no later than 2028 (subject to a holdback to cover any pending claims). Conversion of our class B-1, B-2 and C common stock into class A common stock, or our series A, B and C preferred stock into class A common stock, would increase the amount of class A common stock outstanding, which would dilute the voting power of existing class A common shareholders. In addition, the sale of significant portions of converted class A common stock could adversely impact the market price of our existing class A common stock.

Current wording

The market price of our class A common stock could fall as a result of many factors. The value of our class B and C common stock and series A, B and C preferred stock is tied to the value of the class A common stock. Under our U.S. retrospective responsibility plan, upon final resolution of our U.S. covered litigation, all class B common stock will become convertible into class A common stock. Under our Europe retrospective responsibility plan, Visa will continue to release value from the series B and series C preferred stock in stages based on developments in current and potential litigation. The series B and series C preferred stock will become fully convertible to series A preferred stock or class A common stock no later than 2028 (subject to a holdback to cover any pending claims). Conversion of our class B and C common stock into class A common stock, or our series A, B and C preferred stock into class A common stock, would increase the amount of class A common stock outstanding, which would dilute the voting power of existing class A common shareholders. In addition, the sale of significant portions of converted class A common stock could adversely impact the market price of our existing class A common stock.