VISA INC.

Visa’s Approach to Cybersecurity

As a global company providing payment services to consumers and companies around the world, trust is an indispensable asset. A strong cybersecurity program is a key element to maintaining this trust and supporting the security, availability and resilience of our systems and services. Accordingly, we consider cybersecurity a key enterprise risk and we identify, assess and manage such risk as part of our overall enterprise risk management framework. See Item 1A of this report for further discussion on our overall risk factors, including technology and cybersecurity risks.

Cybersecurity Program

Visa’s cybersecurity program is designed to monitor, identify, assess, mitigate and govern cybersecurity risk and is aligned with widely accepted international standards, such as ISO 27002 and the Payment Card Industry Data Security Standards, as well as applicable legal and regulatory requirements. We implement our cybersecurity program primarily through our Key Controls, which establish enterprise-wide requirements for protecting Visa information and technology assets. All employees must complete annual training on our Key Controls and are required to comply with the requirements. Exceptions to the Key Controls must be approved by a senior management working group overseen by our Corporate Risk Committee (CRC), the management committee responsible for overseeing Visa’s cybersecurity program and other operational risks. To support the continued effectiveness of our control environment, the Key Controls are reviewed and updated annually by our Cybersecurity Governance, Risk and Compliance teams and approved by management committees to address evolving cybersecurity threats and applicable legal and regulatory requirements.

As part of our overall business strategy, we have acquired a number of companies that operate under diverse business, operational and technology requirements. These designated entities may deliver products and services using systems that are not fully integrated with Visa’s standard technology platforms or infrastructure. We have established a separate set of Key Controls for designated entities that are appropriate to their size, risk profile and operations and are aligned with the same widely accepted international standards noted above. These controls are designed to support consistent cybersecurity governance while accounting for differences in business operations, technology environments and integration status. Management receives regular reporting regarding the cybersecurity posture and control environment of these entities, including reporting to our Chief Information Security Officer (CISO), President of Technology, management committees and the board of directors. For additional information about our structural and organizational risks, see Item 1A of this report.

Incident Response Plans

Visa’s global cybersecurity incident response team provides continuous monitoring of Visa networks and digital assets through three cyber fusion centers in the United States, United Kingdom and Singapore. Complementing these efforts, Visa’s threat intelligence and research teams monitor commercial and government intelligence sources to identify, assess and respond to new and emerging threats. To help strengthen employee awareness and resilience, our cybersecurity awareness team regularly provides guidance and information with Visa employees on emerging threats, such as AI-enabled attacks and senior executive impersonation phishing schemes.

To address significant cybersecurity incidents and other crisis events, we maintain a business incident response plan, which identifies key stakeholders, defines escalation procedures, and establishes thresholds for notifying management’s Executive and Disclosure Committees, as well as circumstances under which the CEO or the CEO’s designee informs the board of directors. For cybersecurity incidents that do not rise to these crisis thresholds, we maintain subordinate incident response plans and standard operating procedures that guide the response, investigation, escalation and remediation activities of our security incident response teams. These processes are designed to facilitate the timely identification, assessment, containment and management of cybersecurity incidents and other security events affecting Visa or third parties on which we rely. Like many companies, we, and some third parties on which we rely, periodically experience cybersecurity incidents. As of September 30, 2026, we are not aware of any direct or third-party cybersecurity incidents during the preceding three fiscal years that have materially affected our business strategy, results of operations or financial condition.

Internal and External Testing

We proactively manage cybersecurity risk through the continuous identification, assessment and remediation of potential cybersecurity threats and vulnerabilities affecting our information and technology assets. We also leverage advanced analytics, automation and artificial-intelligence-enabled capabilities to support threat detection, vulnerability management, and the prioritization of remediation activities. These efforts include a combination of both internal and external assessments as well as independent testing, as appropriate. For example, public-facing technology assets are subject to both internal security assessments and external testing through our vulnerability disclosure and bug bounty programs. Findings identified through these activities are prioritized and remediated based on risk through Visa’s established governance frameworks, with compliance and approved exceptions subject to ongoing oversight and reporting to management and the board of directors.

As further discussed in our risk factors in Item 1Aof this report, cybersecurity risks cannot be fully eliminated despite the controls and processes we maintain. To help manage this risk, we maintain three lines of defense designed to promote accountability, oversight and independent assurance across our cybersecurity program. The first line of defense consists of the technology teams that develop, build and deploy our products and services. These teams are trained on and accountable for following our Key Controls. The second line of defense includes separate internal security and risk teams that conduct security assessments of our networks and products, overseeing the remediation of any findings. Finally, our independent internal audit function operates as the third line of defense, assessing the effectiveness of our policies and controls and implementation thereof. In addition, our cybersecurity program is subject to regular, detailed examinations by financial regulators and external auditors.

Third-party Risk Management

We also apply this same overall framework to the oversight and management of cybersecurity risks associated with service providers, vendors, suppliers and other third parties. Our policies require due diligence on our service providers, vendors and suppliers prior to engagement and impose contractual audit rights designed to assist in identifying and managing cybersecurity risks associated with third-party relationships. Such oversight is proportionate to the inherent risk associated with the products and services provided and the criticality and sensitivity of the information and technology assets to which the third party may have access. As noted in our risk factors in Item 1Aof this report, our third-party risk management framework may not be implemented effectively or may not be successful or sufficient to mitigate all of our risks. When we become aware that a service provider, vendor, supplier or other third party has experienced any compromise or failure in the cybersecurity infrastructure owned or controlled by such third party, we take actions consistent with our risk management and incident response frameworks to mitigate our potential risk, including, where appropriate, by restricting, suspending or terminating the third party’s access to our information and technology assets.

Management’s Role and Responsibilities

Our CISO is responsible for day-to-day management and oversight of our information security program and leads our global cybersecurity organization, which comprises of approximately 950 professionals globally as of September 30, 2026. Our CISO and President of Technology receive regular reports from our cybersecurity personnel regarding the prevention, detection, assessment, mitigation and remediation of cybersecurity threats, vulnerabilities and incidents. Our CISO reports directly to our President of Technology and provides quarterly reports on our cybersecurity program, risk posture and significant cybersecurity matters to the CRC.

Our current CISO has over 30 years of industry experience leading enterprise cybersecurity teams and enabling secure and scalable ecommerce and payment platforms at multiple Fortune 500 companies. Since joining Visa in November 2015, the CISO has played a key role in advancing Visa’s cybersecurity program, including supporting the development of Visa's Zero Trust Architecture and advancing VisaNet's cybersecurity defense capabilities. Our President of Technology joined Visa in November 2013 and has over 30 years of experience leading the development, deployment and operation of commerce and transaction technologies, including oversight of cybersecurity risk management and transformational technology initiatives. Our President of Technology is responsible for Visa’s technology innovation and investment strategy, product engineering, cybersecurity, global IT, operations infrastructure, and for accelerating the integration of engineering and product teams.

Board Governance

Visa’s board of directors exercises oversight and control of Visa’s overall enterprise risk management framework and delegates oversight and control of Visa’s cybersecurity program to our audit and risk committee (ARC), which is responsible for ensuring that management has risk-based processes in place designed to assess, identify and manage cybersecurity risks to which Visa is exposed. As noted in Item 1A, however, these processes may not be sufficient to mitigate all cybersecurity risks. Our CISO provides an update on our cybersecurity program to the ARC twice per year and to the full board of directors annually. The updates to the ARC and the full board of directors provide an overview of our cybersecurity performance, progress against goals, cybersecurity threat landscape and other relevant developments.