What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-08-07 compared with 2023-08-03 · 62 added, 51 removed, 147 unchanged (43% of the section changed)

14 unchanged sentences

For example, a change in regulations either decreasing the amount of taxes to be

withheld or allowing less time to remit taxes to government authorities would adversely impact average client balances and, thereby, adversely impact interest income from investing client funds before such funds are remitted to the applicable taxing authorities.

Changes in U.S.

4 unchanged sentences

Even though PEO clients are contractually responsible for the timely remittance of such costs, it is possible that our clients will not remit such payments despite their contractual obligations.

The risk of failing to receive such payments from PEO clients could be magnified during significant financial or other disruptions or catastrophic events, such as the failure of a bank, like that of Signature Bank or Silicon Valley Bank, with whom a significant number of PEO clients may bank at the time, or more widespread stress or failure within the U.S.

The risk of failing to receive such payments from PEO clients could be magnified during significant financial or other disruptions or catastrophic events, such as the failure of a bank with whom a significant number of PEO clients may bank at the time, or more widespread stress or failure within the U.S.

banking system.

13 unchanged sentences

Among other things, the BSA requires certain financial institutions, including banks and money services businesses (such as national trust banks and providers of prepaid access like us), to develop and implement risk-based anti-money laundering programs, report large cash transactions and suspicious activity, and maintain transaction records.

We have registered our payroll card business as a provider of prepaid access, and registered our ADP Trust Bank with the Treasury Department’s Financial Crimes Enforcement Network (FinCEN).

We have registered our payroll card business as a provider of prepaid access, and registered ADP Trust Bank and ADP Retirement Trust Services with the Treasury Department’s Financial Crimes Enforcement Network (FinCEN).

ADP Canada Co.

is a registered entity with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a Money Service Business (MSB).

We have implemented policies and procedures to monitor and address compliance with applicable anti-corruption, economic and trade sanctions and anti-money laundering laws and regulations, and we regularly review, upgrade and enhance our policies and procedures.

However, there can be no assurance that our employees, consultants or agents will not take actions in violation of our policies for which we may be ultimately responsible, or that our policies and procedures will be adequate or will be determined to be adequate by regulators.

Any violations of applicable anti-corruption, economic and trade sanctions or anti-money laundering laws or regulations could limit certain of our business activities until they are satisfactorily remediated and could result in civil and criminal penalties, including fines, which could damage our reputation and have a materially adverse effect on our results of operation or financial condition.

Further, bank regulators continue to impose additional and stricter requirements on banks to ensure they are meeting their BSA obligations, and banks are increasingly viewing money services businesses and third-party senders to be higher risk customers for money laundering.

15 unchanged sentences

We are increasingly leveraging AI and ML in our solutions and service delivery and are exploring how best to integrate generative AI technologies and develop and deploy capabilities that are beneficial to our clients and their employees.

However, legislation that would govern the development and/or use of AI is under consideration in the U.S.

However, legislation that governs the development and/or use of AI has been adopted or is under consideration in the U.S.

at the state and local level, as well as abroad.

In addition , self-regulatory frameworks like the National

Institute of Standards and Technology AI Risk Management Framework are being promulgated and adherence to these may become an industry standard or a client expectation.

As a result, the ability to provide data-driven insights and otherwise leverage AI and ML may be constrained by current or future laws, regulatory or self-regulatory requirements or ethical considerations, including our own published, guiding ethical principles regarding AI and ML, that could restrict or impose burdensome and costly requirements on our ability to leverage data and/or these technologies in innovative ways.

Complying with privacy, data protection, AI and cyber security laws and requirements, including the enhanced obligations imposed by the GDPR, our BCRs and the CPRA, may result in significant costs to our business and require us to amend certain of our business practices.

In addition , self-regulatory frameworks like the National Institute of Standards and Technology AI Risk

Management Framework are being promulgated and adherence to these may become an industry standard or a client expectation.

As a result, the ability to provide data-driven insights and otherwise leverage AI and ML may be constrained by current or future laws (including product liability regimes), regulatory or self-regulatory requirements or ethical considerations, including our own published, guiding ethical principles regarding AI and ML, that could restrict or impose burdensome and costly requirements on our ability to leverage data and/or these technologies in innovative ways.

Our use of generative AI in our products and operations also introduces additional risks, including risks related to accuracy, bias, security, and privacy.

For example, if the data used to train a model or the model’s output is inaccurate or biased, or alleged to be inaccurate or biased, we could be subject to reputational damage or litigation.

Complying with privacy, data protection, AI and cyber security laws and requirements, including the enhanced obligations imposed by the GDPR, our BCRs, U.S.

state privacy laws, including the CPRA, and the EU Artificial Intelligence Act, may result in significant costs to our business and require us to amend certain of our business practices.

Further, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase.

7 unchanged sentences

In addition, the steps we take to protect our intellectual property rights may be inadequate or ineffective, or may not provide us with a significant competitive advantage.

Our intellectual property could be wrongfully acquired as a result of a cyber-attack or other wrongful conduct by third parties or our personnel.

Our intellectual property (including source code) could be wrongfully acquired as a result of a cyber-attack or other wrongful

conduct by third parties or our personnel.

Litigation brought to protect and enforce our intellectual property rights could be costly and time-consuming.

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights, which

may be successful.

In addition, use of AI tools may result in the release of confidential or proprietary information which could limit our ability to protect, or prevent us from protecting, our intellectual property rights.

8 unchanged sentences

SECURITY AND TECHNOLOGY RISKS

Our businesses collect, host, store, transfer, process, disclose, use, secure and retain and dispose of personal and business information, and collect, hold and transmit client funds, and a security or privacy breach may damage or disrupt our businesses, result in the disclosure of confidential information, damage our reputation, increase our costs, cause losses and materially adversely affect our results of operations

In connection with our business, we collect, host, store, transfer, process, disclose, use, secure and retain and dispose of large amounts of personal and business information about our clients, employees of our clients, our vendors and our employees, contractors and temporary staff, including payroll information, health care information, personal and business financial data, social security numbers and their foreign equivalents, bank account numbers, tax information and other sensitive personal and business information.

We also collect significant amounts of funds from the accounts of our clients and transmit them to their employees, taxing authorities and other third parties.

We are focused on ensuring that we safeguard and protect personal and business information and client funds, and we devote significant resources to maintain and regularly update our systems and processes.

Nonetheless, the global environment continues to grow increasingly hostile as attacks on information technology systems continue to grow in frequency, complexity and sophistication, and we are regularly targeted by unauthorized parties using malicious tactics, code and viruses.

Our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of personal and business information, and collect, hold and transmit client funds, and a security or privacy breach may damage or disrupt our businesses or operations, result in the disclosure of confidential information, damage our reputation, increase our costs, cause losses and materially adversely affect our results of operations

In connection with our business, we collect, host, store, transfer, process, disclose, use, secure, retain and dispose of large amounts of personal and business information about our clients, employees of our clients, our vendors and our employees, contractors and temporary staff, including payroll information, health care information, personal and business financial data, social security

numbers and their foreign equivalents, bank account numbers, tax information and other personal and business information.

We also collect significant amounts of funds from the accounts of our clients and transmit them to their employees, tax authorities and other payees.

We are focused on safeguarding and protecting personal and business information and client funds, and we devote significant resources to maintain and regularly update our systems and processes.

Nonetheless, the global environment continues to grow increasingly hostile as attacks on information technology systems continue to grow in frequency, complexity and sophistication (including due to the use of AI), and we are regularly targeted by unauthorized parties using malicious tactics, code and viruses.

Certain of these malicious parties may be state-sponsored and/or supported by significant financial and technological resources.

Although this is a global problem, it may affect our businesses more than other businesses because malevolent parties (including our personnel) may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure and retain and dispose of, and the client funds that we collect and transmit.

We have programs and processes in place to prevent, detect and respond to data or cybersecurity incidents.

Although this is a global problem, it may affect our businesses more than other businesses because malevolent parties (which could include our personnel) may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of, and the client funds that we collect and transmit.

We have programs and processes in place designed to prevent, detect and respond to data or cybersecurity incidents.

However, as a result of the complexity of our operating environment, the period over which hardware and software has been acquired or other reasons, our programs and processes may not be sufficient or adequate or may fail to prevent, detect or respond to a cybersecurity incident or identify and/or remediate a security vulnerability in our operating environment.

3 unchanged sentences

Hardware, software, applications or services that we develop or procure from third parties, or are required by third parties such as foreign governments to install on our systems, may contain defects in design or manufacture or other problems that could (or, in respect of third-party software, may be designed to) compromise the confidentiality, integrity or availability of data or our systems.

Unauthorized parties also attempt to gain access to our systems or facilities, or those of third parties with whom we do business, through fraud, trickery, or other methods of deceiving these third parties or our personnel, including phishing and other social engineering techniques whereby attackers use end-user behaviors to distribute computer viruses and malware into our systems or otherwise compromise the confidentiality, integrity or availability of data or our systems.

As these threats continue to evolve and increase (including due to the use of AI), we continue to invest significant resources, and may be required to invest significant additional resources, to modify and enhance our information security and controls

and to investigate and remediate any security vulnerabilities.

Unauthorized parties have also attempted to gain (and in certain cases have gained), and will continue to attempt to gain, access to our systems or facilities, or those of third parties with whom we do business, through fraud, trickery, or other methods of deceiving these third parties or our personnel, including phishing and other social engineering techniques whereby attackers use end-user behaviors to distribute computer viruses and malware into our systems or otherwise

compromise the confidentiality, integrity or availability of data or our systems.

In addition, while our operating environments are designed to safeguard and protect confidential personal and business information, we may not have the ability to monitor the implementation or effectiveness of any safeguards by our clients, vendors or partners and, in any event, third parties may be able to circumvent those security measures.

Information obtained by malevolent parties (including our personnel) resulting from successful attacks against our clients, vendors, partners or other third parties may, in turn, be used to attack our information technology systems.

A cyberattack, unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, theft of non-public or other sensitive information, or similar act by a malevolent party (including our personnel), or inadvertent acts or inactions by our vendors, partners or personnel, could result in the loss, disclosure or misuse of confidential personal or business information or the theft of client or ADP funds, which could have a materially adverse effect on our business or results of operations or that of our clients, result in liability, litigation, regulatory investigations and sanctions or a loss of confidence in our ability to serve clients, or cause current or potential clients to choose another service provider.

Information or system access obtained by malevolent parties (which could include our personnel) resulting from successful attacks against our clients, vendors, partners or other third parties may, in turn, be used to attack our information technology systems.

Further, while we perform due diligence prior to acquisitions and take actions to safeguard the businesses that we acquire, these businesses may not have invested as significantly as we do in security and technology and may be more susceptible to cybersecurity incidents, which may make us more vulnerable to cybersecurity incidents as well.

We have been, and expect we will continue to be, the subject of cybersecurity attacks, including unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, and theft of sensitive information (including our intellectual property).

Although none of the cybersecurity incidents that we have identified to date have materially affected us, including our business strategy, operations, results of operations, or financial condition, we continue to face significant known and unknown cybersecurity threats.

In the future, a cybersecurity attack, unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, theft of non-public or other sensitive information, or similar act by a malevolent party (which could include our personnel), or inadvertent acts or inactions by our vendors, partners or personnel, could result in the loss, disclosure or misuse of confidential personal or business information or our intellectual property or the theft of client or ADP funds, which could have a materially adverse effect on our business or results of operations or that of our clients, result in liability, litigation, regulatory investigations and sanctions or a loss of confidence in our ability to serve clients, or cause current or potential clients to choose another service provider.

As the global environment continues to grow increasingly hostile, the security of our operating environment is ever more important to our clients and potential clients.

As a result, the breach or perceived breach of our security systems could result in a loss of confidence by our clients or potential clients and cause them to choose another service provider, which could have a materially adverse effect on our business.

Although we believe that we maintain a robust program of information security and controls and none of the data or cybersecurity incidents that we have encountered to date have materially impacted us, a data or cyber security incident could have a materially adverse effect on our business, results of operations, financial condition and reputation.

While ADP maintains insurance coverage that, subject to policy terms and conditions and a significant self-insured retention, is designed to address losses or claims that may arise in connection with certain aspects of data and cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the continually evolving area of data and cyber risk.

Our systems, applications, solutions and services may be subject to disruptions that could have a materially adverse effect on our business and reputation

While ADP maintains insurance coverage that, subject to policy terms and conditions and a significant self-insured

retention, is designed to address losses or claims that may arise in connection with certain aspects of data and cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the continually evolving area of data and cyber risk.

Our systems, applications, solutions and services may be subject to disruptions that could have a materially adverse effect on our business, operations, financial condition, results of operations or reputation

Many of our businesses are highly dependent on our ability to process, on a daily basis, a large number of complicated transactions.

We rely heavily on our payroll, financial,

accounting, and other data processing systems.

We rely heavily on our payroll, financial, accounting, and other data processing systems.

We need to properly manage our systems, applications and solutions, and any upgrades, enhancements and expansions we may undertake from time to time, in order to ensure they properly support our businesses.

From time to time, these systems, applications or solutions fail to operate properly or become disabled.

Any such failure or disablement, even for a brief period of time, whether due to malevolent acts, errors, defects or any other factor(s), could result in financial loss, a disruption of our businesses, liability to clients, loss of clients, regulatory intervention or damage to our reputation, any of which could have a materially adverse effect on our results of operation or financial condition.

We have disaster recovery, business continuity, and crisis management plans and procedures designed to protect our businesses against a multitude of events, including natural disasters, military or terrorist actions, power or communication failures, or similar events.

Any such failure or disablement, even for a brief period of time, whether due to malevolent acts, errors, defects or any other factor(s), could result in financial loss, a disruption of our businesses or operations, liability to clients, loss of clients, regulatory intervention or damage to our reputation, any of which could have a materially adverse effect on our business, results of operations or financial condition.

We have a global business resiliency program that includes disaster recovery, business continuity, and crisis management plans and procedures designed to protect our businesses against a multitude of events, including natural disasters, military or terrorist actions, power or communication failures, or similar events.

Despite our preparations, our plans and procedures may not be successful in preventing or mitigating the loss of client data or funds, service interruptions, disruptions to our operations, or damage to our important facilities.

In addition, the severity of the failure or disablement may require us to replace or rebuild the affected system(s), application(s) or solution(s) and we may be unable to do so before it materially adversely affects our business.

A disruption of the data centers or cloud-computing or other technology services or systems that we utilize could have a materially adverse effect on our business

A disruption of the data centers or cloud-computing or other technology services or systems that we utilize could have a materially adverse effect on our business, operations, financial condition or results of operations

We host our applications and serve our clients with data centers that we operate, and with data centers that are operated, and cloud-computing and other technology services and systems that are provided, by third-party vendors.

These data centers or cloud-computing and other technology services and systems have (and, in the future, may) failed, become disabled or been disrupted.

Any failure, disablement or disruption, even for a limited period of time, could disrupt our businesses and we could suffer financial loss, liability to clients, loss of clients, regulatory intervention or damage to our reputation, any of which could have a material adverse effect on our results of operation or financial condition.

In addition, our third-party vendors may cease providing data center facilities or cloud-computing or other technology services or systems, elect to not renew their agreements with us on commercially reasonable terms or at all, breach their agreements with us or fail to satisfy our expectations, which could disrupt our operations and require us to incur costs which could materially adversely affect our results of operation or financial condition.

These data centers or cloud-computing and other technology services and systems have failed, become disabled or been disrupted, and may do so in the future.

Any failure, disablement or disruption, even for a limited period of time, could disrupt our businesses or operations and we could suffer financial loss, liability to clients, loss of clients, regulatory intervention or damage to our reputation, any of which could have a material adverse

effect on our business, results of operations or financial condition.

In addition, our third-party vendors may cease providing data center facilities or cloud-computing or other technology services or systems (including those on which our products or services are based), elect to not renew their agreements or licenses with us on commercially reasonable terms or at all, breach their agreements or licenses with us or fail to satisfy our expectations, which could disrupt our operations and require us to incur costs which could materially adversely affect our results of operations or financial condition.

BUSINESS AND INDUSTRY RISKS

11 unchanged sentences

We may fail to realize all the economic benefit of our investment in the development of a product which could cause an impairment of goodwill or intangibles and result in a significant charge to earnings.

We may not realize or sustain the expected benefits from our business transformation initiatives, and these efforts could have a materially adverse effect on our business, operations, financial condition, results of operations and competitive position

We may not realize or sustain the expected benefits from our business transformation initiatives, and these efforts could have a materially adverse effect on our business,

operations, financial condition, results of operations and competitive position

We have been and will be undertaking certain transformation initiatives, which are designed to streamline our organization, extend our world-class distribution and strengthen our talent and culture, while supporting our revenue growth, margin improvement and productivity.

13 unchanged sentences

In addition, clients or prospects may delay decision making, demand pricing and other concessions, reduce the value or duration of their orders, delay planned work or seek to terminate existing agreements.

Our business is also impacted by employment levels across our clients, as we have varied contracts throughout our business that blend base fees and per-employee fees.

Our business is also impacted by employment levels across our clients, as we

have varied contracts throughout our business that blend base fees and per-employee fees.

Political, economic and social factors may materially adversely affect our business and financial results

7 unchanged sentences

In addition, as part of our client funds investment strategy, we extend the maturities of our investment portfolio for client funds and utilize short-term financing arrangements to satisfy our short-term funding requirements related to client funds obligations.

In order to satisfy these short-term funding requirements, we maintain access to various sources of liquidity, including borrowings under our commercial paper program and our committed credit facilities, our ability to execute reverse repurchase transactions and corporate cash balances.

In order to satisfy these short-term funding requirements, we maintain access to various sources of liquidity, including borrowings under our commercial paper program and our committed credit facilities, our ability to execute regular reverse repurchase transactions, our committed reverse repurchase agreements, and corporate cash balances.

A reduction in the availability of any such financing during periods of disruption in the financial markets or otherwise may increase our borrowing costs and/or require us to sell available-for-sale securities in our funds held for clients to satisfy our short-term funding requirements.

1 unchanged sentence

A sale of such available-for-sale securities may result in the recognition of losses and reduce the interest income earned on funds held for clients, either or both of which may adversely impact our results of operations, financial condition and cash flow.

In connection with our client funds assets investment strategy, we attempt to minimize the risk of not having funds collected from a client available at the time such client’s obligation becomes due by generally impounding the client’s funds at the time of payment of such client’s obligation.

In connection with our client funds assets investment strategy, we attempt to minimize the risk of not having funds collected from a client available at the time such

client’s obligation becomes due by generally impounding the client’s funds at or before the time of payment of such client’s obligation.

When we don’t impound client funds by the time we pay such client obligations (including for PEO clients with respect to which we are legally obligated for payroll and tax obligations in respect of WSEs as a Certified PEO), we are at risk of not recovering such funds or a material delay in such recovery.

3 unchanged sentences

We are dependent upon various large banks to execute electronic payments and wire transfers as part of our client payroll, tax and other money movement services.

While we have contingency plans in place for bank failures, a

systemic shutdown of the banking industry would impede our ability to process funds on behalf of our payroll, tax and other money movement services clients and could have an adverse impact on our financial results and liquidity.

While we have contingency plans in place for bank failures, a systemic shutdown of the banking industry would impede our ability to process funds on behalf of our payroll, tax and other money movement services clients and could have an adverse impact on our financial results and liquidity.

We derive a significant portion of our revenues and operating income outside of the United States and, as a result, we are exposed to market risk from changes in foreign currency exchange rates that could impact our results of operations, financial position and cash flows.

We publicly share certain information about our environmental, social and governance (“ESG”) initiatives, including our net zero greenhouse gas emissions pledge.

We publicly share certain information about our environmental, social and governance (“ESG”) initiatives, including our efforts related to greenhouse gas emissions reductions and Inclusion, Diversity, Equity and Belonging efforts.

We may face increased scrutiny related to our ESG initiatives and any related targets, including from the investment community.

In addition, our ability to achieve certain ESG initiatives and targets may depend on the actions or continuing requirements of governmental entities (e.g., our paperless initiatives may depend on whether certain states continue to require employers to offer employees to be paid via paper check or to obtain employee consent to be paid electronically instead of via paper check).

Our failure to achieve progress in these and other ESG areas on a timely basis, or at all, could impact our reputation, business, including employee retention, and growth.

In addition, our ability to achieve certain ESG initiatives and targets may depend on the actions or continuing requirements of governmental entities (e.g., our paperless initiatives may depend on whether certain states continue to require employers to offer employees the option to be paid by paper check or to obtain employee consent to be paid electronically instead of by paper check).

There has also been an increase in current and proposed ESG regulations, standards and reporting requirements, which may result in legal and regulatory uncertainty as well as increased compliance costs for our business.

Further, developments in the law relative to diversity may influence our talent strategies.

Our failure to achieve progress in these and other ESG areas on a timely basis, or at all, our failure to fully comply with these new ESG requirements, or our failure to do so in a timely manner, or a negative perception of our ESG initiatives could adversely impact our reputation, business, including employee recruitment and retention, financial results, and growth.

Change in our credit ratings could adversely impact our operations and lower our profitability

The major credit rating agencies periodically evaluate our creditworthiness and have given us strong, investment-grade long-term debt ratings and high commercial paper ratings.

Failure to maintain high credit ratings on long-term and short-term debt could increase our cost of borrowing, reduce our ability to obtain intra-day borrowing required by our Employer Services business, and adversely impact our results of operations.

Failure to maintain high credit ratings on long-term and short-term debt could increase our cost of borrowing, reduce our ability to obtain short-term borrowing required by our business, and adversely impact our results of operations.

Our business could be negatively impacted as a result of actions by activist stockholders or others

We may be subject to actions or proposals from activist stockholders or others that may not align with our business strategies or the interests of our other stockholders.

We have been in the past, and may be in the future, subject to actions or proposals from activist stockholders or others that may not align with our business strategies or the interests of our other stockholders.

Responding to such actions could be costly and time-consuming, disrupt our business and operations, and divert the attention of our Board of Directors and senior management from the pursuit of our business strategies.

Activist stockholders may create perceived uncertainties as to the future direction of our business or strategy, including with respect to our ESG efforts, which may be exploited by our competitors and may make it more difficult to attract and retain qualified personnel, potential clients and business partners and may affect our relationships with current clients, vendors, investors and other third parties.

In addition, actions of activist stockholders may cause periods of fluctuation in our stock price based on temporary or

speculative market perceptions or other factors that do not necessarily reflect the underlying fundamentals and prospects of our business.

In addition, actions of activist stockholders may cause periods of fluctuation in our stock price based on temporary or speculative market perceptions or other factors that do not necessarily reflect the underlying fundamentals and prospects of our business.

We may be unable to attract and retain qualified personnel

4 unchanged sentences

It may also present operational and workplace culture challenges that may adversely affect our business.

Unresolved Staff Comments

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors