What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2022-02-24 compared with 2021-02-25 · 66 added, 78 removed, 273 unchanged (35% of the section changed)

9 unchanged sentences

The secure operation of our information technology networks and systems, and of the processing and maintenance of this information, is critical to our business operations and strategy.

Because our products and services involve the storage and transmission of personal information of consumers, we will routinely be the

target of attempted cyber and other security threats by outside third parties, including technically sophisticated and well-resourced bad actors attempting to access or steal the data we store.

Because our products and services involve the storage and transmission of personal information of consumers, we are routinely the target of attempted cyber and other security threats by outside third parties, including technically sophisticated and well-resourced bad actors attempting to access or steal the data we store.

Additionally, we could experience service disruptions or a loss of access to critical data or systems due to ransomware or other destructive attacks.

Insider or employee cyber and security threats are also a significant concern for all companies, including ours.

Despite our substantial investment in physical and technological security measures, employee training and contractual precautions, our information technology networks and infrastructure (or those of our third-party vendors and other service providers) are potentially vulnerable to unauthorized access to data or breaches of confidential information due to criminal conduct, attacks by hackers, employee or insider malfeasance and/or human error.

Despite our substantial investment in physical and technological security measures, employee training and contractual precautions, our information technology networks and infrastructure (or those of our third-party vendors and other service providers) are potentially vulnerable to unauthorized access to data, loss of access to systems or breaches of confidential information due to criminal conduct, attacks by hackers, employee or insider malfeasance and/or human error.

The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems are constantly evolving and often are not recognized until launched against a target, or even some time after.

4 unchanged sentences

In 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of personally identifiable information of U.S., Canadian and U.K.

If we experience additional breaches of our security measures, including from incidents that we fail to detect for a period of time, sensitive data may be accessed, stolen, disclosed or lost.

If we experience additional significant breaches of our security measures, including from incidents that we fail to detect for a period of time, sensitive data may be accessed, stolen, disclosed or lost.

Any such access, disclosure or other loss of information could subject us to significant litigation, regulatory fines or penalties, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or results of operations.

We cannot ensure that our insurance policies in the future will be adequate to cover losses from any future security breaches.

For example, our $125.0 million cybersecurity insurance policy was not adequate to cover the losses we have incurred to date from the 2017 cybersecurity incident.

Security breaches and the adverse publicity that may follow could also have a negative impact on our reputation and our relationship with our customers.

For example, our reputation with consumers and other stakeholders and our customer relationships were damaged following the 2017 cybersecurity incident, resulting in a negative impact on our revenue.

We cannot ensure that our insurance policies in the future will be adequate to cover losses from any security breaches.

Security breaches and attacks, and the adverse publicity that may follow, can have a negative impact on our reputation and our relationship with our customers.

For example, our reputation with consumers and other stakeholders and our customer relationships were damaged following the 2017 cybersecurity incident, resulting in a negative impact on our revenue for a period of time.

If we experience another material cybersecurity incident or are otherwise unable to demonstrate the security of our systems and the data we maintain and retain the trust of our customers, consumers and data suppliers, we could experience a substantial negative impact on our business.

6 unchanged sentences

Strategy and Market Demand Risks

Our business has been and will continue to be negatively impacted by the recent COVID-19 outbreak.

We face various risks related to health epidemics, pandemics and similar outbreaks, including the global outbreak of COVID-19 in 2020.

The COVID-19 pandemic and the mitigation efforts by governments to attempt to control its spread have adversely impacted the global economy, leading to reduced consumer spending and lending activities and disruptions and volatility in the global capital markets.

Our business has been and may continue to be negatively impacted by the COVID-19 pandemic.

We face various risks related to health epidemics, pandemics and similar outbreaks, including the COVID-19 pandemic.

Our customers, and therefore our business and revenues, are sensitive to negative changes in general economic conditions.

4 unchanged sentences

We cannot assure you that we will be successful in any such mitigation efforts.

The extent to which the coronavirus will continue to negatively impact our operations will depend on future developments which are highly uncertain and cannot be predicted with confidence, including the duration of the outbreak, new information which may emerge concerning the severity of the COVID-19 pandemic, outbreaks occurring at any of our facilities, the actions taken to control the spread of COVID-19 or treat its impact, and changes in worldwide and U.S.

The extent to which the COVID-19 pandemic will continue to negatively impact our operations will depend on future developments which are highly uncertain and cannot be predicted with confidence, including the duration of the pandemic, the emergence of new virus variants, new information which may emerge concerning the severity of the COVID-19 pandemic, outbreaks occurring at any of our facilities, the actions taken to control the spread of COVID-19 or treat its impact, and changes in worldwide and U.S.

economic conditions.

5 unchanged sentences

The failure to realize the anticipated benefits of our technology transformation strategy could adversely impact our business and financial results.

We expect our technology transformation strategy, including our transition to cloud-based technologies, will significantly increase our efficiency and productivity, the functionality of our products and services, as well as decrease the cost of our overall systems infrastructure, all of which we expect will drive growth and have a positive effect on our business, competitive position and results of operations.

We expect our technology transformation strategy, including our transition to cloud-based technologies, will significantly increase our efficiency, our productivity and the stability and functionality of our products and services, as well as decrease the cost of our overall systems infrastructure, all of which we expect will drive growth and have a positive effect on our business, competitive position and results of operations.

This initiative is a major undertaking as we replace many of our previous operating systems with cloud-based systems.

This complex, multifaceted and extensive initiative is expensive and may cause material unanticipated problems and expenses.

If our new systems do not operate as expected, or the data we transition to the cloud changes in a material way, we may have to incur significant additional costs to make modifications and could lose customers as a result.

Moreover, we may experience issues with customer migration, as many of our customers may not migrate to cloud-based technologies on a timely basis or at all or may choose not to utilize our products and services during and after our transition to cloud-based technologies.

If the transition causes errors or adversely impacts system processes, our new systems do not operate as expected, or the data we transition to the cloud changes in a material way, we may have to incur significant additional costs to make modifications and could lose customers and we may suffer reputational harm as a result.

We cannot assure you that our technology transformation strategy will be beneficial to the extent, or within the timeframes expected, or that the estimated efficiency, cost savings and other improvements will be realized as anticipated or at all.

4 unchanged sentences

The loss of access to credit, employment, financial and other data from external sources could harm our ability to provide our products and services.

We rely extensively upon data from external sources to maintain our proprietary and non-proprietary databases, including data received from customers, strategic partners and various government and public record sources.

This data includes the widespread and voluntary contribution of credit data from most lenders in the U.S and many other markets as well as the contribution of data under proprietary contractual agreements, such as employers’ contribution of employment and income data to The Work Number ® and telecommunications, cable and utility companies’ contribution of payment and fraud data to the National Cable, Telecommunications and Utility Exchange.

For a variety of reasons, including concerns of data furnishers arising out of the 2017 cybersecurity incident, legislatively or judicially imposed restrictions on use, additional security breaches or competitive reasons, our data sources could withdraw, delay receipt of or increase the cost of their data provided to us.

We rely extensively upon data from external sources to maintain our proprietary and non-proprietary databases, including data received from customers, licensors, furnishers, strategic partners and various government and public record sources.

This data includes the widespread and voluntary contribution of credit data from most lenders in the U.S.

and many other markets as well as the contribution of data under proprietary contractual agreements, such as employers’ contribution of employment and income data to The Work Number ® and telecommunications, cable and utility companies’ contribution of payment and fraud data to the National Cable, Telecommunications and Utility Exchange.

For a variety of reasons, including concerns of data furnishers arising out of legislatively or judicially imposed restrictions on use, security breaches or competitive reasons, our data sources could withdraw, delay receipt of or increase the cost of their data provided to us.

Where we currently have exclusive use of data, the providers of the data sources could elect to make the information available to competitors.

We also compete with several of our third-party data suppliers.

If a substantial number of data sources or certain key data sources were to withdraw or be unable to provide their data, if we were to lose access to data

due to government regulation, if we lose exclusive right to the use of data, or if the collection, disclosure or use of data becomes uneconomical, our ability to provide products and services to our clients could be adversely affected, which could result in decreased revenue, net income and earnings per share and reputational loss.

If a substantial number of data sources or certain key data sources were to withdraw or be unable to provide their data, if we were to lose access to data due to government regulation, if we lose exclusive right to the use of data, or if the collection, disclosure or use of data becomes uneconomical, our ability to provide products and services to our customers could be adversely affected, which could result in decreased revenue, net income and earnings per share and reputational loss.

There can be no assurance that we would be able to obtain data from alternative sources if our current sources become unavailable.

Negative changes in general economic conditions, including interest rates, unemployment rates, income, home prices, investment values and consumer confidence, could adversely affect us.

Our customers, and therefore our business and revenues, are sensitive to negative changes in general economic conditions, including the demand and availability of affordable credit and capital, the level and volatility of interest rates, inflation, employment levels, consumer confidence and housing demand, both inside and outside the United States.

Negative changes in general economic conditions, including interest rates, the level of inflation, unemployment rates, income, home prices, investment values and consumer confidence, could adversely affect us.

Our customers, and therefore our business and revenues, are sensitive to negative changes in general economic conditions, including the demand and availability of affordable credit and capital, the level and volatility of interest rates, the level of inflation, employment levels, consumer confidence and housing demand, both inside and outside the United States.

Business customers use our credit information and related analytical services and data to process applications for new credit cards, automobile loans, home and equity loans and other consumer loans, and to manage their existing credit relationships.

Demand for our services tends to be correlated to general levels of economic activity and to consumer credit activity, which can be impacted by changes in interest rates.

Demand for our services tends to be correlated to general levels of economic activity and to consumer credit activity, which can be impacted by changes in interest rates and the level of inflation.

Banks’ and other lenders’ willingness to extend credit are adversely affected by elevated consumer delinquency and loan losses in a weak economy.

2 unchanged sentences

High or rising rates of unemployment and interest, declines in income, home prices or investment values, lower consumer confidence and reduced access to credit adversely affect demand for many of our products and services, and consequently our revenue and results of operations, as consumers may postpone or reduce their spending and use of credit, and lenders may reduce the amount of credit offered or available.

In 2022, we expect U.S.

mortgage market inquiries to decline by more than 20 percent compared to 2021.

Any change in the U.S.

mortgage market due to a significant change in mortgage inquiries could have a corresponding negative impact on revenue and operating profit for our business, primarily within the Workforce Solutions and USIS operating segments.

To the extent inflation results in rising interest rates and has other adverse effects upon the securities markets and upon the value of financial instruments, it may adversely affect our financial position and profitability.

Our markets are highly competitive and new product introductions and pricing strategies being offered by our competitors could decrease our sales and market share or require us to enhance our products and services or reduce our prices in a manner that reduces our revenue and operating margins.

19 unchanged sentences

The loss of one or more of our major customers or business partners could adversely affect our business, financial condition and results of operations.

If we do not introduce successful new products, services and analytical capabilities in a timely manner, or if the market does not adopt our new services, our competitiveness and operating results will suffer.

We generally sell our products in industries that are characterized by rapid technological changes, frequent new product and service introductions and changing industry standards.

If we do not introduce successful new products, services and analytical capabilities in a timely manner, or if the market does not adopt our new services, or if new technologies are introduced by competitors that are more effective or at lower costs than ours, our competitiveness and operating results will suffer.

We generally sell our products in industries that are characterized by rapid technological changes, including the introduction of new innovative technologies, frequent new product and service introductions and changing industry standards.

In addition, certain of the markets in which we operate are seasonal and cyclical.

Without the timely introduction of new products, services and enhancements, our products and services will become technologically or commercially obsolete over time, in which case our revenue and operating results would suffer.

Without the timely introduction of new technologies, products, services and enhancements, our products and services will become technologically or commercially obsolete over time, in which case our revenue and operating results would suffer.

The success of our new products and services will depend on several factors, including our ability to properly identify customer needs;

7 unchanged sentences

Our resources have to be committed to any new products and services before knowing whether the market will adopt the new offerings.

In addition, our management is and will continue to be intensely focused on enhancing our security measures and our technology transformation and may not be able to devote as much time or resources to new product development, which could cause us to be less competitive as compared to our peers, lose out on new revenue opportunities and have an adverse effect on our growth and our business.

The demand for some of our products and services may be negatively impacted to the extent the availability of free or less expensive consumer information increases.

Public or commercial sources of free or relatively inexpensive consumer credit, credit score and other information have become increasingly available, particularly through the internet, and this trend is expected to continue.

In addition, governmental agencies in particular have increased the amount of information to which they provide free public access and these or other sources of free or relatively inexpensive consumer information from competitors or other commercial sources may reduce demand for our services, particularly in our USIS and Global Consumer Solutions business units.

Recently, there also has been an increase in companies offering free or low-cost direct-to-consumer credit services (such as credit scores, reports and monitoring) as part of alternative business models that use such services as a means to introduce consumers to other products and services.

1 unchanged sentence

We rely, in part, on acquisitions, joint ventures and other alliances to grow our business and expand our geographic reach.

The acquisition, integration or divestiture of businesses by us may not produce the expected financial, operating results or IT and data security profile we expect.

The acquisition, integration or divestiture of businesses by us may not produce the expected financial or operating results or IT and data security profile we expect.

In addition, if we are unable to make acquisitions or successfully develop and maintain joint ventures and other alliances, our growth may be adversely impacted.

4 unchanged sentences

This may result in significantly greater transaction, remediation and integration costs for future acquisitions than we have experienced historically, or it could mean that we will not pursue certain acquisitions where the costs of integration and remediation are too significant.

We may also have difficulty integrating and operating businesses in countries and geographies where we do not currently have a significant presence, and acquisitions of businesses having a significant presence outside of the U.S.

We may also have difficulty integrating and operating businesses in geographies and markets or market segments where we do not currently have a significant presence, and acquisitions of businesses having a significant presence outside of the U.S.

will increase our exposure to risks of conducting operations in international markets.

These difficulties could disrupt our ongoing business,

distract our management and workforce, increase our expenses and adversely affect our operating results and financial condition.

These difficulties could disrupt our ongoing business, distract our management and workforce, increase our expenses and adversely affect our operating results and financial condition.

Despite our past experience, opportunities to grow our business through acquisitions, joint ventures and other alliances may not be available to us in the future.

In addition, our focus on data security and our technology transformation strategy, including our migration to cloud-based technologies may limit our ability to identify and complete acquisitions as we will have less time and resources to devote to identifying suitable acquisition candidates and our technological criteria and standards for acquisition candidates may increase.

In addition, our focus on data security and our technology transformation strategy, including our migration to cloud-based technologies, may limit our ability to identify and complete acquisitions as our stringent technological criteria and standards for acquisition candidates may continue to increase.

If our government contracts are terminated, if we are suspended from government work, or if our ability to compete for new contracts is adversely affected, our business could suffer.

We derive a portion of our revenue from direct and indirect sales to U.S., state and local governments and their respective agencies.

We derive a portion of our revenue from direct and indirect sales to U.S.

federal, state and local governments and their respective agencies.

We also derive a portion of our revenue from sales to foreign governments and related agencies.

Such contracts are subject to various procurement laws and regulations, and contract provisions relating to their formation, administration and performance.

2 unchanged sentences

If we experience another material cybersecurity incident, if public scrutiny and pressure related to government services we support turns negative or if we experience uptime issues or performance problems, our ability to maintain existing or acquire new government contracts may be substantially impacted.

Also, the government programs to which we provide services, or which are the bases of compliance services we provide non-governmental clients, including, in particular, the employer requirements under the Affordable Care Act, may be terminated or substantially altered by the government and our services would no longer be needed.

If our government contracts are terminated, if we are suspended from government work, if the services we provide are no longer needed due to government program change or termination, or if our ability to compete for new contracts is adversely affected, our business could suffer.

Operational Risks

Our technology transformation strategy places a significant strain on our management, operational, financial and other limited resources.

As part of our technology transformation strategy, we are transitioning and migrating our data systems from traditional data centers to cloud-based platforms.

This initiative places significant strain on our management, personnel, operations, systems, technical performance and financial resources and internal financial control and reporting function.

In addition, many of our existing personnel do not have experience with native cloud-based technologies and, as a result, we have and will continue to hire personnel with such experience.

As part of our technology transformation strategy, we are transitioning and migrating our data systems from traditional, on premises data centers to cloud-based platforms.

This initiative places significant strain on our management, personnel, operations, systems, technical performance, financial resources, internal financial controls and reporting function.

In addition, many of our existing personnel have limited experience with native cloud-based technologies.

This effort has been, and will continue to be, time consuming and costly.

8 unchanged sentences

As part of our technology transformation strategy, we are upgrading a significant portion of the information technology systems used to operate our business and replacing them with cloud-based solutions.

This transition will require substantial changes to our software and network infrastructure, which could lead to system interruptions, affect our data systems and further expose us to

operational disruptions, and cause us to lose customers, all of which could have a material adverse effect on our results of operations.

This transition will continue to require substantial changes to our software and network infrastructure, which could lead to system interruptions, affect our data systems and further expose us to operational disruptions, and cause us to lose customers, all of which could have a material adverse effect on our results of operations.

Upon implementation of the new cloud-based solutions, much of our information technology systems will consist of outsourced, cloud-based infrastructure, platform and software-as-a-service solutions not under our direct management or control.

7 unchanged sentences

These systems and operations, and the personnel that support, service and operate these systems, could be exposed to interruption, damage or destruction from power loss, telecommunication failures, computer viruses, denial-of-service or other cyber attacks, employee or insider malfeasance, human error, fire, natural disasters, war, terrorist acts or civil unrest.

We may not have sufficient disaster recovery or redundant operations in place to cover a loss or failure of systems or telecommunications links in a timely manner.

We may not have sufficient disaster recovery or redundant operations in place to cover a loss or failure of systems or telecommunications links in a timely manner, which may be exacerbated by any delays in obtaining equipment due to supply chain or other impacts.

In addition, as part of our technology transformation, we are seeking to migrate our customers from traditional data platforms to cloud-based products and services.

Many of our customers may not migrate to cloud-based technologies on a timely basis or at all, or may choose not to utilize our products and services during and after our transition to cloud-based technologies.

If our customers’ timelines prevent them from migrating to cloud-based technologies quickly enough, they will remain on our legacy infrastructure, which could expose them to system availability and response time performance issues.

Many of our customers may not migrate to cloud-based technologies on a timely basis or at all, or may choose not to utilize our products and services during and after our transition to cloud-based

technologies.

Any significant system interruption or series of minor interruptions could result in the loss of customers and/or lost revenues, lower margins, service level penalties or other significant harm to our business or reputation.

7 unchanged sentences

Our future success, including our ability to implement our technology transformation strategy, depends partly on the continued service of our key development, sales, marketing, executive and administrative personnel.

Additionally, increased retention risk exists in certain key areas of our operations, such as IT and data security, which require specialized skills, such as migrating legacy computer systems to the cloud, data security expertise and analytical modeling.

Increased retention risk exists in certain key areas of our operations, such as IT and data security, which require specialized skills, such as migrating legacy computer systems to the cloud, data security expertise and analytical modeling.

Additionally, the worker shortage that emerged following the outbreak of COVID-19 has presented increased challenges to our ability to develop, retain and attract qualified personnel.

If we fail to retain and hire a sufficient number of these personnel, we will not be able to maintain or expand our business.

18 unchanged sentences

• implementation of exchange controls;

• geopolitical instability, including terrorism and war;

• geopolitical instability, including terrorism and war, including the evolving situation involving Ukraine and Russia;

• foreign currency changes;

21 unchanged sentences

Compliance with applicable U.S.

and foreign laws and regulations, such as anti-corruption laws, tax laws, foreign exchange controls and restrictions on repatriation of earnings or other similar restraints, data privacy requirements, labor laws and anti-competition relations increases the cost of doing business in foreign jurisdictions.

and foreign laws and regulations, such as anti-corruption laws, tax laws, foreign exchange controls and restrictions on repatriation of earnings or other similar restraints, data privacy requirements, labor laws and anti-competition regulations increases the cost of doing business in foreign jurisdictions.

Although we have implemented policies and procedures to comply with these laws and regulations, a violation by our employees, contractors or agents could nevertheless occur.

The U.K.’s departure from the EU could adversely affect us.

We are subject to risks and uncertainties associated with the U.K.’s withdrawal from the EU (referred to as “Brexit”), including implications for the free flow of labor and goods in the U.K.

and the EU and other financial, legal, tax and trade implications.

Brexit could cause disruptions to and create uncertainty surrounding our business in the U.K., including affecting

our relationships with our existing and future customers, suppliers and employees, which could have an adverse effect on our business, financial results and operations.

Legal and Regulatory Risks

1 unchanged sentence

Consumer MDL Litigation and certain federal and state government investigations arising out of the 2017 cybersecurity incident.

If we are unable to comply with our obligations under these agreements, if the U.S.

Consumer MDL Litigation settlement is not upheld on appeal, or if other lawsuits or investigations are filed or commenced, it could have a material adverse effect on our financial condition.

If we are unable to comply with our obligations under these agreements, it could have a material adverse effect on our financial condition.

In July 2019, the Company entered into multiple agreements that resolve the U.S.

5 unchanged sentences

On January 13, 2020, the U.S.

District Court for the Northern District of Georgia (the “Court”) entered an order granting final approval of the settlement in connection with the U.S.

Consumer MDL Litigation, from which several objectors have appealed.

Until the appeals are finally adjudicated or dismissed and the settlement becomes final in accordance with its terms, we can provide no assurance that the U.S.

Consumer MDL Litigation will be resolved as contemplated by the settlement agreement.

If the Court’s order approving the settlement agreement was overturned by an appellate court and not cured in accordance with the terms of the consent orders with the FTC and CFPB, the consent orders with the FTC, CFPB and MSAG Group would remain in place and the Consumer Restitution Fund (as defined below) would be administered by the FTC.

In that event, there is a risk that we would not be able to settle the U.S.

Consumer MDL Litigation on acceptable terms or at all, which could have a material adverse effect on our financial condition.

District Court for the Northern District of Georgia (the “MDL Court”) entered an order granting final approval of the settlement in connection with the U.S.

Consumer MDL Litigation, from which several objectors appealed.

Those appeals have all been resolved.

On January 11, 2022, the Consumer Settlement became effective which triggered our obligation to deposit approximately $345 million into the consumer settlement fund.

In addition to the monetary payments and consumer redress, we also agreed as part of the Consumer Settlement to implement certain business practice commitments related to consumer assistance and our information security program, including third party assessments of our program.

1 unchanged sentence

To the extent we are unable to comply or we are viewed as not being in compliance with these business practice commitments or other requirements of a relevant order, we could face an enforcement action or contempt proceeding that could potentially result in fines, penalties and new business practice commitments, which, depending on the amount and type, could have a material adverse effect on our financial condition.

In addition, other lawsuits and investigations related to the 2017 cybersecurity incident are still outstanding and additional lawsuits or investigations may be filed, commenced or issued.

The resolution of these additional matters may result in damages, costs, fines or penalties, which, depending on the amount, could be material to the Company’s consolidated financial condition, results of operations, or cash flows in future periods.

Any future losses we incur as a result of the incident will not be covered by insurance.

In addition, we may be required to deposit additional amounts in the consumer settlement fund under certain circumstances if the fund is insufficient to cover claims and certain expenses.

While we do not believe that we will be required to deposit additional amounts into the consumer settlement fund based on our claims experience to date, we could be obligated to fund up to an additional $125 million if our claims experience changes and the consumer fund is exhausted.

We and our customers are subject to various current laws and governmental regulations, and could be affected by new and evolving consumer privacy and cybersecurity or other data-related laws or regulations, compliance with which may cause us to incur significant expenses and change our business practices, and if we fail to maintain satisfactory compliance with certain laws and regulations, we could be subject to civil or criminal penalties.

5 unchanged sentences

In addition, new laws and regulations at the state and federal level are enacted or considered frequently.

Examples of such new and evolving laws and regulations include amendments to the FCRA requiring the provision of free credit freezes to consumers, cybersecurity and other requirements promulgated by the New York Department of Financial Services, the CCPA which took effect on January 1, 2020, the California data broker registration requirements that took effect on January 31, 2020, and the CPRA taking effect on January 1, 2023.

Furthermore, we expect there to be an increased focus on laws and regulations related to our business, including by the new U.S.

presidential administration and the new U.S.

Congress, because of the great public concern in the U.S.

Furthermore, we expect there to be an increased focus on laws and regulations related to our business, including by the current U.S.

presidential administration and the U.S.

Congress, because of the growing policy concerns in the U.S.

with regard to the operation of credit reporting agencies, as well as the collection, use, accuracy, correction and sharing of personal information.

We also use algorithms, artificial intelligence and machine learning in our business processes.

There are a number of legislative proposals pending before the U.S.

Congress, various state legislative bodies and foreign governments concerning privacy or cybersecurity that could affect us.

The Canadian government has initiated a review of consumer privacy laws, and

The Canadian government has initiated a review of consumer privacy laws, and several U.S.

states have introduced varying comprehensive privacy laws modeled to some degree on the CCPA and/or the GDPR.

6 unchanged sentences

We devote substantial compliance, legal and operational business resources to strive for compliance with applicable regulations and requirements.

In the future, we may be subject to significant additional expense related to compliance with applicable laws and regulations, including new laws and evolving interpretations that are difficult to predict, and to investigate, defend or remedy actual or alleged violations.

In the future, we may be subject to significant additional expenses related to compliance with applicable laws and regulations, including new laws and evolving interpretations that are difficult to predict, and to investigate, defend or remedy actual or alleged violations.

Additionally, we cooperate with CFPB supervisory examinations and respond to other state, federal and foreign government examinations of or inquiries into our business practices.

28 unchanged sentences

The federal banking agencies, including the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System and the CFPB, as well as many state banking agencies have issued guidance to insured depository institutions and other providers of financial services on assessing and managing risks associated with third-party relationships, which include all business arrangements between a financial services provider and another entity, by contract or otherwise, and generally requires banks and financial services providers to exercise comprehensive oversight throughout each phase of a bank or financial service provider’s business arrangement with third-party service providers, and instructs banks and financial service providers to adopt risk management processes commensurate with the level of risk and complexity of their third-party relationships.

This guidance requires more rigorous oversight of third-party relationships that involve certain “critical activities.” In light of this guidance, our existing or potential bank and financial services customers subject to this guidance may continue to revise their third-party risk management policies and processes and the terms on which they do business with us, which may adversely affect our relationship with such customers.

In 2018, we entered into a consent order with certain state banking regulators in response to their multi-state review of our information security program.

This consent order obligates us to, among other things, make certain changes to our corporate governance and information security practices.

If we are unable or otherwise fail to comply with this consent order, our ability to do business with financial institutions in those states could be impaired.

It is possible that the consent order or other actions resulting from examinations by federal or state banking regulators could lead to adverse changes in our customer relationships.

We are regularly involved in claims, suits, government investigations, supervisory examinations and other proceedings that may result in adverse outcomes.

9 unchanged sentences

We analyze and take action in response to each such claim on a case by case basis.

A dispute or litigation regarding patents or other intellectual property can be costly and time-consuming due to the complexity of our technology and the inherent uncertainty of intellectual property litigation, could divert our management and key personnel from

our business operations, and we may not prevail.

A claim of intellectual property infringement could force us to enter into a costly or restrictive license agreement, which might not be available under acceptable terms or at all, or could subject us to significant damages or to an injunction against development and sale of certain of our products or services.

21 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors