What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-22 compared with 2023-02-23 · 66 added, 74 removed, 276 unchanged (34% of the section changed)

12 unchanged sentences

Insider or employee cyber and security threats are also a significant concern for all companies, including ours.

Despite our substantial investment in physical and technological security

measures, employee training and contractual precautions, our information technology networks and infrastructure (or those of our third-party vendors and other service providers) are potentially vulnerable to unauthorized access to data, loss of access to systems or breaches of confidential information due to criminal conduct, attacks by hackers, employee or insider malfeasance and/or human error.

Despite our substantial investment in physical and technological security measures, employee training and contractual precautions, our information technology networks and infrastructure (or those of our third-party vendors and other service providers) are potentially vulnerable to unauthorized access to data, loss of access to systems or breaches of confidential information due to criminal conduct, attacks by hackers, employee or insider malfeasance and/or human error.

The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems are constantly evolving and often are not recognized until launched against a target, or even some time after.

3 unchanged sentences

Although we have developed systems and processes that are designed to protect our data and customer data and to prevent data loss and other security breaches, and expect to continue to expend significant additional resources to bolster these protections, these security measures cannot provide absolute security.

In 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of personal information of U.S., Canadian and U.K.

If we experience additional significant breaches of our security measures, including from incidents that we fail to detect for a period of time, sensitive data may be accessed, stolen, disclosed or lost.

Any such access, disclosure or other loss of information could subject us to significant litigation, regulatory fines or penalties, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or results of operations.

We cannot ensure that our insurance policies in the future will be adequate to cover losses from any security breaches.

We previously experienced a material cybersecurity incident in 2017 and if we experience additional breaches of our security measures, including from incidents that we fail to detect for a period of time, sensitive data may be accessed, stolen, disclosed or lost.

Any such access, disclosure or other loss of information could subject us to business interruption, significant litigation, regulatory fines or penalties, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or results of operations.

While we maintain cybersecurity insurance, we cannot ensure that our insurance policies in the future will be adequate to cover losses from any security breaches.

Security breaches and attacks, and the adverse publicity that may follow, can have a negative impact on our reputation and our relationship with our customers.

For example, our reputation with consumers and other stakeholders and our customer relationships were damaged following the 2017 cybersecurity incident, resulting in a negative impact on our revenue for a period of time.

For example, our reputation with consumers and other stakeholders and our customer relationships were damaged following the cybersecurity incident in 2017, resulting in a negative impact on our revenue for a period of time.

If we experience another material cybersecurity incident or are otherwise unable to demonstrate the security of our systems and the data we maintain and retain the trust of our customers, consumers and data suppliers, we could experience a substantial negative impact on our business.

2 unchanged sentences

Such certifications are critical to our business because certain of our current and potential customers and the contracts governing certain customer relationships, as well as certain of our data suppliers, require us to maintain them as a requirement of doing business.

For example, as a result of the 2017 cybersecurity incident, we lost certain key certifications which caused certain customers and business partners to stop or pause doing business with us and temporarily limited our ability to win new business.

For example, as a result of a prior material cybersecurity incident, we lost certain key certifications which caused certain customers and business partners to stop or pause doing business with us and temporarily limited our ability to win new business.

We had to spend significant resources on remediation activities in order to obtain these key re-certifications.

6 unchanged sentences

If the transition causes errors or adversely impacts system processes, our new systems do not operate as expected, or the data we transition to the cloud changes in a material way, we may have to incur significant additional costs to make modifications and could lose customers and we may suffer reputational harm as a result.

Moreover, we may experience issues with customer migration, as many of our customers may not

migrate to cloud-based technologies on a timely basis or at all or may choose not to utilize our products and services during and after our transition to cloud-based technologies, which could negatively impact our revenue.

We cannot assure you that our technology transformation strategy will be beneficial to the extent, or within the timeframes expected, or that the estimated efficiency, cost savings and other improvements will be realized as anticipated or at all.

Moreover, we have experienced issues with customer migration, as some of our customers may not migrate to cloud-based technologies on a timely basis or at all or may choose not to utilize our products and services during and after our transition to cloud-based technologies, which could negatively impact our revenue.

Market acceptance of cloud-based offerings is affected by a variety of factors, including information security, reliability, performance, the sufficiency of technological infrastructure to support our products and services in certain geographies, customer and data provider concerns with entrusting a third party to store and manage its data as well as the customer’s ability to access this data once a contract has expired, and consumer concerns regarding data privacy and the enactment of laws or regulations that restrict our ability to provide such services to customers.

5 unchanged sentences

This data includes the widespread and voluntary contribution of credit data from most lenders in the U.S.

and many other markets as well as the contribution of data under proprietary contractual agreements, such as employers’ contribution of employment and income data to The Work Number ® and telecommunications, cable and utility companies’ contribution of payment and fraud data to the National Cable, Telecommunications and Utility Exchange.

For a variety of reasons, including concerns of data furnishers arising out of legislatively or judicially imposed restrictions on use, security breaches or competitive reasons, our data sources could withdraw, delay receipt of or increase the cost of the data they provide to us.

1 unchanged sentence

We also compete with several of our third-party data suppliers.

If a substantial number of data sources or certain key data sources were to withdraw or be unable to provide their data, if we were to lose access to data due to government regulation, if we lose exclusive right to the use of data, or if the collection, disclosure or use of data becomes uneconomical, our ability to provide products and services to our customers could be adversely affected, which could result in decreased revenue, net income and earnings per share and reputational loss.

If a substantial number of data sources or certain key data sources were to withdraw or be unable to provide their data, if we were to lose access to data due to government regulation, if we lose our right to the use of data, or if the collection, disclosure or use of data becomes uneconomical, our ability to provide products and services to our customers could be adversely affected, which could result in decreased revenue, net income and earnings per share and reputational loss.

There can be no assurance that we would be able to obtain data from alternative sources if our current sources become unavailable.

5 unchanged sentences

Consumer demand for credit (i.e., rates of spending and levels of indebtedness) also tends to grow more slowly or decline during periods of economic contraction or slow economic growth.

Our customer base suffers when financial markets experience volatility, illiquidity and disruption, and the potential for increased and continuing disruptions going forward presents considerable risks to our business and revenue.

Our customer base suffers when financial markets experience volatility, illiquidity and disruption, and the potential for disruptions going forward presents considerable risks to our business and revenue.

High or rising rates of unemployment and interest, declines in income, home prices or investment values, lower consumer confidence and reduced access to credit adversely affect demand for many of our products and services, and consequently our revenue and results of operations, as consumers may postpone or reduce their spending and use of credit, and lenders may reduce the amount of credit offered or available.

In 2023, we expect U.S.

mortgage market originations to decline by approximately 30% compared to 2022.

In 2024, we expect the U.S.

mortgage market, as measured by credit inquiries, to decline by approximately 16% compared to 2023.

Any weakening in the U.S.

mortgage market resulting in a significant reduction in mortgage originations could have a corresponding negative impact on revenue and operating profit for our business, primarily within the Workforce Solutions and USIS operating

To the extent inflation results in rising interest rates and has other adverse effects upon the securities markets and upon the value of financial instruments, it may adversely affect our financial position and profitability.

To the extent inflation results in higher interest rates and has other adverse effects upon the securities markets and upon the value of financial instruments, it may adversely affect our financial position and profitability.

Our markets are highly competitive and new product introductions and pricing strategies being offered by our competitors could decrease our sales and market share or require us to enhance our products and services or reduce our prices in a manner that reduces our revenue and operating margins.

7 unchanged sentences

Moreover, new competitors or alliances among our competitors may emerge and potentially reduce our market share, revenue or margins.

We also sell our information to competing firms, and buy information from certain of our competitors, in order to sell “tri-bureau” and other products, most notably into the U.S.

We also license our information to competing firms, and license information from certain of our competitors, in order to sell “tri-bureau” and other products, most notably into the U.S.

mortgage market.

22 unchanged sentences

Our resources have to be committed to any new products and services before knowing whether the market will adopt the new offerings.

We may face risks associated with our use of certain artificial intelligence and machine learning models.

We use artificial intelligence and machine learning models in the development of some of our products.

The models that we use are developed or trained using various data sets.

If the models are incorrectly designed, the data we use to train them is incomplete, inadequate, or biased in some way, or if we do not have sufficient rights to use the data on which our models rely, the performance of our products and business, as well as our reputation, could suffer or we could incur liability through the violation of laws, third-party privacy, or other rights, or contracts to which we are a party.

In addition, these risks include the possibility of new or enhanced governmental or regulatory scrutiny, litigation, or other legal liability, ethical concerns, negative consumer perceptions as to artificial intelligence, or other complications that could adversely affect our business, reputation, or financial results.

In particular, our use of artificial intelligence in credit decisioning could lead to enhanced scrutiny.

Further, our competitors or other third parties may incorporate artificial intelligence into their products more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations.

The demand for some of our products and services may be negatively impacted to the extent the availability of free or less expensive consumer information increases.

Public or commercial sources of free or relatively inexpensive consumer credit, credit score and other information have become increasingly available, particularly through the internet, and this trend is expected to continue.

Public or commercial sources of free or relatively inexpensive consumer credit, credit score and other information have become increasingly available, and this trend is expected to continue.

Free sources of consumer employment and income information, such as paystubs, have always existed and could impact demand for our products and services in the event that customers determine such data is sufficient to meet their needs.

In addition, governmental agencies in particular have increased the amount of information to which they provide free public access and these or other sources of free or relatively inexpensive consumer information from competitors or other commercial sources may reduce demand for our services.

20 unchanged sentences

Failure to comply with these laws, regulations or provisions in our government contracts could result in the imposition of various civil and criminal penalties, termination of contracts, forfeiture of profits, suspension of payments or suspension of future government contracting.

A number of our federal government contracts have received enhanced scrutiny and media attention due to the sensitive nature of the data we handle and due to the importance of the government programs we support.

If we experience another material cybersecurity incident, if public or legislative scrutiny and pressure related to government services we support turns negative or if we experience uptime issues or performance problems, our ability to maintain existing or acquire new government contracts may be substantially impacted.

A number of our U.S.

federal and state government contracts receive enhanced scrutiny and media attention due to the sensitive nature of the data we handle and due to the importance of the government programs we support.

If we experience another material cybersecurity incident, if public or legislative scrutiny and pressure leads to reduced use of data by government agencies, or if we experience uptime issues or performance problems, our ability to maintain existing or acquire new government contracts may be substantially impacted.

If our government contracts are terminated, if we are suspended from government work, if the services we provide are no longer needed due to government program change or termination, or if our ability to compete for new contracts is adversely affected, including by our failure to achieve certain government certifications, our business could suffer.

Our business has been and may continue to be negatively impacted by health epidemics, pandemics and similar outbreaks, including the COVID-19 pandemic.

Our business has been and may continue to be negatively impacted by health epidemics, pandemics and similar outbreaks.

We face various risks related to health epidemics, pandemics and similar outbreaks.

For example, the COVID-19 pandemic and the mitigation efforts by governments to attempt to control its spread adversely impacted the global economy, leading to reduced consumer spending and lending activities.

For example, the COVID-19 pandemic and the mitigation efforts by governments to attempt to control its spread adversely impacted the global economy and led to reduced consumer spending and lending activities.

Our customers, and therefore our business and revenues, are sensitive to negative changes in general economic conditions.

1 unchanged sentence

Our reputation and/or business could be negatively impacted by ESG matters and/or our reporting of such matters.

There is an increasing focus from regulators, certain investors, and other stakeholders concerning environmental, social and governance ("ESG") matters, both in the United States and internationally.

We communicate certain ESG-related initiatives, goals, and/or commitments regarding environmental matters, diversity, responsible sourcing and social investments, and other matters, on our website, in our filings with the SEC, and elsewhere.

These initiatives, goals, or commitments could be difficult to achieve and costly to implement.

For example, in 2021, we announced our commitment to reach net-zero greenhouse gas emissions by 2040, the achievement of which relies, in large part, on the accuracy of our estimates and assumptions around the availability and cost of low- or non-carbon based energy sources and technologies, the availability of suppliers that can meet our sustainability and other standards, and other factors.

We could fail to achieve, or be perceived to fail to achieve, our net zero 2040 commitment or other ESG-related initiatives, goals or commitments.

In addition, we could be criticized for the timing, scope or nature of these initiatives, goals or commitments, or for any revisions to them.

Over the past several years, regulators, certain investors, and other stakeholders have focused on various environmental, social and governance ("ESG") matters, both in the United States and internationally.

We communicate certain ESG-related initiatives, goals and commitments regarding climate, diversity, responsible sourcing and social investments, and other matters, on our website, in our filings with the SEC and elsewhere.

These initiatives, goals and commitments could be difficult to achieve and costly to implement.

For example, we have announced our commitments to reduce our greenhouse gas emissions, the achievement of which relies, in large part, on the accuracy of our estimates and assumptions around the availability and cost of renewable energy sources and technologies, the availability of suppliers that can meet our sustainability and other standards, and other factors.

We could fail to achieve, or be perceived to fail to achieve, our greenhouse gas reduction commitments or other ESG-related initiatives, goals and commitments.

In addition, we could be criticized for the timing, scope or nature of these initiatives, goals and commitments, or for any revisions to them.

To the extent that our required and voluntary disclosures about ESG matters increase, we could be criticized for the accuracy, adequacy or completeness of such disclosures.

Our actual or perceived failure to achieve our ESG-related initiatives, goals or commitments could negatively impact our reputation or otherwise materially harm our business.

Our actual or perceived failure to achieve our ESG-related initiatives, goals and commitments could negatively impact our reputation or otherwise materially harm our business.

Operational Risks

Our technology transformation strategy places a significant strain on our management, operational, financial and other limited resources.

Our technology transformation strategy places a significant strain on our management, operational, financial and other resources.

As part of our technology transformation strategy, we are transitioning and migrating our data systems from traditional, on premises data centers to cloud-based platforms.

This initiative places significant strain on our management, personnel, operations, systems, technical performance, financial resources, internal financial controls and reporting function.

In addition, many of our existing personnel have limited experience with native cloud-based technologies.

This effort has been, and will continue to be, time consuming and costly.

Our technology transformation strategy requires management time and resources to educate employees and implement new ways of conducting business.

The dedication of resources to our technology transformation strategy and cloud-based technologies limits the resources we have available to devote to other initiatives or growth opportunities, or to invest in the maintenance of our existing internal systems.

We cannot guarantee that our strategy is the right one or that investments in alternative technologies or other initiatives would not be a better use of our limited resources.

We cannot guarantee that our strategy is the right one or that investments in alternative technologies or other initiatives would not be a better use of our resources.

Additionally, as a result of our cloud migration efforts in connection with our technology transformation strategy, we may experience a loss of continuity, loss of accumulated knowledge or loss of efficiency during transitional periods.

Reorganization and transition can require a significant amount of management and other employees’ time and focus, which may divert attention from operating activities and growing our business.

Reorganization and transition can require a significant amount of management and other employees’ time and focus, which may

divert attention from operating activities and growing our business.

If we fail to achieve some or all of the expected benefits of these activities, it could have a material adverse effect on our competitive position, business, financial condition, results of operations and cash flows.

22 unchanged sentences

In addition, as part of our technology transformation, we are seeking to migrate our customers from traditional data platforms to cloud-based products and services.

Many of our customers may not migrate to cloud-based technologies on a timely basis or at all, or may choose not to utilize our products and services during and after our transition to cloud-based technologies.

Some of our customers may not migrate to cloud-based technologies on a timely basis or at all, or may choose not to utilize our products and services during and after our transition to cloud-based technologies.

If our customers’ timelines prevent them from migrating to cloud-based technologies quickly enough, they will remain on our legacy infrastructure, which could expose them to system availability, response time and performance issues.

9 unchanged sentences

Increased retention risk exists in certain key areas of our operations, such as IT and data security, which require specialized skills, such as migrating legacy computer systems to the cloud, data security expertise and analytical modeling.

Additionally, the worker shortage that emerged following the outbreak of COVID-19 has presented increased challenges to our ability to develop, retain and attract qualified personnel.

If we fail to retain and hire a sufficient number of these personnel, we will not be able to maintain or expand our business.

13 unchanged sentences

• data privacy and consumer protection laws and regulations;

• antitrust and competition laws;

• difficulty in staffing and managing widespread operations;

3 unchanged sentences

• implementation of exchange controls;

• geopolitical instability, including terrorism and war, including the Russia-Ukraine war;

• geopolitical instability, including terrorism and war and international conflict, including the Russia-Ukraine war and the Israel-Palestine conflict;

• foreign currency changes;

17 unchanged sentences

We generally do not mitigate the risks associated with fluctuating exchange rates, although we may from time to time through forward contracts or other derivative instruments hedge a portion of our translational foreign currency exposure or exchange rate risks associated with material transactions which are denominated in a foreign currency.

The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are

The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place.

Accordingly, fluctuations in foreign currency exchange rates, particularly the strengthening of the U.S.

1 unchanged sentence

Compliance with applicable U.S.

and foreign laws and regulations, such as anti-corruption laws, tax laws, foreign exchange controls and restrictions on repatriation of earnings or other similar restraints, data privacy requirements, labor laws and anti-competition regulations increases the cost of doing business in foreign jurisdictions.

and foreign laws and regulations, such as anti-corruption laws, tax laws, foreign exchange controls and restrictions on repatriation of earnings or other similar restraints, data privacy requirements, operational resilience requirements, sustainability reporting, labor laws and anti-competition regulations increases the cost of doing business in foreign jurisdictions.

Although we have implemented policies and procedures to comply with these laws and regulations, a violation by our employees, contractors or agents could nevertheless occur.

1 unchanged sentence

As part of a global settlement, we entered into agreements with various parties to settle the U.S.

Consumer MDL Litigation and certain federal and state government investigations arising out of the 2017 cybersecurity incident.

Consumer MDL Litigation and certain federal and state government investigations arising out a material cybersecurity incident in 2017.

If we are unable to comply with our obligations under these agreements, it could have a material adverse effect on our financial condition.

4 unchanged sentences

2800 (Consumer Cases) (the “U.S.

Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the Attorneys General of 48 states, the District of Columbia and Puerto Rico (the “MSAG Group”) and the NYDFS (collectively, the “Consumer Settlement”) relating to the 2017 cybersecurity incident.

The Consumer Settlement became effective on January 11, 2022.

2 unchanged sentences

To the extent we are unable to comply or we are viewed as not being in compliance with these business practice commitments or other requirements of a relevant order, we could face an enforcement action or contempt proceeding that could potentially result in fines, penalties and new business practice commitments, which, depending on the amount and type, could have a material adverse effect on our financial condition.

In addition, we may be required to deposit additional amounts in the consumer settlement fund under certain circumstances if the fund is insufficient to cover claims and certain expenses.

While we do not believe that we will be required to deposit additional amounts into the consumer settlement fund based on our claims experience to date, we could be obligated to fund up to an additional $125 million if our claims experience changes and the consumer fund is exhausted.

We and our customers are subject to various current laws and governmental regulations, and could be affected by new and evolving consumer privacy and cybersecurity or other data-related laws or regulations, compliance with which may cause us to incur significant expenses and change our business practices, and if we fail to maintain satisfactory compliance with certain laws and regulations, we could be subject to civil or criminal penalties.

4 unchanged sentences

These regulations are complex, change frequently, have tended to become more stringent over time, and are subject to administrative interpretation and judicial construction in ways that could harm our business.

In addition, new laws and regulations at the state and federal level are enacted or considered frequently.

Examples of such new and evolving laws and regulations include amendments to the FCRA, cybersecurity and other requirements promulgated by the FTC and New York Department of Financial Services, the CCPA which took effect on January 1, 2020, and amendments to which took effect on January 1, 2023, the California data broker registration requirements that took effect on January 31, 2020, the CPRA taking effect on January 1, 2023 and privacy laws in Virginia, Colorado, Connecticut and Utah which have taken, or will take effect, in 2023.

Furthermore, we expect there to be an increased focus on laws and regulations related to our business, including by the current U.S.

presidential administration and the U.S.

Congress, because of the growing policy concerns in the U.S.

with regard to the operation of credit reporting agencies, the collection, use, accuracy, correction and sharing of personal information, and the use of algorithms, artificial intelligence and machine learning in business processes.

In addition, new laws and regulations at the state and federal level are enacted frequently, such as amendments to the FCRA, cybersecurity and other requirements promulgated by the FTC, New York Department of Financial Services and SEC, and data privacy laws in several U.S.

We expect there to be a continued focus on laws and regulations related to our business, because of policy concerns in the U.S.

with regard to the operation of consumer reporting agencies, the collection, use, accuracy, correction and sharing of personal information, and the use of algorithms, artificial intelligence and machine learning in business processes.

For example, in September 2023, the CFPB issued an outline of proposed changes to the FCRA which would expand the application of the FCRA to certain business practices not currently subject to the FCRA and would require the removal of medical collection debt from consumer credit reports.

Further, in October 2023, California passed the DELETE Act, a first-in-the-nation data broker deletion tool which creates a centralized mechanism to allow consumers to request brokers to delete their personal information, rather than submitting individual requests to brokers registered in the state.

There are a number of legislative proposals pending before the U.S.

Congress, various state legislative bodies and foreign governments concerning privacy or cybersecurity that could affect us.

The Canadian government has initiated a review of consumer privacy laws, and several U.S.

The Canadian and Australian governments have initiated reviews of their consumer privacy laws, and several U.S.

states have introduced varying comprehensive privacy laws modeled to some degree on the CCPA and/or the GDPR.

Compliance with multiple state laws containing varying requirements could be complicated and costly.

In Europe, although the GDPR already includes certain provisions relating to the automated processing

of personal data, there has also been discussion of new legislative proposals to regulate business use of artificial intelligence and machine learning technologies which, if enacted, could impose new legal requirements addressing among other issues, privacy, discrimination and human rights.

and other countries, there have also been new legislative proposals to regulate business use and development of artificial intelligence and machine learning technologies which, if enacted, could impose new legal requirements addressing among other issues, privacy, discrimination and human rights.

The specifics of such legislation and the number of jurisdictions that will introduce legislation in this area remain unclear at this time.

3 unchanged sentences

We devote substantial compliance, legal and operational business resources to strive for compliance with applicable regulations and requirements.

In the future, we may be subject to significant additional expenses related to compliance with applicable laws and regulations, including new laws and evolving interpretations that are difficult to predict, and to the investigation, defense or remedy of actual or alleged violations.

In the future, we may be subject to significant additional expenses related to compliance with applicable laws and regulations, including new laws and evolving interpretations that have varying requirements and/or are difficult to predict, and to the investigation, defense or remedy of actual or alleged violations.

Additionally, we cooperate with CFPB supervisory examinations and respond to other state, federal and foreign government examinations of, or inquiries into, our business practices.

The enactment of new laws and how they are interpreted could impact our business.

In particular, legislative activity in the privacy area may result in new laws that are applicable to us and that may hinder our business, for example, by restricting use or sharing of consumer data, including for marketing or advertising or limiting the use of, limiting our ability to provide certain consumer data to our customers, or otherwise regulating artificial intelligence and machine learning, including the use of algorithms and automated processing in ways that could materially affect our business, or which may lead to significant increases in the cost of compliance.

3 unchanged sentences

In addition, because many of our products are regulated or sold to customers in various industries, we must comply with additional regulations in marketing our products.

Moreover, our compliance with privacy laws and regulations and our reputation depend in part on customers’ adherence to privacy laws and regulations and their use of our services in ways consistent with consumer expectations and regulatory requirements.

Moreover, our compliance with privacy laws and regulations and our reputation depend in part on suppliers’ or customers’ adherence to privacy laws and regulations and their use of our services in ways consistent with consumer expectations and regulatory requirements.

Additionally, we may not succeed in adapting our products to changes in the regulatory environment in an efficient, cost effective manner.

We cannot predict the ultimate impact on our business of new or proposed rules, supervisory examinations or government investigations or enforcement actions.

The following legal and regulatory developments also could have a substantial negative impact on our business, financial condition or results of operations:

• amendment, enactment or interpretation of laws and regulations that restrict the access, sharing and use of personal information and reduce the availability or effectiveness of our solutions or the supply of data available to customers;

• changes in cultural and consumer attitudes in favor of further restrictions on information collection and sharing, which may lead to regulations that prevent full utilization of our solutions;

• failure of data suppliers or customers to comply with laws or regulations, where mutual compliance is required;

• failure of our solutions to comply with current laws and regulations;

• failure of our solutions to adapt to changes in the regulatory environment in an efficient, cost effective manner.

These laws and regulations (as well as actions that may be taken by legislatures and regulatory bodies in other countries) and the consequences of any violation could limit our ability to pursue business opportunities we might otherwise consider engaging in, impose additional costs on us, result in significant loss of revenue, result in significant restitution and fines, impact the value of assets we hold, or otherwise adversely affect our business.

The CFPB has supervisory and examination authority over our business and may initiate enforcement actions with regard to our compliance with federal consumer financial laws.

The CFPB has supervisory authority over our U.S.

business and supporting operations and may initiate enforcement actions with regard to our compliance with federal consumer financial laws.

The CFPB, which was established under the Dodd-Frank Act and commenced operations in July 2011, has broad authority over our business.

4 unchanged sentences

rescission or reformation of contracts, restitution, disgorgement of profits, payment of damages, limits on activities and civil money penalties of up to $1.0 million per day for known violations.

The CFPB conducts periodic examinations of us and the consumer credit reporting industry, which could result in new regulations or enforcement actions or proceedings.

The CFPB conducts periodic examinations of our business and the consumer reporting industry, which could result in new regulations or enforcement actions or proceedings.

Actions by the CFPB could result in requirements to alter or cease offering affected products and services, making them less attractive and restricting our ability to offer them.

4 unchanged sentences

This guidance requires more rigorous oversight of third-party relationships that involve certain “critical activities.” In light of this guidance, our existing or potential bank and financial services customers subject to this guidance may continue to revise their third-party risk management policies and processes and the terms on which they do business with us, which may adversely affect our relationships with such customers and/or increase our expenses in servicing such customers.

We are regularly involved in claims, suits, government investigations, supervisory examinations and other proceedings that may result in adverse outcomes.

We are regularly involved in claims, suits, government investigations, supervisory examinations and regulatory proceedings arising from the ordinary course of our business, including actions with respect to consumer protection and data protection, including purported class action lawsuits.

We are regularly involved in claims, suits, government investigations, enforcement actions and other proceedings that may result in adverse outcomes.

We are regularly involved in claims, suits, government investigations, enforcement actions and regulatory proceedings arising from the ordinary course of our business, including actions with respect to consumer protection and data protection, including purported class action lawsuits.

Such claims, suits, government investigations and proceedings are inherently uncertain and their results cannot be predicted with certainty.

1 unchanged sentence

In addition, it is possible that a resolution of one or more such proceedings could result in reputational harm, liability, penalties or sanctions, as well as judgments, consent decrees or orders preventing us from offering certain features, functionalities, products or services, or requiring a change in our business practices, products or technologies, which could in the future materially and adversely affect our business, operating results, and financial condition.

The FCRA contains an attorney fee shifting provision that provides an incentive for consumers to bring individual and class action lawsuits against a credit reporting agency for violation of the FCRA, and the number of consumer lawsuits (both individual and class action) against us alleging a violation of the FCRA and our resulting costs associated with resolving these lawsuits have increased substantially over the past several years.

The FCRA contains an attorney fee shifting provision that provides an incentive for consumers to bring individual and class action lawsuits against a consumer reporting agency for violation of the FCRA, and the number of consumer lawsuits (both individual and class action) against us alleging a violation of the FCRA and our resulting costs associated with resolving these lawsuits have increased substantially over the past several years.

Third parties may claim that we are infringing on their intellectual property and we could suffer significant litigation or licensing expenses or be prevented from selling products or services.

3 unchanged sentences

We analyze and take action in response to each such claim on a case by case basis.

A dispute or litigation regarding patents or other intellectual property can be costly and time-consuming due to the complexity of our technology and the inherent uncertainty of intellectual property litigation, could divert our management and key personnel from our business operations, and we may not prevail.

litigation regarding patents or other intellectual property can be costly and time-consuming due to the complexity of our technology and the inherent uncertainty of intellectual property litigation, could divert our management and key personnel from our business operations, and we may not prevail.

A claim of intellectual property infringement could force us to enter into a costly or restrictive license agreement, which might not be available under acceptable terms or at all, or could subject us to significant damages or to an injunction against development and sale of certain of our products or services.

Our intellectual property portfolio may not be useful in asserting a counterclaim, or providing commercial leverage for negotiating a license, in response to a claim of intellectual property infringement.

In certain of our businesses we rely on third-party intellectual property

licenses and we cannot ensure that these licenses will be available to us in the future on favorable terms or at all.

In certain of our businesses we rely on third-party intellectual property licenses and we cannot ensure that these licenses will be available to us in the future on favorable terms or at all.

Although our policy is to obtain licenses or other rights where necessary, we cannot provide assurance that we have obtained all required licenses or rights.

23 unchanged sentences

Significant decreases in interest rates, decreases in the fair value of plan assets and investment losses on plan assets will increase our funding obligations, and adversely impact our results of operations and cash flows.

UNRESOLVED STAFF COMMENTS

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors