What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2026-02-19 compared with 2025-02-20 · 67 added, 76 removed, 335 unchanged (30% of the section changed)

2 unchanged sentences

We have a large and diversified group of clients, including financial institutions, corporations, government agencies and individuals.

Our services are based on comprehensive databases of consumer and business information derived from numerous sources including credit, financial assets, telecommunications and utility payments, employment, income, educational history, criminal justice data, healthcare professional licensure and sanctions, demographic and marketing data.

We use advanced statistical techniques, machine learning and proprietary software tools to analyze available data to create customized insights, decision-making and process automation solutions and processing services for our clients.

Our services are based on comprehensive databases of consumer and business information derived from numerous sources including credit, financial assets, telecommunications and utility payments, employment, income, educational history, criminal justice, healthcare professional licensure and sanctions, demographic and marketing data.

We use advanced statistical techniques, artificial intelligence and machine learning, as well as proprietary software tools to analyze available data for the creation of customized insights, decision-making and process automation solutions, and processing services for our clients.

We are a leading provider of information and solutions used in payroll-related and human resource management business process services in the United States of America (“U.S.”), as well as e-commerce fraud and charge back protection services in North America.

For consumers, we provide products and services to help people understand, manage and protect their personal information and make more informed financial decisions.

Additionally, we also provide information, technology and services to support debt collections and recovery management.

Additionally, we provide information, technology and services to support debt collections and recovery management.

We currently operate in four global regions:

North America (U.S.

and Canada), Asia Pacific (Australia, New Zealand and India), Europe (the United Kingdom (“U.K.”), Spain and Portugal) and Latin America (Argentina, Brazil, Chile, Costa Rica, Dominican Republic, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay).

and Canada), Latin America (Argentina, Brazil, Chile, Costa Rica, Dominican Republic, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay), Europe (the United Kingdom (“U.K.”), Spain and Portugal) and Asia Pacific (Australia, New Zealand and India).

We maintain support operations in Chile, Costa Rica, India and Ireland.

4 unchanged sentences

• Workforce Solutions — provides services enabling customers to verify income, employment, educational history, criminal justice data, healthcare professional licensure and sanctions of people in the U.S.

(Verification Services), as well as providing our employer customers with services which include unemployment claims management, I-9 and onboarding services, Affordable Care Act compliance management, tax credits and incentives and other complementary employment-based transaction services (Employer Services).

Workforce Solutions revenue is predominantly in the U.S., and they have also established operations in Canada, Australia and the U.K.

(Verification Services), as well as providing our employer customers with services which include unemployment claims management, I-9 and onboarding services, Affordable Care Act ("ACA") compliance management, tax credits and incentives and other complementary employment-based transaction services (Employer Services).

Information Solutions (“USIS”) — provides consumer and commercial information solutions to businesses in the U.S.

6 unchanged sentences

In addition, we provide products to consumers in Canada, the U.K., Australia and Chile to enable them to understand and monitor their credit and help protect their identity.

This operating segment is comprised of our Asia Pacific, Europe, Latin America and Canada business units.

This operating segment is comprised of our Latin America, Europe, Asia Pacific and Canada business units.

It also includes our joint ventures in Brazil, Cambodia, Malaysia and Singapore.

5 unchanged sentences

Central to our move to cloud-native technology is our custom single data fabric, which is a cloud native platform that enables Equifax to build, manage and deploy data products, as well as implementation of best-in-class cloud-based tools and capabilities.

Our cloud infrastructure also allows us to rapidly deploy and integrate artificial intelligence, machine learning and agentic based capabilities to improve our products and solutions, as well as internal processes.

Our growth strategy includes leveraging our cloud data and technology transformation to accelerate innovation and new product development, deliver market-leading capabilities to our customers, facilitate customer and partner implementation and integration, improve ease of consumer access to and interaction with Equifax, and strengthen system resiliency and uptime.

21 unchanged sentences

At Equifax, we are committed to nurturing a culture where talent thrives.

We are focused on providing meaningful opportunities for career advancement and development, fostering an inclusive work environment, and promoting employee engagement and recognition.

We leverage our enterprise-wide talent

initiatives to develop, retain and attract a highly-qualified workforce in order to promote our culture of innovation, add diverse perspectives and deliver on our business strategy.

We are focused on providing meaningful opportunities for career advancement and development, fostering an inclusive work

environment, and promoting employee engagement and recognition.

We leverage our enterprise-wide talent initiatives to develop, retain and attract a highly-qualified workforce in order to promote our culture of innovation, add diverse perspectives and deliver on our business strategy.

We seek to enhance shareholder value through the disciplined execution of these imperatives and by positioning our Company as a global data, analytics and technology leader with industry-leading security.

44 unchanged sentences

These services are aimed at reducing the cost of the human resources function of businesses through a broad suite of services, including assisting with employment tax matters designed to reduce the cost of unemployment claims through effective claims representation and management and efficient processing to better manage the tax rate that employers are assessed for unemployment taxes;

comprehensive services designed to research the availability of employment-related tax credits (e.g., federal work opportunity tax credits and employee retention credits), and to process the necessary filings and assist the client in obtaining the tax credit;

comprehensive services designed to research the availability of employment-related tax credits (e.g., federal work opportunity tax credits), and to process the necessary filings and assist the client in obtaining the tax credit;

tax form management services (which include initial distribution, reissuance and correction of W-2 and 1095-C forms);

5 unchanged sentences

The Work Number ® is our key employment and income data platform providing a service on behalf of our employer customers to the lenders, government agencies and other customers of our Verification Services business unit.

We rely on payroll data received from over four million organizations to provide up-to-date verifications.

We rely on payroll data received from over 4 million organizations to provide up-to-date verifications.

The updates occur as employers and other data contributors transmit data electronically to Equifax from their payroll systems.

5 unchanged sentences

The Work Number ® held about 209 million active and 813 million total (active and historic) employment records at December 31, 2025.

Workforce Solutions has established an income and employment verification service in Canada, Australia and the U.K., known as Verification Exchange.

At present, revenues from these services in all three regions mentioned are insignificant.

USIS provides consumer and commercial information solutions to businesses in the U.S.

through three product and service lines, as follows:

through two product and service lines, as follows:

Online Information Solutions.

Online Information Solutions’ products are derived from multiple large and comprehensive databases of consumer and commercial information that we maintain about individual consumers and businesses, including credit history, current credit status, payment history, address and other identity information.

Our clients utilize the information and analytical insights we provide to make decisions for a broad range of financial and business purposes, such as whether, and on what terms, to approve auto loans or credit card applications, and whether to allow a consumer or a business to open a new utility or telephone account.

Our clients utilize the information and analytical insights we provide to make decisions for a broad range of financial and business purposes, such as whether, and on what terms, to approve, mortgages, auto loans or credit card applications, and whether to allow a consumer or a business to open a new utility or telephone account.

In addition, this information is used by our clients for cross-selling additional products to existing customers, improving their underwriting and risk management decisions, and authenticating and verifying consumer and business identities.

8 unchanged sentences

We offer scoring and analytical services that provide additional information to help mitigate the credit risk assumed by our clients.

Online Information Solutions also includes our mortgage solutions products, offered in the U.S., which includes specialized credit reports that combine information from the three major consumer reporting agencies (Equifax, Experian and TransUnion) into a single “merged” credit report in an online format, commonly referred to as a tri-merge report.

Mortgage lenders use these tri-merge reports in making their mortgage underwriting decisions.

Additionally, we offer services designed to alert lenders to changes in a consumer’s credit status during the underwriting period and securitized portfolio risk assessment services for evaluating inherent portfolio risk.

Online Information Solutions also includes our consumer solutions product suite that gives U.S.

3 unchanged sentences

We also sell consumer credit information to resellers who may combine our information with other information to provide direct-to-consumer monitoring, reports and scores.

Mortgage Solutions.

Our Mortgage Solutions products, offered in the U.S., consist of specialized credit reports that combine information from the three major consumer credit reporting agencies (Equifax, Experian and TransUnion) into a single “merged” credit report in an online format, commonly referred to as a tri-merge report.

Mortgage lenders use these tri-merge reports in making their mortgage underwriting decisions.

Financial Marketing Services.

3 unchanged sentences

Our products are also utilized by customers to support digital identity verification and fraud detection and protection.

These products utilize information derived from consumer and commercial information, including credit,

income, asset, liquidity, net worth and spending activity, which also support many of our Online Information Solutions’ products.

These products utilize information derived from consumer and commercial information, including credit, income, asset, liquidity, net worth and spending activity, which also support many of our Online Information Solutions’ products.

These data assets broaden the understanding of consumer and business financial potential and opportunity, which can further drive high value decisioning and targeting solutions for our clients.

We also provide account review services, which assist our clients in managing their existing customers and prescreen services that help our clients identify new opportunities with their customers.

We also provide account review services, which assist our clients in managing their existing customers and prescreen services that help our clients identify new opportunities

with their customers.

Clients for these products primarily include institutions in the banking, brokerage, retail, insurance and mortgage industries, as well as companies primarily focused on digital and interactive marketing.

5 unchanged sentences

This operating segment’s products and services generate revenue in Argentina, Australia, Brazil, Canada, Chile, Costa Rica, Dominican Republic, Ecuador, El Salvador, Honduras, India, Mexico, New Zealand, Paraguay, Peru, Portugal, Spain, the U.K.

We also maintain support operations in Chile, Costa Rica, India and Ireland.

We have investments in consumer and/or commercial credit information companies through joint ventures in Brazil, Cambodia, Malaysia and Singapore.

23 unchanged sentences

The countries in which we operate include Australia, New Zealand and India, as well as Cambodia, Malaysia and Singapore through joint ventures.

Similar to the USIS business units, our Canada operation offers products derived from the credit information that we maintain about individual consumers and businesses.

Similar to the USIS business unit, our Canada operation offers products derived from the credit information that we maintain about individual consumers and businesses.

We offer many products in Canada, including credit reporting, monitoring and scoring, consumer and commercial marketing, risk management, fraud detection and modeling services, identity management and authentication services, together with certain of our decisioning products that facilitate pre-approved offers of credit and automate a variety of credit decisions.

3 unchanged sentences

Our competitors vary widely in size and in the nature of the products and services they offer.

Sources of competition are numerous and include the following:

• Competition in the Verification Services business, for both the U.S.

and key International segments of Australia, Canada and the U.K., is highly competitive with low barriers to entry and includes employers who manage verifications in-house, lenders who obtain verifications directly from employers, and numerous online and offline firms that provide verification services.

Sources of competition are numerous and include, but are not limited to, the following:

• Competition in the Verification Services business is highly competitive with low barriers to entry and includes employers who manage verifications in-house, lenders who obtain verifications directly from employers, and numerous online and offline firms that provide verification services.

Third parties may also seek to obtain verifications directly from employees by leveraging paper copies of information or by seeking employee credentials to access information systems.

14 unchanged sentences

In the category of platforms and analytics, we compete with entities that deploy collections platforms, account management systems or recovery solutions.

While we believe that none of our competitors offers the same mix of products and services as we do, we have strong competition in every category and certain competitors may have a larger share of particular geographic or product markets or operate in geographic areas where we do not currently have a presence.

We assess the principal competitive factors affecting our markets to include:

our ability to protect information and systems;

While we believe that none of our competitors offers quite the same mix of products and services as we do, we have strong competition in every category and certain competitors may have a larger share of particular geographic or product markets or operate in geographic areas where we do not currently have a presence.

We assess the principal competitive factors affecting our markets to include, among other things:

the ability to protect information and systems;

product attributes such as quality, depth, coverage, adaptability, scalability, interoperability, functionality and ease of use;

23 unchanged sentences

federal, state, local and foreign laws and regulations that involve matters central to our business.

These laws and regulations may involve consumer reporting, privacy and consumer protection, data protection, intellectual property, competition, anti-corruption, anti-bribery, anti-money laundering, employment, health, taxation or other subjects.

These laws and regulations may involve consumer reports, privacy and consumer protection, data protection, artificial intelligence, intellectual property, competition, anti-corruption, anti-bribery, anti-money laundering, employment, health, taxation or other subjects.

In particular, we are subject to U.S.

5 unchanged sentences

There are also a number of legislative proposals pending before the U.S.

Congress, various state legislative bodies and foreign governments concerning consumer and data protection that could affect us.

Congress, various state legislative bodies and foreign governments concerning consumer and data protection, as well as artificial intelligence, that could affect us.

Summary of U.S.

Regulations Relating to Consumer and Data Protection

operations are subject to numerous laws and regulations that govern the collection, protection and use of consumer credit and other information and impose penalties for the misuse of such information or unauthorized access to data.

Many of these laws and regulations also affect our customers’ use of consumer credit or other data that we license.

operations are subject to numerous laws and regulations that govern the collection, protection and use of consumer credit information, employment and income information, personally identifiable information and other information and impose penalties for the misuse of such information or unauthorized access to data.

Many of these laws and regulations also affect our customers’ use of consumer credit information, employment and income information, personally identifiable information or other data that we license.

Examples of the most significant U.S.

2 unchanged sentences

The Fair Credit Reporting Act (“FCRA”) regulates consumer reporting agencies, including many of our U.S.

operations, as well as data furnishers and users of consumer reports such as banks and other companies.

operations, as well as data furnishers and users of consumer reports such as employers, banks and other companies.

FCRA provisions govern the accuracy, fairness and privacy of information in the files of consumer reporting agencies (“CRAs”) that engage in the practice of assembling or evaluating certain information relating to consumers for certain specified purposes.

2 unchanged sentences

The Consumer Financial Protection Bureau (“CFPB”) is the primary regulator that enforces and provides regulatory guidance related to the FCRA in the United States.

CRAs are required to comply with regulations promulgated by the CFPB and are subject to regular supervisory engagements related to a variety of FCRA requirements.

CRAs are required to comply with regulations promulgated by the CFPB and are subject to supervisory engagements related to a variety of FCRA requirements.

Violation of the FCRA can result in civil and criminal penalties.

The FCRA contains an attorney fee shifting provision to provide an incentive for consumers to bring individual or class action lawsuits against a CRA for violations of the FCRA.

The United States Federal Trade Commission (“FTC”) and state attorneys general may also enforce the requirements of the FCRA.

In addition to the private right of action for individuals and the CFPB’s regulatory authority, the United States Federal Trade Commission (“FTC”) and state attorneys general may also enforce the requirements of the FCRA.

• Dodd-Frank Act.

5 unchanged sentences

The CFPB may pursue administrative proceedings or litigation to enforce the laws and rules subject to its jurisdiction.

In these proceedings, the CFPB can obtain cease and desist orders, which can include orders for restitution to consumers or rescission of contracts, as well as other types of affirmative relief and monetary penalties ranging from $5,000 per day for ordinary

violations and up to $1 million per day for known violations.

In these proceedings, the CFPB

can obtain cease and desist orders, which can include orders for restitution to consumers or rescission of contracts, as well as other types of affirmative relief and monetary penalties ranging from $5,000 per day for ordinary violations and up to $1 million per day for known violations.

Also, the Dodd-Frank Act empowers state attorneys general and state regulators to bring civil actions in certain circumstances for the kind of cease and desist orders available to the CFPB (but not for civil penalties).

12 unchanged sentences

State Laws and Regulations Relating to Consumer and Data Protection

• A number of states have enacted requirements similar to the federal FCRA.

• A number of states have enacted requirements similar to the FCRA.

Some of these state laws impose additional, or more stringent, requirements than the FCRA, especially in connection with investigations and responses to reported inaccuracies in consumer reports.

5 unchanged sentences

• The New York State Department of Financial Services (“NYDFS”) has enacted extensive regulatory requirements applicable to CRAs that require registration with that agency, prohibit unfair and deceptive consumer practices and require compliance with significant portions of the NYDFS cybersecurity rules.

• We or certain of our operations are also subject to and affected by new and evolving state privacy and data security laws such as data broker registration requirements in California and Vermont, and the California Consumer Privacy Act (“CCPA”).

The CCPA, as amended by the California Privacy Rights Act, imposes additional data privacy requirements on many businesses operating in the state.

The CCPA expansively defines “personal information” and imposes new notice requirements relating to the collection, use and sharing of personal information.

It provides consumers with extensive rights, including the right to access the categories and specific pieces of personal information businesses collect, the right to request businesses delete information, and the right to opt-out of “sales” of personal information with sales being defined under the CCPA to include monetary and non-monetary valuable consideration.

The CCPA also contains a private right of action in the event that a business suffers a security breach that was due to unreasonable security measures.

We may also become subject to and affected by newly enacted state privacy laws similar to the CCPA, such as laws in effect in Colorado, Connecticut, Delaware, Florida, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia, as well as enacted laws in states such as Indiana, Kentucky, Maryland, Minnesota, Rhode Island and Tennessee that become effective throughout 2025 and 2026.

A number of other state legislatures, including New York and Washington, have introduced comprehensive data privacy legislation modeled after, and which contain certain elements of, the CCPA, other state consumer privacy laws, or the European Union's General Data Protection Regulation (“GDPR”), which is an extremely broad privacy law.

Additional state legislatures are expected to consider similar legislation in 2025.

• We or certain of our operations are also subject to and affected by new and evolving state privacy and data security laws, including data broker registration requirements in California, Vermont, Oregon and Texas.

Many of these laws (i) impose additional data privacy requirements on many businesses operating in the state when processing personal information, (ii) impose notice requirements relating to the collection, use and sharing of personal information and (iii) provide consumers with extensive rights, including the right to access the categories and specific pieces of personal information businesses collect, the right to request businesses delete information, and the right to opt-out of “sales” of personal information, among other rights.

A number of other state legislatures have introduced comprehensive data privacy legislation that is pending before the state legislative body.

If enacted, such laws may contain variations and impose new compliance risks and obligations on us.

1 unchanged sentence

Generally, such examinations, and related enforcement actions, are focused on assessing our safety and soundness in support of financial institutions we serve.

In 2018, we entered into a consent order with certain state banking regulators in response to their multi-state review of our information security program.

This consent order obligated us to, among other things, make certain changes to our corporate governance and information security practices.

• We are also subject to federal and state laws that are generally applicable to any U.S.

15 unchanged sentences

Information Commissioner’s Office, which focuses on upholding information rights in the public interest and the protection of data privacy for individuals.

In the U.K., we are subject to provisions that are broadly equivalent to the European Union’s General Data Protection Regulation (described below).

These equivalent provisions were adopted into U.K.

laws following the end of the transition period that followed the U.K.’s exit from the EU.

In the U.K., we are subject to provisions that are broadly equivalent to the European Union’s General Data Protection Regulation (“GDPR”), described below.

• In Europe , we are subject to the EU's GDPR, which is an extremely broad and sweeping privacy law.

The GDPR establishes multiple privacy and data protection requirements that are more specific and comprehensive than those of the U.S.

and most other countries where Equifax operates.

In addition, the GDPR includes data breach notification requirements and it establishes the ability of regulators to pursue substantial penalties for non-compliance.

The GDPR establishes multiple privacy and data protection requirements, including data breach notification, and it gives regulators the ability to pursue substantial penalties for non-compliance.

In addition to the GDPR, each EU member state may include specific requirements regarding personal data breaches in its local data protection regulations.

The EU Artificial Intelligence Act imposes mandatory compliance requirements, including for artificial intelligence governance, documentation and human oversight.

• In Canada , federal and provincial laws govern how we collect, use or disclose personal information in the course of our commercial activities.

7 unchanged sentences

At present, each province has credit reporting legislation, with the exception of the territories (Northwest Territories, Yukon, and Nunavut).

speaking, the legislation regulates the contents of credit files, the length of time information can be included on a credit file, who can receive credit reports and consumer rights pertaining to the maintenance of credit reports.

• In Latin America, data protection and credit reporting laws and regulations vary considerably among Latin American countries.

Some countries, such as El Salvador, Paraguay, Chile and Honduras, establish a constitutional right to privacy without general data protection standards or a data protection authority.

These countries, however, have laws that govern the functioning of credit bureaus.

Other countries, such as Argentina, Uruguay, Peru, Costa Rica, Mexico and most recently Brazil have enacted comprehensive data protection legislation similar to the EU's GDPR.

The EU recognizes Argentina and Uruguay as having adequate levels of protection for personal data transfers and processing.

Generally speaking, the legislation regulates the contents of credit files, the length of time information can be included on a credit file, who can receive credit reports and consumer rights pertaining to the maintenance of credit reports.

• In Latin America, data protection and credit reporting regulations have evolved significantly toward comprehensive, GDPR-aligned frameworks.

Recent legislative actions in countries such as Chile, Paraguay and El Salvador have established unified national standards and dedicated regulatory authorities.

For example, Chile enacted Law No.

21.719, which becomes fully enforceable in December 2026 and establishes a Personal Data Protection Agency and introduces rigorous requirements for data portability, breach notification and cross-border transfers.

Similarly, Paraguay passed its first comprehensive Personal Data Protection Law (No.

7593) in November 2025, initiating a two-year transition period for compliance.

El Salvador also implemented a general data protection law in late 2024, overseen by its State Cybersecurity Agency.

These developments align with a regional trend toward “international adequacy,” a legal status whereby one country or region formally recognizes that another country’s data protection laws are essentially equivalent to their own.

In January 2026, the European Commission and Brazil adopted mutual adequacy decisions, allowing the free flow of personal data between the EU and Brazil without additional safeguards.

Brazil now joins

Argentina and Uruguay as jurisdictions recognized for providing “adequate” levels of protection.

Large countries like Mexico, Colombia and Peru have comprehensive, but not yet “adequate”, data protection laws.

In other countries, credit bureaus are still governed by specialized credit reporting laws rather than a broad, EU-style framework.

• In Australia, we are subject to regulatory oversight by various agencies.

The Office of the Australian Information Commissioner (“OAIC”) is the regulator with direct responsibility for administering the Australian Privacy Principles (which relate to the collection, holding, use and disclosure of personal information) and Part IIIA of the Privacy Act 1988 (which regulates credit reporting).

The Office of the Australian Information Commissioner (“OAIC”) is the regulator with direct responsibility for administering the Australian Privacy Act 1988, which incorporates the Australian Privacy Principles (which relate to the collection, holding, use and disclosure of personal information) and Part IIIA of the Privacy Act 1988 (which regulates credit reporting).

The OAIC can investigate a complaint, conduct its own investigations, resolve/make binding determinations and seek civil penalties.

Our credit reporting business, Equifax Information Services and Solutions, is a member of an external dispute resolution scheme, the Australian Financial Complaints Authority, which has been approved by the OAIC to handle privacy and credit reporting complaints and make binding determinations.

Our credit reporting business, Equifax Information Services and Solutions Pty Ltd, is a member of an external dispute resolution scheme, the Australian Financial Complaints Authority, which has been approved by the OAIC to handle privacy and credit reporting complaints and make binding determinations.

The OAIC can register codes of practice under the Privacy Act 1988, and has registered the Privacy (Credit Reporting) Code 2024.

The Australian Competition and Consumer Commission (“ACCC”) is the regulator responsible for administering and enforcing the Competition and Consumer Act 2010 and related legislation concerning consumer protection and competition.

The ACCC has the authority to use a range of actions to ensure compliance with the law, including investigative powers and the ability to seek penalties through litigation and other formal enforcement means.

The ACCC also administers Consumer Data Right legislation, which mandates the supply by banks of comprehensive credit information to credit reporting bodies, including Equifax.

The ACCC also administers the Consumer Data Right legislation, which mandates the supply by banks of comprehensive credit information to credit reporting bodies, including Equifax.

The Australian Retail Credit Association is a credit and credit reporting industry self-regulatory body, which administers principles and standards for the exchange of credit data between industry participants.

Equifax Australasia Credit Ratings Pty Limited (formerly named Corporate Scorecard Pty Limited, one of our Australian subsidiaries) holds an Australia Financial Services License, which allows it to provide general advice to wholesale clients by issuing a credit rating, and has been approved in New Zealand as a rating agency by the Reserve Bank of New Zealand under section 86 of the Non-Bank Deposit Takers Act 2013 (NZ).

Equifax Australasia Credit Ratings Pty Limited (formerly named Corporate Scorecard Pty Limited, one of our Australian subsidiaries) holds an Australian Financial Services Licence, which allows it to provide general advice to wholesale clients by issuing a credit rating, and has been approved in New Zealand as a rating agency by the Reserve Bank of New Zealand under section 86 of the Non-Bank Deposit Takers Act 2013 (NZ).

The Australian Securities and Investments Commission regulates corporations and has authority to investigate, prosecute, ban individuals and to seek civil penalties.

8 unchanged sentences

Entities that collect and maintain personal data and/or credit information must ensure that it is complete, accurate and safeguarded, and must adopt certain privacy principles with respect to collecting, processing, preserving, sharing and using such data and/or credit information.

India enacted a new privacy law, The Digital Personal Data Protection Act, 2023 ("DPDP Act"), in August 2023.

If it becomes effective, the DPDP Act would provide greater protection to individuals' personal data in digital form.

The DPDP Act will become effective at a future date or dates to be determined by the Indian Central Government.

In January 2025, the Central Government published draft Digital Personal Data Protection Rules, 2025, which would supplement the DPDP Act.

India recently enacted a new privacy law, The Digital Personal Data Protection Act, 2023 ("DPDP Act"), which provides greater protection to individuals’ personal data in digital form.

Our Indian business is also subject to regulation by the Reserve Bank of India, which is India’s central banking institution.

3 unchanged sentences

For instance, if the federal government or a state government mandates the use of E-Verify or changes the requirements for individuals to work in the U.S., our I-9 service may be impacted.

In addition, if the federal government changes the employer mandate or tax form requirements of the Affordable Care Act, our Affordable Care Act Management Service may be impacted.

In addition, if the federal government changes the employer mandate or tax form requirements of the Patient Protection and Affordable Care Act, our Affordable Care Act Management Service may be impacted.

The Unemployment Cost Management service could be impacted if a state government changes the requirements for employers to process and/or protest unemployment claims.

3 unchanged sentences

Equifax employed approximately 15,000 employees in 22 countries as of December 31, 2025.

Our global employee base consisted of approximately 3,100 employees in our Workforce Solutions business unit, 2,500 employees in our USIS business unit, 4,500 employees in our International business unit and 4,600 employees in our corporate Centers of Excellence, which include our support centers in Chile, Costa Rica, India and Ireland.

Our global employee base consisted of approximately 3,100 employees in our Workforce Solutions business unit, 2,800 employees in our USIS business unit, 4,800 employees in our International business unit and 4,300 employees in our corporate Centers of Excellence, which also include our support centers in Chile, Costa Rica, India and Ireland.

In 2025, we hired approximately 2,700 new employees and promoted approximately 1,800 employees as we continue to grow and transform our businesses around the world.

1 unchanged sentence

This report contains information that may constitute “forward-looking statements.” Generally, the words “believe,” “expect,” “intend,” “estimate,” “anticipate,” “project,” “will,” “may” and similar expressions identify forward-looking statements, which generally are not historical in nature.

All statements that address future operating performance and events or developments that we expect or anticipate will occur in the future, including statements relating to future operating results, improvements in our information technology and data security infrastructure, including as a part of our cloud technology transformation, our strategy, the expected financial and operational benefits, synergies and growth from our acquisitions, changes in U.S.

and worldwide economic conditions, such as changes in interest rates and inflation, that materially impact consumer spending, home prices, investment values, consumer debt, unemployment rates and the demand for Equifax's products and services, our culture, our ability to innovate, the market acceptance of new products and services and similar statements about our business plans are forward-looking statements.

All statements that address operating performance and events or developments that we expect or anticipate will occur in the future, including statements related to our strategy, our long-term financial framework, our future operating results, improvements in our information technology and data security infrastructure, the expected financial and operational benefits, synergies and growth from our acquisitions, the expected benefits of our use of artificial intelligence, the pricing strategies, benefits and value proposition of product offerings of Equifax and its competitors, changes in the U.S.

mortgage market environment (as well as changes more generally in U.S.

and worldwide economic conditions), such as changes in interest rates and inflation levels, and similar statements about our financial outlook and business plans, are forward-looking statements.

Management believes that these forward-looking statements are reasonable as and when made.

15 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business