Item 1A. Risk Factors
ITEM 1A. RISK FACTORS
payments markets, we are continually involved in diversifying our integrated products and services. These efforts carry the risks associated with any diversification initiative, including cost overruns, delays in delivery and performance problems. These projects also carry risks associated with working with different types of customers, for example organizations such as corporations that are not financial institutions and non-governmental organizations (“NGOs”), and end users other than those we have traditionally worked with. These differences may present new operational challenges in the development and implementation of our new products or services. These new customers are typically less regulated, and as a result, enhanced infrastructure and monitoring is required.
Our failure to deliver these integrated products and services could make our other integrated products and services less desirable to customers, or put us at a competitive disadvantage. In addition, if there is a delay in the implementation of our products or services or if our products or services do not perform as anticipated, or we are unable to adequately anticipate risks related to new types of customers, we could face additional regulatory scrutiny, fines, sanctions or other penalties, which could materially and adversely affect our overall business and results of operations, as well as negatively impact our brand and reputation.
Information Security and Service Disruptions
Information security incidents or account data compromise events could disrupt our business, damage our reputation, increase our costs and cause losses.
Information security risks for payments and technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties. These threats may derive from fraud or malice on the part of our employees or third parties, or may result from human error or accidental technological failure. These threats include cyber-attacks such as computer viruses, malicious code, phishing attacks or information security breaches and could lead to the misappropriation of consumer account and other information and identity theft. The advent of the global COVID-19 pandemic has resulted in a significant rise in these types of threats due to a significant portion of our workforce working from home in a mostly remote environment.
Our operations rely on the secure processing, transmission and storage of confidential, proprietary and other information and technology in our computer systems and networks, as well as the systems of our third-party providers. Our customers and other parties in the payments value chain, as well as account holders, rely on our digital technologies, computer systems, software and networks to conduct their operations. In addition, to access our integrated products and services, our customers and account holders increasingly use personal smartphones, tablet PCs and other mobile devices that may be beyond our control. We, like other financial technology organizations, routinely are subject to cyber-threats and our technologies, systems and networks, as well as the systems of our third-party providers, have been subject to attempted cyber-attacks. Because of our position in the payments value chain, we believe that we are likely to continue to be a target of such threats and attacks. Additionally, geopolitical events and resulting government activity could also lead to information security threats and attacks by affected jurisdictions and their sympathizers.
To date, we have not experienced any material impact relating to cyber-attacks or other information security breaches. However, future attacks or breaches could lead to security breaches of the networks, systems (including third-party provider systems) or devices that our customers use to access our integrated products and services, which in turn could result in the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary and other information (including account data information) or data security compromises. Such attacks or breaches could also cause service interruptions, malfunctions or other failures in the physical infrastructure or operations systems that support our businesses and customers (such as the lack of availability of our value-added services), as well as the operations of our customers or other third parties. In addition, they could lead to damage to our reputation with our customers and other parties and the market, additional costs to us (such as repairing systems, adding new personnel or protection technologies or compliance costs), regulatory penalties, financial losses to both us and our customers and partners and the loss of customers and business opportunities. If such attacks are not detected immediately, their effect could be compounded.
Despite various mitigation efforts that we undertake, there can be no assurance that we will be immune to these risks and not suffer material breaches and resulting losses in the future, or that our insurance coverage would be sufficient to cover all losses. Our risk and exposure to these matters remain heightened because of, among other things, the evolving nature of these threats, our prominent size and scale and our role in the global payments and technology industries, our plans to continue to implement our digital and mobile channel strategies and develop additional remote connectivity solutions to serve our customers and account holders when and how they want to be served, our global presence, our extensive use of third-party vendors and future joint venture and merger and acquisition opportunities. As a result, information security and the continued development and enhancement of our controls, processes and practices designed to protect our systems, computers, software, data and networks
MASTERCARD 2020 FORM 10-K 27
PART I
ITEM 1A. RISK FACTORS
from attack, damage or unauthorized access remain a priority for us. As cyber-threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Any of the risks described above could materially adversely affect our overall business and results of operations.
In addition to information security risks for our systems, we also routinely encounter account data compromise events involving merchants and third-party payment processors that process, store or transmit payment transaction data, which affect millions of Mastercard, Visa, Discover, American Express and other types of account holders. Further events of this type may subject us to reputational damage and/or lawsuits involving payment products carrying our brands. Damage to our reputation or that of our brands resulting from an account data breach of either our systems or the systems of our customers, merchants and other third parties could decrease the use and acceptance of our integrated products and services. Such events could also slow or reverse the trend toward electronic payments. In addition to reputational concerns, the cumulative impact of multiple account data compromise events could increase the impact of the fraud resulting from such events by, among other things, making it more difficult to identify consumers. Moreover, while most of the lawsuits resulting from account data breaches do not involve direct claims against us and while we have releases from many issuers and acquirers, we could still face damage claims, which, if upheld, could materially and adversely affect our results of operations. Such events could have a material adverse impact on our transaction volumes, results of operations and prospects for future growth, or increase our costs by leading to additional regulatory burdens being imposed on us.
Service disruptions that cause us to be unable to process transactions or service our customers could materially affect our overall business and results of operations.
Our transaction switching systems and other offerings have experienced in limited instances and may continue to experience interruptions as a result of technology malfunctions, fire, weather events, power outages, telecommunications disruptions, terrorism, workplace violence, accidents or other catastrophic events. Our visibility in the global payments industry may also put us at greater risk of attack by terrorists, activists, or hackers who intend to disrupt our facilities and/or systems. Additionally, we rely on third-party service providers for the timely transmission of information across our global data network. Inadequate infrastructure in lesser-developed markets could also result in service disruptions, which could impact our ability to do business in those markets. If one of our service providers fails to provide the communications capacity or services we require, as a result of natural disaster, operational disruptions, terrorism, hacking or any other reason, the failure could interrupt our services. Although we maintain a enterprise resiliency program to analyze risk, assess potential impacts, and develop effective response strategies, we cannot ensure that our business would be immune to these risks, because of the intrinsic importance of our switching systems to our business, any interruption or degradation could adversely affect the perception of the reliability of products carrying our brands and materially adversely affect our overall business and our results of operations.
Stakeholder Relationships
Losing a significant portion of business from one or more of our largest customers could lead to significant revenue decreases in the longer term, which could have a material adverse impact on our business and our results of operations.
Most of our customer relationships are not exclusive and may be terminated by our customers. Our customers can reassess their commitments to us at any time in the future and/or develop their own competitive services. Accordingly, our business agreements with these customers may not reduce the risk inherent in our business that customers may terminate their relationships with us in favor of relationships with our competitors, or for other reasons, or might not meet their contractual obligations to us.
In addition, a significant portion of our revenue is concentrated among our five largest customers. Loss of business from any of our large customers could have a material adverse impact on our overall business and results of operations.
Exclusive/near exclusive relationships certain customers have with our competitors may have a material adverse impact on our business.
Certain customers have exclusive, or nearly-exclusive, relationships with our competitors to issue payment products, and these relationships may make it difficult or cost-prohibitive for us to do significant amounts of business with them to increase our revenues. In addition, these customers may be more successful and may grow faster than the customers that primarily issue our payment products, which could put us at a competitive disadvantage. Furthermore, we earn substantial revenue from customers with nearly-exclusive relationships with our competitors. Such relationships could provide advantages to the customers to shift business from us to the competitors with which they are principally aligned. A significant loss of our existing revenue or transaction volumes from these customers could have a material adverse impact on our business.
28 MASTERCARD 2020 FORM 10-K
PART I
ITEM 1A. RISK FACTORS
Consolidation in the banking industry could materially and adversely affect our overall business and results of operations.
The banking industry has undergone substantial, accelerated consolidation in the past. Consolidations have included customers with a substantial Mastercard portfolio being acquired by institutions with a strong relationship with a competitor. If significant consolidation among customers were to continue, it could result in the substantial loss of business for us, which could have a material adverse impact on our business and prospects. In addition, one or more of our customers could seek to merge with, or acquire, one of our competitors, and any such transaction could also have a material adverse impact on our overall business. Consolidation could also produce a smaller number of large customers, which could increase their bargaining power and lead to lower prices and/or more favorable terms for our customers. These developments could materially and adversely affect our results of operations.
Our business significantly depends on the continued success and competitiveness of our issuing and acquiring customers and, in many jurisdictions, their ability to effectively manage or help manage our brands.
While we work directly with many stakeholders in the payments system, including merchants, governments, fintechs and large digital companies and other technology companies, we are, and will continue to be, significantly dependent on our relationships with our issuers and acquirers and their respective relationships with account holders and merchants to support our programs and services. Furthermore, we depend on our issuing partners and acquirers to continue to innovate to maintain competitiveness in the market. We do not issue cards or other payment devices, extend credit to account holders or determine the interest rates or other fees charged to account holders. Each issuer determines these and most other competitive payment program features. In addition, we do not establish the discount rate that merchants are charged for acceptance, which is the responsibility of our acquiring customers. As a result, our business significantly depends on the continued success and competitiveness of our issuing and acquiring customers and the strength of our relationships with them. In turn, our customers’ success depends on a variety of factors over which we have little or no influence, including economic conditions in global financial markets or their disintermediation by competitors or emerging technologies, as well as regulation. If our customers become financially unstable, we may lose revenue or we may be exposed to settlement risk. See our risk factor in “Risk Factors - Settlement and Third-Party Obligations” in this Part I, Item 1A with respect to how we guarantee certain third-party obligations for further discussion.
With the exception of the United States and a select number of other jurisdictions, most in-country (as opposed to cross-border) transactions conducted using Mastercard, Maestro and Cirrus cards are authorized, cleared and settled by our customers or other processors. Because we do not provide domestic switching services in these countries and do not, as described above, have direct relationships with account holders, we depend on our close working relationships with our customers to effectively manage our brands, and the perception of our payments system, among consumers in these countries. We also rely on these customers to help manage our brands and perception among regulators and merchants in these countries, alongside our own relationships with them. From time to time, our customers may take actions that we do not believe to be in the best interests of our payments system overall, which may materially and adversely impact our business.
Merchants’ continued focus on acceptance costs may lead to additional litigation and regulatory proceedings and increase our incentive program costs, which could materially and adversely affect our profitability.
Merchants are important constituents in our payments system. We rely on both our relationships with them, as well as their relationships with our issuer and acquirer customers, to continue to expand the acceptance of our integrated products and services. We also work with merchants to help them enable new sales channels, create better purchase experiences, improve efficiencies, increase revenues and fight fraud. In the retail industry, there is a set of larger merchants with increasingly global scope and influence. We believe that these merchants are having a significant impact on all participants in the global payments industry, including Mastercard. Some large merchants have supported the legal, regulatory and legislative challenges to interchange fees that Mastercard has been defending, including the U.S. merchant litigations. Some merchants are increasingly asking regulators to review and potentially regulate our own network fees, in addition to interchange. See our risk factor in “Risk Factors – Other Regulation” in this Part I, Item 1A with respect to payments industry regulation, including interchange fees. The continued focus of merchants on the costs of accepting various forms of payment, including in connection with the growth of digital payments, may lead to additional litigation and regulatory proceedings.
Certain larger merchants are also able to negotiate incentives from us and pricing concessions from our issuer and acquirer customers as a condition to accepting our products. We also make payments to certain merchants to incentivize them to create co-branded payment programs with us. As merchants consolidate and become even larger, we may have to increase the amount of incentives that we provide to certain merchants, which could materially and adversely affect our results of operations. Competitive and regulatory pressures on pricing could make it difficult to offset the costs of these incentives. Additionally, if the rate of merchant acceptance growth slows our business could suffer.
MASTERCARD 2020 FORM 10-K 29
PART I
ITEM 1A. RISK FACTORS
Our work with governments exposes us to unique risks that could have a material impact on our business and results of operations.
As we increase our work with national, state and local governments, both indirectly through financial institutions and with them directly as our customers, we may face various risks inherent in associating or contracting directly with governments. These risks include, but are not limited to, the following:
• Governmental entities typically fund projects through appropriated monies. Changes in governmental priorities or other political developments, including disruptions in governmental operations, could impact approved funding and result in changes in the scope, or lead to the termination, of the arrangements or contracts we or financial institutions enter into with respect to our payment products and services.
• Our work with governments subjects us to U.S. and international anti-corruption laws, including the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act. A violation and subsequent judgment or settlement under these laws could subject us to substantial monetary penalties and damages and have a significant reputational impact.
• Working or contracting with governments, either directly or via our financial institution customers, can subject us to heightened reputational risks, including extensive scrutiny and publicity, as well as a potential association with the policies of a government as a result of a business arrangement with that government. Any negative publicity or negative association with a government entity, regardless of its accuracy, may adversely affect our reputation.
Settlement and Third-Party Obligations
Our role as guarantor, as well as other contractual obligations, expose us to risk of loss or illiquidity.
We are a guarantor of certain third-party obligations, including those of certain of our customers. In this capacity, we are exposed to credit and liquidity risk from these customers and certain service providers. We may incur significant losses in connection with transaction settlements if a customer fails to fund its daily settlement obligations due to technical problems, liquidity shortfalls, insolvency or other reasons. Concurrent settlement failures of more than one of our larger customers or of several of our smaller customers either on a given day or over a condensed period of time may exceed our available resources and could materially and adversely affect our results of operations.
We have significant contractual indemnification obligations with certain customers. Should an event occur that triggers these obligations, such an event could materially and adversely affect our overall business and result of operations.
Global Economic and Political Environment
Global economic, political, financial and societal events or conditions could result in a material and adverse impact on our overall business and results of operations.
Adverse economic trends in key countries in which we operate may adversely affect our financial performance. Such impact may include, but is not limited to, the following:
• Customers mitigating their economic exposure by limiting the issuance of new Mastercard products and requesting greater incentive or greater cost stability from us
• Consumers and businesses lowering spending, which could impact domestic and cross-border spend
• Government intervention (including the effect of laws, regulations and/or government investments on or in our financial institution customers), as well as uncertainty due to changing political regimes in executive, legislative and/or judicial branches of government, that may have potential negative effects on our business and our relationships with customers or otherwise alter their strategic direction away from our products
• Tightening of credit availability that could impact the ability of participating financial institutions to lend to us under the terms of our credit facility
Additionally, we switch substantially all cross-border transactions using Mastercard, Maestro and Cirrus-branded cards and generate a significant amount of revenue from cross-border volume fees and fees related to switched transactions. Revenue from switching cross-border and currency conversion transactions for our customers fluctuates with the levels and destinations of cross-border travel and our customers’ need for transactions to be converted into their base currency. Cross-border activity has, and may continue to be, adversely affected by world geopolitical, economic, health, weather and other conditions. These include COVID-19, as well as the threat of terrorism and separate outbreaks of flu, viruses and other diseases, as well as major environmental events (including those related to climate change). The uncertainty that could result from such events could decrease cross-border activity. Additionally, any regulation of interregional interchange fees could also negatively impact our cross-border activity. In each case, decreased cross-border activity could decrease the revenue we receive.
30 MASTERCARD 2020 FORM 10-K
PART I
ITEM 1A. RISK FACTORS
Our operations as a global payments network rely in part on global interoperable standards to help facilitate safe and simple payments. To the extent geopolitical events result in jurisdictions no longer participating in the creation or adoption of these standards, or the creation of competing standards, the products and services we offer could be negatively impacted.
Any of these developments could have a material adverse impact on our overall business and results of operations.
Adverse currency fluctuations and foreign exchange controls could negatively impact our results of operations.
During 2020, approximately 67% of our revenue was generated from activities outside the United States. This revenue (and the related expense) could be transacted in a non-functional currency or valued based on a currency other than the functional currency of the entity generating the revenues. Resulting exchange gains and losses are included in our net income. Our risk management activities provide protection with respect to adverse changes in the value of only a limited number of currencies and are based on estimates of exposures to these currencies.
In addition, some of the revenue we generate outside the United States is subject to unpredictable currency fluctuations including devaluation of currencies where the values of other currencies change relative to the U.S. dollar. If the U.S. dollar strengthens compared to currencies in which we generate revenue, this revenue may be translated at a materially lower amount than expected. Furthermore, we may become subject to exchange control regulations that might restrict or prohibit the conversion of our other revenue currencies into U.S. dollars, such as what we have experienced in Venezuela.
The occurrence of currency fluctuations or exchange controls could have a material adverse impact on our results of operations.
Brand and Reputational Impact
Negative brand perception may materially and adversely affect our overall business.
Our brands and their attributes are key assets of our business. The ability to attract consumers to our branded products and retain them depends upon the external perception of us and our industry. Our business may be affected by actions taken by our customers, merchants or other organizations that impact the perception of our brands or the payments industry in general. From time to time, our customers may take actions that we do not believe to be in the best interests of our brands, such as creditor practices that may be viewed as “predatory”. Moreover, adverse developments with respect to our industry or the industries of our customers or other companies and organizations that use our products and services (including certain legally permissible but high risk merchant categories, such as alcohol, tobacco, fire-arms and adult content) may also, by association, impair our reputation, or result in greater public, regulatory or legislative scrutiny. We have also been pursuing the use of social media channels at an increasingly rapid pace. Under some circumstances, our use of social media, or the use of social media by others as a channel for criticism or other purposes, could also cause rapid, widespread reputational harm to our brands by disseminating rapidly and globally actual or perceived damaging information about us, our products or merchants or other end users who utilize our products. To the extent any of our published sustainability metrics are subsequently viewed as inaccurate or we are unable to execute on our sustainability initiatives, we may be viewed negatively by consumers, investors and other stakeholders concerned about these matters. Also, as we are headquartered in the United States, a negative perception of the United States could impact the perception of our company, which could adversely affect our business. Any of the above issues could have a material and adverse effect to our overall business.
Lack of visibility of our brand in our products and services, or in the products and services of our partners who use our technology, may materially and adversely affect our business.
As more players enter the global payments system, the layers between our brand and consumers and merchants increase. In order to compete with other powerful consumer brands that are also becoming part of the consumer payment experience, we often partner with those brands on payment solutions. These brands include large digital companies and other technology companies who are our customers and use our networks to build their own acceptance brands. In some cases, our brand may not be featured in the payment solution or may be secondary to other brands. Additionally, as part of our relationships with some issuers, our payment brand is only included on the back of the card. As a result, our brand may either be invisible to consumers or may not be the primary brand with which consumers associate the payment experience. This brand invisibility, or any consumer confusion as to our role in the consumer payment experience, could decrease the value of our brand, which could adversely affect our business.
MASTERCARD 2020 FORM 10-K 31
PART I
ITEM 1A. RISK FACTORS
Talent and Culture
We may not be able to attract, hire and retain a highly qualified and diverse workforce, or maintain our corporate culture, which could impact our ability to grow effectively.
Our performance largely depends on the talents and efforts of our employees, particularly our key personnel and senior management. We may be unable to retain or to attract highly qualified employees. The market for key personnel is highly competitive, particularly in technology and other skill areas significant to our business. Additionally, changes in immigration and work permit laws and visa regulations and related enforcement have made it difficult for employees to work in, or transfer among, jurisdictions in which we have operations and could impair our ability to attract and retain qualified employees. Moreover, as a result of the global COVID-19 pandemic, a significant portion of our workforce is working in a mostly remote environment. This remote environment may continue after the pandemic due to potential resulting trends, and could impact the quality of our corporate culture. Failure to attract, hire, develop, motivate and retain highly qualified and diverse employee talent, or to maintain a corporate culture that fosters innovation, creativity and teamwork could harm our overall business and results of operations.
We rely on key personnel to lead with integrity and decency. To the extent our leaders behave in a manner that is not consistent with our values, we could experience significant impact to our brand and reputation, as well as to our corporate culture.
Acquisitions
Acquisitions, strategic investments or entry into new businesses could be impacted by regulatory scrutiny, and if successful, could disrupt our business and harm our results of operations or reputation.
As we continue to evaluate our strategic acquisitions of, or acquiring interests in joint ventures or other entities related to, complementary businesses, products or technologies, we face increasing regulatory scrutiny with respect to antitrust and other considerations. Such scrutiny could prevent us from successfully completing such acquisitions in the future.
To the extent we do make these acquisitions, we may not be able to successfully partner with or integrate them, despite original intentions and focused efforts. In addition, such an integration may divert management’s time and resources from our core business and disrupt our operations. Moreover, we may spend time and money on acquisitions or projects that do not meet our expectations or increase our revenue. To the extent we pay the purchase price of any acquisition in cash, it would reduce our cash reserves available to us for other uses, and to the extent the purchase price is paid with our stock, it could be dilutive to our stockholders. Furthermore, we may not be able to successfully finance the business following the acquisition as a result of costs of operations, including any litigation risk which may be inherited from the acquisition.
Any acquisition or entry into a new business could subject us to new regulations, both directly as a result of the new business as well as in the other existing parts of our business, with which we would need to comply. This compliance could increase our costs, and we could be subject to liability or reputational harm to the extent we cannot meet any such compliance requirements. Our expansion into new businesses could also result in unanticipated issues which may be difficult to manage.
Class A Common Stock and Governance Structure
Provisions in our organizational documents and Delaware law could be considered anti-takeover provisions and have an impact on change-in-control.
Provisions contained in our amended and restated certificate of incorporation and bylaws and Delaware law could be considered anti-takeover provisions, including provisions that could delay or prevent entirely a merger or acquisition that our stockholders consider favorable. These provisions may also discourage acquisition proposals or have the effect of delaying or preventing entirely a change in control, which could harm our stock price. For example, subject to limited exceptions, our amended and restated certificate of incorporation prohibits any person from beneficially owning more than 15% of any of the Class A common stock or any other class or series of our stock with general voting power, or more than 15% of our total voting power. In addition:
• our stockholders are not entitled to the right to cumulate votes in the election of directors
• our stockholders are not entitled to act by written consent
• a vote of 80% or more of all of the outstanding shares of our stock then entitled to vote is required for stockholders to amend any provision of our bylaws
• any representative of a competitor of Mastercard or of Mastercard Foundation is disqualified from service on our board of directors
32 MASTERCARD 2020 FORM 10-K
PART I
ITEM 1A. RISK FACTORS
Mastercard Foundation’s substantial stock ownership, and restrictions on its sales, may impact corporate actions or acquisition proposals favorable to, or favored by, the other public stockholders.
As of February 9, 2021, Mastercard Foundation owned 108,210,635 shares of Class A common stock, representing approximately 11.0% of our general voting power. Mastercard Foundation may not sell or otherwise transfer its shares of Class A common stock prior to May 1, 2027, except to the extent necessary to satisfy its charitable disbursement requirements, for which purpose earlier sales are permitted and have occurred. Mastercard Foundation is permitted to sell all of its remaining shares after May 1, 2027, subject to certain conditions. The directors of Mastercard Foundation are required to be independent of us and our customers. The ownership of Class A common stock by Mastercard Foundation, together with the restrictions on transfer, could discourage or make more difficult acquisition proposals favored by the other holders of the Class A common stock. In addition, because Mastercard Foundation is restricted from selling its shares for an extended period of time, it may not have the same interest in short or medium-term movements in our stock price as, or incentive to approve a corporate action that may be favorable to, our other stockholders.
Item 1B. Unresolved staff comments
Not applicable.