What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-13 compared with 2023-02-14 · 96 added, 101 removed, 137 unchanged (59% of the section changed)

Our failure to effectively design and deliver these multi-rail solutions and integrated products and services could make our other offerings less desirable to these customers, or put us at a competitive disadvantage.

In addition, if there is a delay in the implementation of our products or services (which could include compliance obligations, such as AML and CFT, and licensing requirements for our products and services that operate under regulatory licenses), if our products or services do not perform as anticipated, or we are unable to otherwise adequately anticipate risks related to new types of customers, we could face additional regulatory scrutiny, fines, sanctions or other penalties, which could materially and adversely affect our overall business and results of operations, as well as negatively impact our brand and reputation.

Information Security and Operational Resilience

Information security incidents or account data compromise events could disrupt our business, damage our reputation, increase our costs and cause losses.

Information security risks for payments and technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties.

These threats may derive from fraud or malice on the part of our employees or third parties, or may result from human error or accidental technological failure.

These threats include cyber-attacks such as computer viruses, malicious code (including ransomware), phishing attacks or information security breaches and could lead to the misappropriation of consumer account and other information and identity theft.

These types of threats have risen significantly due to a significant portion of our workforce working in a remote or hybrid environment.

Our operations rely on the secure processing, transmission and storage of confidential, proprietary and other information and technology in our computer systems and networks, as well as the systems of our third-party providers.

Our customers and other parties in the payments value chain, as well as account holders, rely on our digital technologies, computer systems, software and networks to conduct their operations.

In addition, to access our integrated products and services, our customers and account holders increasingly use personal smartphones, tablet PCs and other mobile devices that may be beyond our control.

We, like other financial technology organizations, routinely are subject to cyber-threats and our technologies, systems and networks, as well as the systems of our third-party providers, have been subject to attempted cyber-attacks.

Because of our position in the payments value chain, we believe that we are likely to continue to be a target of such threats and attacks.

In response to U.S.

and European sanctions against Russia earlier this year, we saw increased information security threats from state sponsored actors.

Other geopolitical events and resulting government activity could also lead to information security threats and attacks by affected or sympathizing jurisdictions or other actors, which could put our information and assets at risk, as well as result in network disruption.

To date, we have not experienced any material impact relating to cyber-attacks or other information security breaches.

However, future attacks or breaches could lead to security breaches of the networks, systems (including third-party provider systems) or devices that our customers use to access our integrated products and services, which in turn could result in the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary and other information (including account data information) or data security compromises.

Such attacks or breaches could also cause service interruptions, malfunctions or other failures in the physical infrastructure or operations systems that support our businesses and customers (such as the lack of availability of our value-added services), as well as the operations of our customers or other third parties.

In addition, they could lead to damage to our reputation with our customers, other stakeholders and the broader payments ecosystem, additional costs to us (such as repairing systems, adding new personnel or protection technologies or compliance costs), regulatory penalties, financial losses to both us and our customers and partners and the loss of customers and business opportunities.

These consequences could be further pronounced in jurisdictions in which we are deemed critical national infrastructure.

If such attacks are not detected immediately, their effect could be compounded.

Despite various mitigation efforts that we undertake, there can be no assurance that we will be immune to these risks and not suffer material breaches and resulting losses in the future, or that our insurance coverage would be sufficient to cover all losses.

Our risk and exposure to these matters remain heightened because of, among other things, the evolving nature of these threats, our prominent size and scale and our role in the global payments and technology industries, our plans to continue to implement our digital and mobile channel strategies and develop additional remote connectivity solutions to serve our customers and account holders when and how they want to be served, our global presence, our extensive use of third-party vendors and future joint venture and merger and acquisition opportunities.

As a result, information security and the continued development and enhancement of our controls, processes and practices designed to protect our systems, computers, software, data and networks from attack, damage or unauthorized access remain a priority for us.

As cyber-threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities.

Any of the risks described above could materially adversely affect our overall business and results of operations.

MASTERCARD 2022 FORM 10-K 33

In addition to information security risks for our systems, we also routinely encounter account data compromise events involving merchants and third-party payment processors that process, store or transmit payment transaction data, which affect millions of Mastercard, Visa, Discover, American Express and other types of account holders.

In addition to information security risks for our systems and networks, we also routinely encounter account data compromise events involving merchants and third-party payment processors that process, store or transmit payment transaction data, which affect millions of Mastercard, Visa, Discover, American Express and other types of account holders.

Further events of this type may subject us to reputational damage and/or lawsuits involving payment products carrying our brands.

Damage to our reputation or that of our brands resulting from an account data breach of either our systems or the systems of our customers, merchants and other third parties could decrease the use and acceptance of our integrated products and services.

Damage to our reputation or that of our brands resulting from an account data breach of either our systems and networks or the systems and networks of our customers, merchants and other third parties could decrease the use and acceptance of our products and services.

Such events could also slow or reverse the trend toward electronic payments.

1 unchanged sentence

Moreover, while most of the lawsuits resulting from account data breaches do not involve direct claims against us and while we have releases from many issuers and acquirers, we could still face damage claims, which, if upheld, could materially and adversely affect our results of operations.

While we offer cyber and intelligence products that are designed to prevent, detect and respond to fraud and cyber-attacks, there can be no assurance that such security solutions will perform as expected or address all possible security threats.

Real or perceived defects, failures, errors or vulnerabilities in our security solutions, such as our cyber and intelligence products, could adversely impact our reputation, customer confidence in our solutions and our business and may subject us to litigation, governmental audits and investigation or other liabilities.

Such events could have a material adverse impact on our transaction volumes, results of operations and prospects for future growth, or increase our costs by leading to additional regulatory burdens being imposed on us.

In addition, fraudulent activity and increasing cyber-attacks have encouraged legislative and regulatory intervention, and could damage our reputation and reduce the use and acceptance of our products and services or increase our compliance costs.

Criminals are using increasingly sophisticated methods to capture consumer personal information to engage in illegal activities such as counterfeiting or other fraud and may see their effectiveness enhanced by the use of AI.

As outsourcing and specialization become common in the payments industry, there are more third parties involved in processing transactions using our payment products.

While we are continuing to take measures to make card and digital payments more secure, increased fraud levels involving our products and services, or misconduct or negligence by third parties switching or otherwise servicing our products and services, could lead to legislative or regulatory intervention, such as enhanced security requirements and liabilities, as well as damage to our reputation.

See “Risk Factors - Privacy, Data Protection, AI and Information Security Compliance” in this Part I, Item 1A for more detail concerning related legal risks and obligations.

Despite various mitigation efforts that we undertake, there can be no assurance that we will not suffer material breaches and resulting losses in the future.

While we maintain insurance coverage, such coverage may not be adequate to protect us from such losses as well as any liabilities or damages with respect to claims alleging compromises of our confidential, proprietary, sensitive or personal information or our technologies, systems or networks.

In addition, we cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or at all, or that our insurers will not deny coverage as to any future claim.

Our risk and exposure to these matters remain heightened due to, among other things, the evolving nature of these threats, our prominent role in the global payments ecosystem, our continued implementation of our strategic priorities, our extensive use of third-party vendors and potential vulnerabilities from previous and future acquisitions, strategic investments or related opportunities.

As a result, information security and the continued development and enhancement of our controls, processes and practices designed to protect our computer systems, software, data and networks from attack, damage or unauthorized access remain a priority for us.

Any of the risks described above could materially adversely affect our overall business and results of operations.

Service disruptions that cause us to be unable to process transactions or service our customers could reduce our operational resilience and materially affect our overall business and results of operations.

Our transaction switching systems and other offerings have experienced in limited instances and may continue to experience interruptions as a result of technology malfunctions, fire, weather events, power outages, telecommunications disruptions, terrorism, workplace violence, accidents or other catastrophic events (including those related to climate change).

Our visibility in the global payments industry may also put us at greater risk of attack by terrorists, activists, or hackers who intend to disrupt our facilities and/or systems.

Our transaction switching systems and other offerings have experienced in limited instances and may continue to experience interruptions as a result of technology malfunctions, supply-chain attacks, fire, floods, earthquakes, weather events, power outages, telecommunications disruptions, terrorism, workplace violence, accidents or other catastrophic events (including those related to climate change).

Our visibility in the global payments industry may also put us at greater risk of attack by terrorists, activists, or hackers who intend to disrupt our facilities, networks and/or systems.

Additionally, we rely on third-party service providers for the timely transmission of information across our global data network.

2 unchanged sentences

Although we maintain an enterprise resiliency program to analyze risk, assess potential impacts, and develop effective response strategies, we cannot ensure that our business would be immune to these risks, because of the intrinsic importance of our switching systems to our business, any interruption or degradation could adversely affect the perception of the reliability of products carrying our brands and materially adversely affect our overall business and our results of operations.

MASTERCARD 2023 FORM 10-K 35

Stakeholder Relationships

12 unchanged sentences

A significant loss of our existing revenue or transaction volumes from these customers could have a material adverse impact on our business.

34 MASTERCARD 2022 FORM 10-K

Consolidation amongst our customers could materially and adversely affect our overall business and results of operations.

1 unchanged sentence

These consolidations have included customers with a substantial Mastercard portfolio being acquired by institutions with a strong relationship with a competitor.

Potential future consolidation could occur as a result of bank failures, similar to those that occurred in the U.S.

If significant consolidation among customers were to continue, it could result in the substantial loss of business for us, which could have a material adverse impact on our business and prospects.

11 unchanged sentences

If our customers become financially unstable, we may lose revenue or we may be exposed to settlement risk.

See our risk factor in “Risk Factors - Settlement and Third-Party Obligations” in this Part I, Item 1A with respect to how we guarantee certain third-party obligations for further discussion.

With the exception of the United States and a select number of other jurisdictions, most in-country (as opposed to cross-border) transactions conducted using Mastercard, Maestro and Cirrus cards are authorized, cleared and settled by our customers or other processors.

Because we do not provide domestic switching services in these countries and do not, as described above, have direct relationships with account holders, we depend on our close working relationships with our customers to effectively manage our brands, and the perception of our payments system, among consumers in these countries.

See “Risk Factors - Settlement and Third-Party Obligations” in this Part I, Item 1A with respect to how we guarantee certain third-party obligations.

With the exception of the U.S.

and a select number of other jurisdictions, most in-country (as opposed to cross-border) transactions conducted using cards with our brands are switched by our customers or other processors.

Because we do not provide domestic switching services in these countries or have direct relationships with account holders, we depend on our close working relationships with our customers to effectively manage our brands, and the perception of our payments system, among consumers in these countries.

We also rely on these customers to help manage our brands and perception among regulators and merchants in these countries, alongside our own relationships with them.

From time to time, our customers may take actions that we do not believe to be in the best interests of our payments system overall, which may materially and adversely impact our business.

36 MASTERCARD 2023 FORM 10-K

Merchants’ continued focus on acceptance costs may lead to additional litigation and regulatory proceedings and increase our incentive program costs, which could materially and adversely affect our profitability.

Merchants are important constituents in our payments system.

We rely on both our relationships with them, as well as their relationships with our issuer and acquirer customers, to continue to expand the acceptance of our integrated products and services.

We rely on both our relationships with them, as well as their relationships with our issuer and acquirer customers, to continue to expand the acceptance of our products and services.

We also work with merchants to help them enable new sales channels, create better purchase experiences, improve efficiencies, increase revenues and fight fraud.

In the retail industry, there is a set of larger merchants with increasingly global scope and influence that we believe are having a significant impact on all participants in the global payments industry, including Mastercard.

In the retail industry, we believe a set of larger merchants with increasingly global scope and influence are having a significant impact on all participants in the global payments industry, including Mastercard.

Some large merchants have supported the legal, regulatory and legislative challenges to interchange fees that Mastercard has been defending, including the U.S.

1 unchanged sentence

Some merchants are increasingly asking regulators to review and potentially regulate our own network fees, in addition to interchange.

See our risk factor in “Risk Factors – Other Regulation” in this Part I, Item 1A with respect to payments industry regulation, including interchange fees.

The continued focus of merchants on the costs of accepting various forms of payment, including in connection with the growth of digital payments, may lead to additional litigation and regulatory proceedings.

See “Risk Factors – Payments Industry Regulation” in this Part I, Item 1A.

The continued focus of merchants on the costs of accepting various forms of payment (including digital) may lead to additional litigation and regulatory proceedings.

Certain larger merchants are also able to negotiate incentives from us and pricing concessions from our issuer and acquirer customers as a condition to accepting our products.

3 unchanged sentences

Additionally, if the rate of merchant acceptance growth slows, our business could suffer.

MASTERCARD 2022 FORM 10-K 35

Our work with governments exposes us to unique risks that could have a material impact on our business and results of operations.

3 unchanged sentences

Changes in governmental priorities or other political developments, including disruptions in governmental operations, could impact approved funding and result in changes in the scope, or lead to the termination, of the arrangements or contracts we or financial institutions enter into with respect to our payment products and services.

• Our work with governments subjects us to U.S.

• Our work with governments is heavily regulated, subjecting us to additional potential exposure under U.S.

and international anti-corruption laws (including the U.S.

Foreign Corrupt Practices Act and the U.K.

A violation and subsequent judgment or settlement under these laws could subject us to substantial monetary penalties and damages and have a significant reputational impact.

Bribery Act), as well as compliance with various procurement and other laws, regulations, standards and contract terms.

Any violation and subsequent judgment or settlement related to the above could subject us to substantial monetary penalties and damages and have a significant reputational impact.

Moreover, as a government contractor, we are subject to a government’s right to conduct audits and investigations into both our contract performance and our compliance with applicable laws, regulations and contract terms.

Any adverse finding could subject us to civil or criminal penalties, sanctions, or suspension or disbarment.

• Working or contracting with governments, either directly or via our financial institution customers, can subject us to heightened reputational risks, including extensive scrutiny and publicity, as well as a potential association with the policies of a government as a result of a business arrangement with that government.

7 unchanged sentences

• Consumers and businesses lowering spending, which could impact domestic and cross-border spend

• Debt limit and budgetary discussions in the U.S.

has affected, and could further affect, the U.S.

credit rating, impacting consumer confidence and spending

• Government intervention (including the effect of laws, regulations and/or government investments on or in our financial institution customers), as well as uncertainty due to changing political regimes in executive, legislative and/or judicial branches of government, that may have potential negative effects on our business and our relationships with customers or otherwise alter their strategic direction away from our products

MASTERCARD 2023 FORM 10-K 37

• Tightening of credit availability that could impact the ability of participating financial institutions to lend to us under the terms of our credit facility

3 unchanged sentences

Cross-border activity has, and may continue to be, adversely affected by world geopolitical, economic, health, weather and other conditions.

These include COVID-19, as well as the threat of terrorism and separate outbreaks of flu, viruses and other diseases (any of which could result in future epidemics or pandemics), as well as major environmental and extreme weather events, including those related to climate change.

These include or have included:

• the global COVID-19 pandemic (and the potential of any post-pandemic global economic impact) and potential separate outbreaks of flu, viruses and other diseases (any of which could result in future epidemics or pandemics)

• current and potential future geopolitical conflicts, as well as expansion into regional or global conflicts, and the resulting impacts to our business (this includes Russia’s invasion of Ukraine and the actions taken by the U.S., the EU, other governments and Mastercard in response)

• the threat of terrorism and major environmental and extreme weather events (including those related to climate change)

The impact of and uncertainty that could result from any of these events or factors could ultimately decrease cross-border activity.

2 unchanged sentences

Russia’s invasion of Ukraine.

In response to the Russian invasion of Ukraine, the United States, the European Union and other governments imposed sanctions and other restrictive measures on certain Russian-related entities and individuals and we suspended our business operations in Russia.

We have experienced loss of revenue in this fast-growing market as a result of both the implementation of sanctions and the suspension of our business operations, as well as related impacts in Ukraine and throughout the region.

Future developments (including the expansion or extension of the war, future sanctions and/or actions taken by others globally, and other macroeconomic factors) could result in further negative impacts on our business and financial results.

As customers, merchants and other business partners are impacted by the invasion, it can further negatively affect the environment in which we operate.

Moreover, our compliance with sanctions and our decision to suspend business operations has led, and could further lead, to other legal ramifications and operational challenges, including fines, the nationalization of our subsidiary and any resulting impacts, and/or lawsuits.

36 MASTERCARD 2022 FORM 10-K

In addition to the cross-border impacts described above, our compliance with sanctions and our decision to suspend our business operations in Russia has led, and could further lead, to other legal ramifications and operational challenges, including fines, the nationalization of our subsidiary and any resulting impacts, and/or lawsuits.

Our operations as a global payments network rely in part on global interoperable standards to help facilitate safe and simple payments.

To the extent geopolitical events result in jurisdictions no longer participating in the creation or adoption of these standards, or the creation of competing standards, the products and services we offer could be negatively impacted.

Any of these developments could have a material adverse impact on our overall business and results of operations.

The global COVID-19 pandemic and measures taken in response have adversely impacted our business, results of operations and financial condition, and may continue to do so depending on future developments, which are uncertain.

While conditions related to the global COVID-19 pandemic generally improved in 2022, the pandemic continues to have negative effects on the global economy and has affected business activity, in particular, in areas such as travel and supply chains.

These impacts have continued to adversely impact consumers, our customers, suppliers and business partners, as well as our workforce.

Governments, businesses and consumers continue to react to changing conditions, including the emergence of variants of the virus, the severity of infections on a regional basis and the global administration of vaccines and boosters.

Such reactions have included tightening or loosening safety measures and border restrictions or voluntarily making personal safety decisions, as applicable, based on the current environment of their location.

The COVID-19 pandemic has adversely impacted our business, results of operations and financial condition.

There are no comparable recent events which may provide guidance as to the future effects of a global pandemic such as COVID-19, and, as a result, the ultimate impact of this pandemic or a similar health epidemic in the future is uncertain and subject to change.

The full extent to which the COVID-19 pandemic, and measures taken in response, further impacts our business, results of operations and financial condition will depend on future developments, which are uncertain, including, but not limited to, the duration of the pandemic and its impact on the global economy, including the extent to which we can continue to progress toward and maintain more consistent economic and operating conditions.

Even after the COVID-19 pandemic has subsided, we may continue to experience materially adverse impacts to our business and our results of operations as a result of its global economic impact, including any recession that has occurred or may occur in the future.

Factors such as those discussed above have adversely impacted our business, results of operations and financial condition, and any of these developments potentially could have a material adverse impact on our overall business and results of operations.

Adverse currency fluctuations and foreign exchange controls could negatively impact our results of operations.

During 2022, approximately 67% of our revenue was generated from activities outside the United States.

During 2023, approximately 70% of our revenue was generated from activities outside the U.S.

This revenue (and the related expense) could be transacted in a non-functional currency or valued based on a currency other than the functional currency of the entity generating the revenues.

1 unchanged sentence

Our risk management activities provide protection with respect to adverse changes in the value of only a limited number of currencies and are based on estimates of exposures to these currencies.

In addition, some of the revenue we generate outside the United States is subject to unpredictable currency fluctuations including devaluation of currencies where the values of other currencies change relative to the U.S.

In addition, some of the revenue we generate outside the U.S.

is subject to unpredictable currency fluctuations including devaluation of currencies where the values of other currencies change relative to the U.S.

dollar strengthens compared to currencies in which we generate revenue, this revenue may be translated at a materially lower amount than expected.

Furthermore, we may become subject to exchange control regulations that might restrict or prohibit the conversion of our other revenue currencies into U.S.

dollars, such as what we have experienced in Venezuela.

Furthermore, we may become subject to exchange control regulations that might restrict or prohibit the conversion into U.S.

dollars of our other revenue currencies and financial assets.

The occurrence of currency fluctuations or exchange controls could have a material adverse impact on our results of operations.

5 unchanged sentences

From time to time, our customers may take actions that we do not believe to be in the best interests of our brands, such as creditor practices that may be viewed as “predatory”.

Moreover, adverse developments with respect to our industry or the industries of our customers or other companies and organizations that use our products and services (including certain legally permissible but high- risk merchant categories, such as adult content, firearms, alcohol and tobacco) may also, by association, impair our reputation, or result in greater public, regulatory or legislative scrutiny, as well as potential litigation.

Moreover, adverse developments with respect to our industry or the industries of our customers or other companies and organizations that use our products and services (including certain legally permissible but high-risk merchant categories, such as adult content, firearms, alcohol and tobacco) may also, by association, impair our reputation, or result in greater public, regulatory or legislative scrutiny,

38 MASTERCARD 2023 FORM 10-K

as well as potential litigation.

We may also face similar scrutiny to the extent that we are unable to detect and/or prevent illegal activities using our payment products or otherwise occurring over our network.

1 unchanged sentence

Under some circumstances, our use of social media, or the use of social media by others as a channel for criticism or other purposes, could also cause rapid, widespread reputational harm to our brands by disseminating rapidly and globally actual or perceived damaging information about us, our products or merchants or other end users who utilize our products.

MASTERCARD 2022 FORM 10-K 37

• We are headquartered in the United States.

As such, a negative perception of the United States could impact the perception of our company, which could adversely affect our business.

• We are headquartered in the U.S.

As such, a negative perception of the U.S.

could impact the perception of our company, which could adversely affect our business.

Any of the above issues could have a material and adverse effect on our overall business.

8 unchanged sentences

ESG matters and related stakeholder reaction may impact our reputation, expose us to legal requirements and liability and/or have other business impacts, which could adversely affect our overall business and/or results of operations.

Our brand and reputation are associated with our public commitments to various ESG initiatives, including our goals relating to climate (e.g., our commitment to achieve net-zero emissions by 2040), financial inclusion, and diversity, equity and inclusion.

Consumers, investors, employees and other stakeholders are increasingly focused on ESG practices, and to the extent any of our ESG disclosures, public statements and metrics are subsequently viewed as inaccurate, or we are unable to execute on our sustainability initiatives, we may be viewed negatively by stakeholders concerned about these matters.

These stakeholders may also have a negative view of us to the extent we have been or in the future are perceived to have not responded appropriately to growing concerns with respect to ESG matters or take or do not take positions that are unpopular with them.

In addition, various jurisdictions are increasingly adopting or considering laws and regulations that have or would impact us pertaining to ESG governance, strategy, risk management and metrics/targets.

Regulations already adopted or being considered include required corporate reporting and disclosures on specific topics (such as climate and human rights) as well as broader matters (such as other environmental matters, treatment of employees and diversity of workforce).

These requirements would likely result in increased compliance costs for our business and supply chain, which may increase our operating costs.

Our brand and reputation are associated with our public commitments to various ESG initiatives, including our goals relating to climate (such as our commitment to achieve net-zero emissions by 2040), financial inclusion, and DEI.

Consumers, investors, employees and other stakeholders are increasingly focused on ESG practices.

To the extent any of our ESG disclosures, public statements and metrics are subsequently viewed as inaccurate, or we are unable to execute on our ESG initiatives, we may be viewed negatively by stakeholders concerned about these matters.

Stakeholders (including those in support of or in opposition to ESG principles) may also have a negative view of us to the extent we are perceived to have not responded appropriately to their ESG concerns or take positions that are contrary to their views or expectations.

These include required corporate reporting and disclosures on specific topics (such as climate and human rights) as well as broader matters (such as other environmental matters, treatment of employees and diversity of workforce).

These requirements have, and are likely to continue to, result in increased compliance costs for our business and supply chain, which may increase our operating costs.

Moreover, as governments, investors and other stakeholders face pressure to address climate change and other ESG matters, these stakeholders may express new expectations and focus investments in ways that could cause significant shifts in commerce and consumption behaviors.

3 unchanged sentences

We may not be able to attract and retain a highly qualified and diverse workforce, or maintain our corporate culture, which could harm our overall business and results of operations.

Our performance largely depends on the talents and efforts of our employees (including our people leaders), as well as the environment we create for them to enable them to perform their jobs effectively.

The market for specialized skill-sets is highly competitive, particularly in technology and other areas that are important to the growth of our business.

Our inability to meet candidate demands has led in recent years, and may continue to lead, to an increase in declined offers.

In addition, high inflation has impacted both cost structure and employee demand for wage growth, which may lead to talent attrition.

Moreover, changes in and enforcement of immigration and work permit laws and visa regulations have made it difficult for employees to work in, or transfer among, jurisdictions where we operate, potentially impairing our ability to attract and retain talent.

In the wake of the global COVID-19 pandemic and the influence of work flexibility on candidate decisions, we have adapted our policies and practices to allow for flexible team-driven work arrangements (including both remote and hybrid).

This approach may impact the nature of relationships among our workforce, which in turn could have a negative impact on the quality of our corporate culture and our ability to innovate.

To the extent the arrangements we provide do not meet candidate or employee expectations for flexibility, this could also impact our ability to attract and retain talent.

Our performance largely depends on the skills, capabilities and motivation of our employees (including our people leaders), as well as the environment we create for them to enable them to perform their jobs effectively.

While attrition and pace of hiring has slowed due to economic uncertainty, the market for specialized skill-sets remains highly competitive, particularly in technology and other areas that are important to the growth of our business.

To the extent we are unable to differentiate our value proposition in the market, effectively develop leaders and build robust succession pipelines, it could impact our ability to deliver for our customers.

To the extent we cannot design our processes and practices to support equitable outcomes, our ability to attract talent may be significantly impacted and we may experience talent attrition.

In addition, escalations in global conflict and a rise in mental health needs are also impacting the well-being of our people.

To the extent we are unable to communicate effectively on these issues and provide support to our employees, we could experience a significant impact on our business, reputation and culture.

MASTERCARD 2023 FORM 10-K 39

changes in and enforcement of immigration and work permit laws and visa regulations have made it difficult for employees to work in, or transfer among, jurisdictions where we operate, potentially impairing our ability to attract and retain talent.

Our flexibility policies and programs (in particular, those related to work arrangements) may impact the well-being and productivity of our workforce, which in turn could have a negative impact on the quality of our corporate culture and our ability to innovate.

To the extent these policies (including our team-based agreements) do not meet candidate or employee expectations for flexibility, this could also impact our ability to attract and retain talent.

Failure to attract, hire, develop, motivate and retain highly qualified and diverse employee talent could leave us vulnerable to not anticipating or identifying emerging customer or market opportunities.

2 unchanged sentences

Any one or more of the above could harm our overall business and results of operations.

Our efforts to enter into acquisitions, strategic investments or entry into new businesses could be impacted or prevented by regulatory scrutiny and could otherwise result in issues that could disrupt our business and harm our results of operations or reputation.

We continue to evaluate our strategic acquisitions of complementary businesses, products or technologies, as well as acquiring interests in related joint ventures or other entities.

Acquisitions and Strategic Investments

Our efforts to enter into acquisitions, strategic investments or new businesses could be impacted or prevented by regulatory scrutiny and could otherwise result in issues that could disrupt our business and harm our results of operations or reputation.

We continue to evaluate our strategic acquisitions of, and investments in, complementary businesses, products or technologies.

As we do so, we face increasing regulatory scrutiny with respect to antitrust, national security and other considerations that could impact these efforts.

3 unchanged sentences

To the extent we do make these acquisitions, we may not be able to successfully partner with or integrate them, despite original intentions and focused efforts.

In addition, such an integration may divert management’s time and resources from our core business and disrupt our operations.

Moreover, we may spend time and money on acquisitions or projects that do not meet our expectations or increase our revenue.

To the extent we pay the purchase price of any acquisition in cash, it would reduce our cash reserves available to us for other uses, and to the extent the purchase price is paid with our stock, it could be dilutive to our stockholders.

Furthermore, we may inherit litigation risk which may increase our post-acquisition costs of operations and impact our ability to successfully finance that business.

Any acquisition or entry into a new business could subject us to new regulations, both directly as a result of the new business as well as in the other existing parts of our business, with which we would need to comply.

Such an integration also may divert management’s time and resources from our core business and disrupt our operations.

Moreover, we have spent, and may continue to spend, time and money on acquisitions or projects that do not sufficiently meet our expectations (either strategically or financially), which has resulted (and may in the future result) in divesting from or otherwise exiting these investments or businesses.

Additionally, to the extent we pay the purchase price of any acquisition in cash, it would reduce our cash reserves available to us for other uses, and to the extent the purchase price is paid with our stock, it could be dilutive to our stockholders.

Furthermore, we have inherited and may in the future inherit litigation risk which has or may increase our post-acquisition costs of operations and/or impact our ability to successfully finance that business.

Any acquisition, investment or entry into a new business could subject us to new regulations, both directly as a result of the new business as well as in the other existing parts of our business, with which we would need to comply.

This compliance could increase our costs, and we could be subject to liability or reputational harm to the extent we cannot meet any such compliance requirements.

Additionally, targets that we acquire may have data practices that do not initially conform to our privacy and data protection standards and data governance model, which could lead to regulatory scrutiny and reputational harm.

Additionally, targets that we acquire have had, and may in the future have, data practices that do not initially conform to our privacy, data protection and information security standards and data governance model, which could lead to regulatory scrutiny and reputational harm.

These targets also have resulted in, and may in the future lead to, information security vulnerabilities for us.

Settlement and Third-Party Obligations

Our role as guarantor, as well as other contractual obligations, expose us to risk of loss or illiquidity.

We are a guarantor of certain third-party obligations, including those of certain of our customers.

In this capacity, we are exposed to credit and liquidity risk from these customers and certain service providers.

Our role as guarantor, as well as other contractual obligations and discretionary actions, expose us to risk of loss or illiquidity.

We are a guarantor of certain third-party obligations, including those of certain of our customers and service providers.

In this capacity, we are exposed to credit and liquidity risk.

We may incur significant losses in connection with transaction settlements if a customer fails to fund its daily settlement obligations due to technical problems, liquidity shortfalls, insolvency or other reasons.

Concurrent settlement failures of more than one of our larger customers or of several of our smaller customers either on a given day or over a condensed period of time may exceed our available resources and could materially and adversely affect our results of operations.

The recent increased speed of bank failures as recently seen in the U.S.

could increase the potential for such losses.

Concurrent settlement failures of more than one of our larger customers or of several smaller customers either on a given day or over a condensed period of time may exceed our available resources.

Additionally, certain non-guaranteed transactions as well as chargebacks to acquirers in the event of acquirer default could result in elevated brand risk and the potential for financial loss.

These impacts could materially and adversely affect our results of operations.

We have significant contractual indemnification obligations with certain customers.

Should an event occur that triggers these obligations, such an event could materially and adversely affect our overall business and results of operations.

40 MASTERCARD 2023 FORM 10-K

Class A Common Stock and Governance Structure

3 unchanged sentences

For example, subject to limited exceptions, our amended and restated certificate of incorporation prohibits any person from beneficially owning more than 15% of any of the Class A common stock or any other class or series of our stock with general voting power, or more than 15% of our total voting power.

MASTERCARD 2022 FORM 10-K 39

• our stockholders are not entitled to the right to cumulate votes in the election of directors

3 unchanged sentences

As of February 8, 2024, Mastercard Foundation owned 97,543,508 shares of Class A common stock, representing approximately 10.5% of our general voting power.

Currently, Mastercard Foundation may not sell or otherwise transfer its shares of Class A common stock prior to May 1, 2027, except to the extent necessary to satisfy its charitable disbursement requirements, for which purpose earlier sales are permitted and have occurred.

Based on that timing, Mastercard Foundation would be permitted to sell all of its remaining shares beginning May 1, 2027, subject to certain conditions.

Historically, Mastercard Foundation had been restricted from selling or otherwise transferring its shares of Class A common stock prior to May 1, 2027, except to the extent necessary to satisfy its charitable disbursement requirements, for which purpose earlier sales were permitted and had occurred.

In July 2023, pursuant to an application in consultation with Mastercard, Mastercard Foundation received court approval to advance that date to January 1, 2024.

As a result, Mastercard Foundation is now permitted to sell all or part of its remaining shares, subject to certain conditions.

Mastercard Foundation would do so pursuant to an orderly and structured plan to diversify its Mastercard shares over a seven-year period, while remaining a long-term Mastercard stockholder and retaining a significant holding of Mastercard shares in its portfolio.

The directors of Mastercard Foundation are required to be independent of us and our customers.

The ownership of Class A common stock by Mastercard Foundation, together with the restrictions on transfer, could discourage or make more difficult acquisition proposals favored by the other holders of the Class A common stock.

In addition, because Mastercard Foundation is restricted from selling its shares for an extended period of time, it may not have the same interest in short or medium-term movements in our stock price as, or incentive to approve a corporate action that may be favorable to, our other stockholders.

Unresolved staff comments

Not applicable.

The ownership of Class A common stock by Mastercard Foundation, together with the seven-year diversification plan, could discourage or make more difficult acquisition proposals favored by the other holders of the Class A common stock.

In addition, because Mastercard Foundation intends to sell its shares over an extended period of time, it may not have the same interest in short or medium-term movements in our stock price as, or incentive to approve a corporate action that may be favorable to, our other stockholders.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors