What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2026-02-11 compared with 2025-02-12 · 47 added, 54 removed, 236 unchanged (30% of the section changed)

1 unchanged sentence

Some governments have taken action to provide resources, preferential treatment or other protection to selected domestic payments and processing providers, as well as to create their own national providers.

For example, governments in some countries mandate switching of domestic payments either entirely in that country or by only domestic companies.

For example, governments in some countries (such as South Africa) mandate switching of domestic payments either entirely in that country or by only domestic companies.

Some jurisdictions are currently considering adopting or have adopted data localization requirements, which mandate the collection, storage, and/or other processing of data within their borders.

5 unchanged sentences

Office of Foreign Assets Control (“OFAC”) and the European Union.

We have implemented a comprehensive AML/CFT program, comprised of policies, procedures and internal controls, including the designation of a compliance officer, which is designed to prevent our payments network from being used to facilitate money laundering and other illicit activity and to address these legal and regulatory requirements and assist in managing money laundering and terrorist financing risks.

The economic sanctions programs administered by OFAC restrict financial transactions and other dealings with certain countries and geographies (specifically Crimea, the Donetsk People’s Republic and Luhansk People’s Republic regions of Ukraine, Cuba, Iran, North Korea and Syria) and with persons and entities included in OFAC sanctions lists including its list of Specially Designated Nationals and Blocked Persons (the “SDN List”).

We have implemented a comprehensive AML/CFT program, comprised of policies, procedures and internal controls, including the designation of a compliance officer, which is designed to prevent our payment network from being used to facilitate money laundering and other illicit activity and to address these legal and regulatory requirements and assist in managing money laundering and terrorist financing risks.

The economic sanctions programs administered by OFAC restrict financial transactions and other dealings with certain countries and geographies (specifically Crimea, the Donetsk People’s Republic and Luhansk People’s Republic regions of Ukraine, Cuba, Iran and North Korea) and with persons and entities included in OFAC sanctions lists including its list of Specially Designated Nationals and Blocked Persons (the “SDN List”).

We take measures to prevent transactions that do not comply with OFAC and other applicable sanctions, including establishing a risk-based compliance program that has policies, procedures and controls designed to prevent us from having unlawful business dealings with prohibited countries, regions, individuals or entities.

3 unchanged sentences

Iran and Syria have been identified by the U.S.

State Department as terrorist-sponsoring states, and we have no offices, subsidiaries or affiliated entities located in these countries and do not license entities domiciled there.

State Department as terrorist-sponsoring states.

We do not maintain operations, assets or licensed customers in Iran.

While we currently have no operations in Syria, we are evaluating market entry in strict accordance with applicable laws and restrictions.

We are also subject to anti-corruption laws and regulations globally, including the U.S.

5 unchanged sentences

Additionally, regulations such as the EU’s Payment Services Directive in the EEA require financial institutions to provide third-party payment processors access to consumer payment accounts, enabling them to route transactions away from Mastercard products and provide payment initiation and account information services directly to consumers who use our products.

Authorities in the EU are also revising standards relating to the authentication of transactions, which may increase the number of transactions that consumers abandon if we are unable to ensure a frictionless authentication experience under the new standards.

Regulation of Internet and High-Risk Merchant Categories.

1 unchanged sentence

We are also impacted by evolving laws surrounding certain legally permissible but high-risk merchant categories, such as adult content, firearms, alcohol and tobacco.

Privacy, Data Protection, AI and Information Security.

Aspects of our operations or business are subject to increasingly complex and fragmented privacy, data, AI and information security laws and regulations in the U.S., the EU and elsewhere around the world.

Privacy, Data, AI and Information Security.

Aspects of our operations or business are subject to increasingly complex, fragmented, overlapping and/or divergent privacy, data, AI and information security laws and regulations in the U.S., the EU and elsewhere around the world.

For example, in the U.S., we and our customers are respectively subject to, among other laws and regulations, Federal Trade Commission and federal banking agency information safeguarding requirements under the Gramm-Leach-Bliley Act (GLBA) that require, among other things, the maintenance of a written, comprehensive information security program and, increasingly, a number of state data and privacy laws.

We and our customers may also be subject to evolving U.S.

federal and/or state AI laws and regulations.

With respect to information security, we are subject to the U.S.

We and our customers may also be subject (where applicable) to evolving U.S.

federal and/or state AI and data laws and regulations, including those related to national security.

With respect to information security, we are subject to new and evolving cyber notification regimes, including data protection authorities, cyber authorities and law-enforcement.

We are also subject to public disclosure requirements related to cyber incidents, such as the U.S.

Securities and Exchange Commission (the SEC) disclosure rules that require, among other things, disclosing material cybersecurity incidents in a Current Report on Form 8-K, generally within four business days of determining an incident is material.

In the EU, we are subject to the General Data Protection Regulation (the GDPR) and its equivalent in the U.K., which requires, among other things, a comprehensive privacy, data protection and information security program to protect the personal and sensitive data of EEA residents.

Several regulators and policymakers around the globe use the GDPR as a reference to adopt new or updated privacy, data protection and information security laws and regulations, although divergences have occurred.

Laws and regulations in this area are constantly evolving due to several factors, including increasing data collection and data flows, numerous data breaches and security incidents, more sensitive data categories, and emerging technologies such as AI (which is now subject to regulation in the EU as well as other places).

Several regulators and policymakers around the globe use the GDPR as a reference to adopt new or updated privacy, data and information security laws and regulations, although divergences have occurred.

MASTERCARD 2025 FORM 10-K 25

addition, the interpretation and application of these privacy, data protection and information security laws and regulations are often uncertain and in a state of flux, thus requiring constant monitoring for compliance.

Sustainability Disclosures.

Various jurisdictions have adopted or are increasingly considering adopting laws, regulations and oversight expectations requiring disclosure on environmental, social and governance matters.

Regulations already adopted or being considered include required corporate reporting and disclosures on topics with respect to climate, such as the U.K.

Streamlined Energy and Carbon Reporting, the EU Corporate Sustainability Reporting Directive (“EU CSRD”), and, to the extent they become effective, SEC rules related to climate change.

Other adopted or potential regulations focus on social topics, including human rights, such as the EU Corporate Sustainability Due Diligence Directive, the treatment of employees and diversity of workforce, such as in the EU CSRD.

In addition, the interpretation and application of these privacy, data, AI and information security laws and regulations are often uncertain and in a state of flux, thus requiring constant monitoring and governance.

Additional Regulatory Developments.

Various regulatory agencies also continue to examine a wide variety of issues that could impact us, including evolving laws and guidance surrounding buy-now-pay-later, open banking, credit reporting, digital currencies, marijuana, prepaid payroll cards, identity theft, account management guidelines, disclosure rules, marketing and operational resilience.

Various regulatory agencies around the world continue to examine a wide variety of issues that could impact us, including evolving laws and guidance surrounding buy-now-pay-later, open finance, credit reporting, digital currencies (including stablecoins), marijuana, prepaid payroll cards, identity theft, account management guidelines, disclosure rules, marketing and operational resilience.

Additionally, various jurisdictions have adopted or are increasingly considering adopting laws, regulations and oversight expectations requiring disclosure on environmental, social and governance matters.

The focus of such efforts includes climate-related matters, as well as social matters, such as human rights, the treatment of employees and other workforce-related matters.

Additional Information

8 unchanged sentences

Our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to those reports are available for review, without charge, on the investor relations section of our corporate website as soon as reasonably practicable after they are filed with, or furnished to, the SEC.

The information contained on our corporate website, including, but not limited to, our Environmental, Social and Governance Report and our U.S.

The information contained on our corporate website, including, but not limited to, our Impact Report and our U.S.

Consolidated EEO-1 Report, is not incorporated by reference into this Report.

5 unchanged sentences

Preferential or Protective Government Actions Information Security and Operational Resilience Talent and Culture

Privacy, Data Protection, AI and Information Security

Privacy, Data, AI and Information Security

Stakeholder Relationships Acquisitions and Strategic Investments

51 unchanged sentences

laws related to countering the financing of terrorism, economic sanctions and anti-corruption, or other types of government actions could lead affected or other jurisdictions to take actions in response that could adversely affect our business.

Moreover, because of various concerns

Moreover, because of various concerns jurisdictions may have with respect to our business, including any decisions we may make relating to entering or exiting a

28 MASTERCARD 2025 FORM 10-K

jurisdictions may have with respect to our business, including our decision to suspend business operations in Russia, such jurisdictions may decide to begin to or increase their focus on growing local payment networks and other solutions.

particular market, such jurisdictions may decide to begin to or increase their focus on growing local payment networks and other solutions.

• Regional groups of countries are considering, or may consider, efforts to restrict our switching of regional transactions.

5 unchanged sentences

Such restrictions could adversely impact our ability to compete in these markets.

Privacy, Data Protection, AI and Information Security

Privacy, Data, AI and Information Security

Regulation and enforcement of privacy, data, AI, information security and the digital economy could increase our costs and lead to legal claims and fines, as well as negatively impact our growth and reputation.

We are subject to increasingly complex, fragmented and divergent laws and regulations related to privacy and data protection, data use and governance, AI and information security in the jurisdictions in which we do business.

While policymakers around the globe often look to the EU and the GDPR when adopting new or updated privacy and data protection laws, divergences have occurred and continue to occur.

As a result, new or updated privacy and data protection and information security laws and regulations have led, and may continue to lead, to similar, stricter or at times conflicting requirements, creating an uncertain regulatory environment.

For example, some jurisdictions have implemented or are otherwise considering requirements to collect, store and/or process data within their borders, as well as prohibitions on the transfer of data abroad, leading to technological and operational implications.

We are subject to increasingly complex, fragmented, overlapping and/or divergent laws and regulations related to privacy and data protection, data use and governance, AI and information security (including with respect to cybersecurity and cyber-risk) in the jurisdictions in which we do business.

New or updated laws and regulations have led, and may continue to lead, to similar, stricter or at times conflicting requirements, creating an uncertain regulatory environment.

For example, some jurisdictions have implemented or are otherwise considering requirements to collect, store and/or process data within their borders, as well as prohibitions on the transfer of and access to data abroad, leading to technological and operational implications.

Other jurisdictions have adopted or are otherwise considering adopting sector-specific regulations for the payments industry and other industries in which we participate, including forced data sharing requirements or additional verification requirements.

With respect to information security, any single breach could require parallel notifications to data protection authorities, cyber authorities and/or law-enforcement, often requiring different thresholds, reporting deadlines and formats.

In addition, laws and regulations on AI, data governance and credit decisioning may overlap or conflict with, or diverge from, general privacy rules.

Overall, these myriad laws and regulations may require us to modify or limit our data processing practices and policies, incur substantial compliance-related costs and expenses, and otherwise suffer adverse impacts on our business.

Failure to comply with any of these laws, regulations and requirements (including as a result of conflicting regulations) could result in fines, sanctions or other enforcement actions or penalties, which could materially and adversely affect our results of operations and overall business, as well as have an impact on our reputation.

Failure to comply with any of these laws, regulations and requirements (including as a result of conflicting regulations) could result in fines, sanctions or other enforcement actions or penalties (both civil and criminal), which could materially and adversely affect our results of operations and overall business, as well as have an impact on our reputation.

As a user and deployer of AI technology, we are also subject to increasing and evolving laws and regulations related to AI governance, including the EU AI Act, and new applications of existing laws and regulations to AI.

How our use and deployment of AI will be regulated is still developing as policymakers around the world consider how to regulate AI, and uncertainty remains as to how AI technology will continue to advance.

In addition, the use of AI creates or amplifies risks that are challenging to fully prevent or mitigate.

In particular, AI algorithms may generate inaccurate, unintended, unfair, biased or discriminatory outcomes (which may not be easily detectable or explainable) and may inadvertently disclose confidential information and/or breach intellectual property, privacy or other rights.

Our implementation of robust AI governance and risk management frameworks aimed at complying with emerging laws and regulations may not be sufficient protection against these emerging risks.

Our implementation of robust AI governance and risk management frameworks, designed to ensure our responsible use of AI and help us to comply with emerging laws and regulations, may not be sufficient protection against these emerging risks.

Further, as we acquire new companies and develop integrated and personalized products and services to meet the needs of a changing marketplace, we have expanded and may further expand our data profile through additional data types and sources, across multiple channels, and involving new partners.

This expansion has amplified and may continue to amplify the impact of these various laws and regulations on our business or subject us to new laws and regulations.

For example, our acquisition of Recorded Future, a global threat intelligence company, increases our exposure to certain laws and regulations, including global cybercrime and other laws and regulations in various jurisdictions.

For example, as a provider of global threat intelligence services through Recorded Future, we are subject to increased exposure to certain laws and regulations, including global cybercrime and other laws and regulations in various jurisdictions.

As a result, we are required to constantly monitor our data practices and potentially change them when necessary or appropriate.

We also need to provide increased care in our data management, governance and quality practices, particularly as it relates to the use of data in products leveraging AI.

We also need to provide increased care in our data management, governance, quality and accuracy practices, particularly as it relates to the use of data in products leveraging AI.

New requirements and rules, or changing interpretations of existing requirements in these areas, or the development of new regulatory schemes related to the digital economy in general, may also increase our costs and/or restrict our ability to leverage data or use AI for innovation.

This could impact the products and services we offer and other aspects of our business, such as fraud monitoring, the need for improved data management, governance and quality practices, the development of information-based products and solutions, and technology operations.

In addition, these requirements may increase the costs to our customers of

This could impact the products and services we offer and other aspects of our business, such as fraud

MASTERCARD 2025 FORM 10-K 29

issuing payment products or using information products, which may, in turn, decrease the number of our products that they offer.

monitoring, the need for improved data management, governance, quality and accuracy practices, the development of information-based products and solutions, and technology operations.

In addition, these requirements may increase the costs to our customers of issuing payment products or using information products, which may, in turn, decrease the number of our products that they offer.

While we intend to comply with all regulatory requirements, innovate responsibly and deploy Privacy by Design, Data by Design and AI Governance approaches to all of our product development, the speed and pace of changes in laws (as well as stakeholder interests) may not allow us to meet rapidly evolving regulatory and stakeholder expectations.

14 unchanged sentences

• Issuer and Acquirer Practices Legislation and Regulation.

Certain regulations that impact our issuers and acquirers may impact various aspects of our business.

For example, strong authentication requirements within the EU’s Payment Services Directive in the EEA could increase the number of transactions consumers abandon if we are unable to secure a frictionless authentication experience under these standards.

Certain regulations or legislation that do or could impact our issuers and acquirers (such as caps on issuer interest rates) may impact various aspects of our business.

Additionally, strong authentication requirements within the EU’s Payment Services Directive in the EEA could increase the number of transactions consumers abandon if we are unable to secure a frictionless authentication experience under these standards.

Such an increase could adversely impact our volumes or other operational metrics.

16 unchanged sentences

Jurisdictions around the globe have also increased tax-related audits, which require time and resources to resolve.

30 MASTERCARD 2025 FORM 10-K

Any changes in enacted tax laws, rules, regulatory or judicial interpretations or guidance;

1 unchanged sentence

or any changes in the pronouncements relating to accounting for income taxes could materially and adversely impact our effective income tax rate, tax payments, financial condition and results of operations.

28 MASTERCARD 2024 FORM 10-K

Liabilities or business limitations resulting from litigation could materially and adversely affect our results of operations.

2 unchanged sentences

Certain limitations have been placed on our business because of litigation and litigation settlements, such as changes to our no-surcharge rule in the U.S.

Any future limitations resulting from the outcomes of any litigation or regulatory proceeding, including any changes to our rules or business practices, could impact our relationships with our customers, including reducing the volume of business that we do with them, which may materially and adversely affect our overall business and results of operations.

Any future limitations resulting from the outcomes of any litigation and litigation settlements (such as the Rules Relief Class settlement as described in Note 19 (Legal and Regulatory Proceedings) to the consolidated financial statements included in Part II, Item 8) or regulatory proceeding, including any changes to our rules or business practices, could impact our relationships with our customers, including reducing the volume of business that we do with them, which may materially and adversely affect our overall business and results of operations.

Business and Operations

19 unchanged sentences

Our failure to compete effectively against any of the foregoing threats could materially and adversely affect our overall business and results of operations.

MASTERCARD 2025 FORM 10-K 31

Disintermediation from stakeholders both within and outside of the payments value chain could harm our business.

1 unchanged sentence

• Parties that process our transactions in certain countries (such as merchants and third-party payment processors) may try to eliminate our position as an intermediary in the payment process by switching transactions directly with issuers or processing transactions directly between issuers and acquirers.

MASTERCARD 2024 FORM 10-K 29

• Payments industry participants may develop their own products and services to support our switched transaction and payments offerings, forcing us to change our pricing or practices for our own offerings in order to compete.

Participants may also withhold rights to data we use to power our solutions in order to support their own potential future solutions, potentially impacting the effectiveness of our solutions.

In addition, governments may promote their own national or international payments platforms, potentially putting us at a competitive disadvantage in those markets, or requiring us to compete differently.

11 unchanged sentences

In order to stay competitive, we may have to increase the amount of these incentives and pricing discounts so as to meet customer demand for better pricing arrangements and greater rebates and incentives.

As a result, we may not be able to grow our volume and/or services enough to compensate for the additional costs related to these increased incentives and pricing discounts.

As a result, we may not be able to grow our volume and/or services to the extent necessary to compensate for the additional costs related to these increased incentives and pricing discounts.

In addition, increased pressure on prices increases the importance of cost containment and productivity initiatives in areas other than those relating to customer incentives.

7 unchanged sentences

Any of these factors could have a material adverse impact on our overall business and results of operations.

32 MASTERCARD 2025 FORM 10-K

Rapid and significant technological developments and changes could negatively impact our overall business and results of operations or limit our future growth.

The payments industry is subject to rapid and significant technological changes, including new technologies and changes to existing technologies (such as cryptocurrency and blockchain, AI, machine learning, privacy enhancement and cybersecurity).

The payments industry is subject to rapid and significant technological changes, including new technologies and changes to existing technologies (such as digital assets and blockchain, AI, machine learning, privacy enhancement and cybersecurity).

These changes could result in new technologies that may be superior to, or render obsolete, the technologies we currently use in our programs and services.

2 unchanged sentences

These include:

the inability of third parties on which we rely for the development of and access to new technologies to keep pace with technological changes;

potential action from third-party patent holders, including notices or inquiries threatening litigation against us or our customers for alleged

30 MASTERCARD 2024 FORM 10-K

patent infringement or demanding significant license fees;

the scope of, as well as customer and merchant resistance to, industry-wide solutions and standards (such as those related to tokenization or other safety and security technologies);

the inability of third parties on which we rely for the development of and access to new technologies to keep pace with technological changes (including with regard to AI);

potential action from third-party patent holders, including notices or inquiries threatening litigation against us or our customers for alleged patent infringement or demanding significant license fees;

the scope of, as well as customer and merchant resistance to, industry-wide solutions and standards (such as those related to tokenization or other security technologies);

any difficulty we may experience in attracting and retaining employees with technology expertise;

21 unchanged sentences

In addition, if there is a delay in the implementation of our products or services (which could include compliance obligations, such as AML and CFT, and licensing requirements for applicable products and services), if our products or services do not perform as anticipated, or we are unable to otherwise adequately anticipate risks related to new types of customers, we could face additional regulatory scrutiny, fines, sanctions or other penalties, which could materially and adversely affect our overall business and results of operations, as well as negatively impact our brand and reputation.

Information Security and Operational Resilience

Information security incidents or account data compromise events could disrupt our business, damage our reputation, increase our costs and cause losses.

Information security risks for payments and technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, “hacktivists”, terrorists, nation-states, state-sponsored actors and other external parties.

These threats may derive from fraud or malice on the part of our employees or third parties, or may result from human error, software bugs, server malfunctions, software or hardware failure or other technological failure.

These threats include cyber-attacks such as computer viruses, denial-of-service attacks, malicious code (including ransomware), social-engineering attacks (including phishing attacks) or information security breaches and could lead to the misappropriation or loss of consumer account and other information and identity theft.

These types of threats have risen

MASTERCARD 2025 FORM 10-K 33

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business