VISA Inc.

Digital transformation and innovation · Artificial intelligence and automation

We are subject to a variety of laws and regulations governing the development, use and deployment of AI technologies. These laws and regulations are increasingly complex, fragmented and still evolving, and there is no single global regulatory framework for AI.

Cybersecurity and data protection · Data breaches and cyber attacks

Our cybersecurity and processing systems have experienced and may continue to experience errors, interruptions, delays or damage from hardware, software and network failures, computer viruses, ransomware, malware, advanced cyber attacks, and social engineering threats.

Cybersecurity and data protection · Third party data security and vendors

We are impacted by attacks and data security breaches of financial institutions, sellers, and third-party service providers. The security measures and procedures we and our clients have in place may not be successful or sufficient to counter all data security breaches, cyber incidents and attacks.

Digital transformation and innovation · Artificial intelligence and automation

We are subject to a variety of laws and regulations governing the development, use, and deployment of AI technologies. These laws and regulations are still evolving, and there is no single global regulatory framework for AI. The EU has adopted a comprehensive AI Act that applies harmonized rules across Europe with the aim of fostering innovation and respecting fundamental rights, with key provisions related to high risk AI coming into force in August 2026.

Reputation and brand · Brand damage and negative publicity

Our brand reputation may be negatively impacted by authorization, clearing and settlement service disruptions; data security breaches; compliance failures by Visa; failure to meet expectations of our clients, consumers or other stakeholders; and fraudulent or illegal activities using our payment products or services.

Reputation and brand · Corporate social responsibility

Any failure, or perceived failure, by us to adhere to our public statements, comply fully with developing interpretations of CRS laws and regulations, or meet evolving and varied stakeholder expectations and standards could negatively impact our business, reputation, financial condition, and operating results.

Geopolitical and trade · International conflicts and tensions

In March 2022, we suspended our operations in Russia due to economic sanctions imposed on Russia, impacting Visa and its clients. Geopolitical trends towards nationalism, protectionism and restrictive visa requirements could impact the expansion of our business in certain regions.

Economic and market conditions · Economic recession and downturns

More than half of our net revenue is earned outside the U.S. Adverse macroeconomic conditions within the U.S. or internationally, including recessions, inflation, rising interest rates, and reduced consumer spending, have a direct impact on international commerce and our payments volume.

Strategic execution · Merger acquisition and divestiture risks

We may not achieve the anticipated benefits of our current and future acquisitions, joint ventures or strategic investments and they may involve significant risks and uncertainties, including disruption to our ongoing business and failure to adequately develop or integrate our acquired entities.

Market position and competition · Pricing pressure and margin compression

We face intense competitive pressure on the prices we charge our financial institution clients. In order to stay competitive, we may need to adjust our pricing or offer incentives to our clients to grow payments volume, which impacts our net revenue and profitability.

Legal and litigation · Litigation and legal proceedings

We are subject to numerous litigation matters, investigations, claims, examinations investigating or alleging violations of competition and antitrust law. In the event we are found liable or reach a settlement in any action, particularly in a large class action lawsuit involving an antitrust claim entitling the plaintiff to treble damages in the U.S., we may be required to pay significant awards or judgments.

Data and privacy · Cross border data transfer regulations

Certain countries have established specific legal requirements for data localization, such as where personal data must remain stored in the country. Ongoing regulatory initiatives in India, including data localization requirements, have cost implications for us and could affect our ability to compete.

Data and privacy · Data protection and privacy laws

Legislators and regulators around the world are increasingly adopting or revising privacy, data protection, data management, data transfer, AI and cybersecurity laws and regulations. The global proliferation of new privacy and data protection laws may lead to inconsistent and conflicting requirements or legal interpretations.

Tax and financial reporting · Tax compliance and changes in tax law

We are currently under examination by, or in disputes with, the U.S. Internal Revenue Service as well as tax authorities in other jurisdictions. Changes in existing laws in the U.S. or foreign jurisdictions, including digital services taxes or global minimum tax proposals, may materially affect our effective tax rate.

Industry regulation · Regulatory compliance and changes

Regulators around the world have been establishing or increasing their authority to regulate various aspects of the payments industry, including interchange reimbursement fees. Changes to these fees, whether voluntarily or by mandate, can substantially affect our overall payments volume and net revenue.

Tax and financial reporting · Audit and regulatory examinations

We are currently under examination by, or in disputes with, the U.S. Internal Revenue Service as well as tax authorities in other jurisdictions, and we may be subject to additional examinations or disputes in the future. Relevant tax authorities may disagree with our estimates, interpretations or tax treatment of certain material items. Failure to sustain our position in these matters could adversely affect our cash flows and financial position.

Project and contract management · Large contract concentration

Because a significant portion of our net revenue is concentrated among our largest clients, the loss of business from any one of these larger clients could harm our business, results of operations and financial condition.

Human capital and workforce · Talent acquisition and retention

The market for highly skilled workers and leaders in our industry, especially in fintech, technology, AI, cybersecurity and other specialized areas, is extremely competitive. Failure to attract, hire, develop, motivate and retain highly qualified employee talent could impact our ability to achieve our business objectives.

Human capital and workforce · Talent acquisition and retention

Ongoing changes in laws and policies regarding immigration, travel and work authorizations have made it more difficult for employees to work in, or transfer among, jurisdictions in which we have operations and could continue to impair our ability to attract, hire and retain qualified employees.

Credit and liquidity · Credit risk and customer defaults

We indemnify issuers and acquirers for settlement losses they may suffer due to the failure of another issuer or acquirer to honor its settlement obligations. Changes in the credit standing of our clients or concurrent settlement failures could expose us to liquidity risk and negatively impact our financial position.