--- ticker: AJG company: Arthur J. Gallagher & Co. filing_type: 10-K year_current: 2024 year_prior: 2023 risks_added: 2 risks_removed: 3 risks_modified: 16 risks_unchanged: 17 source: SEC EDGAR url: https://riskdiff.com/ajg/2024-vs-2023/ markdown_url: https://riskdiff.com/ajg/2024-vs-2023/index.md generated: 2026-05-10 --- # Arthur J. Gallagher & Co.: 10-K Risk Factor Changes 2024 vs 2023 > Source: U.S. Securities and Exchange Commission (EDGAR) > Generated: 2026-05-10 > All data extracted directly from official filings. No hallucinated content. > **[AI-Generated Summary]** The paragraph below was produced by a language > model and may contain errors. All other content on this page is deterministically > extracted from the original SEC filing. > Arthur J. Gallagher & Co. refined its risk disclosures by removing three risks - including the Willis Re acquisition risk and COVID-19 pandemic impact - while adding two new risks focused on larger acquisitions and artificial intelligence exposure. Sixteen existing risks underwent substantive modifications, with notable changes to disclosures on equity dilution, economic conditions affecting underwriting enterprises, international operations, and regulatory compliance. The net effect reflects the company's shift away from pandemic-specific and deal-specific concerns toward systemic risks including AI adoption and macroeconomic sensitivity. --- ## Summary | Status | Count | |--------|-------| | New risks added | 2 | | Risks removed | 3 | | Risks modified | 16 | | Unchanged | 17 | --- ## New in Current Filing: We face additional risks relating to acquisitions that are larger than our usual tuck-in acquisitions described above. We can provide no assurance that we will be able to successfully integrate the operations of acquisitions that are larger than our usual tuck-in acquisitions, such as Willis Re, Buck, Eastern Insurance, Cadence Insurance and My Plan Manager, that they will perform as expected, or that we will not incur unforeseen obligations or liabilities. Integration efforts relating to larger acquisitions are more complex, including with respect to technology systems, which may divert management's attention and resources and could adversely affect our operating results. In addition, we have made certain assumptions relating to these acquisitions that may be inaccurate, including as a result of the failure to realize expected benefits, higher than expected integration costs and unknown liabilities as well as general economic and business conditions. These assumptions relate to various matters, including projections of future revenues, non-GAAP measures, expenses and expense allocation; our ability to maintain, develop and deepen relationships with employees, including key brokers, and clients; the amount of goodwill and intangibles; and other unforeseen compliance, financial and strategic risks. --- ## New in Current Filing: We are subject to risks associated with AI. We use AI in our business, including with respect to services provided to our clients. We have internal policies governing the use of AI by our employees designed to protect the company from breaches of data privacy, E&O liability and regulatory enforcement risk; however, our employees could violate these policies and expose us to such risks. Furthermore, our exposure to these risks may increase if our vendors, suppliers, or other third-party providers employ AI in relation to the products or services they provide to us, as we have limited control over such use in third-party products or services. These risks include, among others, the input of confidential information, including material non-public information, in contravention of our policies or contractual restrictions to which any of the foregoing are subject, or in violation of applicable laws or regulations, including those relating to data protection. This could result in such information becoming part of a dataset that is accessible by other third-party AI applications and users. Additionally, AI heavily relies on the collection and analysis of extensive data sets. Due to the impracticality of incorporating all relevant data into the models used by AI, it is inevitable that data sets within these models will contain inaccuracies and errors, and potential biases. This could potentially render such models inadequate or flawed, negatively impacting the effectiveness of the technology. We are exposed to the risks associated with these inaccuracies, errors and biases, along with the adverse impacts that such flawed models could have on our business and operations. Furthermore, governance and ethical issues relating to the use of AI may also result in reputational harm and liability. AI and its applications are developing rapidly. The use of this technology by our competitors may give them a competitive advantage that cannot be predicted at this time, and it may negatively affect our assumptions regarding the competitive landscape of our business. Consequently, it is difficult to predict all risks associated with this new technology, which may eventually impact our business, results of operations, or financial condition. See also "Changes in data privacy and protection laws and regulations, or any failure to comply with such laws and regulations, could adversely affect our business and financial results." --- ## No Match in Current: We face risks relating to our acquisition of Willis Re. *This section from the 2023 filing does not have a high-confidence textual match in 2024. It may have been removed, merged, or substantially reworded.* Upon completion of the Willis Re acquisition on December 1, 2021, we paid Willis Towers Watson plc an initial gross purchase price of $3.17 billion. Under the terms of the purchase agreement, the purchase price is subject to potential additional deferred consideration of up to $750 million, payable in 2025 based on revenues of the acquired operations in 2024. We can provide no assurance that we will be able to successfully integrate the reinsurance operations acquired from Willis Towers Watson plc, that the acquired operations will perform as expected, or that we will not incur unforeseen obligations or liabilities. Integration efforts relating 13 to the Willis Re acquisition are complex, including with respect to technology and IT systems, which may divert management's attention and resources, which could adversely affect our operating results. In addition, we have made certain assumptions relating to the Willis Re acquisition, which assumptions may be inaccurate, including as a result of the failure to realize the expected benefits of the Willis Re acquisition, higher than expected integration costs and unknown liabilities as well as general economic and business conditions that adversely affect the combined company following the acquisition of Willis Re. These assumptions relate to various matters, including: projections of future expenses and expense allocation relating to the Willis Re acquisition and the acquired assets; our ability to maintain, develop and deepen relationships with employees, including key brokers, and customers associated with the acquired assets; the amount of goodwill and intangibles that will result from the acquisition of the Willis Re acquisition; and other financial and strategic risks of the Willis Re acquisition. --- ## No Match in Current: The COVID-19 pandemic has and could continue to adversely affect our business, results of operations and financial condition. *This section from the 2023 filing does not have a high-confidence textual match in 2024. It may have been removed, merged, or substantially reworded.* The global spread of COVID-19 created significant volatility, uncertainty and economic disruption. If more contagious variants of COVID-19 develop and spread in the future, many of the negative impacts of the pandemic could return. Earlier in the pandemic, the decline in economic activity it caused adversely affected our business, results of operations and financial condition. Reductions in our clients' exposure units (such as headcount, payroll, properties, the market values of their assets, and plant, equipment and other asset utilization levels, among other factors) reduced the amount of insurance coverage and consulting and claims administration services they needed. In addition, earlier in the pandemic, the number of newly arising workers' compensation and general liability claims, which directly impact our fee revenues in our risk management operation, declined materially. Certain of our brokerage industry 17 niches, such as hospitality, transportation, manufacturing and construction, were significantly affected by the economic decline during the pandemic. If such a decline in economic activity were to return and clients enter bankruptcy, liquidate their operations or consolidate, our revenues and the collectability of our receivables will be adversely affected. In addition, factors related to the pandemic, including supply chain issues, have contributed to a rise in inflation in the U.S. and around the world that could negatively impact the economy and the capital markets, which could adversely affect our business, results of operations and financial condition. COVID-19 and the volatile regional and global economic and regulatory conditions stemming from the pandemic, as well as reactions to future pandemics or new strains or resurgences of COVID-19, could also precipitate or aggravate the other risk factors that we identify in this report, which in turn could materially adversely affect our business, financial condition, liquidity, results of operations (including revenues and profitability) and/or stock price. Further, COVID-19 may also affect our operating and financial results in a manner that is not presently known to us or that we currently do not consider to present significant risks to our operations. --- ## No Match in Current: Limited protection of our intellectual property could harm our business and our ability to compete effectively, and we face the risk that our services or products may infringe upon the intellectual property rights of others. *This section from the 2023 filing does not have a high-confidence textual match in 2024. It may have been removed, merged, or substantially reworded.* We cannot guarantee that trade secret, trademark and copyright law protections, or our internal policies and procedures regarding our management of intellectual property, are adequate to deter misappropriation of our intellectual property. Existing laws of some countries in which we provide services or products may offer only limited protection of our intellectual property rights. Also, we may be unable to detect the unauthorized use of our intellectual property and take the necessary steps to enforce our rights, which may have a material adverse impact on our business, financial condition or results of operations. We cannot be sure that our services and products, or the products of others that we offer to our clients, do not infringe on the intellectual property rights of third parties, and we may have infringement claims asserted against us or our clients. These claims may harm our reputation, result in financial liability, consume financial resources to pursue or defend, and prevent us from offering some services or products. In addition, these claims, whether with or without merit, could be expensive, take significant time and divert management's focus and resources from business operations. Successful challenges against us could require us to modify or discontinue our use of technology or business processes where such use is found to infringe or violate the rights of others, or require us to purchase licenses from third parties, any of which could adversely affect our business, financial condition and operating results. --- ## Modified: Future sales or other dilution of our equity could adversely affect the market price of our common stock. **Key changes:** - Reworded sentence: "Moreover, to the extent that we issue restricted stock units, performance stock units, options or warrants to purchase shares of our common stock in the future and those options or warrants are exercised or as the restricted stock units or performance stock units vest, our stockholders will experience further dilution." **Prior (2023):** An important way we grow our business is through acquisitions. One method of acquiring companies or otherwise funding our corporate activities is through the issuance of additional equity securities. The issuance of any additional shares of common or of preferred stock or convertible securities could be substantially dilutive to holders of our common stock. Moreover, to the extent that we issue restricted stock units, performance stock units, options or warrants to purchase shares of our common stock in the future and those options or warrants are exercised or as the restricted stock units or performance stock units vest, our stockholders may experience further dilution. Holders of our common stock have no preemptive rights that entitle holders to purchase their pro rata share of any offering of shares of any class or series and, therefore, such sales or offerings could result in increased dilution to our stockholders. The market price of our common stock could decline as a result of sales of shares of our common stock or the perception that such sales could occur. **Current (2024):** An important way we grow our business is through acquisitions. One method of acquiring companies or otherwise funding our corporate activities is through the issuance of additional equity securities. The issuance of any additional shares of common or of preferred stock or convertible securities could be substantially dilutive to holders of our common stock. Moreover, to the extent that we issue restricted stock units, performance stock units, options or warrants to purchase shares of our common stock in the future and those options or warrants are exercised or as the restricted stock units or performance stock units vest, our stockholders will experience further dilution. In November 2022, we established an "at the market" equity offering program (which we refer to as an ATM program) pursuant to which we may offer and sell up to 3,000,000 shares of our common stock. We have refreshed our ATM program in the past and expect to refresh our ATM program periodically. Sales under our ATM 29 program will result in additional dilution for our stockholders. Holders of our common stock have no preemptive rights that entitle holders to purchase their pro rata share of any offering of shares of any class or series and, therefore, such sales or offerings could result in increased dilution to our stockholders. The market price of our common stock could decline as a result of sales of shares of our common stock or the perception that such sales could occur. --- ## Modified: Risk Factor Summary **Key changes:** - Reworded sentence: "•Global economic and geopolitical events, such as inflation, monetary policy responses and changing interest rates; a recession or economic downturn, political violence, and instability, including geo-economic fragmentation, could adversely affect our results of operations and financial condition." - Added sentence: "•We have historically acquired large numbers of insurance brokers, benefit consulting firms and, to a lesser extent, third party claims administration and risk management firms." - Added sentence: "We may not be able to continue such an acquisition strategy in the future and there are risks associated with such acquisitions, which could adversely affect our growth and results of operations." - Added sentence: "We have historically acquired large numbers of insurance brokers, benefit consulting firms and, to a lesser extent, third party claims administration and risk management firms." - Added sentence: "We may not be able to continue such an acquisition strategy in the future and there are risks associated with such acquisitions, which could adversely affect our growth and results of operations." **Prior (2023):** •A recession or economic downturn, as well as unstable economic conditions in the countries and regions in which we operate, could adversely affect our results of operations and financial condition. A recession or economic downturn, as well as unstable economic conditions in the countries and regions in which we operate, could adversely affect our results of operations and financial condition. •Economic conditions that result in financial difficulties for underwriting enterprises or lead to reduced risk-taking capital capacity could adversely affect our results of operations and financial condition. Economic conditions that result in financial difficulties for underwriting enterprises or lead to reduced risk-taking capital capacity could adversely affect our results of operations and financial condition. •Business disruptions could have a material adverse effect on our operations, damage our reputation and impact client relationships. Business disruptions could have a material adverse effect on our operations, damage our reputation and impact client relationships. •We face risks relating to our acquisition of Willis Re. We face risks relating to our acquisition of Willis Re. •We have historically acquired large numbers of insurance brokers, benefit consulting firms and, to a lesser extent, third party claims administration and risk management firms. We may not be able to continue such an acquisition strategy in the future and there are risks associated with such acquisitions, which could adversely affect our growth and results of We have historically acquired large numbers of insurance brokers, benefit consulting firms and, to a lesser extent, third party claims administration and risk management firms. We may not be able to continue such an acquisition strategy in the future and there are risks associated with such acquisitions, which could adversely affect our growth and results of 10 operations. operations. •Damage to our reputation could have a material adverse effect on our business. Damage to our reputation could have a material adverse effect on our business. •Our ESG-related aspirations, goals and initiatives, and our public statements and disclosures regarding them, expose us to numerous risks. Our ESG-related aspirations, goals and initiatives, and our public statements and disclosures regarding them, expose us to numerous risks. •If we are unable to apply technology and data analytics effectively in driving value for our clients through technology-based solutions or gain internal efficiencies and effective internal controls through the application of technology and related tools, our operating results, client relationships, growth and compliance programs could be adversely affected. If we are unable to apply technology and data analytics effectively in driving value for our clients through technology-based solutions or gain internal efficiencies and effective internal controls through the application of technology and related tools, our operating results, client relationships, growth and compliance programs could be adversely affected. •Our success depends, in part, on our ability to attract and retain qualified talent, including our senior management team. Our success depends, in part, on our ability to attract and retain qualified talent, including our senior management team. •Sustained increases in compensation expense and the cost of employee benefits could reduce our profitability. Sustained increases in compensation expense and the cost of employee benefits could reduce our profitability. •Our substantial operations outside the U.S. expose us to risks different than those we face in the U.S. Our substantial operations outside the U.S. expose us to risks different than those we face in the U.S. •Changes in tax laws could adversely affect us. Changes in tax laws could adversely affect us. •The COVID-19 pandemic has and could continue to adversely affect our business, results of operations and financial condition. The COVID-19 pandemic has and could continue to adversely affect our business, results of operations and financial condition. •The substantial increase in remote work among our employees subjects us to certain challenges and risks. The substantial increase in remote work among our employees subjects us to certain challenges and risks. •We face significant competitive pressures in each of our businesses. We face significant competitive pressures in each of our businesses. •Volatility or declines in premiums or other adverse trends in the insurance industry may seriously undermine our profitability. Volatility or declines in premiums or other adverse trends in the insurance industry may seriously undermine our profitability. •Contingent and supplemental revenues we receive from underwriting enterprises are less predictable than standard commission revenues, and any decrease in the amount of these forms of revenue could adversely affect our results of operations. Contingent and supplemental revenues we receive from underwriting enterprises are less predictable than standard commission revenues, and any decrease in the amount of these forms of revenue could adversely affect our results of operations. •We face a variety of risks in our benefit consulting operations distinct from those we face in our insurance brokerage operations. We face a variety of risks in our benefit consulting operations distinct from those we face in our insurance brokerage operations. •We face a variety of risks in our third-party claims administration operations that are distinct from those we face in our brokerage and benefit consulting operations. We face a variety of risks in our third-party claims administration operations that are distinct from those we face in our brokerage and benefit consulting operations. •Climate risks, including the risk of an economic crisis, risks associated with the physical effects of climate change and disruptions caused by the transition to a low-carbon economy, could adversely affect our business, results of operations and financial condition. Climate risks, including the risk of an economic crisis, risks associated with the physical effects of climate change and disruptions caused by the transition to a low-carbon economy, could adversely affect our business, results of operations and financial condition. **Current (2024):** •Global economic and geopolitical events, such as inflation, monetary policy responses and changing interest rates; a recession or economic downturn, political violence, and instability, including geo-economic fragmentation, could adversely affect our results of operations and financial condition. Global economic and geopolitical events, such as inflation, monetary policy responses and changing interest rates; a recession or economic downturn, political violence, and instability, including geo-economic fragmentation, could adversely affect our results of operations and financial condition. •Economic conditions that result in financial difficulties for underwriting enterprises or lead to reduced risk-taking capital capacity could adversely affect our results of operations and financial condition. Economic conditions that result in financial difficulties for underwriting enterprises or lead to reduced risk-taking capital capacity could adversely affect our results of operations and financial condition. •We have historically acquired large numbers of insurance brokers, benefit consulting firms and, to a lesser extent, third party claims administration and risk management firms. We may not be able to continue such an acquisition strategy in the future and there are risks associated with such acquisitions, which could adversely affect our growth and results of operations. We have historically acquired large numbers of insurance brokers, benefit consulting firms and, to a lesser extent, third party claims administration and risk management firms. We may not be able to continue such an acquisition strategy in the future and there are risks associated with such acquisitions, which could adversely affect our growth and results of operations. •We face additional risks relating to acquisitions that are larger than our usual tuck-in acquisitions, including that these acquisitions will not perform as expected and that we cannot successfully integrate complex operations. We face additional risks relating to acquisitions that are larger than our usual tuck-in acquisitions, including that these acquisitions will not perform as expected and that we cannot successfully integrate complex operations. •Damage to our reputation could have a material adverse effect on our business. Damage to our reputation could have a material adverse effect on our business. •Our sustainability and ESG-related aspirations, goals and initiatives, and our public statements and disclosures regarding them, expose us to numerous risks. Our sustainability and ESG-related aspirations, goals and initiatives, and our public statements and disclosures regarding them, expose us to numerous risks. •If we are unable to apply technology and data analytics effectively in driving value for our clients through technology-based solutions or gain internal efficiencies and effective internal controls through the application of technology and related tools, our operating results, client relationships, growth and compliance programs could be adversely affected. If we are unable to apply technology and data analytics effectively in driving value for our clients through technology-based solutions or gain internal efficiencies and effective internal controls through the application of technology and related tools, our operating results, client relationships, growth and compliance programs could be adversely affected. •We are subject to risks associated with AI. We are subject to risks associated with AI. •Our success depends, in part, on our ability to attract and retain qualified talent, including our senior management team. Our success depends, in part, on our ability to attract and retain qualified talent, including our senior management team. •The substantial increase in remote work among our employees subjects us to certain challenges and risks. The substantial increase in remote work among our employees subjects us to certain challenges and risks. •Business disruptions could have a material adverse effect on our operations, damage our reputation and impact client relationships. Business disruptions could have a material adverse effect on our operations, damage our reputation and impact client relationships. •Sustained increases in compensation expense and the cost of employee benefits could reduce our profitability. Sustained increases in compensation expense and the cost of employee benefits could reduce our profitability. •Our substantial operations outside the U.S. expose us to risks different than those we face in the U.S. Our substantial operations outside the U.S. expose us to risks different than those we face in the U.S. •Changes in tax laws could adversely affect us. Changes in tax laws could adversely affect us. •We face significant competitive pressures in each of our businesses. We face significant competitive pressures in each of our businesses. •Volatility or declines in premiums or other adverse trends in the insurance industry may seriously undermine our profitability. Volatility or declines in premiums or other adverse trends in the insurance industry may seriously undermine our profitability. •Contingent and supplemental revenues we receive from underwriting enterprises are less predictable than standard commission revenues, and any decrease in the amount of these forms of revenue could adversely affect our results of operations. Contingent and supplemental revenues we receive from underwriting enterprises are less predictable than standard commission revenues, and any decrease in the amount of these forms of revenue could adversely affect our results of operations. •We face a variety of risks in our benefit consulting operations distinct from those we face in our insurance brokerage operations. We face a variety of risks in our benefit consulting operations distinct from those we face in our insurance brokerage operations. •We face a variety of risks in our third-party claims administration operations that are distinct from those we face in our brokerage and benefit consulting operations. We face a variety of risks in our third-party claims administration operations that are distinct from those we face in our brokerage and benefit consulting operations. •Climate risks, including the risk of an economic crisis, risks associated with the physical effects of climate change and disruptions caused by the transition to a low-carbon economy, could adversely affect our business, results of Climate risks, including the risk of an economic crisis, risks associated with the physical effects of climate change and disruptions caused by the transition to a low-carbon economy, could adversely affect our business, results of 11 operations and financial condition. operations and financial condition. --- ## Modified: Economic conditions that result in financial difficulties for underwriting enterprises or lead to reduced risk-taking capital capacity could adversely affect our results of operations and financial condition. **Key changes:** - Reworded sentence: "We have a significant amount of receivables from certain of the underwriting enterprises with which we place insurance and reinsurance." - Reworded sentence: "The failure of an underwriting enterprise with which we place business could result in E&O claims against us by our clients." - Reworded sentence: "In addition, if underwriting enterprises merge, fail, or withdraw from offering certain lines of coverage, for example, because of large payouts related to climate or weather events or other emerging risk areas, overall risk-taking capital capacity could be negatively affected, which could reduce our ability to place certain lines of coverage, reduce demand from the insurance company clients of Gallagher Re and, as a result, reduce our revenues and profitability." **Prior (2023):** We have a significant amount of receivables from certain of the underwriting enterprises with which we place insurance. If those companies experience liquidity problems or other financial difficulties, we could encounter delays or defaults in payments owed to us, which could have a significant adverse impact on our consolidated financial condition and results of operations. The failure of an underwriting enterprise with which we place business could result in errors and omissions claims against us by our clients. Further, the failure of errors and omissions underwriting enterprises could make the errors and omissions insurance we rely upon cost prohibitive or unavailable. Underwriting enterprises are also clients of our reinsurance brokerage operations, so any of the negative developments for underwriting enterprises referred to above could also reduce our commission revenues from such clients. Any of these developments could adversely affect our results of operations and financial condition. In addition, if underwriting enterprises merge or if a large underwriting enterprise fails or withdraws from offering certain lines of coverage, for example, because of large payouts related to climate change or other emerging risk areas, overall risk-taking capital capacity could be negatively affected, which could reduce our ability to place certain lines of coverage and reduce demand from the insurance company clients of our reinsurance operations and, as a result, reduce our revenues and profitability. **Current (2024):** We have a significant amount of receivables from certain of the underwriting enterprises with which we place insurance and reinsurance. If those companies experience liquidity problems or other financial difficulties, we could encounter delays or defaults in payments owed to us, which could have a significant adverse impact on our consolidated financial condition and results of operations. The failure of an underwriting enterprise with which we place business could result in E&O claims against us by our clients. Further, the failure of E&O underwriting enterprises could make the E&O insurance we rely upon cost prohibitive or unavailable. Underwriting enterprises are also clients of Gallagher Re and, as such, any of the negative developments for underwriting enterprises referred to above could also reduce our commission revenues from such clients. Any of these developments could adversely affect our results of operations and financial condition. In addition, if underwriting enterprises merge, fail, or withdraw from offering certain lines of coverage, for example, because of large payouts related to climate or weather events or other emerging risk areas, overall risk-taking capital capacity could be negatively affected, which could reduce our ability to place certain lines of coverage, reduce demand from the insurance company clients of Gallagher Re and, as a result, reduce our revenues and profitability. --- ## Modified: Our substantial operations outside the U.S. expose us to risks different than those we face in the U.S. **Key changes:** - Reworded sentence: "In 2023, we generated approximately 36% of our combined brokerage and risk management revenues outside the U.S." - Reworded sentence: "These include, among others, risks relating to: •Maintaining awareness of and complying with a wide variety of labor practices and foreign laws, including those relating to labor and employment, data privacy requirements, AI prohibitions on corrupt payments to government officials, export and import duties, environmental policies, sustainability disclosures, as well as laws and regulations applicable to U.S." - Reworded sentence: "We are subject to the risk that we, our employees, our agents, or our affiliated entities, or their respective officers, directors, employees and agents, take actions determined to be in violation of any of these laws, regulations or policies, for which we might be held responsible." - Reworded sentence: "These and other international regulatory risks and labor related risks are described below under "Regulatory, Legal and Accounting Risks"; Maintaining awareness of and complying with a wide variety of labor practices and foreign laws, including those relating to labor and employment, data privacy requirements, AI prohibitions on corrupt payments to government officials, export and import duties, environmental policies, sustainability disclosures, as well as laws and regulations applicable to U.S." - Reworded sentence: "We are subject to the risk that we, our employees, our agents, or our affiliated entities, or their respective officers, directors, employees and agents, take actions determined to be in violation of any of these laws, regulations or policies, for which we might be held responsible." **Prior (2023):** In 2022, we generated approximately 35% of our combined brokerage and risk management revenues outside the U.S. Our business outside the U.S. presents operational, economic and other risks that are different from, or greater than, the risks we face doing comparable business in the U.S. These include, among others, risks relating to: •Maintaining awareness of and complying with a wide variety of labor practices and foreign laws, including those relating to labor and employment, data privacy requirements, prohibitions on corrupt payments to government officials, export and import duties, environmental policies, sustainability disclosures, as well as laws and regulations applicable to U.S. business operations abroad. We are subject to the risk that we, our employees, our agents, or our affiliated entities, or their respective officers, directors, employees and agents, may take actions determined to be in violation of any of these laws, regulations or policies, for which we might be held responsible. Actual or alleged violations could result in substantial fines, sanctions, civil or criminal penalties, debarment from government contracts, curtailment of operations in certain jurisdictions, competitive or reputational harm, litigation or regulatory action and other consequences that might adversely affect our results of operations, financial condition or strategic objectives. While we believe that relations with work councils and trade unions in these countries are and will continue to be satisfactory, work stoppages could occur and we may not be successful in negotiating new collective bargaining agreements. In addition, collective bargaining negotiations may (1) result in significant increases in the cost of labor, (2) divert management's attention away from operating the business or (3) break down and result in the disruption of operations. The occurrence of any of the preceding conditions could result in increased costs and impair our ability to operate our business. These and other international regulatory risks and labor related risks are described below under "Regulatory, Legal and Accounting Risks"; Maintaining awareness of and complying with a wide variety of labor practices and foreign laws, including those relating to labor and employment, data privacy requirements, prohibitions on corrupt payments to government officials, export and import duties, environmental policies, sustainability disclosures, as well as laws and regulations applicable to U.S. business operations abroad. We are subject to the risk that we, our employees, our agents, or our affiliated entities, or their respective officers, directors, employees and agents, may take actions determined to be in violation of any of these laws, regulations or policies, for which we might be held responsible. Actual or alleged violations could result in substantial fines, sanctions, civil or criminal penalties, debarment from government contracts, curtailment of operations in certain jurisdictions, competitive or reputational harm, litigation or regulatory action and other consequences that might adversely affect our results of operations, financial condition or strategic objectives. While we believe that relations with work councils and trade unions in these countries are and will continue to be satisfactory, work stoppages could occur and we may not be successful in negotiating new collective bargaining agreements. In addition, collective bargaining negotiations may (1) result in significant increases in the cost of labor, (2) divert management's attention away from operating the business or (3) break down and result in the disruption of operations. The occurrence of any of the preceding conditions could result in increased costs and impair our ability to operate our business. These and other international regulatory risks and labor related risks are described below under "Regulatory, Legal and Accounting Risks"; •We own interests in firms where we do not exercise management control (such as Casanueva Perez S.A.P.I. de C.V. in Mexico) and are therefore unable to direct or manage the business to realize the anticipated benefits, including mitigation of risks, that could be achieved through full ownership; We own interests in firms where we do not exercise management control (such as Casanueva Perez S.A.P.I. de C.V. in Mexico) and are therefore unable to direct or manage the business to realize the anticipated benefits, including mitigation of risks, that could be achieved through full ownership; •The potential costs, difficulties and risks associated with local regulations across the globe, including the risk of personal liability for directors and officers (for example, in the U.K.) and "piercing the corporate veil" risks under the corporate law regimes of certain countries; The potential costs, difficulties and risks associated with local regulations across the globe, including the risk of personal liability for directors and officers (for example, in the U.K.) and "piercing the corporate veil" risks under the corporate law regimes of certain countries; •Difficulties in staffing and managing foreign operations. For example, we are building our Latin American operations through acquisitions of local family-owned insurance brokerage firms. If we lose a local leader, recruiting a replacement locally or finding an internal candidate qualified to transfer to such location could be difficult; Difficulties in staffing and managing foreign operations. For example, we are building our Latin American operations through acquisitions of local family-owned insurance brokerage firms. If we lose a local leader, recruiting a replacement locally or finding an internal candidate qualified to transfer to such location could be difficult; •Less flexible employee relationships, which in certain circumstances has limited our ability to prohibit employees from competing with us after they are no longer employed with us or recover damages, and made it more difficult and expensive to terminate their employment; Less flexible employee relationships, which in certain circumstances has limited our ability to prohibit employees from competing with us after they are no longer employed with us or recover damages, and made it more difficult and expensive to terminate their employment; •Some of our foreign subsidiaries receive revenues or incur obligations in currencies that differ from their functional currencies. We must also translate the financial results of our foreign subsidiaries into U.S. dollars. Although we have used foreign currency hedging strategies in the past and currently have some in place, such risks cannot be eliminated entirely, and significant changes in exchange rates may adversely affect our results of operations; Some of our foreign subsidiaries receive revenues or incur obligations in currencies that differ from their functional currencies. We must also translate the financial results of our foreign subsidiaries into U.S. dollars. Although we have used foreign currency hedging strategies in the past and currently have some in place, such risks cannot be eliminated entirely, and significant changes in exchange rates may adversely affect our results of operations; •Conflicting regulations in the countries in which we do business; Conflicting regulations in the countries in which we do business; •Political and economic instability (including risks relating to undeveloped or evolving legal systems, unstable governments, acts of terrorism and outbreaks of war, including the military conflict between Russia and Ukraine); Political and economic instability (including risks relating to undeveloped or evolving legal systems, unstable governments, acts of terrorism and outbreaks of war, including the military conflict between Russia and Ukraine); •Coordinating our communications, policies and logistics across geographic distances, multiple time zones and in different languages, including during times of crisis management; Coordinating our communications, policies and logistics across geographic distances, multiple time zones and in different languages, including during times of crisis management; •Risks relating to our post-Brexit plan to address the loss of passporting rights between the U.K. and EU with respect to insurance brokerage services. Our plan (implemented in September 2020) involved transferring the European Economic Area (EEA) clients of our U.K.-based regulated entities to a Swedish subsidiary authorized in the EEA, and providing some services through a U.K. branch of such subsidiary. Although this "reverse branch" model is typical of other brokers Risks relating to our post-Brexit plan to address the loss of passporting rights between the U.K. and EU with respect to insurance brokerage services. Our plan (implemented in September 2020) involved transferring the European Economic Area (EEA) clients of our U.K.-based regulated entities to a Swedish subsidiary authorized in the EEA, and providing some services through a U.K. branch of such subsidiary. Although this "reverse branch" model is typical of other brokers 16 of a similar size, there can be no assurance that the approach of EU regulators will not change. We currently await the outcome of an industry-wide consultation initiated by the European Insurance and Occupational Pensions Authority (EIOPA) in July 2022, the outcome of which could potentially require us to adjust our plans in relation to the U.K. branch and cause further management distraction and cost; of a similar size, there can be no assurance that the approach of EU regulators will not change. We currently await the outcome of an industry-wide consultation initiated by the European Insurance and Occupational Pensions Authority (EIOPA) in July 2022, the outcome of which could potentially require us to adjust our plans in relation to the U.K. branch and cause further management distraction and cost; •Unfavorable audits and exposure to additional liabilities relating to various non-income taxes (such as payroll, sales, use, value-added, net worth, property and goods and services taxes) in foreign jurisdictions. In addition, our future effective tax rates could be unfavorably affected by changes in tax rates, discriminatory or confiscatory taxation, changes in the valuation of our deferred tax assets or liabilities, changes in tax laws or their interpretation and the financial results of our international subsidiaries. The Organization for Economic Cooperation and Development (which we refer to as the OECD) continues to issue reports and recommendations as part of its Base Erosion and Profit Shifting project (which we refer to as BEPS), and in response many countries in which we do business are expected to adopt rules which may change various aspects of the existing framework under which our tax obligations are determined. For example, in response to the OECD recommendations for a global minimum tax, the EU has unanimously agreed to modify its domestic laws before the end of 2023 to comply with BEPS Pillar 2, adopting the various elements of a global minimum tax regime. Other countries such as the U.K. and Canada have made similar announcements during 2022. In addition, many jurisdictions adopted stimulus measures in response to COVID-19, many of which offered continued employment benefit subsidies, payroll tax deferrals or tax refunds that have various tax impacts for businesses; Unfavorable audits and exposure to additional liabilities relating to various non-income taxes (such as payroll, sales, use, value-added, net worth, property and goods and services taxes) in foreign jurisdictions. In addition, our future effective tax rates could be unfavorably affected by changes in tax rates, discriminatory or confiscatory taxation, changes in the valuation of our deferred tax assets or liabilities, changes in tax laws or their interpretation and the financial results of our international subsidiaries. The Organization for Economic Cooperation and Development (which we refer to as the OECD) continues to issue reports and recommendations as part of its Base Erosion and Profit Shifting project (which we refer to as BEPS), and in response many countries in which we do business are expected to adopt rules which may change various aspects of the existing framework under which our tax obligations are determined. For example, in response to the OECD recommendations for a global minimum tax, the EU has unanimously agreed to modify its domestic laws before the end of 2023 to comply with BEPS Pillar 2, adopting the various elements of a global minimum tax regime. Other countries such as the U.K. and Canada have made similar announcements during 2022. In addition, many jurisdictions adopted stimulus measures in response to COVID-19, many of which offered continued employment benefit subsidies, payroll tax deferrals or tax refunds that have various tax impacts for businesses; •Legal or political constraints on our ability to maintain or increase prices; Legal or political constraints on our ability to maintain or increase prices; •Cash balances held in foreign banks and institutions where governments have not specifically enacted formal guarantee programs; Cash balances held in foreign banks and institutions where governments have not specifically enacted formal guarantee programs; •New pandemics (in addition to COVID-19) at a regional or global level; New pandemics (in addition to COVID-19) at a regional or global level; •Lost business or other financial harm due to protectionism in the U.S. and in countries around the world, including adverse trade policies, governmental actions affecting the flow of goods, services and currency, and governmental restrictions on the transfer of funds to us from our operations outside the U.S.; and Lost business or other financial harm due to protectionism in the U.S. and in countries around the world, including adverse trade policies, governmental actions affecting the flow of goods, services and currency, and governmental restrictions on the transfer of funds to us from our operations outside the U.S.; and •The trade and military policies of the U.S. government could further develop in ways that exacerbate the risks described above, or introduce new risks for our international operations. The trade and military policies of the U.S. government could further develop in ways that exacerbate the risks described above, or introduce new risks for our international operations. If any of these risks materialize, our results of operations and financial condition could be adversely affected. **Current (2024):** In 2023, we generated approximately 36% of our combined brokerage and risk management revenues outside the U.S. Our business outside the U.S. presents operational, economic and other risks that are different from, or greater than, the risks we face doing comparable business in the U.S. These include, among others, risks relating to: •Maintaining awareness of and complying with a wide variety of labor practices and foreign laws, including those relating to labor and employment, data privacy requirements, AI prohibitions on corrupt payments to government officials, export and import duties, environmental policies, sustainability disclosures, as well as laws and regulations applicable to U.S. business operations abroad. We are subject to the risk that we, our employees, our agents, or our affiliated entities, or their respective officers, directors, employees and agents, take actions determined to be in violation of any of these laws, regulations or policies, for which we might be held responsible. Actual or alleged violations could result in substantial fines, sanctions, civil or criminal penalties, debarment from government contracts, curtailment of operations in certain jurisdictions, competitive or reputational harm, litigation or regulatory action and other consequences that might adversely affect our results of operations, financial condition or strategic objectives. While we believe that relations with work councils and trade unions in these countries are and will continue to be satisfactory, work stoppages could occur and we may not be successful in negotiating new collective bargaining agreements. In addition, collective bargaining negotiations may (1) result in significant increases in the cost of labor, (2) divert management's attention away from operating the business or (3) break down and result in the disruption of operations. The occurrence of any of the preceding conditions could result in increased costs and impair our ability to operate our business. These and other international regulatory risks and labor related risks are described below under "Regulatory, Legal and Accounting Risks"; Maintaining awareness of and complying with a wide variety of labor practices and foreign laws, including those relating to labor and employment, data privacy requirements, AI prohibitions on corrupt payments to government officials, export and import duties, environmental policies, sustainability disclosures, as well as laws and regulations applicable to U.S. business operations abroad. We are subject to the risk that we, our employees, our agents, or our affiliated entities, or their respective officers, directors, employees and agents, take actions determined to be in violation of any of these laws, regulations or policies, for which we might be held responsible. Actual or alleged violations could result in substantial fines, sanctions, civil or criminal penalties, debarment from government contracts, curtailment of operations in certain jurisdictions, competitive or reputational harm, litigation or regulatory action and other consequences that might adversely affect our results of operations, financial condition or strategic objectives. While we believe that relations with work councils and trade unions in these countries are and will continue to be satisfactory, work stoppages could occur and we may not be successful in negotiating new collective bargaining agreements. In addition, collective bargaining negotiations may (1) result in significant increases in the cost of labor, (2) divert management's attention away from operating the business or (3) break down and result in the disruption of operations. The occurrence of any of the preceding conditions could result in increased costs and impair our ability to operate our business. These and other international regulatory risks and labor related risks are described below under "Regulatory, Legal and Accounting Risks"; •We own interests in firms where we do not exercise management control (such as Casanueva Perez S.A.P.I. de C.V. in Mexico and Renomia, A.S. in the Czech Republic) and are therefore unable to direct or manage the business to realize the anticipated benefits, including mitigation of risks, that could be achieved through full ownership; We own interests in firms where we do not exercise management control (such as Casanueva Perez S.A.P.I. de C.V. in Mexico and Renomia, A.S. in the Czech Republic) and are therefore unable to direct or manage the business to realize the anticipated benefits, including mitigation of risks, that could be achieved through full ownership; •The potential costs, difficulties and risks associated with local regulations across the globe, including the risk of personal liability for directors and officers (for example, in the U.K.) and "piercing the corporate veil" risks under the corporate law regimes of certain countries; The potential costs, difficulties and risks associated with local regulations across the globe, including the risk of personal liability for directors and officers (for example, in the U.K.) and "piercing the corporate veil" risks under the corporate law regimes of certain countries; •Difficulties in staffing and managing foreign operations. For example, we are growing our Latin American operations through acquisitions of local family-owned insurance brokerage firms. If we lose a local key employee, hiring and retaining talent locally or finding an internal candidate qualified to transfer to such location could be difficult; Difficulties in staffing and managing foreign operations. For example, we are growing our Latin American operations through acquisitions of local family-owned insurance brokerage firms. If we lose a local key employee, hiring and retaining talent locally or finding an internal candidate qualified to transfer to such location could be difficult; •Less flexible employee relationships, which in certain circumstances has limited our ability to prohibit employees from competing with us after they are no longer employed with us or recover damages, and made it more difficult and expensive to terminate their employment; Less flexible employee relationships, which in certain circumstances has limited our ability to prohibit employees from competing with us after they are no longer employed with us or recover damages, and made it more difficult and expensive to terminate their employment; •Some of our foreign subsidiaries receive revenues or incur obligations in currencies that differ from their functional currencies. We must also translate the financial results of our foreign subsidiaries into U.S. dollars. Although we Some of our foreign subsidiaries receive revenues or incur obligations in currencies that differ from their functional currencies. We must also translate the financial results of our foreign subsidiaries into U.S. dollars. Although we 17 have used foreign currency hedging strategies in the past and currently have some in place, such risks cannot be eliminated entirely, and significant changes in exchange rates may adversely affect our results of operations; have used foreign currency hedging strategies in the past and currently have some in place, such risks cannot be eliminated entirely, and significant changes in exchange rates may adversely affect our results of operations; •Conflicting regulations in the countries in which we do business; Conflicting regulations in the countries in which we do business; •Political and economic instability (including risks relating to undeveloped or evolving legal systems, unstable governments, acts of terrorism and outbreaks of war, including between Russia and Ukraine, and in the Middle East); Political and economic instability (including risks relating to undeveloped or evolving legal systems, unstable governments, acts of terrorism and outbreaks of war, including between Russia and Ukraine, and in the Middle East); •Coordinating our communications, policies and logistics across geographic distances, multiple time zones and in different languages, including during times of crisis management; Coordinating our communications, policies and logistics across geographic distances, multiple time zones and in different languages, including during times of crisis management; •Risks relating to our post-Brexit plan to address the loss of passporting rights between the U.K. and EU with respect to insurance brokerage services. Our plan (implemented in September 2020) involved transferring the European Economic Area (EEA) clients of our U.K.-based regulated entities to a Swedish subsidiary authorized in the EEA, and providing some services through a U.K. branch of such subsidiary. Although this "reverse branch" model is typical of other brokers of a similar size, EU regulators continue to assess their approach to this model, including as a result of, among other developments, the supervisory statement issued by the European Insurance and Occupational Pensions Authority (EIOPA) in February 2023. While we are continuously assessing the impact of these developments, it is difficult to predict such impact on our current plan; Risks relating to our post-Brexit plan to address the loss of passporting rights between the U.K. and EU with respect to insurance brokerage services. Our plan (implemented in September 2020) involved transferring the European Economic Area (EEA) clients of our U.K.-based regulated entities to a Swedish subsidiary authorized in the EEA, and providing some services through a U.K. branch of such subsidiary. Although this "reverse branch" model is typical of other brokers of a similar size, EU regulators continue to assess their approach to this model, including as a result of, among other developments, the supervisory statement issued by the European Insurance and Occupational Pensions Authority (EIOPA) in February 2023. While we are continuously assessing the impact of these developments, it is difficult to predict such impact on our current plan; •Unfavorable audits and exposure to additional liabilities relating to various non-income taxes (such as payroll, sales, use, value-added, net worth, property and goods and services taxes) in foreign jurisdictions. In addition, our future effective tax rates could be unfavorably affected by changes in tax rates, discriminatory or confiscatory taxation, changes in the valuation of our deferred tax assets or liabilities, changes in tax laws or their interpretation and the financial results of our international subsidiaries. The Organization for Economic Cooperation and Development (which we refer to as the OECD) continues to issue reports and recommendations as part of its Base Erosion and Profit Shifting project (which we refer to as BEPS), and in response many countries in which we do business have adopted, or are expected to adopt, rules which will change various aspects of the existing framework under which our tax obligations are determined. For example, the majority of EU countries and the U.K. have incorporated some elements of BEPS Pillar 2 into their national laws. Other countries in which we have significant operations, such as Australia and Canada, have either announced an intention to adopt it or started the process of doing so. Additionally, other jurisdictions in which we do business are also reacting to these efforts; for example, Bermuda enacted a corporate tax regime for the first time in 2023. We anticipate further significant developments across several jurisdictions in which we operate in 2024 and 2025; Unfavorable audits and exposure to additional liabilities relating to various non-income taxes (such as payroll, sales, use, value-added, net worth, property and goods and services taxes) in foreign jurisdictions. In addition, our future effective tax rates could be unfavorably affected by changes in tax rates, discriminatory or confiscatory taxation, changes in the valuation of our deferred tax assets or liabilities, changes in tax laws or their interpretation and the financial results of our international subsidiaries. The Organization for Economic Cooperation and Development (which we refer to as the OECD) continues to issue reports and recommendations as part of its Base Erosion and Profit Shifting project (which we refer to as BEPS), and in response many countries in which we do business have adopted, or are expected to adopt, rules which will change various aspects of the existing framework under which our tax obligations are determined. For example, the majority of EU countries and the U.K. have incorporated some elements of BEPS Pillar 2 into their national laws. Other countries in which we have significant operations, such as Australia and Canada, have either announced an intention to adopt it or started the process of doing so. Additionally, other jurisdictions in which we do business are also reacting to these efforts; for example, Bermuda enacted a corporate tax regime for the first time in 2023. We anticipate further significant developments across several jurisdictions in which we operate in 2024 and 2025; •Legal or political constraints on our ability to maintain or increase prices; Legal or political constraints on our ability to maintain or increase prices; •Cash balances held in foreign banks and institutions where governments have not specifically enacted formal guarantee programs; Cash balances held in foreign banks and institutions where governments have not specifically enacted formal guarantee programs; •Epidemics or pandemics at a regional or global level; Epidemics or pandemics at a regional or global level; •Lost business or other financial harm due to protectionism in the U.S. and in countries around the world, including adverse trade policies, governmental actions affecting the flow of goods, services and currency, and governmental restrictions on the transfer of funds to us from our operations outside the U.S.; and Lost business or other financial harm due to protectionism in the U.S. and in countries around the world, including adverse trade policies, governmental actions affecting the flow of goods, services and currency, and governmental restrictions on the transfer of funds to us from our operations outside the U.S.; and •The trade and military policies of the U.S. government could further develop in ways that exacerbate the risks described above, or introduce new risks for our international operations. The trade and military policies of the U.S. government could further develop in ways that exacerbate the risks described above, or introduce new risks for our international operations. If any of these risks materialize, our results of operations and financial condition could be adversely affected. --- ## Modified: We are subject to regulation worldwide. If we fail to comply with regulatory requirements or if regulations change in a way that adversely affects our operations, we may not be able to conduct our business, or we may be less profitable. **Key changes:** - Reworded sentence: "Many of our activities throughout the world, especially regulated businesses such as our insurance brokerage, securities broker-dealer and investment advisory services, are subject to supervision and regulations promulgated by regulatory or self-regulatory bodies such as the SEC, the NYSE, the DOJ, the IRS, the Financial Crimes Enforcement Network, the FTC and FINRA in the U.S., the Financial Conduct Authority in the U.K., the Australian Securities and Investments Commission in Australia and insurance regulators in nearly every jurisdiction in which we operate." - Reworded sentence: "A compliance failure by even one of our smallest branches could lead to a loss of reputation in the local market, and litigation and/or disciplinary actions that may include compensating clients for loss, the imposition of penalties, and/or the loss of our authorization to operate." - Reworded sentence: "In emerging markets and other jurisdictions with less developed legal systems, local laws and regulations may not be established with sufficiently clear and reliable guidance to provide us with adequate assurance that we are aware of all necessary licenses to operate our business, that we are operating our business in a compliant manner, or that our rights are otherwise protected." - Removed sentence: "In 2022, we acquired Willis Re's reinsurance operations in China." - Reworded sentence: "Future changes in the regulatory environment may impact our ability to collect these revenues." **Prior (2023):** Many of our activities throughout the world are subject to supervision and regulations promulgated by regulatory or self-regulatory bodies such as the SEC, the NYSE, the DOJ, the IRS, the Office of Foreign Assets Control, the FTC and the FINRA in the U.S., the Financial Conduct Authority in the U.K., the Australian Securities and Investments Commission in Australia and insurance regulators in nearly every jurisdiction in which we operate. Our retirement-related consulting and investment services are subject to pension law and financial regulation in many countries. Our activities are also subject to a variety of other laws, rules and regulations addressing licensing, data privacy, wage-and-hour standards, employment and labor relations, anti-competition, anti-corruption, currency, the conduct of business, reserves and the amount of local investment with respect to our operations in certain countries. For example, the DOJ recently revised its Corporate Criminal Enforcement Policies and Practices to include a section on the use of personal devices and third-party messaging applications, indicating that their use poses significant risk to companies and suggesting that it intends to investigate seriously whether companies have ensured that data from these sources is preserved for investigations. This and other forms of regulatory supervision could reduce our profitability or growth by increasing the costs of compliance, increasing the risk of costly enforcement actions, restricting the products or services we sell, the markets we enter, the methods by which we sell our products and services, or the prices we can charge for our services and the form of compensation we can accept from our clients, underwriting enterprises and third parties. As our operations grow around the world, it is increasingly difficult to monitor and enforce regulatory compliance across the organization. A compliance failure by even one of our smallest branches could lead to litigation and/or disciplinary actions that may include compensating clients for loss, the imposition of penalties, and/or the loss of our authorization to operate. In all such cases, we would also likely incur significant internal investigation costs and legal fees. The global nature of our operations increases the complexity and cost of compliance with laws and regulations, including increased staffing needs, the development of new policies, procedures and internal controls and providing training to employees in multiple locations, adding to our cost of doing business. Many of these laws and regulations may have differing or conflicting legal standards across jurisdictions, increasing further the complexity and cost of compliance. In emerging markets and other jurisdictions with less 23 developed legal systems, local laws and regulations may not be established with sufficiently clear and reliable guidance to provide us with adequate assurance that we are aware of all necessary licenses to operate our business, that we are operating our business in a compliant manner, or that our rights are otherwise protected. In addition, major political and legal developments in jurisdictions in which we do business may lead to new regulatory costs and challenges. For example, China adopted a "blocking" statute similar to that of the EU requiring compliance with certain Chinese laws if they conflict with U.S. laws. In 2022, we acquired Willis Re's reinsurance operations in China. Rising global tensions and protectionism may also lead other countries to adopt similar blocking statutes, which could make it more difficult and costly for us to expand our operations globally. Changes in legislation or regulations and actions by regulators, including changes in administration and enforcement policies, or the failure of state and local governments to follow through on agreed-upon state and local tax credits or other tax related incentives, could adversely affect our results of operations or require operational changes that could result in lost revenues or higher costs or hinder our ability to operate our business. For example, the method by which insurance brokers are compensated has received substantial scrutiny in the past because of the potential for conflicts of interest. The potential for conflicts of interest arises when a broker is compensated by two parties in connection with the same or similar transactions. The vast majority of the compensation we receive for our work as insurance and reinsurance brokers is in the form of retail commissions and fees. We receive additional revenue from underwriting enterprises, separate from retail commissions and fees, including, among other things, contingent and supplemental revenues and payments for consulting and analytics services we provide them. Future changes in the regulatory environment may impact our ability to collect these amounts. Adverse regulatory, legal or other developments regarding these revenues could have a material adverse effect on our business, results of operations or financial condition, expose us to negative publicity and reputational damage and harm our relationships with clients, underwriting enterprises or other business partners. In addition, as regulators and investors increasingly focus on climate change and other sustainability issues, we are exposed to the risk of frameworks and regulations being adopted that require significant effort to comply with and which are ill-adapted to our operations. For example, the CSRD, which envisages the adoption of EU sustainability reporting standards to be developed by the European Financial Reporting Advisory Group, with such standards to be tailored to EU policies building on and contributing to international standardization initiatives, was adopted and entered into force in 2022. The CSRD applies not only to local operations in the EU, but under certain circumstances, to entire global companies that have EU operations. The CSRD will not apply to our operations in 2023, but we expect to begin assessing our obligations under the CSRD in 2023 as they are expected to be substantial in future years. The SEC and the state of California have also proposed new climate change disclosure requirements, and compliance with such rules, when they are finalized, could require significant effort and divert management's attention and resources, which could adversely affect our operating results. **Current (2024):** Many of our activities throughout the world, especially regulated businesses such as our insurance brokerage, securities broker-dealer and investment advisory services, are subject to supervision and regulations promulgated by regulatory or self-regulatory bodies such as the SEC, the NYSE, the DOJ, the IRS, the Financial Crimes Enforcement Network, the FTC and FINRA in the U.S., the Financial Conduct Authority in the U.K., the Australian Securities and Investments Commission in Australia and insurance regulators in nearly every jurisdiction in which we operate. Our retirement-related consulting and investment advisory services are subject to pension law and financial regulation in many countries. Our activities are also subject to a variety of other laws, rules and regulations addressing licensing, data privacy, AI, wage-and-hour standards, employment and labor relations, competition, anti-corruption, currency, the conduct of business, reserves and the amount of local investment with respect to our operations in certain countries. For example, the DOJ revised its Corporate Criminal Enforcement Policies and Practices to include a section on the use of personal devices and third-party messaging applications, indicating that their use poses significant risk to companies and suggesting that it intends to investigate seriously whether companies have ensured that data from these sources is preserved for investigations; additionally, the FTC proposed a rule that would prevent employers from entering into non-competes with employees and require employers to rescind existing non-competes. These and other forms of regulatory action could reduce our profitability or growth by increasing the costs of compliance, increasing the risk of costly enforcement actions, restricting the products or services we sell, the markets we enter, the methods by which we sell our products and services, or the prices we can charge for our services and the form of compensation we can accept from our clients, underwriting 25 enterprises and third parties. As our operations grow around the world, it is increasingly difficult to monitor and enforce regulatory compliance across the organization. A compliance failure by even one of our smallest branches could lead to a loss of reputation in the local market, and litigation and/or disciplinary actions that may include compensating clients for loss, the imposition of penalties, and/or the loss of our authorization to operate. In all such cases, we would also likely incur significant internal investigation costs and legal fees. The global nature of our operations increases the complexity and cost of compliance with laws and regulations, including increased staffing needs, the development of new policies, procedures and internal controls and providing training to employees in multiple locations, adding to our cost of doing business. Many of these laws and regulations may have differing or conflicting legal standards across jurisdictions, increasing further the complexity and cost of compliance. In emerging markets and other jurisdictions with less developed legal systems, local laws and regulations may not be established with sufficiently clear and reliable guidance to provide us with adequate assurance that we are aware of all necessary licenses to operate our business, that we are operating our business in a compliant manner, or that our rights are otherwise protected. In addition, major political and legal developments in jurisdictions in which we do business may lead to new regulatory costs and challenges. For example, China adopted a "blocking" statute similar to that of the EU requiring compliance with certain Chinese laws if they conflict with U.S. laws. Rising global tensions and protectionism may also lead other countries to adopt similar blocking statutes, which could make it more difficult and costly for us to expand our operations globally. Changes in legislation or regulations and actions by regulators, including changes in administration and enforcement policies, or the failure of state and local governments to follow through on agreed-upon state and local tax credits or other tax related incentives, could adversely affect our results of operations or require operational changes that could result in lost revenues or higher costs or hinder our ability to operate our business. For example, the method by which insurance brokers are compensated has received substantial scrutiny in the past because of the potential for conflicts of interest. The potential for conflicts of interest arises when a broker is compensated by two parties in connection with the same or similar transactions. The vast majority of the compensation we receive for our work as insurance and reinsurance brokers is in the form of retail commissions and fees. We receive additional revenue from underwriting enterprises, separate from retail commissions and fees, including, among other things, contingent and supplemental revenues and payments for consulting and analytics services we provide them. Future changes in the regulatory environment may impact our ability to collect these revenues. Adverse regulatory, legal or other developments regarding these revenues could have a material adverse effect on our business, results of operations or financial condition, expose us to negative publicity and reputational damage and harm our relationships with clients, underwriting enterprises or other business partners. In addition, as regulators and investors increasingly focus on climate change and other sustainability issues, we are exposed to the risk of frameworks and regulations being adopted that require significant effort to comply with and which are ill-adapted to our operations. For example, pursuant to the CSRD, in 2023 the first set of EU sustainability reporting standards (which we refer to as ESRS) has been developed by the European Financial Reporting Advisory Group (which we refer to as EFRAG) and adopted by the EU. EFRAG will continue to issue sector-specific and non-EU applicable ESRS in the coming years, with such standards to be tailored to EU policy positions which may be different or contradictory with those applicable to our business in other jurisdictions. The CSRD is expected to entail substantial disclosure obligations in future years for us and some of our EU subsidiaries. The SEC has also proposed new climate change disclosure requirements, which are expected to become effective in 2024. Additionally, the state of California has enacted disclosure rules similar to the SEC rules, which will become effective between 2024 and 2026. Furthermore, in the U.K., our business is subject to a number of disclosure obligations under different sustainability frameworks, such as the Task Force on Climate-Related Financial Disclosures framework; Australia is planning to enact mandatory disclosures based on the International Sustainability Standards Board standards (which we refer to as ISSB) in 2024; and other jurisdictions, such as Canada and Brazil, have also announced that they plan to implement ISSB-based disclosures. Compliance with such rules and frameworks will require significant effort and could divert management's attention and resources, which could adversely affect our operating results. --- ## Modified: We face a variety of risks in our third-party claims administration operations that are distinct from those we face in our brokerage and benefit consulting operations. **Key changes:** - Reworded sentence: "Our third party claims administration operations face a variety of risks distinct from those faced by the rest of our business, including the risks that: •Epidemics and pandemics that reduce in-person business activity have a greater negative impact because they result in a reduction in the number of claims processed, as experienced during the years 2020, 2021, and the beginning of 2022." - Reworded sentence: "A disruption affecting RISX-FACS®, third-party cloud services or any other infrastructure supporting our business, including key client relationship management software, could have a material adverse effect on our operations, cause reputational harm and damage our employee and client relationships; RISX-FACS®, our proprietary risk management information system, on which our ability to provide clients with insurance claim settlement and administration services is highly dependent, becomes inoperable for some reason." - Reworded sentence: "A disruption affecting RISX-FACS®, third-party cloud services or any other infrastructure supporting our business, including key client relationship management software, could have a material adverse effect on our operations, cause reputational harm and damage our employee and client relationships; •The favorable trend among both underwriting enterprises and self-insured entities toward outsourcing various types of claims administration and risk management services will reverse or slow, causing our revenues or revenue growth to decline; The favorable trend among both underwriting enterprises and self-insured entities toward outsourcing various types of claims administration and risk management services will reverse or slow, causing our revenues or revenue growth to decline; •Concentration of large amounts of revenue with certain clients results in greater exposure to the potential negative effects of lost business due to changes in management at such clients or changes in state government policies, in the case of our government-entity clients, or for other reasons; Concentration of large amounts of revenue with certain clients results in greater exposure to the potential negative effects of lost business due to changes in management at such clients or changes in state government policies, in the case of our government-entity clients, or for other reasons; •Contracting terms will become less favorable or the margins on our services will decrease due to increased competition, regulatory constraints or other developments; Contracting terms will become less favorable or the margins on our services will decrease due to increased competition, regulatory constraints or other developments; •We do not satisfy regulatory requirements related to third party administrators or regulatory developments, including those relating to security, cybersecurity and data privacy as we manage a large amount of highly sensitive and confidential information including personally identifiable information, protected health information and financial information, will impose additional burdens, costs or business restrictions that make our business less profitable; We do not satisfy regulatory requirements related to third party administrators or regulatory developments, including those relating to security, cybersecurity and data privacy as we manage a large amount of highly sensitive and confidential information including personally identifiable information, protected health information and financial information, will impose additional burdens, costs or business restrictions that make our business less profitable; •Volatility in our case volumes, which are dependent upon a number of factors and difficult to forecast accurately, could impact our revenues; Volatility in our case volumes, which are dependent upon a number of factors and difficult to forecast accurately, could impact our revenues; •Wage inflation, difficulty attracting and retaining talent, and rising technology costs, all of which have been challenging to control since 2020, may impact our ability to remain competitive in the marketplace and profitably fulfill our existing contracts (other than those that provide cost-plus or other margin protection); Wage inflation, difficulty attracting and retaining talent, and rising technology costs, all of which have been challenging to control since 2020, may impact our ability to remain competitive in the marketplace and profitably fulfill our existing contracts (other than those that provide cost-plus or other margin protection); •We may be unable to develop further efficiencies in our claims-handling business and may be unable to obtain or retain certain clients if we fail to make adequate improvements in technology or operations; and We may be unable to develop further efficiencies in our claims-handling business and may be unable to obtain or retain certain clients if we fail to make adequate improvements in technology or operations; and •Underwriting enterprises or certain large self-insured entities may create in-house servicing capabilities that compete with our third party administration and other administration, servicing and risk management products, and we could face additional competition from potential new entrants into the global claims management services market." **Prior (2023):** In 2020, 2021 and the beginning of 2022, the COVID-19 pandemic caused a reduction in the number of claims we otherwise would have processed, negatively impacting our third party claims administration operations to a greater degree than the rest of our business. If a new COVID-19 variant emerges and we return to the conditions of 2020 and 2021, we could experience the same kind of negative impact in the future. Our third party claims administration operations also face a variety of additional risks distinct from those faced by the rest of our business, including the risks that: •RISX-FACS®, our proprietary risk management information system, on which our ability to provide clients with insurance claim settlement and administration services is highly dependent, becomes inoperable for some reason. In addition, we are increasing our use of cloud storage and cloud computing application services supported, upgraded and maintained by third-party vendors. A disruption affecting RISX-FACS®, third-party cloud services or any other infrastructure supporting our business, including key customer relationship management software, could have a material adverse effect on our operations, cause reputational harm and damage our employee and client relationships; RISX-FACS®, our proprietary risk management information system, on which our ability to provide clients with insurance claim settlement and administration services is highly dependent, becomes inoperable for some reason. In addition, we are increasing our use of cloud storage and cloud computing application services supported, upgraded and maintained by third-party vendors. A disruption affecting RISX-FACS®, third-party cloud services or any other infrastructure supporting our business, including key customer relationship management software, could have a material adverse effect on our operations, cause reputational harm and damage our employee and client relationships; •The favorable trend among both underwriting enterprises and self-insured entities toward outsourcing various types of claims administration and risk management services will reverse or slow, causing our revenues or revenue growth to decline; The favorable trend among both underwriting enterprises and self-insured entities toward outsourcing various types of claims administration and risk management services will reverse or slow, causing our revenues or revenue growth to decline; •Concentration of large amounts of revenue with certain clients results in greater exposure to the potential negative effects of lost business due to changes in management at such clients or changes in state government policies, in the case of our government-entity clients, or for other reasons; Concentration of large amounts of revenue with certain clients results in greater exposure to the potential negative effects of lost business due to changes in management at such clients or changes in state government policies, in the case of our government-entity clients, or for other reasons; •Contracting terms will become less favorable or the margins on our services will decrease due to increased competition, regulatory constraints or other developments; Contracting terms will become less favorable or the margins on our services will decrease due to increased competition, regulatory constraints or other developments; •We will not be able to satisfy regulatory requirements related to third party administrators or regulatory developments (including those relating to security and data privacy) will impose additional burdens, costs or business restrictions that make our business less profitable; We will not be able to satisfy regulatory requirements related to third party administrators or regulatory developments (including those relating to security and data privacy) will impose additional burdens, costs or business restrictions that make our business less profitable; 20 •Volatility in our case volumes, which are dependent upon a number of factors and difficult to forecast accurately, could impact our revenues; Volatility in our case volumes, which are dependent upon a number of factors and difficult to forecast accurately, could impact our revenues; •If we do not control our labor and technology costs (and beginning during the pandemic we have been experiencing wage inflation and difficulty attracting and retaining talent), we may be unable to remain competitive in the marketplace and profitably fulfill our existing contracts (other than those that provide cost-plus or other margin protection); If we do not control our labor and technology costs (and beginning during the pandemic we have been experiencing wage inflation and difficulty attracting and retaining talent), we may be unable to remain competitive in the marketplace and profitably fulfill our existing contracts (other than those that provide cost-plus or other margin protection); •We may be unable to develop further efficiencies in our claims-handling business and may be unable to obtain or retain certain clients if we fail to make adequate improvements in technology or operations; and We may be unable to develop further efficiencies in our claims-handling business and may be unable to obtain or retain certain clients if we fail to make adequate improvements in technology or operations; and •Underwriting enterprises or certain large self-insured entities may create in-house servicing capabilities that compete with our third party administration and other administration, servicing and risk management products, and we could face additional competition from potential new entrants into the global claims management services market. Underwriting enterprises or certain large self-insured entities may create in-house servicing capabilities that compete with our third party administration and other administration, servicing and risk management products, and we could face additional competition from potential new entrants into the global claims management services market. If any of these risks materialize, our results of operations and financial condition could be adversely affected. **Current (2024):** Our third party claims administration operations face a variety of risks distinct from those faced by the rest of our business, including the risks that: •Epidemics and pandemics that reduce in-person business activity have a greater negative impact because they result in a reduction in the number of claims processed, as experienced during the years 2020, 2021, and the beginning of 2022. If a new epidemic or pandemic were to emerge, these operations could face similar negative impacts in the future; Epidemics and pandemics that reduce in-person business activity have a greater negative impact because they result in a reduction in the number of claims processed, as experienced during the years 2020, 2021, and the beginning of 2022. If a new epidemic or pandemic were to emerge, these operations could face similar negative impacts in the future; •RISX-FACS®, our proprietary risk management information system, on which our ability to provide clients with insurance claim settlement and administration services is highly dependent, becomes inoperable for some reason. In addition, we are increasing our use of cloud storage and cloud computing application services supported, upgraded and maintained by third-party vendors. A disruption affecting RISX-FACS®, third-party cloud services or any other infrastructure supporting our business, including key client relationship management software, could have a material adverse effect on our operations, cause reputational harm and damage our employee and client relationships; RISX-FACS®, our proprietary risk management information system, on which our ability to provide clients with insurance claim settlement and administration services is highly dependent, becomes inoperable for some reason. In addition, we are increasing our use of cloud storage and cloud computing application services supported, upgraded and maintained by third-party vendors. A disruption affecting RISX-FACS®, third-party cloud services or any other infrastructure supporting our business, including key client relationship management software, could have a material adverse effect on our operations, cause reputational harm and damage our employee and client relationships; •The favorable trend among both underwriting enterprises and self-insured entities toward outsourcing various types of claims administration and risk management services will reverse or slow, causing our revenues or revenue growth to decline; The favorable trend among both underwriting enterprises and self-insured entities toward outsourcing various types of claims administration and risk management services will reverse or slow, causing our revenues or revenue growth to decline; •Concentration of large amounts of revenue with certain clients results in greater exposure to the potential negative effects of lost business due to changes in management at such clients or changes in state government policies, in the case of our government-entity clients, or for other reasons; Concentration of large amounts of revenue with certain clients results in greater exposure to the potential negative effects of lost business due to changes in management at such clients or changes in state government policies, in the case of our government-entity clients, or for other reasons; •Contracting terms will become less favorable or the margins on our services will decrease due to increased competition, regulatory constraints or other developments; Contracting terms will become less favorable or the margins on our services will decrease due to increased competition, regulatory constraints or other developments; •We do not satisfy regulatory requirements related to third party administrators or regulatory developments, including those relating to security, cybersecurity and data privacy as we manage a large amount of highly sensitive and confidential information including personally identifiable information, protected health information and financial information, will impose additional burdens, costs or business restrictions that make our business less profitable; We do not satisfy regulatory requirements related to third party administrators or regulatory developments, including those relating to security, cybersecurity and data privacy as we manage a large amount of highly sensitive and confidential information including personally identifiable information, protected health information and financial information, will impose additional burdens, costs or business restrictions that make our business less profitable; •Volatility in our case volumes, which are dependent upon a number of factors and difficult to forecast accurately, could impact our revenues; Volatility in our case volumes, which are dependent upon a number of factors and difficult to forecast accurately, could impact our revenues; •Wage inflation, difficulty attracting and retaining talent, and rising technology costs, all of which have been challenging to control since 2020, may impact our ability to remain competitive in the marketplace and profitably fulfill our existing contracts (other than those that provide cost-plus or other margin protection); Wage inflation, difficulty attracting and retaining talent, and rising technology costs, all of which have been challenging to control since 2020, may impact our ability to remain competitive in the marketplace and profitably fulfill our existing contracts (other than those that provide cost-plus or other margin protection); •We may be unable to develop further efficiencies in our claims-handling business and may be unable to obtain or retain certain clients if we fail to make adequate improvements in technology or operations; and We may be unable to develop further efficiencies in our claims-handling business and may be unable to obtain or retain certain clients if we fail to make adequate improvements in technology or operations; and •Underwriting enterprises or certain large self-insured entities may create in-house servicing capabilities that compete with our third party administration and other administration, servicing and risk management products, and we could face additional competition from potential new entrants into the global claims management services market. Underwriting enterprises or certain large self-insured entities may create in-house servicing capabilities that compete with our third party administration and other administration, servicing and risk management products, and we could face additional competition from potential new entrants into the global claims management services market. If any of these risks materialize, our results of operations and financial condition could be adversely affected. --- ## Modified: Our success depends, in part, on our ability to attract and retain qualified talent, including our senior management team. **Key changes:** - Reworded sentence: "We could be adversely affected if we fail to successfully execute our succession plans for these leaders, including our chief executive officer, and if our succession plans are not well-received by our employees and trading partners." - Reworded sentence: "Competition for talent is intense in many areas of our business, particularly in our claims management business, IT and in rapidly developing fields such as AI and data engineering." - Reworded sentence: "In addition, the Federal Trade Commission (FTC) has proposed a rule that would prevent employers from entering into non-competes with employees and require employers to rescind existing non-competes." **Prior (2023):** We depend upon members of our senior management team, who possess extensive knowledge and a deep understanding of our business and strategy. We could be adversely affected if we fail to plan adequately for the succession of these leaders, including our chief executive officer. We could also be adversely affected if we fail to attract and retain talent and foster a diverse and inclusive workplace throughout our organization. Competition for talent is intense in many areas of our business, particularly in our claims management business, our IT organization and in rapidly developing fields such as artificial intelligence and data engineering. In addition, our industry has experienced competition for leading brokers and in the past we have lost key brokers and groups of brokers, along with their clients, business relationships and intellectual property directly to our competition. We enter into agreements with many of our brokers and significant client-facing employees and all of our executive officers, which prohibit them from disclosing confidential information and/or soliciting our clients, prospects and employees upon their termination of employment. The confidentiality and non-solicitation provisions of such agreements terminate in the event of a hostile change in control, as defined in the agreements. Although we pursue legal actions for alleged breaches of non-compete or other restrictive covenants, theft of trade secrets, breaches of fiduciary duties, intellectual property infringement and related causes of action, such legal actions may not be effective in preventing such breaches, theft or infringement. In certain cases, our competitors have solicited employees in violation of their employment agreements as a matter of standard business practice, apparently determining that the cost of defending litigation is outweighed by the benefits of acquiring our employees in this manner. In addition, the Federal Trade Commission (FTC) recently proposed a rule that would prevent employers from entering into non-competes with employees and require employers to rescind existing non-competes. If this rule goes into effect, or if we fail to adequately address any of the issues referred to above, we could experience a material adverse effect on our business, operating results and financial condition. See also "The substantial increase in remote work among our employees subjects us to certain challenges and risks" below. **Current (2024):** We depend upon members of our senior management team, who possess extensive knowledge and a deep understanding of our business and strategy. We could be adversely affected if we fail to successfully execute our succession plans for these leaders, including our chief executive officer, and if our succession plans are not well-received by our employees and trading partners. We could also be adversely affected if we fail to attract and retain talent and foster a diverse and inclusive workplace throughout our organization. Competition for talent is intense in many areas of our business, particularly in our claims management business, IT and in rapidly developing fields such as AI and data engineering. Furthermore, the increased availability of remote 15 working arrangements has expanded the pool of companies that compete with us for talent. As competition for skilled professionals remains intense, employers are implementing new offerings to attract talent, including but not limited to increasing compensation, enhancing health and wellness solutions, and providing in-office and remote work options. We may have to devote significant resources to attract and retain talent, which could negatively affect our business, operating results and financial condition. In addition, our industry has experienced competition for leading brokers and in the past we have lost key brokers and groups of brokers, along with their clients, business relationships and intellectual property directly to our competition. We enter into agreements with many of our brokers and significant client-facing employees and all of our executive officers, which prohibit them from disclosing confidential information and/or soliciting our clients, prospects and employees upon their termination of employment. The confidentiality and non-solicitation provisions of such agreements terminate in the event of a hostile change in control, as defined in the agreements. Although we pursue legal actions for alleged breaches of non-compete or other restrictive covenants, theft of trade secrets, breaches of fiduciary duties, intellectual property infringement and related causes of action, such legal actions may not be effective in preventing such breaches, theft or infringement. In certain cases, our competitors have solicited employees in violation of their employment agreements as a matter of standard business practice, apparently determining that the cost of defending litigation is outweighed by the benefits of acquiring our employees in this manner. In addition, the Federal Trade Commission (FTC) has proposed a rule that would prevent employers from entering into non-competes with employees and require employers to rescind existing non-competes. Furthermore, certain states like Minnesota, North Dakota and Oklahoma have implemented comparable or more stringent regulations, while California has broadened the scope of its longstanding restrictions on non-competes. If this rule goes into effect, more states adopt similar rules or if we fail to adequately address any of the issues referred to above, we could experience a material adverse effect on our business, operating results and financial condition. See also "The substantial increase in remote work among our employees subjects us to certain challenges and risks" below. --- ## Modified: Changes in data privacy and protection laws and regulations, or any failure to comply with such laws and regulations, could adversely affect our business and financial results. **Key changes:** - Reworded sentence: "We are subject to a variety of continuously evolving and developing laws and regulations globally regarding privacy, data protection, and data security, including those related to the collection, storage, handling, use, disclosure, transfer, destruction, and security of personal data." - Reworded sentence: "Significant uncertainty exists as privacy and data protection laws evolve and may be interpreted and applied differently from country to country and state to state, and may create inconsistent or conflicting requirements." - Reworded sentence: "In the U.S., there is pending federal legislation and a number of states have proposed their own comprehensive data privacy bills similar to the GDPR and CCPA, with some of those laws already in effect, and others coming into effect between 2024 and 2026." - Reworded sentence: "have proposed or have enacted sweeping data protection laws, and in some cases we are subject to sector and personal data localization laws that may require that data or personal data stay within their borders, such as India's IRDIA (Maintenance of Insurance Records) Regulation, 2015." - Reworded sentence: "For example, we are subject to the New York State Department of Financial Services Cybersecurity Regulation for Financial Services Companies, which were substantively amended in 2023." **Prior (2023):** We are subject to a variety of continuously evolving and developing laws and regulations globally regarding privacy, data protection, and data security, including those related to the collection, storage, handling, use, disclosure, transfer, and security of personal data. These laws apply to transfers of personal information among our affiliates, as well as to transactions we enter into with third party vendors and clients. Significant uncertainty exists as privacy and data protection laws evolve and may be interpreted and applied differently from country to country, and may create inconsistent or conflicting requirements. Some of these laws provide rights to individuals to access, correct, and delete their personal information and to obtain copies at the expense of the business entities that process their data. Some of these laws carry heavy penalties for violations, e.g., fines of up to 4% of worldwide revenue under the U.K. Data Protection Act and the European Union General Data Protection Regulation (GDPR) and up to $7,500 per intentional violation under the California Consumer Privacy Act (CCPA). In the U.S., there is pending federal legislation and several states have proposed their own comprehensive data privacy bills similar to the GDPR and CCPA. India and other countries where we have operations outside the U.S. have proposed sweeping new data protection laws, in some cases including data localization laws that may require that personal data stay within their borders. In addition, in the U.S., legislators are continuing to enact comprehensive cybersecurity laws. For example, we are subject to the New York State Department of Financial Services Cybersecurity Regulation for Financial Services Companies. 22 Complying with enhanced obligations imposed by various new and emerging laws results in significant costs for developing, implementing and securing our servers lawfully processing personal data and requires we allocate more resources to new privacy compliance processes and to improved technologies, adding to our IT and compliance costs. In addition, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase. The enactment of more restrictive laws, rules, regulations, or future enforcement actions or investigations could impact us through increased costs or restrictions on our business, and noncompliance could result in regulatory penalties and significant legal liability. **Current (2024):** We are subject to a variety of continuously evolving and developing laws and regulations globally regarding privacy, data protection, and data security, including those related to the collection, storage, handling, use, disclosure, transfer, destruction, and security of personal data. These laws apply to transfers of personal information among our affiliates, as well as to transactions we enter into with third party vendors and clients. Significant uncertainty exists as privacy and data protection laws evolve and may be interpreted and applied differently from country to country and state to state, and may create inconsistent or conflicting requirements. Some of these laws provide rights to individuals to access, correct, and delete their personal information and to obtain copies at the expense of the business entities that process their data. Some of these laws carry heavy penalties for violations, e.g., fines of up to 4% of worldwide revenue under the U.K. Data Protection Act and the European Union General Data Protection Regulation (GDPR) and up to $7,500 per intentional violation under the California Consumer Privacy Act (CCPA). In the U.S., there is pending federal legislation and a number of states have proposed their own comprehensive data privacy bills similar to the GDPR and CCPA, with some of those laws already in effect, and others coming into effect between 2024 and 2026. India and other countries where we have operations outside the U.S. have proposed or have enacted sweeping data protection laws, and in some cases we are subject to sector and personal data localization laws that may require that data or personal data stay within their borders, such as India's IRDIA (Maintenance of Insurance Records) Regulation, 2015. In addition, in the U.S., legislators are continuing to enact comprehensive cybersecurity laws. For example, we are subject to the New York State Department of Financial Services Cybersecurity Regulation for Financial Services Companies, which were substantively amended in 2023. We also expect to be subject to a variety of laws and regulations governing AI, such as the proposed EU AI Act which is expected to be enacted in 2024. These laws and regulations are still evolving, and while we are assessing how regulators may apply existing consumer protection, data protection and other similar laws to AI, there is uncertainty regarding the scope of new laws and how existing laws will apply. Due to this uncertainty, we may face challenges complying with existing and new laws, and our policies and governance frameworks may not be successful in mitigating these risks. See also "We are subject to risks associated with AI." Adhering to the increased obligations imposed by various new and emerging laws causes us to incur substantial expenses in connection with developing, implementing, and securing our systems and effectively implementing data privacy governance policies for the lawful processing of personal data. Such increased obligations also result in the allocation of additional resources towards new privacy compliance processes and enhanced technologies, further contributing to our IT and compliance costs. In addition, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase. The enactment of more restrictive laws, rules, regulations, or future enforcement actions or investigations 24 could impact us through increased costs or restrictions on our business, and noncompliance could result in regulatory penalties and significant legal liability. --- ## Modified: Improper disclosure of confidential, personal or proprietary information and cybersecurity attacks or other security breach of our information systems, or those of third-party vendors we rely on, could result in regulatory scrutiny, legal liability or reputational harm, and could adversely affect our business, financial condition and reputation. **Key changes:** - Reworded sentence: "Nonetheless, we cannot eliminate the risk of human error, malfeasance or highly sophisticated cyber-attacks, which are heightened as a result of the war in Ukraine and in the Middle East or other cybersecurity incidents." - Reworded sentence: "Given the continuously evolving cyber threat landscape, it will become increasingly difficult to detect, defend against and remediate cybersecurity incidents and data breaches." - Reworded sentence: "Cybersecurity incidents and data breaches of certain systems on which we rely have occurred, such as the ransomware incident that occurred in 2020 (as disclosed in previous filings), and we also have from time to time experienced other cybersecurity incidents such as computer viruses, unauthorized parties gaining access to our information technology systems, and privacy incidents, such as loss or inadvertent transmission of data, although to date we have not been materially impacted by such events." - Reworded sentence: "The process of integrating information systems of businesses we acquire is complex and exposes us to additional risk as we might not adequately identify weaknesses in the targets' information systems or information handling, privacy and security policies and protocols, which could expose us to unexpected liabilities or make our own systems and data more vulnerable to cybersecurity incidents." - Reworded sentence: "We cannot ensure that any limitations of liability provisions in our agreements with clients, vendors and other third parties with which we do business would be enforceable or adequate or would otherwise protect us from any liability with respect to claims arising from a cybersecurity, data or similar incident." **Prior (2023):** We collect, use, store, transmit and otherwise process, confidential, personal and proprietary information relating to our company, acquisition targets, our employees and our clients. This information includes personally identifiable information, protected health information, financial information and intellectual property. We maintain policies, procedures and technical safeguards designed to protect the security and privacy of confidential, personal and proprietary information. Nonetheless, we cannot eliminate the risk of human error, malfeasance or highly sophisticated cyber-attacks. It is possible that our security controls and employee training are not effective. See "The substantial increase in remote work among our employees subjects us to certain challenges and risks" above for a discussion of how remote work enhances these risks. We have and continue to invest in technology security initiatives, policies, resources and employee training. The cost and operational consequences of implementing, maintaining and enhancing appropriate technical measures is high. Given the continuously evolving cyber threat landscape, it will become increasingly difficult to detect, defend against and remediate cybersecurity incidents and data 21 breaches. If we are unable to effectively maintain and enhance our system safeguards in line with evolving cyber threats, including in connection with the integration of acquisitions, we may incur unexpected costs, regulatory enforcement action, loss of clients, reputational damage and certain of our systems may become more vulnerable to unauthorized access. We rely on information technology and third party vendors to support our business activities, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to improve our and our vendors' ability to protect and defend against cyber-attacks, we may not be able to protect all of our data. Cybersecurity incidents and data breaches of certain systems on which we rely have occurred, although to date we have not been materially impacted by such events. In the future, breaches of any third-party or internal systems may result from circumvention of security systems, denial-of-service, hacking, "phishing", computer viruses, ransomware, malware, or other cyber-attacks, employee or insider error, malfeasance, social engineering, physical breaches or other actions. We have from time to time experienced cybersecurity incidents, such as computer viruses, unauthorized parties gaining access to our information technology systems, and privacy incidents, such as loss or inadvertent transmission of data, which to date have not had a material impact on our business. For example, we have previously disclosed a ransomware incident that occurred in 2020. We are an acquisitive organization. The process of integrating information systems of businesses we acquire is complex and exposes us to additional risk as we might not adequately identify weaknesses in the targets' information systems or information handling, privacy and security policies and protocols, which could expose us to unexpected liabilities or make our own systems and data more vulnerable to attack. Any future, material cybersecurity or data incident, or media report of the same, even if untrue, may cause us to experience reputational harm, loss of clients and revenue, loss of proprietary data, regulatory action and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard clients' information or financial losses. Such incidents could result in confidential, personal or proprietary information being lost or stolen, used to perpetuate fraud, maliciously made public, surreptitiously modified, or rendered inaccessible for a period of time. As we experienced in connection with the 2020 ransomware incident referred to above, during a cyber-attack we might have to take our systems offline, which could interfere with services to our clients or damage our reputation. Such losses may not be insured against or be fully covered by insurance we maintain. Any of the foregoing may have a material adverse effect on our business, financial condition and reputation. In addition, the competition for talent is high in the cybersecurity and privacy space, and we may not be able to hire, develop or retain suitable talent we need to be capable of identifying, mitigating or remediating these risks. With respect to our commercial arrangements with third party vendors, we have processes designed to require third party IT outsourcing, offsite storage and other vendors to agree to maintain certain standards with respect to their storage, protection and transfer of confidential, personal and proprietary information. However, we remain at risk of a data breach due to the intentional or unintentional non-compliance by a vendor's employee or agent, the breakdown of a vendor's data protection processes, or a cyber‑attack on a vendor's information systems. **Current (2024):** We collect, use, store, transmit and otherwise process, confidential, personal and proprietary information relating to our company, acquisition targets, our employees and our clients. This information includes personally identifiable information, protected health information, financial information and intellectual property. We maintain policies, procedures and technical safeguards designed to protect the security and privacy of confidential, personal and proprietary information. Nonetheless, we cannot eliminate the risk of human error, malfeasance or highly sophisticated cyber-attacks, which are heightened as a result of the war in Ukraine and in the Middle East or other cybersecurity incidents. It is possible that our security controls, employee training and other aspects of our cybersecurity safeguards are not effective. See "The substantial increase in remote work among our employees subjects us to certain challenges and risks" above for a discussion of how remote work enhances these risks. We have and continue to invest in technology security initiatives, policies, resources and employee training. The cost and operational consequences of implementing, maintaining and enhancing appropriate technical measures is high. Given the continuously evolving cyber threat landscape, it will become increasingly difficult to detect, defend against and remediate cybersecurity incidents and data breaches. If we are unable to effectively maintain and enhance our system safeguards in line with evolving cyber threats, including in connection with the integration of acquisitions, we may incur unexpected costs, including litigation costs, regulatory enforcement action, loss of clients, reputational damage, and certain of our systems may become more vulnerable to unauthorized access. We rely on IT and third party vendors to support our business activities, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to improve our and our vendors' ability to protect and defend against cyber-attacks, we may not be able to protect all of our data. Cybersecurity incidents and data breaches of certain systems on which we rely have occurred, such as the ransomware incident that occurred in 2020 (as disclosed in previous filings), and we also have from time to time experienced other cybersecurity incidents such as computer viruses, unauthorized parties gaining access to our information technology systems, and privacy incidents, such as loss or inadvertent transmission of data, although to date we have not been materially impacted by such events. In the future, breaches of any third-party or internal systems may result from circumvention of security systems, denial-of-service, hacking, "phishing", 22 computer viruses, ransomware, malware, or other cyber-attacks, employee or insider error, malfeasance, social engineering, physical breaches or other actions. Furthermore, the risk from threat actors has increased due to the rapid development of AI capabilities. We are an acquisitive organization. The process of integrating information systems of businesses we acquire is complex and exposes us to additional risk as we might not adequately identify weaknesses in the targets' information systems or information handling, privacy and security policies and protocols, which could expose us to unexpected liabilities or make our own systems and data more vulnerable to cybersecurity incidents. Any future, material cybersecurity or data incident, may cause us to experience unauthorized access, exfiltration, manipulation, corruption, loss or disclosure of our proprietary, client, employee, or other data, reputational harm, the inability to render services due to system outages or other business disruptions, loss of clients and revenue, regulatory action and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard clients' information, increases in cybersecurity costs or financial losses. Any of the foregoing may be exacerbated by a delay or failure to detect a cybersecurity incident or the full extent of such incident. In addition, disclosure or media reports of actual or perceived security vulnerabilities to our systems or those of our third-party service providers, even if no breach has been attempted or occurred, could lead to reputational harm, loss of customers and revenue, or increased regulatory actions oversight and scrutiny. Such incidents could result in confidential, personal or proprietary information being lost or stolen, used to perpetuate fraud, maliciously made public, surreptitiously modified, or rendered inaccessible for a period of time. We cannot ensure that any limitations of liability provisions in our agreements with clients, vendors and other third parties with which we do business would be enforceable or adequate or would otherwise protect us from any liability with respect to claims arising from a cybersecurity, data or similar incident. As we experienced in connection with the 2020 ransomware incident referred to above, during a cybersecurity incident, we might have to take our systems offline, which could interfere with services to our clients or damage our reputation. While we endeavor to design and implement technologies, policies and procedures to identify such incidents as quickly as possible, any response would take substantial time, and there may be extensive delays before we obtain full and reliable information. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all of which may further increase the costs and consequences of such incident. Any of these losses may not be insured against or be fully covered by insurance we maintain. In addition, the competition for talent is high in the cybersecurity and privacy space, and we may not be able to hire, develop or retain suitable talent that we need to be capable of minimizing, identifying, mitigating or remediating these risks. With respect to our commercial arrangements with third party vendors, we have processes designed to require third party IT outsourcing, offsite storage and other vendors to agree to maintain certain standards with respect to their storage, protection and transfer of confidential, personal and proprietary information. However, we remain at risk of a cyber or data incident due to the intentional or unintentional non-compliance by a vendor's employee or agent, the breakdown of a vendor's processes, or a cybersecurity incident involving vendor's information systems. We cannot ensure that any provisions in our agreements with these vendors would be enforceable or adequate or would otherwise protect us from any liability in connection with these incidents. Any of the foregoing may have a material adverse effect on our business, financial condition and reputation. --- ## Modified: We could be adversely affected by violations or alleged violations of laws that impose requirements for the conduct of our overseas operations, including the FCPA, the U.K. Bribery Act or other anti-corruption laws, sanctions laws and FATCA. **Key changes:** - Reworded sentence: "In countries outside the U.S., a risk exists that our employees or third parties acting on our behalf, including correspondent brokers, consultants, introducers, partners or agents, could engage in business practices prohibited by applicable laws and regulations, including anti-bribery and anti-corruption laws, and sanctions laws such as those administered by the U.S." - Reworded sentence: "In such parts of the world, in certain circumstances, local customs and practice might not be consistent with the requirements of anti-bribery and anti-corruption laws." - Reworded sentence: "During the fourth quarter of 2023, the DOJ informed us that it has closed its inquiry and would not be pursuing enforcement action against us." **Prior (2023):** In countries outside the U.S., a risk exists that our employees, third party partners or agents could engage in business practices prohibited by applicable laws and regulations, such as the FCPA and the U.K. Bribery Act. Such anti-corruption laws generally prohibit companies from making improper payments to foreign officials and require companies to keep accurate books and records and maintain appropriate internal controls. We operate in some parts of the world that have experienced governmental corruption. In such parts of the world, in certain circumstances, local customs and practice might not be consistent with the requirements of anti-corruption laws. Our policies mandate strict compliance with such laws and we devote substantial resources to programs to ensure compliance, including investigating business practices and taking steps to address the risk that our employees, third party partners or agents will engage in business practices that are prohibited by our policies and/or such laws and regulations. We offer client service capabilities in many countries around the world through a network of correspondent brokers and consultants. In certain limited instances, we also work with third-party introducers that provide services for public sector or other clients. There is a risk that our correspondent brokers and consultants or introducers engage in business practices that are prohibited by our internal policies or violate applicable laws and regulations, such as the U.S. Foreign Corrupt Practices Act and the U.K. Anti-Bribery Act. Violations by us or a third party acting on our behalf could result in significant internal investigation costs and legal fees, civil and criminal penalties, including prohibitions on the conduct of our business, and reputational harm. As previously disclosed, during 2022, we received a subpoena from the FCPA Unit of the DOJ seeking information related to our insurance business with public entities in Ecuador. We continue to fully cooperate with the investigation. We may also be subject to legal liability and reputational damage if we violate trade sanctions laws of the U.S., the EU and other jurisdictions in which we operate. In addition, FATCA requires certain of our subsidiaries, affiliates and other entities to obtain valid FATCA documentation from payees prior to remitting certain payments to such payees and our failure to do so properly could result in penalties. **Current (2024):** In countries outside the U.S., a risk exists that our employees or third parties acting on our behalf, including correspondent brokers, consultants, introducers, partners or agents, could engage in business practices prohibited by applicable laws and regulations, including anti-bribery and anti-corruption laws, and sanctions laws such as those administered by the U.S. Department of the Treasury's Office of Foreign Assets Control. Anti-bribery and anti-corruption laws, such as the FCPA and the U.K. Bribery Act, generally prohibit companies from making improper payments to foreign officials and require companies to keep accurate books and records and maintain appropriate internal controls. Trade and financial sanctions laws generally restrict the ability to engage in trade with, or provide goods or services, to designated governments or other parties, or may require freezing of such parties' assets. We operate in some parts of the world that have experienced governmental corruption. In such parts of the world, in certain circumstances, local customs and practice might not be consistent with the requirements of anti-bribery and anti-corruption laws. Similarly, some of these countries do not implement sanctions laws and may not restrict trade with parties designated as sanctions targets under U.S., U.K. or EU laws. Our policies mandate strict compliance with such laws and we devote substantial resources to programs designed to ensure compliance, including investigating business practices and taking steps to address the risk that our employees, third party representatives, partners or agents will engage in business practices that are prohibited by our policies and/or such laws and regulations. We offer client service capabilities in many countries around the world through a network of third-party representatives acting on our behalf such as correspondent brokers and consultants. In certain limited instances, we also work with third-party introducers that provide services for certain clients. There is a risk that our third party representatives engage in business practices that are prohibited by our internal policies or violate applicable laws and regulations, such as the FCPA and the U.K. Anti-Bribery Act. As previously disclosed, during 2022, we received a subpoena from the FCPA Unit of the DOJ seeking information related to our insurance business with public entities in Ecuador. During the fourth quarter of 2023, the DOJ informed us that it has closed its inquiry and would not be pursuing enforcement action against us. Violations by us or our third party representatives could result in significant internal investigation costs and legal fees, civil and criminal penalties, including prohibitions on the conduct of our business, and reputational harm. We may also be subject to legal liability and reputational damage if we violate trade sanctions laws of the U.S., the EU and other jurisdictions in which we operate. In addition, FATCA requires certain of our subsidiaries, affiliates and other entities to obtain valid FATCA documentation from payees prior to remitting certain payments to such payees and our failure to do so properly could result in penalties. --- ## Modified: Business disruptions could have a material adverse effect on our operations, damage our reputation and impact client relationships. **Key changes:** - Reworded sentence: "This includes infrastructure controlled by third-party vendors and suppliers." - Reworded sentence: "However, such factors could potentially affect our operations 16 there in the future." **Prior (2023):** Our ability to conduct business may be adversely affected by a disruption in the infrastructure that supports our business. Such a disruption could be caused by a cybersecurity incident (for example, as disclosed in previous filings, we experienced a ransomware attack in 2020), human error, capacity constraints, hardware failure or defect, natural disasters, pandemics, fire, power loss, telecommunication failures, break-ins, sabotage, intentional acts of vandalism, acts of terrorism, civil disruption, political violence and unrest in the U.S. or elsewhere around the world, or war. Our disaster recovery procedures may not be effective and insurance may not continue to be available at reasonable prices and may not address all such losses or compensate us for the possible loss of clients or increase in claims and lawsuits directed against us. For example, we have substantial operations in India that provide important client support and other back-office services for our global organization. To date, the dispute between India and Pakistan involving the Kashmir region, rising tensions between India and China, incidents of terrorism in India, the potential for civil unrest and general geopolitical uncertainties have not adversely affected our operations in India. However, such factors could potentially affect our operations there in the future. Should our access to these services be disrupted, our client relationships could be harmed, our liability for errors and omissions could increase, and our reputation could be damaged, causing our business, operating results and financial condition to be adversely affected. **Current (2024):** Our ability to conduct business may be adversely affected by a disruption in the infrastructure that supports our business. This includes infrastructure controlled by third-party vendors and suppliers. Such disruptions could be caused by various factors, such as cybersecurity incidents (for example, as disclosed in previous filings, we experienced a ransomware attack in 2020), security breaches, human error, capacity constraints, hardware failures or defects, natural disasters, climate and weather events, pandemics, fires, power outages, telecommunication failures, break-ins, sabotage, intentional acts of vandalism, acts of terrorism, civil disruption, political violence and unrest, or war. While we have disaster recovery procedures in place, they may not be effective. Additionally, insurance may not continue to be available at reasonable prices and may not address all potential losses or compensate us for the possible loss of clients or increase in claims and lawsuits directed against us. Further, because we do not control infrastructure owned by third parties, we cannot guarantee that such parties have effective recovery procedures, or sufficient funds or insurance to recover any damages, losses or other liabilities that we may incur due to business interruptions caused by disruptions to their infrastructure. The risk of business disruption is more pronounced in certain geographic areas where a significant portion of our business is concentrated. For example, we have substantial operations in India that provide important client support and other back-office services for our global organization. To date, the dispute between India and Pakistan involving the Kashmir region, rising tensions between India and China, incidents of terrorism in India, the potential for civil unrest and general geopolitical uncertainties have not adversely affected our operations in India. However, such factors could potentially affect our operations 16 there in the future. If our access to these services is disrupted, our client relationships could be harmed, our liability for E&O could increase, and our reputation could be damaged, causing our business, operating results and financial condition to be adversely affected. --- ## Modified: Damage to our reputation could have a material adverse effect on our business. **Key changes:** - Reworded sentence: "Negative perceptions or publicity regarding these matters, including our association with clients or business partners with damaged reputations, or from actual or alleged conduct by us or our employees, including corruption or bribery allegations (for example, those in connection with the previously-disclosed investigation of our business in Ecuador) or cybersecurity incidents (for example, as disclosed in previous filings, we experienced a ransomware attack in 2020) could damage our reputation." - Reworded sentence: "As we venture into new jurisdictions and markets globally, negative reputational events (whether arising from regulatory matters or otherwise) may have a disproportionate impact in locations or markets where our employee and client presence is limited." **Prior (2023):** Our reputation is one of our key assets. We advise our clients on and provide services related to a wide range of subjects and our ability to attract and retain clients is highly dependent upon the external perceptions of our expertise, level of service, ability to protect client information, trustworthiness, business practices, financial condition and other subjective qualities such as ethics, culture and values. Our success is also dependent on maintaining a good reputation with existing and potential employees, investors, regulators and the communities in which we operate. Negative perceptions or publicity regarding the matters noted above, including our association with clients or business partners with damaged reputations, or from actual or alleged conduct by us or our employees, could damage our reputation. Our reputation could also be harmed by negative perceptions or publicity regarding ESG, including concerns with environmental matters, climate change, workforce diversity, political spending, pay equity, harassment, racial justice, cybersecurity and data privacy, as well as backlash against ESG initiatives generally. Any resulting erosion of trust and confidence could make it difficult for us to attract and retain clients, employees or investors; result in lower ESG ratings, exclusion of our stock from ESG-oriented indices, and reduced demand for our stock from ESG-focused investment funds; increase our cost of borrowing; or harm our relationships with regulators and the communities in which we operate. Any of these matters could have a material adverse effect on our business, financial condition and results of operations. See below for additional risk factors regarding climate risks and ESG initiatives and disclosures. **Current (2024):** Our reputation is one of our key assets. We advise our clients on and provide services related to a wide range of subjects and our ability to attract and retain clients is highly dependent upon the external perceptions of our expertise, level of service, ability to protect client information, trustworthiness, business practices, financial condition and other subjective qualities such as ethics, culture and values. Our success is also dependent on maintaining a good reputation with existing and potential employees, investors, regulators and the communities in which we operate. Negative perceptions or publicity regarding these matters, including our association with clients or business partners with damaged reputations, or from actual or alleged conduct by us or our employees, including corruption or bribery allegations (for example, those in connection with the previously-disclosed investigation of our business in Ecuador) or cybersecurity incidents (for example, as disclosed in previous filings, we experienced a ransomware attack in 2020) could damage our reputation. Negative publicity resulting from one of our marketing partnerships (for example, with a sports team or league) could damage our brand and/or our reputation. Our reputation could also be harmed by negative perceptions or publicity regarding sustainability or ESG matters, including concerns with environmental, climate change, workforce diversity, political spending, pay equity, harassment, racial justice, cybersecurity and data privacy matters, as well as backlash against sustainability or ESG initiatives generally. Negative publicity may be posted on social media or other Internet forums, whether or not true, and the speed and pervasiveness with which information can be disseminated through these channels, in particular social media, may magnify the risks noted above. Any resulting erosion of trust and confidence could make it difficult for us to attract and retain clients, employees or investors; result in lower ESG ratings, exclusion of our stock from ESG-oriented indices, and reduced demand for our stock from ESG-focused investment funds; increase our cost of borrowing; or harm our relationships with regulators and the communities in which we operate. Any of these matters could have a material adverse effect on our business, financial condition and results of operations. As we venture into new jurisdictions and markets globally, negative reputational events (whether arising from regulatory matters or otherwise) may have a disproportionate impact in locations or markets where our employee and client presence is limited. Any negative publicity could potentially hinder our growth prospects in such locations or markets. See below for additional risk factors regarding climate change and ESG initiatives and disclosures. --- ## Modified: Changes in our accounting estimates and assumptions could negatively affect our financial position and operating results. **Key changes:** - Reworded sentence: "We are also required to make certain judgments and estimates that affect the disclosed and recorded amounts of revenues and expenses related to revenue recognition and deferred costs - see Note 4 to our 2023 consolidated financial statements." - Reworded sentence: "We base our estimates on historical experience and various assumptions that we 26 believe to be reasonable based on specific circumstances." - Reworded sentence: "Additionally, changes in accounting standards (see Note 2 to our 2023 consolidated financial statements) could increase costs to the organization and could have an adverse impact on our future financial position and results of operations." **Prior (2023):** We prepare our financial statements in accordance with U.S. generally accepted accounting principles (which we refer to as GAAP). These accounting principles require us to make estimates and assumptions that affect the reported amounts of assets and liabilities, and the disclosure of contingent assets and liabilities at the date of our consolidated financial statements. We are also required to make certain judgments and estimates that affect the disclosed and recorded amounts of revenues and expenses related to revenue recognition and deferred costs - see Note 4 to our 2022 consolidated financial statements. We periodically evaluate our estimates and assumptions, including those relating to the valuation of goodwill and other intangible assets, investments, income taxes, revenue recognition, deferred costs, stock-based compensation, claims handling obligations, retirement plans, litigation and contingencies. We base our estimates on historical experience and various assumptions that we believe to be reasonable based on specific circumstances. Such estimates and assumptions could change in the future as more information becomes known, which could impact the amounts reported and disclosed in our consolidated financial statements. Further, in August 2022, the U.S. enacted tax legislation commonly referred to as the Inflation Reduction Act (which we refer to as the IRA) which, among other things, implements a corporate book minimum tax and an excise tax on stock buy backs beginning for years after 2022. While guidance is still being issued, our current understanding of these new rules suggests that we will not face significant impacts from these changes. As additional guidance relating to the IRA is released, our estimates related to the IRA may change. Additionally, changes in accounting standards (see Note 2 to our 2022 consolidated financial statements) could increase costs to the organization and could have an adverse impact on our future financial position and results of operations. **Current (2024):** We prepare our financial statements in accordance with U.S. generally accepted accounting principles (which we refer to as GAAP). These accounting principles require us to make estimates and assumptions that affect the reported amounts of assets and liabilities, and the disclosure of contingent assets and liabilities at the date of our consolidated financial statements. We are also required to make certain judgments and estimates that affect the disclosed and recorded amounts of revenues and expenses related to revenue recognition and deferred costs - see Note 4 to our 2023 consolidated financial statements. We periodically evaluate our estimates and assumptions, including those relating to the valuation of goodwill and other intangible assets, investments, income taxes, revenue recognition, deferred costs, stock-based compensation, claims handling obligations, retirement plans, litigation and contingencies. We base our estimates on historical experience and various assumptions that we 26 believe to be reasonable based on specific circumstances. Such estimates and assumptions could change in the future as more information becomes known, which could impact the amounts reported and disclosed in our consolidated financial statements. Further, in August 2022, the U.S. enacted tax legislation commonly referred to as the Inflation Reduction Act (which we refer to as the IRA) which, among other things, implements a corporate book minimum tax and an excise tax on stock buy backs beginning for years after 2022. While guidance is still being issued, our current understanding of these new rules suggests that we will not face significant impacts from these changes. As additional guidance relating to the IRA is released, our estimates related to the IRA may change. Additionally, changes in accounting standards (see Note 2 to our 2023 consolidated financial statements) could increase costs to the organization and could have an adverse impact on our future financial position and results of operations. Limited protection of our intellectual property could harm our business and our ability to compete effectively, and we face the risk that our services or products may infringe upon the intellectual property rights of others. We cannot guarantee that trade secret, trademark and copyright law protections, or our internal policies and procedures regarding our management of intellectual property, are adequate to deter misappropriation of our intellectual property. Existing laws of some countries in which we provide services or products may offer only limited protection of our intellectual property rights. Also, we may be unable to detect the unauthorized use of our intellectual property and take the necessary steps to enforce our rights, which may have a material adverse impact on our business, financial condition or results of operations. We cannot be sure that our services and products, or the products of others that we offer to our clients, do not infringe on the intellectual property rights of third parties, and we may have infringement claims asserted against us or our clients. These claims may harm our reputation, result in financial liability, consume financial resources to pursue or defend, and prevent us from offering some services or products. In addition, these claims, whether with or without merit, could be expensive, take significant time and divert management's focus and resources from business operations. Successful challenges against us could require us to modify or discontinue our use of technology or business processes where such use is found to infringe or violate the rights of others, or require us to purchase licenses from third parties, any of which could adversely affect our business, financial condition and operating results. --- ## Modified: We face a variety of risks in our benefit consulting operations distinct from those we face in our insurance brokerage operations. **Key changes:** - Reworded sentence: "The portion of our revenue derived from consulting engagements and special project work is more vulnerable to reduction, postponement, cancellation or non-renewal during an economic downturn than traditional insurance brokerage commissions." - Reworded sentence: "A portion of our benefit consulting operation revenue is tied to assets invested by our clients, and when investment returns are adversely affected that portion of our revenue is negatively impacted." - Reworded sentence: "We closed the acquisition of Buck in April 2023." **Prior (2023):** Our benefit consulting operations face a variety of risks distinct from those faced by our brokerage operations. The portion of our revenue derived from consulting engagements and special project work is more vulnerable to reduction, postponement, cancellation or non-renewal during an economic downturn than traditional insurance brokerage commissions, and we did experience such a reduction earlier in the pandemic. In the event of a future recession or economic downturn, we could again experience deterioration in these sources of revenue. A portion of our benefit consulting operation revenue is tied to assets invested by our clients, and when investment returns are adversely affected (as they were generally in 2022) that portion of our revenue is negatively impacted. Certain areas within our retirement consulting practice may attract a higher level of regulatory scrutiny due to regulators' historical interest in such matters, including pension-related products and investment advisory and broker-dealer services. In addition, we have made significant investments in product and knowledge development to assist clients as they navigate the complex regulatory requirements relating to employer-sponsored healthcare. New laws or regulations reducing employer-sponsored health insurance, by limiting or eliminating tax-advantaged employer-sponsored benefits or otherwise, could impact clients' demand for our services. If we are unable to adapt our services to changes in the legal and regulatory landscape around employer-sponsored benefits, our results of operations could be adversely impacted. In December 2022, we announced the acquisition of Buck, which is expected to close in the first half of 2023. Upon closing, Buck will be the largest acquisition in the history of our benefit consulting operations and will represent a material portion of such operation's revenue. As such, the integration of Buck into our existing operations will represent a more significant effort than for our typical acquisitions. Risks related to Buck include the possibility that the acquisition does not close when expected or at all because required regulatory approvals are not received or other conditions to the closing are not satisfied on a timely basis or at all; potential adverse reactions or changes to business or employee relationships; the possibility that the anticipated benefits of the acquisition, including expense synergies, are not realized when expected or at all, including as a result of the impact of, or issues arising from, the integration; the possibility that the acquisition may be more expensive to integrate than anticipated, including as a result of unexpected factors or events; diversion of management's attention from ongoing business operations and opportunities; the inability to retain certain key employees of the acquired operations or Gallagher; competitive responses to the acquisition; and risks related to defined benefits administration and enterprise-level software development and sales, new areas for our benefit consulting operations. **Current (2024):** Our benefit consulting operations face a variety of risks distinct from those faced by our brokerage operations. The portion of our revenue derived from consulting engagements and special project work is more vulnerable to reduction, postponement, cancellation or non-renewal during an economic downturn than traditional insurance brokerage commissions. For instance, we experienced a decline in such revenue during the economic downturn triggered by the COVID-19 pandemic. In the event of a future recession or economic downturn, we could again experience deterioration in these sources of revenue. A portion of our benefit consulting operation revenue is tied to assets invested by our clients, and when investment returns are adversely affected that portion of our revenue is negatively impacted. Certain areas within our retirement consulting practice may attract a higher level of regulatory scrutiny due to regulators' historical interest in such matters, including pension-related products and investment advisory and broker-dealer services. In addition, we have made significant investments in product and knowledge development to assist clients as they navigate the complex regulatory requirements relating to employer-sponsored healthcare. New laws or regulations reducing employer-sponsored health insurance, by limiting or eliminating tax-advantaged employer-sponsored benefits or otherwise, could impact clients' demand for our services. If we are unable to adapt our services to changes in the legal and regulatory landscape around employer-sponsored benefits, our results of operations could be adversely impacted. We closed the acquisition of Buck in April 2023. Buck is the largest acquisition in the history of our benefit consulting operations and represents a material portion of its revenue. As such, the integration of Buck into our existing operations requires 20 a more significant effort and involves additional risks compared to our typical acquisitions. See also "We face additional risks relating to acquisitions that are larger than our usual tuck-in acquisitions" described above. --- ## Modified: Our ESG-related aspirations, goals and initiatives, and our statements and disclosures regarding ESG-related matters, expose us to numerous risks. **Key changes:** - Reworded sentence: "The increased focus on ESG issues has made compliance with regulations, frameworks and stakeholder expectations increasingly complex." - Added sentence: "See also "We are subject 14 to regulation worldwide." - Added sentence: "If we fail to comply with regulatory requirements or if regulations change in a way that adversely affects our operations, we may not be able to conduct our business, or we may be less profitable."" **Prior (2023):** Our business may face increased scrutiny from the investment community, clients, employees, other stakeholders, potential acquisition targets, regulators and the media related to our ESG activities, including our goal to reach Net Zero carbon emissions in our direct operations (Scope 1 and Scope 2) by 2050, other goals, targets and objectives we may announce in the future, and our methodologies and timelines for pursuing them. If our ESG practices do not meet investor or other stakeholder expectations and standards, which continue to evolve, our reputation, our ability to attract or retain employees and our attractiveness as an investment, 14 business partner or as an acquiror could be negatively impacted. Similarly, our failure or perceived failure to pursue or fulfill our goals, targets and objectives, to comply with ethical, environmental or other standards, regulations or expectations or to satisfy various reporting standards with respect to these matters, could have the same negative impacts, as well as expose us to government enforcement actions and private litigation. **Current (2024):** The increased focus on ESG issues has made compliance with regulations, frameworks and stakeholder expectations increasingly complex. Our business faces increased scrutiny from the investment community, clients, employees, potential acquisition targets, regulators and other stakeholders related to our ESG activities. This includes scrutiny regarding our goal to reach Net Zero carbon emissions in our direct operations (Scope 1 and Scope 2) by 2050 and our interim goal of 50% reduction in our Scope 1 and Scope 2 carbon emissions, on a per employee basis, by 2030. We anticipate the same level of scrutiny with respect to any other goals, targets and objectives we may announce in the future, and our methodologies and timelines for pursuing them. Heightened scrutiny has increased the risk that we could be perceived as, or accused of, making inaccurate or misleading statements, commonly referred to as "greenwashing." If our ESG practices and disclosures do not comply with regulations or align with stakeholder expectations and standards, which are continuously evolving, our reputation, our ability to attract or retain employees and our attractiveness as an investment, business partner or as an acquirer could be negatively impacted. Similarly, our failure or perceived failure to pursue or fulfill our goals, targets and objectives, to comply with ethical, environmental or other standards, regulations or expectations or to satisfy various reporting standards with respect to these matters, could have the same negative impacts, as well as expose us to government enforcement actions and private litigation. See also "We are subject 14 to regulation worldwide. If we fail to comply with regulatory requirements or if regulations change in a way that adversely affects our operations, we may not be able to conduct our business, or we may be less profitable." --- ## Modified: Global economic conditions and geopolitical events may cause unstable economic conditions in the countries, regions or industries in which we operate and adversely affect our results of operations and financial condition. **Key changes:** - Reworded sentence: "Global economic events, including accommodative monetary and fiscal policies, have contributed to significant inflation in many markets in which we operate." - Reworded sentence: "Further, a tightening of credit or capital markets could negatively impact our business, financial condition and liquidity, including our ability to continue to access preferred sources of liquidity when needed and under similar terms, which may increase our capital costs." **Prior (2023):** Global economic events and other factors, such as accommodative monetary and fiscal policy and the impacts of the COVID-19 pandemic, have contributed to significant inflation in many of the markets in which we operate. In order to combat inflation and restore price stability, the U.S. Federal Reserve has raised interest rates and has signaled further increases to interest rates in 2023. Increased inflation and interest rates may hinder economic growth in the U.S. and could have far reaching effects on the global economy. Furthermore, as central banks worldwide simultaneously raise interest rates to combat inflation, economic growth may also deteriorate in Europe, China and other geographies. A recession or decline in economic activity for these and any other reasons (including repercussions from the war in Ukraine, climate change, the transition to a low-carbon economy, or uncertainty caused by a political crisis over the debt ceiling in the U.S. or political 12 violence and chaos around the world), could adversely impact us in future periods as a result of reductions in the amount of insurance coverage, reinsurance coverage, consulting services or claims administration services that our clients purchase due to reductions in headcount, payroll, properties, and the market values of assets, among other factors. Any such reduction or decline (whether caused by an overall economic decline or declines in certain industries or in certain countries and regions in which we operate) could adversely impact our commission and fee revenues, consulting revenues or revenues from managing third-party insurance claims. Some of our clients may experience liquidity problems or other financial difficulties in the event of a prolonged deterioration in the economy, which could have an adverse effect on our results of operations and financial condition. If our clients become financially less stable, enter bankruptcy, liquidate their operations or consolidate, our revenues and collectability of receivables could be adversely affected. Moreover, U.S. and global economic conditions have created market uncertainty and volatility. Such general economic conditions, such as inflation, stagflation, political volatility, rising cost of labor, cost of capital, interest rates and tax rates, affect our operating and general and administrative expenses, and we have no control or limited ability to control such factors. If our costs grow significantly, our margins and results of operations may be materially and adversely impacted and we may not be able to achieve our strategic and financial objectives. Further, a slowdown in the global economy, including a recession, or in a particular region or industry, inflation or a tightening of the credit markets could negatively impact our business, financial condition and liquidity, including our ability to continue to access preferred sources of liquidity when needed and under similar terms, which may increase our borrowing costs. In addition, we could experience losses on our holdings of cash and investments due to failures of financial institutions and other counterparties. Thus, a deterioration of macroeconomic conditions in the U.S. and globally could adversely affect our business, results of operations or financial condition. **Current (2024):** Global economic events, including accommodative monetary and fiscal policies, have contributed to significant inflation in many markets in which we operate. To combat inflation and restore price stability, the U.S. Federal Reserve and other central banks raised interest rates in 2023. While moderate inflation generally benefits our industry by increasing insurable asset values, increased inflation and higher interest rates have had far-reaching negative effects on the global economy during the past several years. Geopolitical conflicts such as the wars in Ukraine and the Middle East, geo-economic fragmentation, climate change, the transition to a low-carbon economy, political crises like potential U.S. governmental shutdowns or gridlock over increasing the U.S. debt ceiling, and political violence and instability worldwide could also weigh negatively on the economy. A recession or decline in economic activity, for these and any other reasons, could adversely impact us in future periods. This could happen, for example, if our clients reduce the amount of insurance coverage, reinsurance coverage, consulting services or 12 claims administration services they purchase due to reductions in headcount, payroll, or replacement and asset values, among other factors. Whether these reductions are caused by an overall economic downturn or declines in certain countries, regions and industries in which we operate, our commission and fee revenues, consulting revenues, or revenues from managing third-party insurance claims could be adversely impacted. Some of our clients may also experience liquidity problems or other financial difficulties due to tightening credit markets or lower levels of economic activity. If our clients file for bankruptcy, liquidate their operations, consolidate or are generally unable to meet their obligations, our revenues, ability to collect receivables and liquidity could be adversely impacted, which could have an adverse effect on our results of operations and financial condition. Uncertain economic conditions have created volatility in the U.S. and other markets where we operate. A rise in the cost of labor, cost of capital, or interest and tax rates, among other things, could negatively impact our operating and general and administrative expenses. We have no or limited control over such developments. If our costs grow significantly, our margins and results of operations may be materially and adversely impacted and we may not be able to achieve our strategic and financial objectives. Further, a tightening of credit or capital markets could negatively impact our business, financial condition and liquidity, including our ability to continue to access preferred sources of liquidity when needed and under similar terms, which may increase our capital costs. We could also experience losses on holdings of cash and investments due to failures of financial institutions and other counterparties. Thus, a deterioration in macroeconomic conditions could adversely affect our business, results of operations or financial condition. Lower interest rates in the future could reduce investment earnings on our cash, revenue from our premium financing operations and short-term investments of fiduciary and operating funds. In addition, lower levels of inflation in the future may reduce our revenue growth by slowing the increase in insurable asset values. --- *Data sourced from SEC EDGAR. Last updated 2026-05-10.*