American Express Company: 10-K Risk Factor Changes

We consider operational risk to be the risk of loss due to, among other things, inadequate or failed processes, people or information systems, or impacts from the external environment (e.g., natural disasters). Operational risk includes, among others, the risk that error or misconduct could result in a material financial misstatement, a failure to monitor a third party’s compliance with regulatory or legal requirements, a failure to adequately monitor and control access to, or use of, data in our systems we grant to third parties or a failure to satisfy our obligations to our customers with respect to our products and services. As processes or organizations are changed or become more complex, we grow in size, new products and services are introduced, such as new lending features, debit products, checking accounts and digital collectibles, or we become subject to more stringent or complicated regulatory requirements, we may not identify or address new operational risks. Through human error, fraud or malfeasance, conduct risk can result in harm to customers, legal liability, fines, sanctions, customer remediation and brand damage. Compliance risk arises from violations of, or failure to conform or comply with, laws, rules, regulations, internal policies and procedures and ethical standards. We need to continually update and enhance our control environment to address operational and compliance risks. Operational and compliance failures, deficiencies in our control environment or an inability to maintain high standards of business conduct can expose us to reputational and legal risks as well as fines, civil money penalties or payment of damages and can lead to diminished business opportunities and diminished ability to expand key operations. 28 28 28 Table of Contents Table of Contents

We consider operational risk to be the risk of loss due to, among other things, inadequate or failed processes, people or information systems, or impacts from the external environment (e.g., natural disasters). Operational risk includes, among others, the risk that error or misconduct could result in a material financial misstatement, a failure to monitor a third party’s compliance with regulatory or legal requirements, or a failure to adequately monitor and control access to, or use of, data in our systems we grant to third parties. As processes or organizations are changed, or new products and services are introduced, such as new lending features, debit products and checking accounts, we may not fully appreciate or identify new operational risks that may arise from such changes. Through human error, fraud or malfeasance, conduct risk can result in harm to customers, legal liability, fines, sanctions, customer remediation and brand damage. Compliance risk arises from violations of, or failure to conform or comply with, laws, rules, regulations, internal policies and procedures, and ethical standards. We need to continually update and enhance our control environment to address operational and compliance risks. Operational and compliance failures, deficiencies in our control environment or an inability to maintain an ethical workplace and high standards of business conduct can expose us to reputational and legal risks as well as fines, civil money penalties or payment of damages and can lead to diminished business opportunities and diminished ability to expand key operations.

We have acquired a number of businesses and have made a number of strategic investments, and continue to evaluate potential transactions. There is no assurance that we will be able to successfully identify suitable candidates, value potential investment or acquisition opportunities accurately, negotiate acceptable terms for those opportunities, or complete proposed acquisitions and investments. The process of integrating an acquired company, business or technology could create unforeseen operating difficulties and expenditures, including in integrating systems and personnel or further developing the acquired business or technology, result in unanticipated liabilities, including legal claims, violations of laws, commercial disputes and information security vulnerabilities or breaches (including from not integrating the acquired company, business or technology quickly or appropriately, from activities that occurred prior to the acquisition, from inadequate systems or controls of the acquired company, and from exposure to third party relationships of the acquired company or business or new laws and regulations), and harm our business generally. It may take us longer than expected to fully realize the anticipated benefits of these transactions, and those benefits may ultimately be smaller than anticipated or may not be realized at all, which could materially adversely affect our business and operating results, including as a result of write-downs of goodwill and other intangible assets. Joint ventures, including our joint ventures in China and Switzerland, and minority investments in companies such as GBTG inherently involve a lesser degree of control over business operations, thereby potentially increasing the financial, legal, operational and/or compliance risks associated with the joint venture or minority investment, including as a result of being subject to different laws or regulations. Joint ventures and other partnerships or minority investments operating in foreign jurisdictions may also face risks from adverse regulatory actions, which could adversely affect their operations or our investment. In addition, we may be dependent on joint venture partners, controlling shareholders or management who may have business interests, strategies or goals that are inconsistent with ours and we have been and may in the future be involved in litigation with our joint venture partners and other shareholders and parties related to the joint ventures and investments. We have extensive commercial arrangements with GBTG, including, among other things, a long-term trademark license agreement pursuant to which GBTG uses the American Express brand, GBTG’s support of our partnerships, GBTG negotiations with travel suppliers on our behalf and a strategic relationship between GBTG and our Commercial Services business. Business decisions or other actions or omissions of a joint venture partner, other shareholders or management of our joint ventures and companies in which we have minority investments may adversely affect the value of our investment, result in litigation or regulatory action against us and otherwise damage our reputation and brand. In addition, trade secrets and other proprietary information we may provide to a joint venture may become available to third parties beyond our control. The ability to enforce intellectual property and contractual rights to prevent disclosure of our trade secrets and other proprietary information may be limited in certain jurisdictions. Additionally, from time to time we may decide to divest certain businesses or assets. These divestitures may involve significant uncertainty and execution complexity, which may cause us not to achieve our strategic objectives, realize expected cost savings or obtain other benefits from the divestiture and may result in unexpected losses of colleagues or harm to our brand, customers or other partners. Further, during the pendency of a divestiture, we may be subject to risks such as that the transaction may not close or the business to be divested may decline, and if a divestiture is not completed, we may not be able to find another acquiror on similar terms.

We have acquired a number of businesses and have made a number of strategic investments, and continue to evaluate potential transactions. There is no assurance that we will be able to successfully identify suitable candidates, value potential investment or acquisition opportunities accurately, negotiate acceptable terms for those opportunities, or complete proposed acquisitions and investments. The process of integrating an acquired company, business or technology could create unforeseen operating difficulties and expenditures, including in integrating systems and personnel or further developing the acquired business or technology, result in unanticipated liabilities, including legal claims, violations of laws, commercial disputes and information security vulnerabilities or breaches (including from not integrating the acquired company, business or technology quickly or appropriately, from activities that occurred prior to the acquisition, and from exposure to third party relationships of the acquired company or business or new laws and regulations), and harm our business generally. It may take us longer than expected to fully realize the anticipated benefits of these transactions, and those benefits may ultimately be smaller than anticipated or may not be realized at all, which could materially adversely affect our business and operating results, including as a result of write-downs of goodwill and other intangible assets. Joint ventures, including our joint venture in China, and minority investments in companies such as GBTG inherently involve a lesser degree of control over business operations, thereby potentially increasing the financial, legal, operational and/or compliance risks associated with the joint venture or minority investment, including as a result of being subject to different laws or regulations. Joint ventures and other partnerships or minority investments operating in foreign jurisdictions may also face risks from adverse regulatory actions, which could adversely affect their operations or our investment. In addition, we may be dependent on joint venture partners, controlling shareholders or management who may have business interests, strategies or goals that are inconsistent with ours and we have been and may in the future be involved in litigation with our joint venture partners and other shareholders and parties related to the joint ventures and investments. During the second quarter of 2022, GBTG became a publicly traded company following the completion of a business combination between American Express Global Business Travel and Apollo Strategic Growth Capital. We have extensive commercial arrangements with GBTG, including, among other things, a long-term trademark license agreement pursuant to which GBTG uses the American Express 29 29 29 Table of Contents Table of Contents brand, GBTG's support of our partnerships, GBTG negotiations with travel suppliers on our behalf and a strategic relationship between GBTG and our Commercial Services business. Business decisions or other actions or omissions of a joint venture partner, other shareholders or management of our joint ventures and companies in which we have minority investments may adversely affect the value of our investment, result in litigation or regulatory action against us and otherwise damage our reputation and brand. In addition, trade secrets and other proprietary information we may provide to a joint venture may become available to third parties beyond our control. The ability to enforce intellectual property and contractual rights to prevent disclosure of our trade secrets and other proprietary information may be limited in certain jurisdictions. We may also face risks with other types of strategic transactions, such as the sale to InComm of the operations relating to our prepaid reloadable and gift card business. The reloadable operations have experienced disruptions in the past, impacting the ability of our prepaid customers to load and use their cards. If such operations are interrupted, suspended or terminated in the future, it could further negatively impact our customers’ experience, result in additional costs, litigation and regulatory action, and harm our business and reputation.

Geopolitical conditions, terrorist attacks, military conflicts, natural disasters, severe weather, widespread health emergencies or pandemics, information or cybersecurity incidents (including intrusion into or degradation or unavailability of systems or technology by cyberattacks), operational incidents and other catastrophic events can have a material adverse effect on our business. Political and social conditions, including actions upending geopolitical stability (such as from tensions involving China and the U.S.), fiscal and monetary policies (including developments related to the U.S. federal debt ceiling, budgetary issues and government shutdowns), trade wars and tariffs, labor shortages, regional or domestic hostilities, economic sanctions and the prospect or occurrence of more widespread conflicts could also negatively affect our business, operations and partners, consumer and business spending, including travel patterns and business investment, and demand for credit. Because we derive a portion of our revenues from travel-related spending, our business is sensitive to safety concerns related to travel and tourism, limitations on travel and mobility and health-related risks. In addition, disruptions in air travel and other forms of travel can result in the payment of claims under travel protection products we offer. The COVID-19 pandemic had widespread, rapidly evolving and unpredictable impacts on global society, economies, financial markets and consumer and business behaviors. The pandemic and resulting containment measures adversely impacted a significant portion of our network volumes. The global macroeconomic outlook continues to remain uncertain due to a variety of factors, including the emergence of new variants, impacts to the labor market, supply chain disruptions and inflation. The extent to which our business and results of operations may continue to be adversely affected by this macroeconomic uncertainty will depend on numerous evolving factors and future developments, including the continued spread and severity of the virus and new variants; the availability, distribution, use and effectiveness of treatments and vaccines; the extent and duration of lingering effects on the economy, inflation, consumer confidence and consumer and business spending; and the impact on consumers and businesses as forbearance and government support programs end, including the end of the moratorium on student loan repayments. Several military conflicts are taking place across the world (such as the ongoing Russia-Ukraine and Israel-Hamas wars), which may adversely affect our business, and geopolitical tensions may result in additional conflicts or escalate existing conflicts. Following the Russian invasion of Ukraine, we announced that we suspended business operations in Russia and Belarus and this 22 22 22 Table of Contents Table of Contents conflict has led to economic uncertainty and market disruptions, including the imposition of financial and economic sanctions and export controls designed to constrain Russia. The conflict in Israel and surrounding areas has also created economic uncertainty and regional instability, including due to the risk of escalation into a wider regional conflict, and resulted in the imposition of sanctions targeting Hamas-affiliated individuals and entities. The broader consequences of these conflicts remain uncertain, but may include further sanctions, regional instability and geopolitical shifts, increased prevalence and sophistication of cyberattacks, potential retaliatory action against companies such as us, heightened regulatory scrutiny related to sanctions compliance, increased inflation, further increases or fluctuations in commodity and energy prices, decreases in global travel, further disruptions to the global supply chain and other adverse effects on macroeconomic conditions. Hurricanes and other natural disasters have impacted spending and credit performance in the areas affected. Other disasters or catastrophic events in the future, and the impact of such events on certain industries or the overall economy, could have a negative effect on our business, results of operations and infrastructure, including our technology and systems. Climate change may exacerbate certain of these threats, including the frequency and severity of weather-related events. Card Members in California, Florida, New York, Texas, Georgia and New Jersey account for a significant portion of U.S. consumer and small business billed business and Card Member loans, and our results of operations could be impacted by events or conditions that disproportionately or specifically affect one or more of those states.

Geopolitical conditions, terrorist attacks, natural disasters, severe weather, widespread health emergencies or pandemics, information or cyber security incidents (including intrusion into or degradation or unavailability of systems or technology by cyberattacks), operational incidents, and other catastrophic events can have a material adverse effect on our business. Political and social conditions, including actions aimed at upending geopolitical stability, fiscal and monetary policies (including developments related to the U.S. federal debt ceiling), trade wars and tariffs, labor shortages, prolonged or recurring government shutdowns, regional or domestic hostilities, economic sanctions and the prospect or occurrence of more widespread conflicts could also negatively affect our business, operations and partners, consumer and business spending, including travel patterns and business investment, and demand for credit. Because we derive a portion of our revenues from travel-related spending, our business is sensitive to safety concerns related to travel and tourism, limitations on travel and mobility and health-related risks. In addition, disruptions in air travel and other forms of travel can result in the payment of claims under travel protection products we offer. The COVID-19 pandemic had, and continues to have, widespread, rapidly evolving and unpredictable impacts on global society, economies, financial markets and consumer and business spending. The pandemic and resulting containment measures adversely impacted a significant portion of our network volumes. The global macroeconomic outlook continues to remain uncertain due to a variety of factors, including the emergence of new variants, impacts to the labor market, supply chain disruptions and inflation, and the impacts of the pandemic may continue even as the pandemic subsides. The extent to which our business and results of operations could continue to be adversely affected by the lingering impacts of the pandemic will depend on numerous evolving factors and future developments, including the continued spread and severity of the virus and new variants; the imposition or concern relating to the possible imposition of further containment measures; the availability, distribution, use and effectiveness of treatments and vaccines; the extent and duration of the effect on the economy, inflation, consumer confidence and consumer and business spending; the impact on consumers and businesses as forbearance and government support programs end; the continued stress on businesses due to operational changes and staffing issues; and the extent of the continued resumption of normal operating conditions and customer behaviors. 22 22 22 Table of Contents Table of Contents Following the Russian invasion of Ukraine, we announced that we suspended all business operations in Russia and Belarus and this conflict has led to economic uncertainty and market disruptions, including heightened energy prices, and the imposition of financial and economic sanctions and export controls designed to constrain Russia. The broader consequences of this conflict remain uncertain, but may include further sanctions, regional instability and geopolitical shifts, increased prevalence and sophistication of cyberattacks, potential retaliatory action by customers or the Russian government against companies such as us, heightened regulatory scrutiny related to sanctions compliance, increased inflation, further increases or fluctuations in commodity and energy prices, decreases in global travel, further disruptions to the global supply chain and the availability of certain natural resources and other adverse effects on macroeconomic conditions. Hurricanes and other natural disasters have impacted spending and credit performance in the areas affected. Other disasters or catastrophic events in the future, and the impact of such events on certain industries or the overall economy, could have a negative effect on our business, results of operations and infrastructure, including our technology and systems. Climate change may exacerbate certain of these threats, including the frequency and severity of weather-related events. Card Members in California, New York, Florida, Texas, Georgia and New Jersey account for a significant portion of U.S. consumer and small business billed business and Card Member loans, and our results of operations could be impacted by events or conditions that disproportionately or specifically affect one or more of those states.

We are subject to income and other taxes in the United States and in various foreign jurisdictions. The laws and regulations related to tax matters are extremely complex and subject to varying interpretations. Although management believes our positions are reasonable, we are subject to audit by the Internal Revenue Service in the United States and by tax authorities in all the jurisdictions in which we conduct business operations. We are being challenged in a number of countries regarding our application of value-added taxes (VAT) to certain transactions. While we believe we comply with all applicable VAT and other tax laws, rules and regulations in the relevant jurisdictions, the tax authorities may determine that we owe additional taxes or apply existing laws and regulations more broadly, which could result in a significant increase in liabilities for taxes and interest in excess of accrued liabilities. Legislative action or inaction in the countries in which we have operations could increase our effective tax rate. For example, new guidelines issued by the Organization for Economic Cooperation and Development (OECD) will impact how multinational enterprises (MNEs) are taxed on their global profits. In particular, the OECD’s guidelines on a global minimum tax of 15 percent will impact the effective tax rate for many MNEs. Several countries are beginning to implement these minimum tax guidelines, with effectiveness commencing in 2024, and if all OECD member countries were to implement these minimum tax guidelines in their current form, we expect that it would result in a significant increase to our effective tax rate. In addition to legislative changes, actions by tax authorities, including an increase in tax audit activity, could have an adverse impact on our tax liabilities. Jurisdictions may also make changes related to the tax treatment of card transactions, such as imposing taxes on Card Member rewards, which could decrease the value we provide to customers and adversely impact our business.

We are subject to income and other taxes in the United States and in various foreign jurisdictions. The laws and regulations related to tax matters are extremely complex and subject to varying interpretations. Although management believes our positions are reasonable, we are subject to audit by the Internal Revenue Service in the United States and by tax authorities in all the jurisdictions in which we conduct business operations. We are being challenged in a number of countries regarding our application of value-added taxes (VAT) to certain transactions. While we believe we comply with all applicable VAT and other tax laws, rules and regulations in the relevant jurisdictions, the tax authorities may determine that we owe additional taxes or apply existing laws and regulations more broadly, which could result in a significant increase in liabilities for taxes and interest in excess of accrued liabilities. New tax legislation could be enacted in the countries in which we have operations. For example, new guidelines issued by the Organization for Economic Cooperation and Development (OECD) would impact how multinational enterprises (MNEs) are taxed on their global profits. In particular, the OECD’s guidelines on a global minimum tax of 15 percent could impact the effective tax rate for many MNEs. A number of countries, including the Member States in the EU, have adopted, or plan to adopt, these minimum tax guidelines starting in 2024, which we expect would impact our effective tax rate when the rules become effective. In addition to legislative changes, actions by tax authorities, including an increase in tax audit activity, could have an adverse impact on our tax liabilities.

Failure to meet current or future capital or liquidity requirements could compromise our competitive position and could result in restrictions imposed by the Federal Reserve, or the OCC with respect to AENB, including limiting our ability to pay dividends, repurchase our capital stock, invest in our business, expand our business or engage in acquisitions. Some elements of the capital and liquidity regimes are not yet final and certain developments could significantly impact the requirements applicable to financial institutions. For example, if the capital rule proposal by the U.S. federal bank regulatory agencies is adopted as proposed, it would result in significantly higher regulatory capital requirements for us, as discussed in “Supervision and Regulation — Capital and Liquidity Regulation” under “Business”. The U.S. federal bank regulatory agencies have also issued a proposed rule that would require us and AENB to issue and/or maintain minimum amounts of eligible long-term debt with specific terms. In addition, it may be necessary for us to hold additional capital because of an increase in the SCB requirement based on results from a supervisory stress test. Compliance with capital adequacy and liquidity rules requires a material investment of resources. An inability to meet regulatory expectations regarding our compliance with applicable capital adequacy and liquidity rules may also negatively impact the assessment of us and AENB by federal banking regulators. Additionally, changes in our regulatory tailoring category, such as becoming a Category III or Category II firm, would subject us to more stringent capital and liquidity requirements. For more information on capital adequacy requirements, see “Supervision and Regulation — Capital and Liquidity Regulation” under “Business.”

Failure to meet current or future capital or liquidity requirements could compromise our competitive position and could result in restrictions imposed by the Federal Reserve, or the OCC with respect to AENB, including limiting our ability to pay dividends, repurchase our capital stock, invest in our business, expand our business or engage in acquisitions. Some elements of the capital and liquidity regimes are not yet final and certain developments could significantly impact the requirements applicable to financial institutions. For example, if the 2017 Basel Committee revisions to the standardized approach for credit risk and operational risk capital requirements are adopted in the United States and applicable to us, we are likely to be required to hold significantly more capital. In addition, it may be necessary for us to hold additional capital because of an increase in the SCB requirement based on results from a supervisory stress test. Compliance with capital adequacy and liquidity rules requires a material investment of resources. An inability to meet regulatory expectations regarding our compliance with applicable capital adequacy and liquidity rules may also negatively impact the assessment of us and our U.S. bank subsidiary by federal banking regulators. For more information on capital adequacy requirements, see “Capital and Liquidity Regulation” under “Supervision and Regulation.”

We are subject to evolving and comprehensive government regulation and supervision in jurisdictions around the world, which significantly affects our business and requires continual enhancement of our compliance efforts. Supervision efforts and the enforcement of existing laws and regulations impact the scope and profitability of our existing business activities, limit our ability to pursue certain business opportunities and adopt new technologies, compromise our competitive position, and affect our relationships with Card Members, partners, merchants, service providers and other third parties. New laws or regulations could similarly affect our business, increase the costs and complexity of doing business, impact what we are able to charge for, or offer in connection with, our products and services, impose conflicting obligations, and require us to change certain of our business practices and invest significant management attention and resources, all of which could adversely affect our results of operations and financial condition. Legislators and regulators around the world are aware of each other’s approaches to the regulation of the financial services industry. Consequently, a development in one country, state or region may influence regulatory approaches in another. If we fail to satisfy regulatory requirements or maintain our financial holding company status, our financial condition and results of operations could be adversely affected, and we may be restricted in our ability to take certain capital actions (such as declaring dividends or repurchasing outstanding shares) or engage in certain business activities or acquisitions, which could compromise our competitive position. Additionally, our banking regulators have wide discretion in the examination and the enforcement of applicable banking statutes and regulations and may restrict our ability to engage in certain business activities or acquisitions or require us to maintain more capital. In response to recent bank failures and stress in the banking sector, legislators and regulators have increased their scrutiny of financial institutions and are proposing new measures and regulations, including those related to capital levels, liquidity standards, deposit concentrations and risk management practices, as well as increased deposit assessments. As we continue to grow, we expect to become subject to heightened regulatory expectations and more stringent regulatory requirements, such as becoming a Category III or Category II firm for purposes of the U.S. federal bank regulatory agencies’ enhanced prudential standards, which may increase our compliance costs and adversely affect our business. Legislators and regulators continue to focus on the operation of card networks, including interchange fees paid to card issuers in payment networks such as Visa and Mastercard, network routing practices and the fees merchants are charged to accept cards. Even where we are not directly regulated, regulation of bankcard fees significantly negatively impacts the discount revenue derived from our business, including as a result of downward pressure on our discount rate from decreases in competitor pricing in connection with caps on interchange fees. In some cases, regulations also extend, or may extend, to certain aspects of our business, such as network and cobrand arrangements, new products or services we may offer, or the terms of card acceptance for merchants, including terms relating to non-discrimination and honor-all-cards. For example, we have exited our network licensing businesses in the EU and Australia as a result of regulation in those jurisdictions. In addition, there is uncertainty as to when or how interchange fee caps and other provisions of payments legislation might apply when we work with cobrand partners and agents in the EU. In a ruling issued on February 7, 2018, the EU Court of Justice confirmed the validity of fee capping and other provisions in circumstances where three-party networks issue cards with a cobrand partner or through an agent, although the ruling provided only limited guidance as to when or how the provisions might apply in such circumstances and remains subject to differing interpretations by regulators and participants in cobrand arrangements. On August 29, 2023, the Dutch Trade and Industry Appeals Tribunal referred questions to the EU Court of Justice on the interpretation of the application of the interchange fee caps in connection with an administrative proceeding by the Netherlands Authority for Consumers and Markets regarding our cobrand relationship with KLM Royal Dutch Airlines. Given differing interpretations by regulators and participants in cobrand arrangements, we are subject to regulatory action, penalties and the possibility we will not be able to maintain our existing cobrand and agent relationships in the EU. Legislators and regulators have also increased their focus on limiting fees associated with card and banking products, such as the recent proposed rule by the CFPB related to credit card fees for late payments, which could negatively impact our fee revenue. 30 30 30 Table of Contents Table of Contents Legislators and regulators also continue to focus on consumer protection, including product design and pricing constructs, account management and security, credit bureau reporting, disclosure rules, marketing and debt collection practices. Any new requirements or increased enforcement of existing requirements may result in increased scrutiny of our pricing, underwriting and account management practices, the imposition of fines and customer remediation, higher compliance costs, restrictions on our ability to issue cards, appropriately price for the value of our products or partner with other financial institutions and otherwise result in changes to our business practices, which could materially and adversely impact our revenue growth and profitability. We are subject to significant supervision and regulation with respect to compliance with AML/CFT laws and sanctions regimes in numerous jurisdictions. As regulators increase their focus in these areas, new technologies such as digital currencies develop, near real-time money movement solutions are adopted, we introduce new products like checking accounts and geopolitical tensions increase, we face increased costs related to oversight, supervision and potential fines. Our AML/CFT programs have become the subject of heightened scrutiny in some countries, including certain Member States in the EU. Any errors, failures or delays in complying with AML/CFT and sanctions laws, perceived deficiencies in our related compliance programs or association of our business with money laundering, terrorist financing, tax fraud or other illicit activities or sanctioned persons, entities, governments or countries can give rise to significant supervisory, criminal and civil proceedings and lawsuits, which could result in significant penalties and forfeiture of assets, loss of licenses or restrictions on business activities, or other enforcement actions, and our reputation may suffer due to our customers’ association with certain countries, persons or entities or the existence of any such transactions. See “Supervision and Regulation” under “Business” for more information about certain laws and regulations to which we are subject and their impact on us.

We are subject to comprehensive government regulation and supervision in jurisdictions around the world, which significantly affects our business and requires continual enhancement of our compliance efforts. Supervision efforts and the enforcement of existing laws and regulations impact the scope and profitability of our existing business activities, limit our ability to pursue certain business opportunities and adopt new technologies, compromise our competitive position, and affect our relationships 30 30 30 Table of Contents Table of Contents with Card Members, partners, merchants, service providers and other third parties. New laws or regulations could similarly affect our business, increase our costs of doing business, impact what we are able to charge for, or offer in connection with, our products and services, impose conflicting obligations, and require us to change certain of our business practices and invest significant management attention and resources, all of which could adversely affect our results of operations and financial condition. Legislators and regulators around the world are aware of each other’s approaches to the regulation of the financial services industry. Consequently, a development in one country, state or region may influence regulatory approaches in another. In preparation for the completion of Brexit, numerous EU laws and regulations were separately adopted into UK domestic legislation in order to ensure continuity. However, the UK plans to evaluate the extent to which these EU-legacy laws and regulations should change going forward and has already indicated some areas where it may take a different approach from the EU. To the extent that different regulatory systems impose overlapping or inconsistent requirements on the conduct of our business, we face complexity and additional costs in our compliance efforts, as well as potential regulatory enforcement actions and penalties. If we fail to satisfy regulatory requirements or maintain our financial holding company status, our financial condition and results of operations could be adversely affected, and we may be restricted in our ability to take certain capital actions (such as declaring dividends or repurchasing outstanding shares) or engage in certain business activities or acquisitions, which could compromise our competitive position. Additionally, our banking regulators have wide discretion in the examination and the enforcement of applicable banking statutes and regulations and may restrict our ability to engage in certain business activities or acquisitions or require us to maintain more capital. Legislators and regulators continue to focus on the operation of card networks, including interchange fees paid to card issuers in payment networks such as Visa and Mastercard, network routing practices and the fees merchants are charged to accept cards. Even where we are not directly regulated, regulation of bankcard fees significantly negatively impacts the discount revenue derived from our business, including as a result of downward pressure on our discount rate from decreases in competitor pricing in connection with caps on interchange fees. In some cases, regulations also extend, or may extend, to certain aspects of our business, such as network and cobrand arrangements, new products or services we may offer, or the terms of card acceptance for merchants, including terms relating to non-discrimination and honor-all-cards. For example, we have exited our network businesses in the EU and Australia as a result of regulation in those jurisdictions. In addition, there is uncertainty as to when or how interchange fee caps and other provisions of payments legislation might apply when we work with cobrand partners and agents in the EU. In a ruling issued on February 7, 2018, the EU Court of Justice confirmed the validity of the application of the fee caps and other provisions in circumstances where three-party networks issue cards with a cobrand partner or through an agent, although the ruling provided only limited guidance as to when or how the provisions might apply in such circumstances and remains subject to differing interpretations by regulators and participants in cobrand arrangements. As a result, we are subject to regulatory action, penalties and the possibility we will not be able to maintain our existing cobrand and agent relationships in the EU. We are subject to certain provisions of the Bank Secrecy Act, as amended by the Patriot Act and the AMLA, with regard to maintaining effective AML/CFT programs. Similar AML/CFT requirements apply under the laws of most jurisdictions where we operate. As regulators increase their focus in this area, new technologies such as digital currencies develop and we introduce new products like checking accounts, we face increased costs related to oversight, supervision and potential fines. Our AML/CFT programs have become the subject of heightened scrutiny in some countries, including certain Member States in the EU. Any errors, failures or delays in complying with AML/CFT laws, perceived deficiencies in our AML/CFT programs or association of our business with money laundering, terrorist financing, tax fraud or other illicit activities can give rise to significant supervisory, criminal and civil proceedings and lawsuits, which could result in significant penalties and forfeiture of assets, loss of licenses or restrictions on business activities, or other enforcement actions, and our reputation may suffer due to our customers’ association with certain countries, persons or entities or the existence of any such transactions. Various regulatory agencies and legislatures are also considering regulations and legislation covering identity theft, account management guidelines, credit bureau reporting, disclosure rules, security and marketing that would impact us directly, in part due to increased scrutiny of our underwriting and account management standards. Any new requirements may restrict our ability to issue cards or partner with other financial institutions, which could adversely affect our revenue growth. See “Supervision and Regulation” for more information about certain laws and regulations to which we are subject and their impact on us.

At any given time, we are involved in a number of legal proceedings, including class action lawsuits, mass arbitrations and similar actions. Many of these actions include claims for substantial compensatory or punitive damages and require us to incur significant costs for legal representation, arbitration fees or other legal or related services. While we have historically relied on our arbitration clause in agreements with customers to limit our exposure to class action litigation, there can be no assurance that we will continue to be successful in enforcing our arbitration clause in the future, including as a result of possible regulation that would require that our consumer arbitration clause not apply to cases filed in court as class actions, and claims of the type we previously arbitrated could be subject to the complexities, risks and costs associated with class action cases. The continued focus of merchants on issues relating to the acceptance of various forms of payment may lead to additional litigation and other legal actions. Given the inherent uncertainties involved in litigation, and the very large or indeterminate damages sought in some matters asserted against us, there is significant uncertainty as to the ultimate liability we may incur from litigation. We expect that financial institutions, such as us, will continue to face significant regulatory scrutiny, with regulators taking formal enforcement actions against financial institutions in addition to addressing supervisory concerns through non-public supervisory actions or findings, which could involve restrictions on our activities, among other limitations, that could adversely affect our business. In addition, a violation of law or regulation by another financial institution could give rise to an investigation by regulators and other governmental agencies of the same or similar practices by us. Further, a single event may give rise to numerous and overlapping investigations and proceedings. External publicity concerning investigations can increase the scope and scale of investigations and lead to further regulatory inquiries. We are also involved at any given time with governmental and regulatory inquiries, investigations and proceedings. Regulatory scrutiny has continued to increase in a number of areas, and regulatory action could subject us to significant fines, penalties or other requirements resulting in Card Member reimbursements, increased expenses, limitations or conditions on our business activities, and damage to our reputation and our brand, all of which could materially adversely affect our business and results of operations. For example, as previously disclosed and described in more detail in Note 12 to the “Consolidated Financial Statements,” we are cooperating with governmental investigations related to certain of our historical sales practices and have already paid a civil money penalty pursuant to a settlement with the OCC with respect to its investigation. Other investigations of our historical sales practices are ongoing.

At any given time, we are involved in a number of legal proceedings, including class action lawsuits. Many of these actions have included claims for substantial compensatory or punitive damages. While we have historically relied on our arbitration clause in agreements with customers to limit our exposure to class action litigation, there can be no assurance that we will continue to be successful in enforcing our arbitration clause in the future, including as a result of possible regulation that would require that our consumer arbitration clause not apply to cases filed in court as class actions, and claims of the type we previously arbitrated could be subject to the complexities, risks and costs associated with class action cases. The continued focus of merchants on issues relating to the acceptance of various forms of payment may lead to additional litigation and other 31 31 31 Table of Contents Table of Contents legal actions. Given the inherent uncertainties involved in litigation, and the very large or indeterminate damages sought in some matters asserted against us, there is significant uncertainty as to the ultimate liability we may incur from litigation. We are also involved at any given time with governmental and regulatory inquiries, investigations and proceedings. Regulatory action could subject us to significant fines, penalties or other requirements resulting in Card Member reimbursements, increased expenses, limitations or conditions on our business activities, and damage to our reputation and our brand, all of which could adversely affect our results of operations and financial condition. We expect that financial institutions, such as us, will continue to face significant regulatory scrutiny, with regulators taking formal enforcement actions against financial institutions in addition to addressing supervisory concerns through non-public supervisory actions or findings, which could involve restrictions on our activities, among other limitations, that could adversely affect our business. In addition, a violation of law or regulation by another financial institution could give rise to an investigation by regulators and other governmental agencies of the same or similar practices by us. Further, a single event may give rise to numerous and overlapping investigations and proceedings. External publicity concerning investigations can increase the scope and scale of investigations and lead to further regulatory inquiries. For example, as previously disclosed, in May 2020, we began responding to a review by the OCC and the Department of Justice (DOJ) Civil Division regarding historical sales practices relating to sales to small business customers in the United States. In January 2021, we received a grand jury subpoena from the United States Attorney’s Office for the Eastern District of New York (EDNY) regarding these sales practices issues, as well as a Civil Investigative Demand from the CFPB pertaining to its investigation into sales practices related to consumers. In January 2023, the CFPB notified us that its investigation was completed and that it does not intend to recommend an enforcement action be taken against us at this time. The OCC, DOJ and EDNY reviews and investigations are ongoing and could result in enforcement actions or other regulatory proceedings against us seeking fines or other remedial actions. We are cooperating with all inquiries. We continue to review and enhance our processes and controls related to our sales practices and business conduct generally, take disciplinary and remedial actions where appropriate, and provide information regarding our reviews to our regulators, including the Federal Reserve. We also face an increased risk of litigation and governmental and regulatory scrutiny as a result of the effects of the pandemic on market and economic conditions, such as a renewed focus on fair lending laws, and actions governmental authorities take in response to those conditions, and in connection with our ESG-related disclosures and initiatives.

Our industry is subject to rapid and significant technological changes. In order to compete in our industry, we need to continue to invest in technology across all areas of our business, including in transaction processing, data management and analytics, machine learning and artificial intelligence, customer interactions and communications, open banking and alternative payment and financing mechanisms, authentication technologies and digital identification, tokenization, real-time settlement and risk management and compliance systems. Incorporating new technologies into our products and services, including developing the appropriate governance and controls consistent with regulatory expectations, requires substantial expenditures and takes considerable time, and ultimately may not be successful. We expect that new technologies in the payments industry will continue to emerge, and these new technologies may be superior to, or render obsolete, our existing technology. The process of developing new products and services, enhancing existing products and services and adapting to technological changes and evolving industry standards is complex, costly and uncertain, and any failure by us to anticipate customers’ changing needs and emerging technological trends accurately could significantly impede our ability to compete effectively. Adoption by consumers, merchants and other service providers is a key competitive factor and our competitors may develop products, platforms or technologies that become more widely adopted than ours. In addition, we may underestimate the resources needed and overestimate our ability to develop new products and services, particularly beyond our traditional card products and travel-related services. The use of artificial intelligence and machine learning technologies, including generative artificial intelligence, has increased rapidly with increasing complexity and changes in the nature of the technology. Our use of artificial intelligence and machine learning is subject to various risks including the use of personal information, flaws in our models or datasets that may result in biased or inaccurate results, ethical considerations regarding artificial intelligence, and our ability to safely deploy and implement governance and controls for artificial intelligence systems. Additionally, laws and regulations related to automated decision making, artificial intelligence and machine learning are still evolving and there is uncertainty as to new laws and regulations that will be adopted and the application of existing laws and regulations, which may restrict or impose burdensome and costly requirements on our ability to use artificial intelligence and machine learning. Adverse consequences of these risks related to artificial intelligence and machine learning could undermine the decisions, predictions or analysis such technologies produce and subject us to competitive harm, legal liability, heightened regulatory scrutiny and brand or reputational harm. Our ability to adopt new technologies may be inhibited by the emergence of industry-wide standards, a changing legislative and regulatory environment, an inability to develop appropriate governance and controls, a lack of internal product and engineering expertise, resistance to change from Card Members, merchants or service providers, lack of appropriate change management processes or the complexity of our systems. In addition, our adoption of new technologies and our introduction of new products and services may expose us to new or enhanced risks, particularly in areas where we have less experience or our existing governance and control systems may be insufficient, which could require us to make substantial expenditures or subject us to legal liability, heightened regulatory scrutiny and brand or reputational harm. 27 27 27 Table of Contents Table of Contents

Our industry is subject to rapid and significant technological changes. In order to compete in our industry, we need to continue to invest in technology across all areas of our business, including in transaction processing, data management and analytics, machine learning and artificial intelligence, customer interactions and communications, open banking and alternative payment and financing mechanisms, authentication technologies and digital identification, tokenization, real-time settlement, and risk management and compliance systems. Incorporating new technologies into our products and services, including developing the appropriate governance and controls consistent with regulatory expectations, requires substantial expenditures and takes considerable time, and ultimately may not be successful. We expect that new technologies in the payments industry will continue to emerge, and these new technologies may be superior to, or render obsolete, our existing technology. The process of developing new products and services, enhancing existing products and services and adapting to technological changes and evolving industry standards is complex, costly and uncertain, and any failure by us to anticipate customers’ changing needs and emerging technological trends accurately could significantly impede our ability to compete effectively. Consumer and merchant adoption is a key competitive factor and our competitors may develop products, platforms or technologies that become more widely adopted than ours. In addition, we may underestimate the resources needed and our ability to develop new products and services, particularly beyond our traditional card products and travel-related services. Our use of artificial intelligence and machine learning is subject to risks related to flaws in our algorithms and datasets that may be insufficient or contain biased information. These deficiencies could undermine the decisions, predictions or analysis such technologies produce, subjecting us to competitive harm, legal liability, and brand or reputational harm. Our ability to adopt new technologies may be inhibited by the emergence of industry-wide standards, a changing legislative and regulatory environment, an inability to develop appropriate governance and controls, a lack of internal product and engineering expertise, resistance to change from Card Members or merchants, lack of appropriate change management processes or the complexity of our systems. In addition, our adoption of new technologies and our introduction of new products and services may expose us to new or enhanced risks, particularly in areas where we have less experience or our existing governance and control systems may be insufficient, which could require us to make substantial expenditures or subject us to legal liability and brand or reputational harm.

Legislators and regulators in the United States and other countries in which we operate are increasingly adopting or revising privacy, data protection, data governance, resiliency, data transfer, third party oversight, account access, artificial intelligence and machine learning and information security and cybersecurity laws, including data localization, authentication and notification laws. As such laws are interpreted and applied (in some cases, with significant differences or conflicting requirements across 32 32 32 Table of Contents Table of Contents jurisdictions), compliance and technology costs will continue to increase, particularly in the context of ensuring that adequate data governance, data management, data protection, incident management, resiliency, third party management, data transfer, security controls, account access mechanisms and controls related to artificial intelligence and machine learning are in place. Compliance with current or future privacy, data protection, data governance, resiliency, data transfer, third party oversight, account access, artificial intelligence and machine learning and information security and cybersecurity laws could significantly impact our collection, use, sharing, retention and safeguarding of consumer and/or colleague information and could restrict our ability to fully maximize our closed-loop capability or provide certain products and services or work with certain service providers, which could materially and adversely affect our profitability. Our failure to comply with such laws or to maintain sufficient governance and control structures could result in potentially significant regulatory and/or governmental investigations and/or actions, litigation, fines, sanctions, ongoing regulatory monitoring, customer attrition, decreases in the use or acceptance of our cards and damage to our reputation and our brand. In recent years, there has been increasing regulatory enforcement and litigation activity in the areas of privacy, data protection and information security and cybersecurity in the United States, the EU and various other countries in which we operate and our data protection and governance programs have become the subject of heightened scrutiny. For more information on regulatory and legislative activity in this area, see “Supervision and Regulation — Privacy, Data Protection, Data Governance, Information Security and Cybersecurity” under “Business.”

Legislators and regulators in the United States and other countries in which we operate are increasingly adopting or revising privacy, data protection, data governance, resiliency, data transfer, third party oversight, account access and information and cyber security laws, including data localization, authentication and notification laws. As such laws are interpreted and applied (in some cases, with significant differences or conflicting requirements across jurisdictions), compliance and technology costs will continue to increase, particularly in the context of ensuring that adequate data governance, data protection, incident management, resiliency, third party management, data transfer, security controls and account access mechanisms are in place. Compliance with current or future privacy, data protection, data governance, resiliency, data transfer, third party oversight, account access and information and cyber security laws could significantly impact our collection, use, sharing, retention and safeguarding of consumer and/or colleague information and could restrict our ability to fully maximize our closed-loop capability or provide certain products and services or work with certain service providers, which could materially and adversely affect our profitability. Our failure to comply with such laws could result in potentially significant regulatory and/or governmental investigations and/or actions, litigation, fines, sanctions, ongoing regulatory monitoring, customer attrition, decreases in the use or acceptance of our cards and damage to our reputation and our brand. In recent years, there has been increasing regulatory enforcement and litigation activity in the areas of privacy, data protection and information and cyber security in the United States, the EU and various other countries in which we operate. For more information on regulatory and legislative activity in this area, see “Privacy, Data Protection, Data Governance, Information and Cyber Security” under “Supervision and Regulation.”