American Express Company: 10-K Risk Factor Changes

We are, and have been in the past, a defendant in a number of actions, including legal proceedings, arbitrations and proposed class actions, challenging certain provisions of our card acceptance agreements. See Note 12 to the “Consolidated Financial Statements” for a description of certain outstanding legal proceedings. An adverse outcome in these proceedings could have a material adverse effect on our business and results of operations, require us to change our merchant agreements in a way that could expose our cards to increased merchant steering and other forms of discrimination that could impair the Card Member experience, result in additional litigation and/or arbitrations, impose substantial monetary damages and damage our reputation and brand. Even if we were not required to change our merchant agreements, changes in Visa’s and Mastercard’s policies or practices as a result of legal proceedings, lawsuit settlements or regulatory actions pending against them could result in changes to our business practices and materially and adversely impact our profitability. For example, in 2024 Visa and Mastercard proposed a lawsuit settlement agreement that would have, among other things, required reductions and caps on interchange fees and streamlined requirements for merchants who wish to impose a surcharge on credit transactions. While the settlement agreement was not approved by the court, Visa and Mastercard may ultimately agree or be subject to changes in policies or practices that result in greater surcharging generally or downward pressure on our merchant discount rates from decreases in competitor pricing in connection with reductions and caps on interchange fees.

We are, and have been in the past, a defendant in a number of actions, including legal proceedings and proposed class actions, challenging certain provisions of our card acceptance agreements. See Note 12 to the “Consolidated Financial Statements” for a description of certain outstanding legal proceedings. An adverse outcome in these proceedings could have a material adverse effect on our business and results of operations, require us to change our merchant agreements in a way that could expose our cards to increased merchant steering and other forms of discrimination that could impair the Card Member experience, result in additional litigation and/or arbitrations, impose substantial monetary damages and damage our reputation and brand. Even if we were not required to change our merchant agreements, 31 31 31 Table of Contents Table of Contents changes in Visa’s and Mastercard’s policies or practices as a result of legal proceedings, lawsuit settlements or regulatory actions pending against them could result in changes to our business practices and materially and adversely impact our profitability.

We rely extensively on our information technology systems and those of our third parties, including our transaction authorization, clearing and settlement systems, and data centers, which have experienced and may continue to experience service disruptions or degradation that may result from technology malfunction, sudden increases in processing or other volumes, natural disasters and weather events, fires, accidents, technology change management issues, power outages, internet outages, telecommunications failures, fraud, denial-of-service, ransomware and other cyberattacks, inadequate infrastructure in lesser-developed markets, technology capacity management issues, terrorism, computer viruses, vulnerabilities or failures in hardware or software, physical or electronic break-ins, or similar events. Due to the interconnectivity and complexity of information systems and their reliance on common systems, software and vendors, disruptions or degradations have had, and will likely continue to have, wide-reaching consequences, including the potential to disrupt the overall financial system and other key systems in the global economy. Service disruptions or degradations impacting us or our partners can prevent access to online services and account information, compromise or limit access to company or customer data, impede or prevent transaction processing, communications to customers and financial reporting, disrupt ordinary business operations, result in contractual penalties or obligations, trigger regulatory reporting obligations, and lead to regulatory investigations and fines, increased regulatory oversight, and litigation (including class action litigation). Any such service disruption or degradation could adversely affect the perception of the reliability of our products and services and materially adversely affect our overall business, reputation and results of operations.

Our information technology systems and those of our third parties upon which we rely, including our transaction authorization, clearing and settlement systems, and data centers, have experienced and may continue to experience service disruptions or degradation, which may result from technology malfunction, sudden increases in processing or other volumes, natural disasters and weather events, fires, accidents, technology change management issues, power outages, internet outages, telecommunications failures, fraud, denial-of-service, ransomware and other cyberattacks, inadequate infrastructure in lesser-developed markets, technology capacity management issues, terrorism, computer viruses, vulnerabilities in hardware or software, physical or electronic break-ins, or similar events. Service disruptions or degradations can prevent access to our online services and account information, compromise or limit access to company or customer data, impede or prevent transaction processing, communications to customers and financial reporting, disrupt ordinary business operations, result in contractual penalties or obligations, trigger regulatory reporting obligations, and lead to regulatory investigations and fines, increased regulatory oversight, and litigation (including class action litigation). Any such service disruption or degradation could adversely affect the perception of the reliability of our products and services and materially adversely affect our overall business, reputation and results of operations.

Our success is, in many ways, dependent on the success of our partners. From customer acquisition to cobranding arrangements, from participation in our rewards programs to facilitating B2B supplier payments for our corporate clients, we rely on our business partners across many aspects of our company and our arrangements with business partners represent a significant portion of our business. For example, our two largest redemption partners are Amazon and Delta. Some of our partners manage certain aspects of our customer relationships, such as our OptBlue partners. To the extent any of our partners fail to effectively promote and support our products, experience a slowdown in their business, operational disruptions, reputational issues or loss of consumer confidence, or are otherwise unable to meet our expectations or those of their other stakeholders, our business may be materially negatively impacted. For example, the operational rights relating to our prepaid reloadable and gift card business are owned by a business partner and the reloadable operations have experienced disruptions and compliance issues that impacted the ability of our prepaid customers to load and use their cards. If such operations are interrupted, suspended, terminated or otherwise experience further issues in the future, it could further negatively impact our customers’ experience, result in additional costs, litigation and regulatory action, and harm our business and reputation. We also face the risk that existing relationships will be renegotiated with less favorable terms for us or that we may be unable to renegotiate on terms that are acceptable to us. In addition, we may be obligated to make or accelerate payments to certain business partners such as cobrand partners upon the occurrence of certain triggering events such as a shortfall in certain performance and revenue levels. If we are not able to effectively manage these triggering events, we could unexpectedly have to make payments to these partners, which could have a negative effect on our 25 25 25 Table of Contents Table of Contents financial condition and results of operations. See Note 12 to the “Consolidated Financial Statements” for additional information on financial commitments related to agreements with certain cobrand partners. Similarly, we are exposed to risk from bankruptcies, liquidations, insolvencies, financial distress, restructurings, consolidations, operational outages, cybersecurity incidents and other similar events that may occur in any industry representing a significant portion of our billed business, which could negatively impact particular card products and services (and volumes generally) and our financial condition and results of operations. We have previously and may in the future pre-purchase loyalty points from certain of our cobrand partners, the value of which may diminish to the extent such partners cease operations or such points become less desirable to our customers. We could also be materially impacted if we were obligated or elected to reimburse Card Members for products and services purchased from merchants that have ceased operations or stopped accepting our cards. For example, we are exposed to credit risk in the airline industry to the extent we protect Card Members against non-delivery of purchases, such as where we have remitted payment to an airline for a Card Member purchase of tickets that have not yet been used or “flown.” If we are unable to collect the amount from the airline, we may bear the loss for the amount credited to the Card Member. Spending at airline merchants accounted for approximately 7 percent of our worldwide billed business for the year ended December 31, 2024. For additional information relating to operational risks of our business partners, see “We rely on third-party providers for acquiring and servicing customers, technology, platforms and other services integral to the operations of our businesses. These third parties may act in ways that could materially harm our business” below.

Our success is, in many ways, dependent on the success of our partners. From customer acquisition to cobranding arrangements, from participation in our rewards programs to facilitating B2B supplier payments for our corporate clients, we rely on our business partners across many aspects of our company and our arrangements with business partners represent a significant portion of our business. Some of our partners manage certain aspects of our customer relationships, such as our OptBlue partners. To the extent any of our partners fail to effectively promote and support our products, experience a slowdown in their business, operational disruptions, reputational issues or loss of consumer confidence, or are otherwise unable to meet our expectations or those of their other stakeholders, our business may be materially negatively impacted. For example, the operational rights relating to our prepaid reloadable and gift card business are owned by a business partner and the reloadable operations have experienced disruptions and compliance issues that impacted the ability of our prepaid customers to load and use their cards. If such operations are interrupted, suspended, terminated or otherwise experience further issues in the future, it could further negatively impact our customers’ 24 24 24 Table of Contents Table of Contents experience, result in additional costs, litigation and regulatory action, and harm our business and reputation. We also face the risk that existing relationships will be renegotiated with less favorable terms for us or that we may be unable to renegotiate on terms that are acceptable to us. In addition, we may be obligated to make or accelerate payments to certain business partners such as cobrand partners upon the occurrence of certain triggering events such as a shortfall in certain performance and revenue levels. If we are not able to effectively manage these triggering events, we could unexpectedly have to make payments to these partners, which could have a negative effect on our financial condition and results of operations. See Note 12 to the “Consolidated Financial Statements” for additional information on financial commitments related to agreements with certain cobrand partners. Similarly, we are exposed to risk from bankruptcies, liquidations, insolvencies, financial distress, restructurings, consolidations, operational outages, cybersecurity incidents and other similar events that may occur in any industry representing a significant portion of our network volumes, which could negatively impact particular card products and services (and volumes generally) and our financial condition and results of operations. We have previously and may in the future pre-purchase loyalty points from certain of our cobrand partners, the value of which may diminish to the extent such partners cease operations or such points become less desirable to our customers. We could also be materially impacted if we were obligated or elected to reimburse Card Members for products and services purchased from merchants that have ceased operations or stopped accepting our cards. For example, we are exposed to credit risk in the airline industry to the extent we protect Card Members against non-delivery of purchases, such as where we have remitted payment to an airline for a Card Member purchase of tickets that have not yet been used or “flown.” If we are unable to collect the amount from the airline, we may bear the loss for the amount credited to the Card Member. At December 31, 2023, our best estimate of the maximum amount of billed business for purchases that had yet to be delivered by, or could be charged back to, merchants was $35.3 billion. This amount assumes all such merchants worldwide cease operations and thus are no longer available to deliver such purchases or to accept such chargebacks, and that all such billed business results in claims-in-full by Card Members. Such a maximum amount has not been indicative of our actual loss exposure in the past and we have not experienced significant losses related to these exposures to date; however, our historical experience may not be representative in the current environment given the current global economic, financial and geopolitical conditions. For additional information relating to operational risks of our business partners, see “We rely on third-party providers for acquiring and servicing customers, technology, platforms and other services integral to the operations of our businesses. These third parties may act in ways that could materially harm our business” below and for the general risks related to the airline industry, see “Risk Management — Institutional Credit Risk — Exposure to the Airline and Travel Industry” under “MD&A.”

Our industry is subject to rapid and significant technological changes. In order to compete in our industry, we need to continue to invest in technology across all areas of our business, including in transaction processing, data management and analytics, machine learning and artificial intelligence, customer interactions and communications, open banking and alternative payment and financing mechanisms, authentication technologies and digital identification, tokenization, real-time settlement and risk management and compliance systems. Incorporating new technologies into our products and services, including developing the appropriate governance and controls consistent with regulatory expectations, requires substantial expenditures and takes considerable time, and may have unintended consequences or ultimately be unsuccessful. We expect that new technologies in the payments industry will continue to emerge, and these new technologies may be superior to, or render obsolete, our existing technology. The process of developing new products and services, enhancing existing products and services and adapting to technological changes and evolving industry standards is complex, costly and uncertain, and any failure by us to anticipate customers’ changing needs and emerging technological trends accurately could significantly impede our ability to compete effectively. Our competitors may develop products, platforms or technologies that become more widely adopted by consumers, merchants or service providers than ours, including as a result of increased involvement by technology companies in the payments industry and our competitors’ greater scale or ability to pursue and adopt new technologies. In addition, we may underestimate the resources needed and overestimate our ability to develop new products and services, particularly beyond our traditional card products and travel-related services. The use of artificial intelligence and machine learning technologies, including generative artificial intelligence, has increased rapidly with the increasing sophistication and applications of the technology. Our and our partners’ use of artificial intelligence and machine learning is subject to various risks including flaws in models or datasets that may result in biased or inaccurate results, unintended or unexpected outcomes, ethical considerations regarding artificial intelligence, infringement of intellectual property rights, exposure of proprietary or personal information, heightened security risks and the ability to safely deploy and implement governance and controls for artificial intelligence systems. The complexity of these technologies can make it difficult to assess proper operation, reduce error, or understand and explain their outputs. Adverse consequences of artificial intelligence and machine learning remain uncertain but could include flaws in the decisions, predictions, outputs or analysis such technologies produce and subjecting us to competitive harm, legal liability, heightened regulatory scrutiny and brand or reputational harm. Our ability to adopt new technologies may be inhibited by the emergence of industry-wide standards, a changing legislative and regulatory environment, an inability to develop appropriate governance and controls, a lack of internal product and engineering expertise, resistance to change from Card Members, merchants or service providers, lack of appropriate change management processes or the complexity of our systems. In addition, our adoption of new technologies and our introduction of new products and services may increase operational complexity and risk, and expose us to new or enhanced risks, particularly in areas where we have less experience or our existing governance and control systems may be insufficient, which could require us to make substantial expenditures or subject us to legal liability, heightened regulatory scrutiny and brand or reputational harm.

Our industry is subject to rapid and significant technological changes. In order to compete in our industry, we need to continue to invest in technology across all areas of our business, including in transaction processing, data management and analytics, machine learning and artificial intelligence, customer interactions and communications, open banking and alternative payment and financing mechanisms, authentication technologies and digital identification, tokenization, real-time settlement and risk management and compliance systems. Incorporating new technologies into our products and services, including developing the appropriate governance and controls consistent with regulatory expectations, requires substantial expenditures and takes considerable time, and ultimately may not be successful. We expect that new technologies in the payments industry will continue to emerge, and these new technologies may be superior to, or render obsolete, our existing technology. The process of developing new products and services, enhancing existing products and services and adapting to technological changes and evolving industry standards is complex, costly and uncertain, and any failure by us to anticipate customers’ changing needs and emerging technological trends accurately could significantly impede our ability to compete effectively. Adoption by consumers, merchants and other service providers is a key competitive factor and our competitors may develop products, platforms or technologies that become more widely adopted than ours. In addition, we may underestimate the resources needed and overestimate our ability to develop new products and services, particularly beyond our traditional card products and travel-related services. The use of artificial intelligence and machine learning technologies, including generative artificial intelligence, has increased rapidly with increasing complexity and changes in the nature of the technology. Our use of artificial intelligence and machine learning is subject to various risks including the use of personal information, flaws in our models or datasets that may result in biased or inaccurate results, ethical considerations regarding artificial intelligence, and our ability to safely deploy and implement governance and controls for artificial intelligence systems. Additionally, laws and regulations related to automated decision making, artificial intelligence and machine learning are still evolving and there is uncertainty as to new laws and regulations that will be adopted and the application of existing laws and regulations, which may restrict or impose burdensome and costly requirements on our ability to use artificial intelligence and machine learning. Adverse consequences of these risks related to artificial intelligence and machine learning could undermine the decisions, predictions or analysis such technologies produce and subject us to competitive harm, legal liability, heightened regulatory scrutiny and brand or reputational harm. Our ability to adopt new technologies may be inhibited by the emergence of industry-wide standards, a changing legislative and regulatory environment, an inability to develop appropriate governance and controls, a lack of internal product and engineering expertise, resistance to change from Card Members, merchants or service providers, lack of appropriate change management processes or the complexity of our systems. In addition, our adoption of new technologies and our introduction of new products and services may expose us to new or enhanced risks, particularly in areas where we have less experience or our existing governance and control systems may be insufficient, which could require us to make substantial expenditures or subject us to legal liability, heightened regulatory scrutiny and brand or reputational harm. 27 27 27 Table of Contents Table of Contents

In certain countries, such as Australia, Canada (other than in the Province of Quebec) and certain Member States in the EU, and in certain states in the United States, merchants are permitted by law to engage in surcharging, steering or other differential acceptance practices for certain card purchases and certain merchants and merchant organizations continue to push for these practices in other jurisdictions. In jurisdictions allowing surcharging, we have seen an increase in merchant surcharging on American Express cards, particularly in certain merchant categories, and in some cases, either the surcharge is greater than that applied to Visa and Mastercard cards or Visa and Mastercard cards are not surcharged at all (practices that are known as differential surcharging), even though there are many cards issued on competing networks that have an equal or greater cost of acceptance for the merchant. We also encounter merchants that accept our cards, but tell their customers that they prefer to accept another type of payment or otherwise seek to suppress use of our cards or certain of our cards, such as limiting the use of our cards for certain transactions. Our Card Members value the ability to use their cards where and when they want to, and we, therefore, take steps to meet our Card Members’ expectations and to protect the American Express brand by prohibiting discrimination through provisions in our merchant contracts, including non-discrimination and honor-all-cards provisions, subject to local legal requirements. We have increasingly relied on merchant acquirers, aggregators and processors to manage certain aspects of our merchant relationships. When we work with such third parties, we are dependent on them to promote and support the acceptance and usage of our cards, but they may have business interests, strategies or goals that are inconsistent with ours. Recently introduced products, such as debit cards on the American Express network, could fail to gain market acceptance and American Express cards could become less desirable to consumers and businesses generally due to surcharging, steering or other 26 26 26 Table of Contents Table of Contents forms of discrimination, which could result in a decrease in cards-in-force, coverage and transaction volumes. The impact could vary depending on such factors as: the industry or manner in which a surcharge is levied; how Card Members are surcharged or steered to other card products or payment forms at the point of sale; the ease and speed of implementation for merchants, merchant acquirers, aggregators, processors or other merchant service providers, including as a result of new or emerging technologies; the size and recurrence of the underlying charges; and whether and to what extent these actions are applied to other forms of payment, including whether it varies depending on the type of card (e.g., credit or debit), product, network, acquirer or issuer. Discrimination against American Express cards could have a material adverse effect on our business, financial condition and results of operations, particularly where it only or disproportionately impacts credit card usage or card usage generally, our Card Members or our business.

In certain countries, such as Australia, Canada (other than in Quebec) and certain Member States in the EU, and in certain states in the United States, merchants are permitted by law to surcharge certain card purchases. In jurisdictions allowing surcharging, we have seen merchant surcharging on American Express cards in certain merchant categories, and in some cases, either the surcharge is greater than that applied to Visa and Mastercard cards or Visa and Mastercard cards are not surcharged at all (practices that are known as differential surcharging), even though there are many cards issued on competing networks that have an equal or greater cost of acceptance for the merchant. 25 25 25 Table of Contents Table of Contents We also encounter merchants that accept our cards, but tell their customers that they prefer to accept another type of payment or otherwise seek to suppress use of our cards or certain of our cards, which could become more prevalent with the existence of debit cards on the American Express network. Our Card Members value the ability to use their cards where and when they want to, and we, therefore, take steps to meet our Card Members’ expectations and to protect the American Express brand by prohibiting discrimination through provisions in our merchant contracts, including non-discrimination and honor-all-cards provisions, subject to local legal requirements. We have increasingly relied on merchant acquirers, aggregators and processors to manage certain aspects of our merchant relationships. When we work with such third parties, we are dependent on them to promote and support the acceptance and usage of our cards, but they may have business interests, strategies or goals that are inconsistent with ours. New products, such as debit cards on the American Express network, could fail to gain market acceptance and American Express cards could become less desirable to consumers and businesses generally due to surcharging, steering or other forms of discrimination, which could result in a decrease in cards-in-force, coverage and transaction volumes. The impact could vary depending on such factors as: the industry or manner in which a surcharge is levied; how Card Members are surcharged or steered to other card products or payment forms at the point of sale; the ease and speed of implementation for merchants, merchant acquirers, aggregators, processors or other merchant service providers, including as a result of new or emerging technologies; the size and recurrence of the underlying charges; and whether and to what extent these actions are applied to other forms of payment, including whether it varies depending on the type of card (e.g., credit or debit), product, network, acquirer or issuer. Discrimination against American Express cards could have a material adverse effect on our business, financial condition and results of operations, particularly where it only or disproportionately impacts credit card usage or card usage generally, our Card Members or our business.

Our brand and its attributes are key assets, and we believe our continued success depends on our ability to preserve, grow and realize the benefits of the value of our brand. Our ability to attract and retain consumer and small business Card Members and corporate clients is highly dependent upon the external perceptions of our level of service, trustworthiness, business practices, privacy and data protection, management, workplace culture, merchant acceptance, financial condition, response to political and social issues or catastrophic events and other subjective qualities. Negative perceptions or publicity regarding these matters — even if related to seemingly isolated incidents and whether or not factually correct—could erode trust and confidence and damage our reputation among existing and potential Card Members, corporate clients, merchants and partners, which could make it difficult for us to attract new customers and maintain existing ones, and could subject us to heightened legal and regulatory scrutiny. Negative public opinion could result from actual or alleged conduct in any number of activities or circumstances, including card practices, regulatory compliance, the use and protection of customer information, conduct by our colleagues and policy engagement, including activities of the American Express Company Political Action Committee, and from actions taken by regulators or others in response thereto. Moreover, the speed with which information spreads through social media, enhanced technology and other news sources and the ease with which customers transact may amplify the onset and negative effects from such perceptions. Our brand and reputation may also be harmed by actions taken by third parties that are outside our control. For example, any shortcoming of or controversy related to a third-party service provider, business partner, merchant acquirer or network partner may be attributed by Card Members and merchants to us, thus damaging our reputation and brand value. Our brand may also be negatively impacted by acceptance of American Express cards by merchants in certain industries, when American Express cards are used for payment for legal, but controversial, products and services or any government inquiries or legislative scrutiny related to card acceptance or usage. The lack of acceptance, suppression of card usage or surcharging by merchants can also negatively impact perceptions of our brand and our products, lower overall transaction volume and increase the attractiveness of other payment products or systems. Adverse developments with respect to our industry, including the creation and implementation of new merchant categories codes, may also negatively impact our reputation, or result in greater regulatory or legislative scrutiny or litigation against us. Furthermore, as a corporation with headquarters and operations located in the United States and a brand name 27 27 27 Table of Contents Table of Contents referring to the United States, a negative perception of the United States arising from its political or other positions could harm the perception of our company and our brand. These risks to our brand and reputation, as well as other risks described in this Risk Factors section, are heightened by the increasing sophistication and availability of artificial intelligence technology, including by assisting with the creation of deepfakes and increasing the velocity of distribution of disinformation. Although we monitor developments for areas of potential risk to our reputation and brand, negative perceptions or publicity could materially and adversely affect our business volumes, revenues and profitability. We face increased scrutiny from stakeholders who have diverging views related to business practices and company activities, which could result in reputational harm, litigation, enforcement actions and other adverse consequences. In addition, we are subject to increasing regulatory requirements and legal risks related to environmental, social and governance topics, such as those arising from new disclosure requirements in certain jurisdictions. Inaccurate perceptions or mischaracterizations of disclosures on these topics, or our goals and initiatives, while outside of our control, could impact our reputation, colleague hiring and retention and public perceptions of our business.

Our brand and its attributes are key assets, and we believe our continued success depends on our ability to preserve, grow and realize the benefits of the value of our brand. Our ability to attract and retain consumer and small business Card Members and corporate clients is highly dependent upon the external perceptions of our level of service, trustworthiness, business practices, privacy and data protection, management, workplace culture, merchant acceptance, financial condition, response to political and social issues or catastrophic events and other subjective qualities. Negative perceptions or publicity regarding these matters — even if related to seemingly isolated incidents and whether or not factually correct—could erode trust and confidence and damage our reputation among existing and potential Card Members, corporate clients, merchants and partners, which could make it difficult for us to attract new customers and maintain existing ones. Negative public opinion could result from actual or alleged conduct in any number of activities or circumstances, including card practices, regulatory compliance, the use and protection of 26 26 26 Table of Contents Table of Contents customer information, conduct by our colleagues and policy engagement, including activities of the American Express Company Political Action Committee, and from actions taken by regulators or others in response thereto. Discussion about such matters in social media channels can also cause rapid, widespread reputational harm to our brand. Our brand and reputation may also be harmed by actions taken by third parties that are outside our control. For example, any shortcoming of or controversy related to a third-party service provider, business partner, merchant acquirer or network partner may be attributed by Card Members and merchants to us, thus damaging our reputation and brand value. Our brand may also be negatively impacted by acceptance of American Express cards by merchants in certain industries, when American Express cards are used for payment for legal, but controversial, products and services or any government inquiries or legislative scrutiny related to card acceptance or usage. The lack of acceptance, suppression of card usage or surcharging by merchants can also negatively impact perceptions of our brand and our products, lower overall transaction volume and increase the attractiveness of other payment products or systems. Adverse developments with respect to our industry, including the creation and implementation of new merchant categories codes, may also negatively impact our reputation, or result in greater regulatory or legislative scrutiny or litigation against us. Furthermore, as a corporation with headquarters and operations located in the United States and a brand name referring to the United States, a negative perception of the United States arising from its political or other positions could harm the perception of our company and our brand. These risks to our brand and reputation, as well as other risks described in this Risk Factors section, are heightened by the increasing sophistication and availability of artificial intelligence technology that can assist with the creation of deepfakes and increase the velocity of distribution of disinformation. Although we monitor developments for areas of potential risk to our reputation and brand, negative perceptions or publicity could materially and adversely affect our business volumes, revenues and profitability. We may face increased scrutiny related to our ESG goals and initiatives, which could result in litigation and other adverse consequences. There can be no assurance that we will achieve our ESG goals, which depend in part on third-party performance or data that is outside of our control, or that any such achievements will have the desired results. Further, our ESG goals and the methodologies for reporting may change over time and we may be subject to new legal and regulatory requirements related to ESG matters. Our failure or perceived failure to achieve progress in these areas on a timely basis, if at all, or inaccurate perceptions or misrepresentations of our ESG goals and initiatives could impact our reputation, colleague hiring and retention and public perceptions of our business.

We are subject to income and other taxes in the United States and in various foreign jurisdictions. The laws and regulations related to tax matters are extremely complex, require significant judgment and are subject to varying interpretations. Although management believes our positions are reasonable, they are subject to challenge by the Internal Revenue Service in the United States and by tax authorities in other jurisdictions in which we conduct business operations, which could have an adverse impact on our tax liabilities. Refer to Note 20 to the “Consolidated Financial Statements” for information on the U.S. federal income tax audit of transfer pricing arrangements between our U.S. and foreign subsidiaries. We are being challenged in a number of countries regarding our application of value-added taxes (VAT) to certain transactions. While we believe we comply with all applicable VAT and other tax laws, rules and regulations in the relevant jurisdictions, the tax authorities may determine that we owe additional taxes or apply existing laws and regulations more broadly, which could result in a significant increase in liabilities for taxes and interest in excess of accrued liabilities. Legislative action or inaction in the countries in which we have operations could increase our effective tax rate. For example, new guidelines issued by the Organization for Economic Cooperation and Development (OECD) will impact how multinational enterprises (MNEs) are taxed on their global profits. In particular, the OECD’s guidelines on a global minimum tax of 15 percent will impact the effective tax rate for many MNEs. Many countries have already implemented these minimum tax guidelines, with effective dates commencing in 2024. We expect that these minimum tax guidelines in their current form would increase our effective tax rate in future years. Furthermore, various provisions of the Tax Cut and Jobs Act will expire in 2025 unless extended. As a result, U.S. Congress may seek to enact significant tax legislation in the new session of Congress, which could result in higher levels of U.S. tax on our global operations, increasing our effective tax rate. Jurisdictions may also make changes related to the tax treatment of card transactions, such as imposing taxes on Card Member rewards or prohibiting interchange fees on sales tax, which could decrease the value we provide to customers and adversely impact our business.

We are subject to income and other taxes in the United States and in various foreign jurisdictions. The laws and regulations related to tax matters are extremely complex and subject to varying interpretations. Although management believes our positions are reasonable, we are subject to audit by the Internal Revenue Service in the United States and by tax authorities in all the jurisdictions in which we conduct business operations. We are being challenged in a number of countries regarding our application of value-added taxes (VAT) to certain transactions. While we believe we comply with all applicable VAT and other tax laws, rules and regulations in the relevant jurisdictions, the tax authorities may determine that we owe additional taxes or apply existing laws and regulations more broadly, which could result in a significant increase in liabilities for taxes and interest in excess of accrued liabilities. Legislative action or inaction in the countries in which we have operations could increase our effective tax rate. For example, new guidelines issued by the Organization for Economic Cooperation and Development (OECD) will impact how multinational enterprises (MNEs) are taxed on their global profits. In particular, the OECD’s guidelines on a global minimum tax of 15 percent will impact the effective tax rate for many MNEs. Several countries are beginning to implement these minimum tax guidelines, with effectiveness commencing in 2024, and if all OECD member countries were to implement these minimum tax guidelines in their current form, we expect that it would result in a significant increase to our effective tax rate. In addition to legislative changes, actions by tax authorities, including an increase in tax audit activity, could have an adverse impact on our tax liabilities. Jurisdictions may also make changes related to the tax treatment of card transactions, such as imposing taxes on Card Member rewards, which could decrease the value we provide to customers and adversely impact our business.

We rely upon our colleagues not only for business success, but also to act with integrity and promote a culture of respect. To the extent our colleagues behave in a manner that does not comport with our company’s values, the consequences to our brand and reputation could be severe and could negatively affect our financial condition and results of operations. The market for qualified, highly motivated individuals with diverse perspectives is highly competitive and we may not be able to attract and retain such individuals. The unexpected loss of key personnel could disrupt our business and have an adverse impact on our future performance. Changes in immigration and work permit laws and regulations or the administration or enforcement of such laws or regulations or other changes in the legal or regulatory environment can also impair our ability to attract and retain qualified personnel, or to employ colleagues in the location(s) of our choice. Our compensation practices are subject to review and oversight by the Federal Reserve and the compensation practices of AENB are subject to review and oversight by the OCC. This regulatory review and oversight could further affect our ability to attract and retain our executive officers and other key personnel. Our inability to attract, develop and retain highly skilled, motivated and diverse personnel could materially adversely affect our business and our culture.

We rely upon our colleagues not only for business success, but also to act with integrity and promote a culture of respect. To the extent our colleagues behave in a manner that does not comport with our company’s values, the consequences to our brand and reputation could be severe and could negatively affect our financial condition and results of operations. The changing nature of the office environment, such as changes in the prevalence of remote and hybrid working and expectations regarding such arrangements, may result in increased costs and present operational and workplace culture challenges and difficulties in attracting, developing and retaining personnel that may also adversely affect our business. The market for qualified, highly motivated individuals with diverse perspectives and reflecting the diversity of our communities is highly competitive, with elevated levels of turnover in recent years, and we may not be able to attract and retain such individuals. We have and may continue to experience increased costs related to compensation and other benefits necessary to attract and retain such individuals, however the compensation and benefits we offer may still be viewed as less favorable than that offered by our competitors. Changes in immigration and work permit laws and regulations or the administration or enforcement of such laws or regulations or other changes in the legal or regulatory environment can also impair our ability to attract and retain qualified personnel, or to employ colleagues in the location(s) of our choice. Our compensation practices are subject to review and oversight by the Federal Reserve and the compensation practices of AENB are subject to review and oversight by the OCC. This regulatory review and oversight could further affect our ability to attract and retain our executive officers and other key personnel. Our inability to attract, develop and retain highly skilled, motivated and diverse personnel could materially adversely affect our business and our culture.

We face significantly heightened regulatory expectations and scrutiny in the U.S. and globally, which significantly affects our business and requires continual enhancement of our compliance efforts. Supervision efforts and the enforcement of existing laws 30 30 30 Table of Contents Table of Contents and regulations impact the scope and profitability of our existing business activities, limit our ability to pursue certain business opportunities and adopt new technologies, compromise our competitive position, and affect our relationships with Card Members, partners, merchants, service providers and other third parties. New laws or regulations could similarly affect our business, increase the costs and complexity of doing business, impact what we are able to charge for, or offer in connection with, our products and services, impose conflicting obligations, and require us to change certain of our business practices and invest significant management attention and resources, all of which could adversely affect our results of operations and financial condition. Political developments can result in legislative and regulatory uncertainty and changes to supervisory and enforcement priorities. In addition, legislators and regulators around the world are aware of each other’s approaches to the regulation of the financial services industry. Consequently, a development in one country, state or region may influence regulatory approaches in another. If we fail to satisfy regulatory requirements or maintain our financial holding company status, our financial condition and results of operations could be adversely affected, and we may be restricted in our ability to take certain capital actions (such as declaring dividends or repurchasing outstanding shares) or engage in certain business activities or acquisitions, which could compromise our competitive position. Additionally, our banking regulators have wide discretion in the examination and the enforcement of applicable banking statutes and regulations and may restrict our ability to engage in certain business activities or acquisitions or require us to maintain more capital. In 2024, we became a Category III firm for purposes of the U.S. federal bank regulatory agencies’ tailoring framework, resulting in us becoming subject to heightened regulatory expectations and more stringent regulatory requirements. As we continue to grow, these expectations and requirements may further increase, such as if we become a Category II firm, which may increase our compliance costs and adversely affect our business. Legislators and regulators continue to focus on the operation of card networks, including interchange fees paid to card issuers in payment networks such as Visa and Mastercard, network routing practices and the fees merchants are charged to accept cards. While in some cases our business is subject to exemptions related to certain of these regulations, there is no guarantee that such exemptions will continue to be available and even where we are not directly regulated, regulation of bankcard fees significantly negatively impacts the discount revenue derived from our business, including as a result of downward pressure on our discount rate from decreases in competitor pricing in connection with caps on interchange fees. In some cases, regulations also extend, or may extend, to certain aspects of our business, such as network and cobrand arrangements, new products or services we may offer, or the terms of card acceptance for merchants, including terms relating to non-discrimination and honor-all-cards. For example, we have exited our network licensing businesses in the EU and Australia as a result of regulation in those jurisdictions. In addition, there is uncertainty as to when or how interchange fee caps and other provisions of payments legislation might apply when we work with cobrand partners and agents in the EU. See “Supervision and Regulation — Payments Regulation” under “Business” for more information. Given differing interpretations by regulators and participants in cobrand arrangements, we are subject to regulatory action, penalties and the possibility we will not be able to maintain our existing cobrand and agent relationships in the EU. In addition, a number of federal and state laws to regulate various aspects of network operations are being considered or have passed, including regarding information associated with electronic transactions (such as the use of specific merchant categories codes or limitations on the use of transaction data) and pricing of electronic transactions (such as interchange fees on sales tax or gratuities). Legislators and regulators also continue to focus on consumer protection, including product design and pricing constructs, account management and security, credit bureau reporting, disclosure rules, marketing and debt collection practices. This focus has included fees associated with card and banking products, such as a rule issued by the CFPB related to credit card fees for late payments (which is currently stayed); interest rates, such as recent proposals to cap credit card interest rates; rewards programs, such as the recent inquiries by the CFPB and DOT focused on credit card and airline rewards programs; and factors considered by financial institutions in providing services, such as “fair access” laws. Any new requirements or increased enforcement of existing requirements could materially and adversely impact our revenue growth and profitability, including, as a result of increased scrutiny of our pricing, underwriting and account management practices; the imposition of fines and customer remediation; higher compliance costs; reputational harm; restrictions on our ability to issue cards, appropriately price for the value of our products or work with certain business partners; and changes to our business practices generally. We are subject to significant supervision and regulation with respect to compliance with AML/CFT laws, sanctions regimes and anti-corruption laws in numerous jurisdictions. As regulators increase their focus in these areas, new technologies such as digital currencies develop, near real-time money movement solutions are adopted, we introduce new products like checking accounts and geopolitical tensions increase, we face increased costs related to oversight, supervision and potential fines. Our AML/CFT, sanctions and anti-corruption compliance programs have become the subject of heightened scrutiny, and we are working to make enhancements to our existing programs, policies and procedures and to identify and remediate deficiencies. For example, we recently voluntarily reported certain transactions and accounts to OFAC, some of which related to Iran, as described in “Supervision and Regulation — Anti-Money Laundering, Countering the Financing of Terrorism, Economic Sanctions and Anti-Corruption Compliance” under “Business.” Errors, failures or delays in complying with AML/CFT, sanctions and anti-corruption laws, deficiencies in our related compliance programs or association of our business with money laundering, terrorist financing, tax fraud or other illicit activities or sanctioned persons, entities, governments or countries can give rise to significant supervisory, criminal and civil proceedings and lawsuits, which could result in significant penalties and forfeiture of assets, loss of licenses or restrictions on business activities, or other enforcement actions, and our reputation may suffer due to our customers’ association with certain countries, persons or entities or the existence of any such transactions. Additionally, our AML/CFT, sanctions and anti-corruption compliance programs may limit our ability to pursue certain business opportunities or affect our relationships with certain partners, service providers and other third parties. See “Supervision and Regulation” under “Business” for more information about certain laws and regulations to which we are subject and their impact on us. 31 31 31 Table of Contents Table of Contents

We are subject to evolving and comprehensive government regulation and supervision in jurisdictions around the world, which significantly affects our business and requires continual enhancement of our compliance efforts. Supervision efforts and the enforcement of existing laws and regulations impact the scope and profitability of our existing business activities, limit our ability to pursue certain business opportunities and adopt new technologies, compromise our competitive position, and affect our relationships with Card Members, partners, merchants, service providers and other third parties. New laws or regulations could similarly affect our business, increase the costs and complexity of doing business, impact what we are able to charge for, or offer in connection with, our products and services, impose conflicting obligations, and require us to change certain of our business practices and invest significant management attention and resources, all of which could adversely affect our results of operations and financial condition. Legislators and regulators around the world are aware of each other’s approaches to the regulation of the financial services industry. Consequently, a development in one country, state or region may influence regulatory approaches in another. If we fail to satisfy regulatory requirements or maintain our financial holding company status, our financial condition and results of operations could be adversely affected, and we may be restricted in our ability to take certain capital actions (such as declaring dividends or repurchasing outstanding shares) or engage in certain business activities or acquisitions, which could compromise our competitive position. Additionally, our banking regulators have wide discretion in the examination and the enforcement of applicable banking statutes and regulations and may restrict our ability to engage in certain business activities or acquisitions or require us to maintain more capital. In response to recent bank failures and stress in the banking sector, legislators and regulators have increased their scrutiny of financial institutions and are proposing new measures and regulations, including those related to capital levels, liquidity standards, deposit concentrations and risk management practices, as well as increased deposit assessments. As we continue to grow, we expect to become subject to heightened regulatory expectations and more stringent regulatory requirements, such as becoming a Category III or Category II firm for purposes of the U.S. federal bank regulatory agencies’ enhanced prudential standards, which may increase our compliance costs and adversely affect our business. Legislators and regulators continue to focus on the operation of card networks, including interchange fees paid to card issuers in payment networks such as Visa and Mastercard, network routing practices and the fees merchants are charged to accept cards. Even where we are not directly regulated, regulation of bankcard fees significantly negatively impacts the discount revenue derived from our business, including as a result of downward pressure on our discount rate from decreases in competitor pricing in connection with caps on interchange fees. In some cases, regulations also extend, or may extend, to certain aspects of our business, such as network and cobrand arrangements, new products or services we may offer, or the terms of card acceptance for merchants, including terms relating to non-discrimination and honor-all-cards. For example, we have exited our network licensing businesses in the EU and Australia as a result of regulation in those jurisdictions. In addition, there is uncertainty as to when or how interchange fee caps and other provisions of payments legislation might apply when we work with cobrand partners and agents in the EU. In a ruling issued on February 7, 2018, the EU Court of Justice confirmed the validity of fee capping and other provisions in circumstances where three-party networks issue cards with a cobrand partner or through an agent, although the ruling provided only limited guidance as to when or how the provisions might apply in such circumstances and remains subject to differing interpretations by regulators and participants in cobrand arrangements. On August 29, 2023, the Dutch Trade and Industry Appeals Tribunal referred questions to the EU Court of Justice on the interpretation of the application of the interchange fee caps in connection with an administrative proceeding by the Netherlands Authority for Consumers and Markets regarding our cobrand relationship with KLM Royal Dutch Airlines. Given differing interpretations by regulators and participants in cobrand arrangements, we are subject to regulatory action, penalties and the possibility we will not be able to maintain our existing cobrand and agent relationships in the EU. Legislators and regulators have also increased their focus on limiting fees associated with card and banking products, such as the recent proposed rule by the CFPB related to credit card fees for late payments, which could negatively impact our fee revenue. 30 30 30 Table of Contents Table of Contents Legislators and regulators also continue to focus on consumer protection, including product design and pricing constructs, account management and security, credit bureau reporting, disclosure rules, marketing and debt collection practices. Any new requirements or increased enforcement of existing requirements may result in increased scrutiny of our pricing, underwriting and account management practices, the imposition of fines and customer remediation, higher compliance costs, restrictions on our ability to issue cards, appropriately price for the value of our products or partner with other financial institutions and otherwise result in changes to our business practices, which could materially and adversely impact our revenue growth and profitability. We are subject to significant supervision and regulation with respect to compliance with AML/CFT laws and sanctions regimes in numerous jurisdictions. As regulators increase their focus in these areas, new technologies such as digital currencies develop, near real-time money movement solutions are adopted, we introduce new products like checking accounts and geopolitical tensions increase, we face increased costs related to oversight, supervision and potential fines. Our AML/CFT programs have become the subject of heightened scrutiny in some countries, including certain Member States in the EU. Any errors, failures or delays in complying with AML/CFT and sanctions laws, perceived deficiencies in our related compliance programs or association of our business with money laundering, terrorist financing, tax fraud or other illicit activities or sanctioned persons, entities, governments or countries can give rise to significant supervisory, criminal and civil proceedings and lawsuits, which could result in significant penalties and forfeiture of assets, loss of licenses or restrictions on business activities, or other enforcement actions, and our reputation may suffer due to our customers’ association with certain countries, persons or entities or the existence of any such transactions. See “Supervision and Regulation” under “Business” for more information about certain laws and regulations to which we are subject and their impact on us.

During 2024, approximately 22 percent of our total revenues net of interest expense were generated from activities outside the United States. We are exposed to foreign exchange risk from our international operations, and accordingly the revenue we generate outside the United States is subject to unpredictable fluctuations if the values of other currencies change relative to the U.S. dollar, which could have a material adverse effect on our results of operations. Political and economic conditions could continue to cause changes in the values of currencies and a further strengthening of the U.S. dollar will negatively impact our net revenues. Substantial and sudden devaluation of local Card Members’ currency can also affect their ability to make payment to us. Foreign exchange regulations or capital controls might restrict or prohibit the conversion of other currencies into U.S. dollars or our ability to transfer them and the availability of foreign exchange could further impact our results of operations.

During 2023, approximately 22 percent of our total revenues net of interest expense were generated from activities outside the United States. We are exposed to foreign exchange risk from our international operations, and accordingly the revenue we generate outside the United States is subject to unpredictable fluctuations if the values of other currencies change relative to the U.S. dollar, which could have a material adverse effect on our results of operations. Foreign exchange regulations or capital controls might restrict or prohibit the conversion of other currencies into U.S. dollars or our ability to transfer them. Political and economic conditions in other countries could also cause fluctuations in the values of their currencies, such as the devaluation of the Argentinian peso, and impact the availability of foreign exchange for the payment to us by the local card issuer for obligations arising out of local Card Members’ spending outside such country and for the payment by Card Members who are billed in a currency other than their local currency. Substantial and sudden devaluation of local Card Members’ currency can also affect their ability to make payments to the local issuer of the card in connection with spending outside the local country. The occurrence of any of these circumstances could further impact our results of operations.

Geopolitical conditions, terrorist attacks, military conflicts, supply chain issues, natural disasters, severe weather, widespread health emergencies or pandemics, information or cybersecurity incidents (including intrusion into or degradation or unavailability of systems or technology by cyberattacks), operational incidents and other catastrophic events can have a material adverse effect on our business. Political and social conditions, including geopolitical instability (such as from tensions involving China and the U.S.), fiscal and monetary policies (including developments related to the U.S. federal deficit, debt ceiling, government shutdowns and other budgetary issues), trade wars and tariffs, labor shortages, regional or domestic hostilities, economic sanctions and the prospect or occurrence of more widespread conflicts could also negatively affect our business, operations and partners, consumer and business spending, including travel patterns and business investment, and demand for credit. Pandemics and other health emergencies can have widespread and unpredictable impacts on global society, economic conditions and consumer and business behavior, which may reoccur or occur over an extended duration, such as the macroeconomic and behavioral impacts during the COVID-19 pandemic. Because we derive a portion of our revenues from travel-related spending and many of our partners’ businesses relate to travel, our business is sensitive to impacts to travel and tourism, such as health and safety concerns and limitations on travel and mobility. In addition, disruptions in air travel and other forms of travel can result in the payment of claims under travel protection products we offer. A number of actions are taking place across the globe that impact geopolitical stability. Several countries are considering or have implemented tariffs or other trade barriers or restrictions, as well as other measures affecting cross-border commerce and the flow of information, which could have broad economic consequences, impact global supply chains and negatively affect our business, customers and partners. There are multiple ongoing military conflicts (such as the Russia-Ukraine and Middle East conflicts) and geopolitical tensions may result in additional conflicts or escalate existing conflicts. Following the Russian invasion of Ukraine, we announced that we suspended business operations in Russia and Belarus, and these conflicts have led to economic uncertainty and market disruptions, including the imposition of sanctions and export controls. The broader consequences remain uncertain, but geopolitical conditions may adversely affect macroeconomic conditions and our business in a number of ways, including regional 23 23 23 Table of Contents Table of Contents instability, increased prevalence and sophistication of cyberattacks, potential retaliatory action against companies such as us, further sanctions activity and related regulatory scrutiny, increased inflation, further increases or fluctuations in commodity and energy prices, decreases in global travel and further disruptions to the global supply chain. If international political instability and geopolitical tensions continue or increase, our business and results of operations could be harmed. Hurricanes, wildfires and other natural disasters have impacted, and may continue to impact, spending and credit performance in the areas affected. For example, there can be no assurance as to the ultimate impact of the Los Angeles area wildfires on spending levels and credit performance. Disasters and catastrophic events, and the impact of such events on certain industries or the overall economy, could have a negative effect on our business, results of operations and infrastructure, including our technology and systems. Climate-related risks may exacerbate certain of these threats, including the frequency and severity of weather-related events. Card Members in California, Florida, New York, Texas, Georgia and New Jersey account for a significant portion of U.S. consumer and small business billed business and Card Member loans, and our results of operations could be impacted by events or conditions that disproportionately or specifically affect one or more of those states.

Geopolitical conditions, terrorist attacks, military conflicts, natural disasters, severe weather, widespread health emergencies or pandemics, information or cybersecurity incidents (including intrusion into or degradation or unavailability of systems or technology by cyberattacks), operational incidents and other catastrophic events can have a material adverse effect on our business. Political and social conditions, including actions upending geopolitical stability (such as from tensions involving China and the U.S.), fiscal and monetary policies (including developments related to the U.S. federal debt ceiling, budgetary issues and government shutdowns), trade wars and tariffs, labor shortages, regional or domestic hostilities, economic sanctions and the prospect or occurrence of more widespread conflicts could also negatively affect our business, operations and partners, consumer and business spending, including travel patterns and business investment, and demand for credit. Because we derive a portion of our revenues from travel-related spending, our business is sensitive to safety concerns related to travel and tourism, limitations on travel and mobility and health-related risks. In addition, disruptions in air travel and other forms of travel can result in the payment of claims under travel protection products we offer. The COVID-19 pandemic had widespread, rapidly evolving and unpredictable impacts on global society, economies, financial markets and consumer and business behaviors. The pandemic and resulting containment measures adversely impacted a significant portion of our network volumes. The global macroeconomic outlook continues to remain uncertain due to a variety of factors, including the emergence of new variants, impacts to the labor market, supply chain disruptions and inflation. The extent to which our business and results of operations may continue to be adversely affected by this macroeconomic uncertainty will depend on numerous evolving factors and future developments, including the continued spread and severity of the virus and new variants; the availability, distribution, use and effectiveness of treatments and vaccines; the extent and duration of lingering effects on the economy, inflation, consumer confidence and consumer and business spending; and the impact on consumers and businesses as forbearance and government support programs end, including the end of the moratorium on student loan repayments. Several military conflicts are taking place across the world (such as the ongoing Russia-Ukraine and Israel-Hamas wars), which may adversely affect our business, and geopolitical tensions may result in additional conflicts or escalate existing conflicts. Following the Russian invasion of Ukraine, we announced that we suspended business operations in Russia and Belarus and this 22 22 22 Table of Contents Table of Contents conflict has led to economic uncertainty and market disruptions, including the imposition of financial and economic sanctions and export controls designed to constrain Russia. The conflict in Israel and surrounding areas has also created economic uncertainty and regional instability, including due to the risk of escalation into a wider regional conflict, and resulted in the imposition of sanctions targeting Hamas-affiliated individuals and entities. The broader consequences of these conflicts remain uncertain, but may include further sanctions, regional instability and geopolitical shifts, increased prevalence and sophistication of cyberattacks, potential retaliatory action against companies such as us, heightened regulatory scrutiny related to sanctions compliance, increased inflation, further increases or fluctuations in commodity and energy prices, decreases in global travel, further disruptions to the global supply chain and other adverse effects on macroeconomic conditions. Hurricanes and other natural disasters have impacted spending and credit performance in the areas affected. Other disasters or catastrophic events in the future, and the impact of such events on certain industries or the overall economy, could have a negative effect on our business, results of operations and infrastructure, including our technology and systems. Climate change may exacerbate certain of these threats, including the frequency and severity of weather-related events. Card Members in California, Florida, New York, Texas, Georgia and New Jersey account for a significant portion of U.S. consumer and small business billed business and Card Member loans, and our results of operations could be impacted by events or conditions that disproportionately or specifically affect one or more of those states.

There are increasing and rapidly evolving concerns over climate-related risks and related environmental sustainability and recovery matters. We face physical risks related to climate, including rising average global temperatures, rising sea levels and an increase in the frequency and severity of extreme weather events and natural disasters. Such events and disasters could disrupt our operations or the operations of customers or third parties on which we rely and could result in market volatility or negatively impact our customers’ spending behaviors or ability to pay outstanding loans. Additionally, we may face risks related to the transition to a low-carbon economy. Changes in consumer preferences, travel patterns and legal requirements could impact our revenues or expenses or otherwise adversely affect our business, our customers and partners. We may not be able to effectively identify, measure or control our exposure to climate-related risks, particularly given that the timing, nature and severity of the impacts of these risks may not be predictable. We could be criticized for the timing, scope or nature of our climate-related initiatives and goals. There can be no assurance that we will achieve these goals, which depend in part on third-party performance, data that is outside of our control and methodologies that may evolve over time. We could be required to change our business, management practices and partnerships, incur expenses from changes to our technology, operations, products and services, and experience reputational harm as a result of negative public sentiment, regulatory scrutiny and reduced stakeholder confidence, due to our response or perceived lack of response to climate and environmental issues.

There are increasing and rapidly evolving concerns over the risks of climate change and related environmental sustainability matters. We face physical risks related to climate change, including rising average global temperatures, rising sea levels and an increase in the frequency and severity of extreme weather events and natural disasters. Such events and disasters could disrupt our operations or the operations of customers or third parties on which we rely and could result in market volatility or negatively impact our customers’ spending behaviors or ability to pay outstanding loans. Additionally, we may face risks related to the transition to a low-carbon economy. Changes in consumer preferences, travel patterns and legal requirements could impact our revenues or expenses or otherwise adversely affect our business, our customers and partners. We and other parties in our value chain are expected to be subject to additional climate and other environmental-related obligations arising from legislation and regulation in the United States and abroad, including those that may impose inconsistent or conflicting requirements. Banking regulators and other governmental authorities and stakeholders are increasingly focused on the issue of climate risk at financial institutions, and several of the U.S. federal bank regulatory agencies have issued principles designed to provide a framework for the management of climate-related risks. Legislators and regulators have begun to mandate, or are considering mandating, 33 33 33 Table of Contents Table of Contents disclosure of additional climate-related information by companies, even as the availability and quality of such information remains limited. We could also be required to change our business and management practices and experience increased expenses resulting from strategic planning, litigation and changes to our technology, operations, products and services, as well as reputational harm as a result of negative public sentiment, regulatory scrutiny and reduced stakeholder confidence, due to our response to climate change and our efforts relating to the Advancing Climate Solutions pillar of our ESG strategy. Our risk management framework may not be effective in identifying, measuring and controlling our exposure to climate-related risks, particularly given that the timing, nature and severity of the impacts of climate change may not be predictable.

We use models and automation throughout our business, including to inform and support decision making, manage risks and estimate financial values. Although we have a governance framework for model development and independent model validation, the modeling methodology or key assumptions could be erroneous or the models could be misused. In addition, issues with the quality or effectiveness of our data aggregation and validation procedures, as well as the quality and integrity of data inputs, could result in ineffective or inaccurate model outputs and reports. For example, models based on historical data sets might not be accurate predictors of future outcomes, such as because of changes in the credit profile of our Card Members, and they may not be able to predict future outcomes. Additionally, we increasingly use models that leverage artificial intelligence, which are subject to additional risks such as biased or inaccurate results or lowered interpretability. Our models also may not be able to function properly in the current geopolitical and macroeconomic environment given the lack of recent precedent. Certain models, such as models for credit loss accounting under Current Expected Credit Loss (CECL) and Membership Rewards liability, require us to make difficult, subjective and complex judgments, and utilize forward-looking information. If our business decisions or financial estimates are based on incorrect or misused models and assumptions or we fail to manage data inputs effectively and to aggregate or analyze data in an accurate and timely manner, our results of operations and financial condition may be materially adversely affected. 34 34 34 Table of Contents Table of Contents

Our risk management framework seeks to identify and mitigate risk and appropriately balance risk and return. Although we have devoted significant resources to develop our risk management policies and procedures and expect to continue to do so in the future, these policies and procedures, as well as our risk management techniques, such as our hedging strategies, may not be fully effective. There may also be risks that exist, or develop in the future, that we have not appropriately identified or mitigated. As regulations, technology and competition continue to evolve, our risk management framework may not always keep sufficient pace with those changes. If our risk management framework does not effectively identify or mitigate our risks, we could suffer unexpected losses and could be materially adversely affected. Management of our risks in some cases depends upon the use of analytical and/or forecasting models. Although we have a governance framework for model development and independent model validation, the modeling methodology or key assumptions could be erroneous or the models could be misused. In addition, issues with the quality or effectiveness of our data aggregation and validation procedures, as well as the quality and integrity of data inputs, could result in ineffective or inaccurate model outputs and reports. For example, models based on historical data sets might not be accurate predictors of future outcomes, such as because of changes in the credit profile of our Card Members, and they may not be able to predict future outcomes. Our models also may not be able to function properly in the current geopolitical and macroeconomic environment given the lack of recent precedent. The CECL methodology requires measurement of expected credit losses for the estimated life of certain financial instruments, not only based on historical experience and current conditions, but also by including forecasts incorporating forward-looking information. If our business decisions or estimates for credit losses are based on incorrect or misused models and assumptions or we fail to manage data inputs effectively and to aggregate or analyze data in an accurate and timely manner, our results of operations and financial condition may be materially adversely affected.