CME Group Inc.: 10-K Risk Factor Changes

2025 vs 2024  ·  SEC EDGAR  ·  2026-10-16
Other years: 2026 vs 2025
⚠ AI Risk Brief Interpretation layer — deterministic data below

CME refined customer retention risk language and global expansion complexity; one legacy risk removed. Net profile neutral.

Direction · Neutral
✓ Deterministic extraction — no AI-generated data

Classification is based on semantic text similarity scoring and may include approximations. “No match” means no high-confidence textual match was found — not necessarily that a section was removed.

0
New Risks
1
Removed
2
Modified
22
Unchanged
🟡 Modified Disclosure change7/10

Our trading volume, and consequently our revenues and profits, would be adversely affected if we are unable to retain our current customers at substantially similar trading levels or attract new customers.

high match confidence

Sentence-level differences:

  • Added sentence: "The success of our business depends, in part, on our ability to maintain and increase trading volume in our markets."
  • Added sentence: "To do so, we must maintain and expand our product offerings, our customer base and our trade execution facilities, our pre-and post-trade services and clearing facilities."
  • Added sentence: "Our success also depends on our ability to offer competitive prices and services in an increasingly price-sensitive business."
  • Added sentence: "For example, some of our competitors have engaged in aggressive pricing strategies in the past, such as lowering the fees they charge for taking liquidity and increasing liquidity payments or rebates."
  • Added sentence: "We cannot provide assurances that we will be able to continue to expand our products and services, that we will be able to retain our current customers or attract new customers or that we will not be required to modify our pricing structure to compete effectively."

Current (2025):

View prior text (2024)

We regard the secure storage and transmission of data and the ability to continuously transact and clear on our electronic trading platforms as critical elements of our operations and our operational resiliency. Our technology, our customers, our people and our third-party service providers may be vulnerable to targeted attacks, such as "phishing" attacks, unauthorized access, fraud, computer viruses, denial of service attacks, terrorism, "ransomware" attacks, attacks created through artificial intelligence, firewall or encryption failures or other security or operational risks. Criminal groups, political activist groups and nation-state actors have targeted the financial services industry in general, including as a result of wars, and our role in the global marketplace places us at significant risk for a cyber attack and other information security threats. While to date we have not experienced cyber incidents that are individually, or in the aggregate, material, we and certain of our third party providers have experienced cyber attacks of varying degrees in the past.

Our usage of mobile, web, and cloud technologies, such as those pursuant to our partnership with Google Cloud, may increase our risk of a cyber attack. Our security defenses may also be impacted or breached due to employee error, malfeasance, system errors or vulnerabilities. Additionally, outside parties may attempt to fraudulently induce employees, users, customers or our third party providers to disclose sensitive information in order to gain access to our technology systems and data, or our customers’ data. Any such breach or unauthorized access could result in significant legal and financial exposure, damage to our reputation, and a loss of confidence in the services we provide that could potentially have an adverse effect on our business, while resulting in regulatory penalties or the imposition of additional obligations by regulators or others. The regulatory environment related to information security, privacy, data collection, data usage and use of artificial intelligence is increasingly rigorous and complex, and any failure to comply may carry significant penalties and reputational damage.

We have designed our cyber defense program to mitigate such attacks and security risks through administrative, physical and technical safeguards. As part of our global information security and privacy programs, we employ resources to prevent, detect and respond to cyber attacks and security risks that could impact our people, processes and technology infrastructure, including rapid response to zero-day vulnerabilities. However, our security measures or those of our third-party providers, including any cloud-based technologies, such as those pursuant to our partnership with Google Cloud, may prove insufficient depending upon the attack or threat posed. Any security attack or breach could result in system failures and delays, malfunctions in our operations, loss of customers or lower trading volume, loss of competitive position, damage to our reputation, disruption of our business, legal liability or regulatory fines and significant costs, which in turn may cause our revenues and earnings to decline. We may be subject to litigation and financial losses that exceed our insurance policy limits or are not covered under any of our current policies.

🔴 No Match in Current Filing Our trading volume, and consequently our revenues and profits, would be adversely affected if we are unable to retain our current customers at substantially similar trading levels or attract new customers. 🔒
🟡 Modified The expansion of our global operations is complex and subjects us to increased business and economic risks that could adversely affect our financial results. 🔒
2 changes in this historical filing

The complete historical comparison (2025 vs 2024) is available on the Pro plan.

Get Pro access Already a Pro subscriber? View full diff →