Fiserv Inc.: 10-K Risk Factor Changes

For the foreseeable future, we expect to continue to derive revenue primarily from products and services we provide to the financial services industry and from our merchant acquiring business. Given this focus, we are exposed to global economic conditions and adverse economic trends may accelerate the timing, or increase the impact of, risks to our financial performance. Such trends may include, but are not limited to, the following: •inflation, foreign currency fluctuations, declining economies, social unrest, natural disasters, public health crises, including the occurrence of a contagious disease or illness, and the pace of economic recovery can change consumer spending behaviors, on which a significant portion of our revenues are dependent; •low levels of consumer and business confidence typically associated with recessionary environments and those markets experiencing relatively high inflation and/or unemployment, may cause decreased spending by cardholders; •budgetary concerns in the U.S. and other countries around the world could affect the U.S. and other specific sovereign credit ratings, impact consumer confidence and spending, and increase the risks of operating in those countries; •emerging market economies tend to be more volatile than the more established markets we serve in the U.S. and Europe, and adverse economic trends, including high rates of inflation, may be more pronounced in such emerging markets; •financial institutions may restrict credit lines to cardholders or limit the issuance of new cards to mitigate cardholder defaults; •uncertainty and volatility in the performance of our clients’ businesses may make estimates of our revenues, rebates, incentives, and realization of prepaid assets less predictable; •our clients may decrease spending for value-added services; and •government intervention, including the effect of laws, regulations, treaties and/or government investments in our clients, may have potential negative effects on our business, operations and our relationships with our clients or otherwise alter their strategic direction away from our products. A weakening in the economy or competition from other retailers could force some retailers to close, resulting in exposure to potential credit losses and declines in transactions, and reduced earnings on transactions due to a potential shift to large discount merchants. Additionally, credit card issuers may reduce credit limits and become more selective in their card issuance practices. A prolonged poor economic environment, including a potential recession in the U.S. or other economies in which our business operates, could result in significant decreases in demand by current and potential clients for our products and services and in the number and dollar amount of transactions we process or accounts we service, which could have a material adverse effect on our business, results of operations and financial condition.

For the foreseeable future, we expect to continue to derive revenue primarily from products and services we provide to the financial services industry and from our merchant acquiring business. Given this focus, we are exposed to global economic conditions and adverse economic trends may accelerate the timing, or increase the impact of, risks to our financial performance. Such trends may include, but are not limited to, the following: •inflation, foreign currency fluctuations, declining economies, social unrest, natural disasters, public health crises, including the occurrence of a contagious disease or illness, and the pace of economic recovery can change consumer spending behaviors, on which a significant portion of our revenues are dependent; •low levels of consumer and business confidence typically associated with recessionary environments and those markets experiencing relatively high inflation and/or unemployment, may cause decreased spending by cardholders; •budgetary concerns in the U.S. and other countries around the world could affect the U.S. and other specific sovereign credit ratings, impact consumer confidence and spending, and increase the risks of operating in those countries; •emerging market economies tend to be more volatile than the more established markets we serve in the U.S. and Europe, and adverse economic trends, including high rates of inflation, may be more pronounced in such emerging markets; •financial institutions may restrict credit lines to cardholders or limit the issuance of new cards to mitigate cardholder defaults; •uncertainty and volatility in the performance of our clients’ businesses may make estimates of our revenues, rebates, incentives, and realization of prepaid assets less predictable; •our clients may decrease spending for value-added services; and •government intervention, including the effect of laws, regulations, treaties and/or government investments in our clients, may have potential negative effects on our business, operations and our relationships with our clients or otherwise alter their strategic direction away from our products. A further weakening in the economy or competition from other retailers could also force some retailers to close, resulting in exposure to potential credit losses and declines in transactions, and reduced earnings on transactions due to a potential shift to large discount merchants. Additionally, credit card issuers may reduce credit limits and become more selective in their card issuance practices. A prolonged poor economic environment, including a potential recession in the U.S. or other economies in which our business operates, could result in significant decreases in demand by current and potential clients for our products and services and in the number and dollar amount of transactions we process or accounts we service, which could have a material adverse effect on our business, results of operations and financial condition. In Europe, we are continuing to assess the implications of the U.K. leaving the E.U. (“Brexit”). We cannot predict the impact that Brexit, including any future trade agreements, divergence in law or currency fluctuations, will have on our business and our clients, and it is possible that it may adversely affect our operations and financial results.

Cybersecurity and data privacy risks have received heightened legislative and regulatory attention. In Europe, the General Data Protection Regulation (“GDPR”) extends the scope of the E.U. data protection law to all companies processing data of individuals within the E.U., regardless of the company’s location, subject to certain limitations. The law requires companies to meet stringent requirements regarding the handling of personal data. E.U. data protection law continuously develops and requires significant changes to our policies and procedures. We are also subject to U.K. GDPR following the U.K.’s exit from the E.U. Single Market and Customs Union. Our efforts to comply with E.U., U.K. and other privacy and data protection laws around the world that apply to our businesses could involve substantial expenses, divert resources from other initiatives and projects and limit the services we are able to offer. There is also increased focus on data localization requirements around the world in countries such as the United Arab Emirates, China and India which could impact our business model with respect to our storage and transfer of personal data. In addition, U.S. regulators, including the U.S. Federal Banking Agencies and the U.S. Federal Trade Commission have adopted or proposed enhanced cyber and privacy security standards that apply to us and our financial institution clients and address cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience and situational awareness. Legislation and regulations on cybersecurity, data privacy and data localization may compel us to enhance or modify our systems, invest in new systems or alter our business practices or our policies on data governance and privacy. If any of these outcomes were to occur, our operational costs could increase significantly. Failure to comply with applicable laws in this area could also result in significant fines, penalties and reputational damage.

Cybersecurity and data privacy risks have received heightened legislative and regulatory attention. In Europe, the General Data Protection Regulation (“GDPR”) extends the scope of the E.U. data protection law to all companies processing data of individuals within the E.U., regardless of the company’s location, subject to certain limitations. The law requires companies to meet stringent requirements regarding the handling of personal data. E.U. data protection law continuously develops and requires significant changes to our policies and procedures. For example, in 2020, the Court of Justice of the E.U. issued a decision that invalidated the European Commission’s adequacy decision for the E.U.-U.S. Privacy Shield Framework and placed additional safeguards necessary for transfers of personal data to the U.S., requiring companies and regulators to conduct case-by-case analyses to determine whether foreign protections concerning government access to transferred data meet E.U. standards. Together with our vendors and clients, we have been directly impacted by this decision, and our ability to transfer data outside the E.U. may be further impacted by determinations made by regulators in the E.U. We are also subject to U.K. GDPR following the U.K.’s exit from the E.U. Single Market and Customs Union. Our efforts to comply with E.U., U.K. and other privacy and data protection laws around the world that apply to our businesses could involve substantial expenses, divert resources from other initiatives and projects and limit the services we are able to offer. There is also increased focus on data localization requirements around the world in countries such as the United Arab Emirates, China and India which could impact our business model with respect to our storage and transfer of personal data. Failure to comply with applicable laws in this area could also result in significant fines, penalties and reputational damage. In addition, U.S. banking agencies have adopted or proposed enhanced cyber risk management standards that would apply to us and our financial institution clients and that would address cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience and situational awareness. Several states also have adopted or proposed new privacy and cybersecurity laws targeting these issues. Legislation and regulations on cybersecurity, data privacy and data localization may compel us to enhance or modify our systems, invest in new systems or alter our business practices or our policies on data governance and privacy. If any of these outcomes were to occur, our operational costs could increase significantly. 17 17 17 Table of Contents Table of Contents

Our businesses are subject to state, federal, and foreign laws and regulations, including payment, cybersecurity, consumer protection, money transmission, data privacy, anti-money laundering, economic and trade sanctions, payment institution, electronic money licensing, credit reporting and debt collection laws and regulations. Our clients are also subject to numerous laws and regulations applicable to banks, financial institutions and card issuers in the U.S. and abroad, and, consequently, we are at times affected by these federal, state, local and foreign laws and regulations. These laws and regulations are subject to change, and new laws, regulations and interpretations are regularly adopted. We operate our business around the world, including in certain foreign countries with developing economies where companies often engage in business practices that are prohibited by laws applicable to us, including the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act. These laws prohibit, among other things, improper payments or offers of payments to foreign governments and their officials and political parties for the purpose of obtaining or retaining business. We also derive revenue from transactions involving sales to U.S. federal, state and local governments and their respective agencies, and are subject to various procurement laws, regulations, and contract provisions relating to those contracts. We have implemented policies and training programs to comply with applicable laws, regulations and obligations; however, there can be no assurance that all of our employees, consultants and agents will comply with our policies and all applicable laws and any noncompliance could subject us to fines, penalties and loss of business. The volume and complexity of the regulations that impact our business, directly or indirectly, will continue to increase our cost of doing business. If we or third parties with whom we partner or contract fail to comply with applicable laws and regulations, we could be exposed to litigation or regulatory proceedings, our client relationships and reputation could be harmed, our ability to obtain new clients could be inhibited, we could be required to change the manner in which we conduct our business or suspend or terminate certain services, and we could incur significant fines, penalties, or losses, all of which could have a material adverse impact on our business, results of operations and financial condition.

If we or third parties with whom we partner or contract fail to comply with laws and regulations applicable to our business, including state and federal payment, cybersecurity, consumer protection, trade and data privacy laws and regulations, we could be exposed to litigation or regulatory proceedings, our client relationships and reputation could be harmed, and our ability to obtain new clients could be inhibited, which could have a material adverse impact on our business, results of operations and financial condition. Our clients are also subject to numerous laws and regulations applicable to banks, financial institutions and card issuers in the U.S. and abroad, and, consequently, we are at times affected by these federal, state, local and foreign laws and regulations. These laws and regulations are subject to change, and new laws, regulations and interpretations are regularly adopted. Certain of our subsidiaries are licensed as money transmitters and are required, among other matters, to demonstrate and maintain certain levels of net worth and liquidity and to file periodic reports. Our direct-to-consumer payments businesses are subject to state and federal regulations in the U.S., including state money transmission regulations, anti-money laundering regulations, economic and trade sanctions administered by the U.S. Treasury Department’s Office of Foreign Asset Control (“OFAC”) and certain privacy regulations, such as the U.S. Gramm-Leach-Bliley Act. Our Money Network Financial, LLC subsidiary must meet the requirements of the Financial Crimes Enforcement Network because it is the program manager for various prepaid card programs. We operate businesses that are subject to credit reporting and debt collection laws and regulations in the U.S. and certain of our subsidiaries are subject to privacy, anti-money laundering, debt collection, and payment institution or electronic money licensing regulations outside the U.S. We operate our business around the world, including in certain foreign countries with developing economies where companies often engage in business practices that are prohibited by laws applicable to us, including the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act. These laws prohibit, among other things, improper payments or offers of payments to foreign governments and their officials and political parties for the purpose of obtaining or retaining business. We also derive revenue from transactions involving sales to U.S. federal, state and local governments and their respective agencies, and are subject to various procurement laws, regulations, and contract provisions relating to those contracts. We have implemented policies and training programs to comply with applicable laws, regulations and obligations; however, there can be no assurance that all of our employees, consultants and agents will comply with our policies and all applicable laws and any noncompliance could subject us to fines, penalties and loss of business. We are also subject to certain economic and trade sanctions programs, including those that are administered by OFAC, which prohibit or restrict transactions to or from, or dealings with, specified countries, their governments, individuals and entities that are specially-designated nationals of those countries, narcotics traffickers and terrorists or terrorist organizations. Similar anti-money laundering, counter terrorist financing and proceeds of crime laws apply to movements of currency and payments through electronic transactions and to dealings with persons specified in lists equivalent to OFAC lists in several other countries and require specific data retention obligations to be observed by intermediaries in the payment process. Our businesses in those jurisdictions are subject to those data retention obligations. The volume and complexity of the regulations that impact our business, directly or indirectly, will continue to increase our cost of doing business. Failure to comply with these laws and regulations, or changes in the regulatory environment, including changing interpretations and the implementation of new, varying or more restrictive laws and regulations by federal, state, local or foreign governments, may result in significant financial penalties, reputational harm, suspension or termination of our ability to provide certain services, or change or restrict the manner in which we currently conduct our business, all of which could have a material adverse impact on our business, results of operations and financial condition.

The markets for our products and services are characterized by constant and rapid technological change, evolving industry standards, frequent introduction of new products and services, and increasing client expectations. Our ability to respond timely to these changes, including by enhancing our current products and services and developing and introducing new products and services, will significantly affect our future success. In addition, the success of certain of our products and services rely, in part, on financial institutions, business partners and other third parties promoting the use of or distributing our products and services. If we are unsuccessful in developing, marketing and selling products or services that gain market acceptance, or if third parties insufficiently promote or distribute our products and services, it would likely have a material adverse effect on our ability to retain existing clients, to attract new ones and to grow profitably. We believe that data, and the insights enabled by data, can be used to create or enhance the products and services that we offer to our clients. As a result, we are using, and expect to continue to expand our use of, artificial intelligence and machine learning. However, legislation that would govern the development or use of artificial intelligence is under consideration in the U.S. at the state and local level, as well as abroad. As a result, the ability to use artificial intelligence and machine learning may be constrained by current or future laws, regulatory or self-regulatory requirements.

The markets for our products and services are characterized by constant and rapid technological change, evolving industry standards, frequent introduction of new products and services, and increasing client expectations. Our ability to respond timely to these changes, including by enhancing our current products and services and developing and introducing new products and services, will significantly affect our future success. In addition, the success of certain of our products and services rely, in part, on financial institutions, business partners and other third parties promoting the use of or distributing our products and services. If we are unsuccessful in developing, marketing and selling products or services that gain market acceptance, or if third parties 11 11 11 Table of Contents Table of Contents insufficiently promote or distribute our products and services, it would likely have a material adverse effect on our ability to retain existing clients, to attract new ones and to grow profitably.