Global Payments Inc.: 10-K Risk Factor Changes

We have designed our risk identification, assessment, and management processes and procedures to account for cybersecurity risks associated with our use of third-party service providers. In addition to performing periodic assessments of vendors that include evaluating those vendors for cybersecurity risks, we endeavor to reduce supply chain cybersecurity risks by: (1) seeking to impose contractual requirements on our counterparties related to the use and security of personal data and other confidential information, as well as compliance with applicable privacy and security laws, wherever required by law to do so; and (2) requiring new software integrations and connectivity with vendors to undergo an architectural review process that involves consultation with the information security function and other relevant stakeholders. Moreover, critical vendors receive periodic comprehensive risk assessments conducted by the vendor management office (a team within ERM), in collaboration with Information Security and our Business Resiliency Governance ("BRG") team, that include a focus on the vendor’s cybersecurity practices.