Moody's Corporation: 10-K Risk Factor Changes

Moody’s reputation and the strength of its brand are key competitive strengths. To the extent that the credit rating business as a whole or Moody's, relative to its competitors, suffers a loss in credibility, Moody’s business will be significantly impacted. Factors that may have already affected credibility and could potentially continue to have an impact in this regard include the appearance of conflicts of interest, the performance of securities relative to the ratings assigned to such securities, the timing and nature of changes in ratings and rating methodologies, a major compliance failure, negative perceptions or publicity and increased criticism by users of ratings, regulators and legislative bodies, including as to the ratings process, or the Company’s recent sustainability strategies and our incorporation of climate- and other sustainability-related risks in the Company's rating process, and intentional, poor representation of our products and services by our partners or agents, manipulation of our products and services by third parties, or unintentional misrepresentations of Moody’s products and services in advertising materials, public relations information, social media or other external communications. Operational errors, including calculation or methodological errors, or errors in software or data, whether by Moody’s or a Moody’s competitor, could also harm the reputation of the Company or the industries in which the Company operates. Additionally, as Moody's develops its Gen AI product offerings, the Company may incur risks or challenges in its adoption, such as falling behind market expectations for the performance and cost savings related to these offerings, as well as for Moody's perceived expertise regarding these offerings, that could lead to reputational harm. Damage to reputation and credibility could have a material adverse impact on Moody’s business, operating results and financial condition, as well as on the Company’s ability to find suitable candidates for acquisition.

Moody’s reputation and the strength of its brand are key competitive strengths. To the extent that the rating agency business as a whole or Moody's, relative to its competitors, suffers a loss in credibility, Moody’s business will be significantly impacted. Factors that may have already affected credibility and could potentially continue to have an impact in this regard include the appearance of a conflict of interest, the performance of securities relative to the rating assigned to such securities, the timing and nature of changes in ratings, a major compliance failure, negative perceptions or publicity and increased criticism by users of ratings, regulators and legislative bodies, including as to the ratings process, or the Company’s recent ESG initiatives and our incorporation of climate- and other ESG- related risks in the Company's rating process, and its implementation with respect to one or more securities and intentional, poor representation of our products and services by our partners or agents, manipulation of our products and services by third parties, or unintentional misrepresentations of Moody’s products and services in advertising materials, public relations information, social media or other external communications. Operational errors, or errors in software or data, whether by Moody’s or a Moody’s competitor, could also harm the reputation of the Company or the industries in which the Company operates. Additionally, as Moody's develops its Gen AI product offerings, the Company may incur risks or challenges in its adoption that could lead to reputational harm. Damage to reputation and credibility could have a material adverse impact on Moody’s business, operating results and financial condition, as well as on the Company’s ability to find suitable candidates for acquisition.

Moody’s faces exposure to litigation and government and regulatory proceedings, investigations and inquiries (including market studies) related to MIS’s ratings actions, as well as other business practices and products within both MIS and MA. When the market value of credit-dependent instruments has declined or defaults have occurred, whether as a result of difficult economic times, rapid changes in interest rates, decreased liquidity, turbulent markets or otherwise, the number of investigations and legal proceedings that Moody’s has faced has increased significantly. Parties who invest in securities rated by MIS or issued by MIS-rated entities have pursued claims against MIS or Moody’s for losses they faced in their portfolios. For instance, Moody’s faced numerous class action lawsuits and other litigation, government investigations and inquiries (including market studies) concerning events linked to the U.S. subprime residential mortgage sector and broader deterioration in the credit markets during and after the financial crisis of 2007-2008. Evolving and/or inconsistent expectations regarding climate-risk and other sustainability disclosures and reporting could also result in increased regulatory scrutiny and new regulatory actions at a corporate and business unit level. MA’s offering of products and services relating to sanctions, KYC and financial crime may result in increased regulatory scrutiny and could expose the Company to increased risk of litigation from data subjects and other third-parties, including due to potential inaccuracies in the products and services we offer, as well as regulatory recordkeeping requirements associated with our services. Additionally, as Moody’s develops its Gen AI product offerings and/or increases its use of Gen AI, the Company may face increased regulatory scrutiny and exposure to increased litigation. Legal proceedings and regulatory inquiries and investigations impose additional expenses on the Company and require the attention of senior management to an extent that may significantly reduce their ability to devote time to addressing other business issues, and any of these proceedings, investigations or inquiries (including market studies) could ultimately result in adverse judgments, damages, fines, penalties or activity restrictions. Risks relating to legal proceedings are heightened in foreign jurisdictions that lack the legal protections or liability standards comparable to those that exist in the U.S. In addition, new laws and regulations have been and may continue to be enacted that establish lower liability standards, shift the burden of proof or relax pleading requirements, thereby increasing the risk of successful litigations in the U.S. and in foreign jurisdictions. These litigation risks are often difficult to assess or quantify. Moody’s may not have adequate insurance or reserves to cover these risks, and the existence and magnitude of these risks often remain unknown for substantial periods of time. Furthermore, when Moody’s is unable to achieve dismissals at an early stage and litigation matters proceed to trial, the aggregate legal defense costs incurred by Moody’s increase substantially, as does the risk of an adverse outcome. Additionally, as litigation or the process to resolve pending matters progress, Moody’s will continue to review the latest information available and may change its accounting estimates, which could require Moody’s to record or increase liabilities in the consolidated financial statements in future periods. See Note 21 to the consolidated financial statements for more information regarding ongoing investigations and civil litigation that the Company currently faces. Due to the potential number of these proceedings and the significant amount of damages that could be sought, there is a risk that Moody’s will be subject to judgments, settlements, fines, penalties or other adverse results that have a material adverse effect on its business, operating results and financial condition.

Moody’s faces exposure to litigation and government and regulatory proceedings, investigations and inquiries related to MIS’s ratings actions, as well as other business practices and products within both MIS and MA. When the market value of credit-dependent instruments has declined or defaults have occurred, whether as a result of difficult economic times, turbulent markets or otherwise, the number of investigations and legal proceedings that Moody’s has faced has increased significantly. Parties who invest in securities rated by MIS have pursued claims against MIS or Moody’s for losses they faced in their portfolios. For instance, MOODY'S 2023 10-K 27 MOODY'S 2023 10-K 27 MOODY'S 2023 10-K 27 Table of Contents Table of Contents Moody’s faced numerous class action lawsuits and other litigation, government investigations and inquiries concerning events linked to the U.S. subprime residential mortgage sector and broader deterioration in the credit markets during the financial crisis of 2007-2008. Evolving expectations on ESG disclosures and reporting could also result in increased regulatory scrutiny and new regulatory actions at a corporate and business unit level. MA’s offering of products and services relating to sanctions, KYC and financial crime may result in increased regulatory scrutiny and could expose the Company to increased risk of litigation from data subjects and other third-parties. Additionally, as Moody’s develops its Gen AI product offerings and/or its uses of Gen AI, the Company may face increased regulatory scrutiny and exposure to increased litigation. Legal proceedings and regulatory inquiries and investigations impose additional expenses on the Company and require the attention of senior management to an extent that may significantly reduce their ability to devote time to addressing other business issues, and any of these proceedings, investigations or inquiries could ultimately result in adverse judgments, damages, fines, penalties or activity restrictions. Risks relating to legal proceedings are heightened in foreign jurisdictions that lack the legal protections or liability standards comparable to those that exist in the U.S. In addition, new laws and regulations have been and may continue to be enacted that establish lower liability standards, shift the burden of proof or relax pleading requirements, thereby increasing the risk of successful litigations in the U.S. and in foreign jurisdictions. These litigation risks are often difficult to assess or quantify. Moody’s may not have adequate insurance or reserves to cover these risks, and the existence and magnitude of these risks often remains unknown for substantial periods of time. Furthermore, when Moody’s is unable to achieve dismissals at an early stage and litigation matters proceed to trial, the aggregate legal defense costs incurred by Moody’s increase substantially, as does the risk of an adverse outcome. Additionally, as litigation or the process to resolve pending matters progresses, Moody’s will continue to review the latest information available and may change its accounting estimates, which could require Moody’s to record or increase liabilities in the consolidated financial statements in future periods. See Note 21 to the consolidated financial statements for more information regarding ongoing investigations and civil litigation that the Company currently faces. Due to the number of these proceedings and the significant amount of damages sought, there is a risk that Moody’s will be subject to judgments, settlements, fines, penalties or other adverse results that have a material adverse effect on its business, operating results and financial condition.

laws in multiple jurisdictions may need to determine a means to comply with such laws. Such conflicts could eventually affect the ability of entities to adhere to applicable laws or continue to operate in certain jurisdictions; –differing and potentially conflicting legal or civil liability, compliance and regulatory standards; –current and future regulations relating to the imposition of mandatory rotation requirements on CRAs hired by issuers of securities; –uncertain, evolving and new laws and regulations, including those applicable to the financial services industries, such as the EU’s implementation of DORA in January 2025, and to the protection of intellectual property and to the emergence of LLMs in the context of Gen AI and other technologies, such as the EU AI Act, including the effect of these laws and regulations on our customers and on the products and services that we offer; –uncertainty regarding the future relationship and increasing tensions between the U.S. and China, which may result in further restrictions or actions by the U.S. government with respect to doing business in China and/or by the Chinese government with respect to business conducted by foreign entities in China; –the possibility of nationalization, expropriation, price controls and other restrictive governmental actions; –competition with CRAs that have greater familiarity, longer operating histories and/or support from local governments or other institutions; –uncertainties in obtaining reliable data and creating products and services relevant to particular geographic markets; –reduced protection for intellectual property rights; –longer payment cycles and possible problems in collecting receivables; –differing accounting principles and standards; –difficulties in staffing and managing foreign operations; –difficulties and delays in translating documentation into foreign languages; –potentially adverse tax consequences; and –complexities of compliance with employment laws, various proposed and enacted data privacy laws, and cybersecurity rules in numerous jurisdictions. Additionally, Moody’s is subject to complex U.S., foreign and other local laws and regulations that are applicable to its operations abroad, such as laws and regulations governing economic and trade sanctions, tariffs, embargoes, and anti-corruption including the Foreign Corrupt Practices Act of 1977, the U.K. Bribery Act of 2010 and other similar local laws. The internal controls, policies and procedures and employee training and compliance programs to deter prohibited practices the Company has implemented may not be effective in preventing employees, contractors or agents from violating or circumventing such internal policies or from material violations of applicable laws and regulations. Any determination or allegations, even if unfounded, that the Company has violated sanctions, anti-bribery or anti-corruption laws could have a material adverse effect on Moody’s business, operating results and financial condition. Compliance with international and U.S. laws and regulations that apply to the Company’s international operations increases the cost of doing business in foreign jurisdictions. Violations of such laws and regulations may result in severe fines and penalties, criminal sanctions, administrative remedies and restrictions on business conduct and could have a material adverse effect on Moody’s reputation, its ability to attract and retain employees, its business, operating results and financial condition.

Moody’s conducts operations in various countries outside the U.S. and derives a significant portion of its revenue from foreign sources. Changes in the economic condition of the various foreign economies in which the Company operates have an impact on the Company’s business. For example, economic uncertainty in the Eurozone or elsewhere, including, but not limited to, in Latin America, China or the Middle East, affects the number of securities offerings undertaken within those particular areas. In addition to the risks addressed elsewhere in this section, operations abroad expose Moody’s to a number of legal, economic and regulatory risks such as: –economic and geopolitical events and market conditions, such as the Russia-Ukraine military conflict and the military conflict in Israel and surrounding areas, including the effect of these events and conditions on customers, customer retention and demands for our products and services; –exposure to exchange rate movements between foreign currencies and USD; –restrictions on the ability to convert local currency into USD and the costs, including the tax impact, of repatriating cash held by entities outside the U.S.; –U.S. laws affecting overseas operations, including domestic and foreign export and import restrictions, tariffs and other trade barriers and restrictions, such as those related to the U.S.’s relationship with China and embargoes and sanctions laws with respect to Russia, including the Russia-Ukraine military conflict; –differing and potentially conflicting legal or civil liability, compliance and regulatory standards; –current and future regulations relating to the imposition of mandatory rotation requirements on CRAs hired by issuers of securities; –uncertain, evolving and new laws and regulations, including those applicable to the financial services industries, such as the European Union’s upcoming implementation of DORA in January 2025, and to the protection of intellectual property and to the emergence of LLMs in the context of Gen AI and other technologies, such as the EU AI Act, including the effect of these laws and regulations on our customers and on the products and services that we offer; –uncertainty regarding the future relationship and increasing tensions between the U.S. and China, which may result in further restrictions or actions by the U.S. government with respect to doing business in China and/or by the Chinese government with respect to business conducted by foreign entities in China; –the possibility of nationalization, expropriation, price controls and other restrictive governmental actions; –competition with CRAs that have greater familiarity, longer operating histories and/or support from local governments or other institutions; –uncertainties in obtaining data and creating products and services relevant to particular geographic markets; –reduced protection for intellectual property rights; MOODY'S 2023 10-K 29 MOODY'S 2023 10-K 29 MOODY'S 2023 10-K 29 Table of Contents Table of Contents –longer payment cycles and possible problems in collecting receivables; –differing accounting principles and standards; –difficulties in staffing and managing foreign operations; –difficulties and delays in translating documentation into foreign languages; –potentially adverse tax consequences; and –complexities of compliance with employment laws, various proposed and enacted data privacy laws, and cybersecurity rules in numerous jurisdictions. Additionally, Moody’s is subject to complex U.S., foreign and other local laws and regulations that are applicable to its operations abroad, such as laws and regulations governing economic and trade sanctions, tariffs, embargoes, and anticorruption including the Foreign Corrupt Practices Act of 1977, the U.K. Bribery Act of 2010 and other similar local laws. The internal controls, policies and procedures and employee training and compliance programs to deter prohibited practices the Company has implemented may not be effective in preventing employees, contractors or agents from violating or circumventing such internal policies or from material violations of applicable laws and regulations. Any determination or allegations, even if unfounded, that the Company has violated sanctions, anti-bribery or anti-corruption laws could have a material adverse effect on Moody’s business, operating results and financial condition. Compliance with international and U.S. laws and regulations that apply to the Company’s international operations increases the cost of doing business in foreign jurisdictions. Violations of such laws and regulations may result in severe fines and penalties, criminal sanctions, administrative remedies and restrictions on business conduct and could have a material adverse effect on Moody’s reputation, its ability to attract and retain employees, its business, operating results and financial condition.

Over the past several years, both in the United States and internationally, regulators, certain investors and other stakeholders have focused on various environmental, social policy, human rights, and other sustainability matters. We communicate certain sustainability initiatives, goals and commitments (including with respect to environmental matters, social matters and other matters), in our various public disclosures, Task Force on Climate-related Financial Disclosures Report, on our website, in our filings with the SEC and elsewhere. These goals or commitments could be challenging to achieve and costly to implement, and could result in scrutiny, criticism or claims from certain stakeholders, including governmental authorities, regulators, shareholders and customers that could negatively impact our business or reputation. Furthermore, MIS incorporates climate and other sustainability-related risks in its rating process, which also could cause reputational risk or could lead to litigation. The Company could fail to achieve, or be perceived to fail to achieve, our net zero 2040 commitment or other sustainability-related initiatives, goals or commitments. Furthermore, we could be criticized for the timing, scope or nature of these initiatives, goals or commitments, or for any changes to them. To the extent that our required and voluntary disclosures about such sustainability matters increase, we could be criticized for the accuracy, sufficiency or completeness of such disclosures. We could be subject to litigation or regulatory enforcement actions regarding the accuracy, sufficiency or completeness of our sustainability-related 30 MOODY'S 2024 10-K 30 MOODY'S 2024 10-K 30 MOODY'S 2024 10-K

Both in the United States and internationally, there is an increasing focus from regulators, certain investors and other stakeholders concerning ESG matters. We communicate certain ESG-related initiatives, goals and/or commitments (including with respect to environmental matters, diversity and other matters), in our various public disclosures, Task Force on Climate-related Financial Disclosures Report, on our website, in our filings with the SEC and elsewhere. These initiatives, goals or commitments could be challenging to achieve and costly to implement. In addition, MIS incorporates climate and other ESG related risks in its rating process, which also could cause reputational risk or could lead to litigation. The Company could fail to achieve, or be perceived to fail to achieve, our net zero 2040 commitment or other ESG-related initiatives, goals or commitments. Furthermore, we could be criticized for the timing, scope or nature of these initiatives, goals or commitments, or for any changes to them. To the extent that our required and voluntary disclosures about such ESG matters increase, we could be criticized for the accuracy, sufficiency or completeness of such disclosures. We could be subject to litigation or regulatory enforcement actions regarding the accuracy, sufficiency or completeness of our ESG-related disclosures. Our actual or perceived failure to achieve our ESG-related initiatives, goals or commitments could negatively impact our reputation or otherwise materially harm our business.

Unauthorized third parties may also try to obtain and use technology or other information that the Company regards as proprietary. It is also possible that Moody’s competitors or other entities could obtain patents or other intellectual property rights related to the types of products and services that Moody’s offers, and attempt to require Moody’s to stop developing or marketing the products or services, to modify or redesign the products or services to avoid infringing, or to obtain licenses from the holders of the intellectual property in order to continue developing and marketing the products and services. Even if Moody’s attempts to assert or protect its intellectual property rights through litigation, it may require considerable cost, time and resources to do so, and there is no guarantee that the Company will be successful. The Company’s ability to establish, maintain and protect its intellectual property and proprietary rights against theft, misappropriation or infringement could be materially and adversely affected by insufficient and/or changing proprietary rights and intellectual property legal protections in some jurisdictions and markets. These risks, and the cost, time and resources needed to address them, may increase as the Company’s business grows and its profile rises in countries with intellectual property regimes that are less protective than the rules and regulations applied in the United States.

Moody’s considers many aspects of its products and services to be proprietary. Failure to protect the Company’s intellectual property adequately could harm its reputation and affect the Company’s ability to compete effectively. Businesses the Company acquires also involve intellectual property portfolios, which increase the challenges the Company faces in protecting its strategic advantage. In addition, the Company’s operating results can be adversely affected by inadequate or changing legal and technological protections for intellectual property and proprietary rights in some jurisdictions and markets, including if and how rights in these markets evolve to address advances in LLMs and Gen AI. The lack of strong legal and technological intellectual property protections in foreign jurisdictions in which we operate may increase our vulnerability and may pose risks to our business. From time to time, laws are passed that require publication of certain information, in some cases at no cost, that the Company considers to be its intellectual property and that it currently sells or licenses for a fee, which could result in lost revenue. Unauthorized third parties may also try to obtain and use technology or other information that the Company regards as proprietary. It is also possible that Moody’s competitors or other entities could obtain patents related to the types of products and services that Moody’s offers, and attempt to require Moody’s to stop developing or marketing the products or services, to modify or redesign the products or services to avoid infringing, or to obtain licenses from the holders of the patents in order to continue developing and marketing the products and services. Even if Moody’s attempts to assert or protect its intellectual property rights through litigation, it may require considerable cost, time and resources to do so, and there is no guarantee that the Company will be successful. The Company’s ability to establish, maintain and protect its intellectual property and proprietary rights against theft, misappropriation or infringement could be materially and adversely affected by insufficient and/or changing proprietary rights and intellectual property legal protections in some jurisdictions and markets. These risks, and the cost, time and resources needed to address them, may increase as the Company’s business grows and its profile rises in countries with intellectual property regimes that are less protective than the rules and regulations applied in the United States.

Moody’s ability to conduct business may be materially and adversely impacted by a disruption in the infrastructure that supports its businesses and the communities in which Moody’s is located, including: (i) New York City, the location of Moody’s headquarters, (ii) major cities worldwide in which Moody’s has offices, and (iii) locations that may be affected by the Russia-Ukraine military conflict and the military conflict in the Middle East. This may include a disruption involving physical or technological infrastructure (whether or not controlled by the Company), including the Company’s electronic delivery systems, the Company's data center facilities, or the Internet, used by the Company or third parties with or through whom Moody’s conducts business. Many of the Company’s products and services are delivered electronically and the Company’s customers depend on the Company’s ability to receive, store, process, transmit and otherwise rapidly handle very substantial quantities of data and transactions on computer-based networks. Some of Moody’s operations require complex processes and the Company’s extensive controls to reduce the risk of error inherent in our operations cannot eliminate such risk completely. To the extent the Company grows through acquisitions, newly acquired businesses may not have invested in technological infrastructure and disaster recovery to the same extent as Moody's has. As their systems are integrated into Moody's, a vulnerability could be introduced, which could impact platforms across the Company. The Company’s customers also depend on the continued capacity, reliability and security of the Company’s telecommunications, data centers, networks and other electronic delivery systems, including its websites and connections to the Internet. The Company’s employees also depend on these systems for internal use. Any significant failure, compromise, cyber-breach, interruption or a significant slowdown of operations of the Company’s infrastructure, whether due to human error, capacity constraints, hardware failure or defect, weather (including climate-related risks), natural disasters, fire, power loss, telecommunication failures, break-ins, 28 MOODY'S 2024 10-K 28 MOODY'S 2024 10-K 28 MOODY'S 2024 10-K

Moody’s ability to conduct business may be materially and adversely impacted by a disruption in the infrastructure that supports its businesses and the communities in which Moody’s is located, including: (i) New York City, the location of Moody’s headquarters, (ii) major cities worldwide in which Moody’s has offices, (iii) locations that may be affected by the Russia-Ukraine military conflict and the military conflict in Israel and surrounding areas; and (iv) locations in China used for certain Moody’s work. This may include a disruption involving physical or technological infrastructure (whether or not controlled by the Company), including the Company’s electronic delivery systems, the Company's data center facilities, or the Internet, used by the Company or third parties with or through whom Moody’s conducts business. Many of the Company’s products and services are delivered electronically and the Company’s customers depend on the Company’s ability to receive, store, process, transmit and otherwise rapidly handle very substantial quantities of data and transactions on computer-based networks. Some of Moody’s operations require complex processes and the Company’s extensive controls to reduce the risk of error inherent in our operations cannot eliminate such risk completely. To the extent the Company grows through acquisitions, newly acquired businesses may not have invested in technological infrastructure and disaster recovery to the same extent as Moody's has. As their systems are integrated into Moody's, a vulnerability could be introduced, which could impact platforms across the Company. The Company’s customers also depend on the continued capacity, reliability and security of the Company’s telecommunications, data centers, networks and other electronic delivery systems, including its websites and connections to the Internet. The Company’s employees also depend on these systems for internal use. Any significant failure, compromise, cyber-breach, interruption or a significant slowdown of operations of the Company’s infrastructure, whether due to human error, capacity constraints, hardware failure or defect, weather (including climate change), natural disasters, fire, power loss, telecommunication failures, break-ins, sabotage, intentional acts of vandalism, acts of terrorism, political unrest, pandemic, war or otherwise, may impair the Company’s ability to deliver its products and services. Moody’s efforts to secure and plan for potential disruptions of its major operating systems may not be successful. The Company relies on third-party providers, including, increasingly, cloud-based service providers, to provide certain essential services. While the Company believes that such providers are reliable, the Company has limited control over the performance of such providers. To the extent any of the Company’s third-party providers ceases to provide these services in an efficient, cost-effective manner or fails to adequately expand its services to meet the Company’s needs and the needs of the Company’s customers, the Company could experience lower revenues and higher costs. Additionally, although the Company maintains processes to prevent, detect and recover from a disruption, the Company also does not have fully redundant systems for most of its smaller office locations and low-risk systems, and its disaster recovery plan does not include restoration of non-essential services. If a disruption occurs in one of Moody’s locations or systems and its personnel in those locations or those who rely on such systems are unable to utilize other systems or communicate with or travel to other locations, such persons’ ability to service and interact with Moody’s customers will suffer. The Company cannot predict with certainty all of the adverse effects that could result from the Company’s failure, or the failure of a third party, to efficiently address and resolve these delays and interruptions. A disruption to Moody’s operations or infrastructure may have a material adverse effect on its reputation, business, operating results and financial condition. 30 MOODY'S 2023 10-K 30 MOODY'S 2023 10-K 30 MOODY'S 2023 10-K Table of Contents Table of Contents

The markets for credit ratings, research, credit risk management services, business intelligence and analytical services are highly competitive and characterized by rapid technological change, including change based on our Gen AI offerings, disruption by the Gen AI offerings of others, changes in customer and investor demands, and evolving regulatory requirements, industry standards and market preferences. The ability to develop and successfully launch and maintain innovative products, technologies and services that anticipate customers’ and investors’ changing requirements and utilize emerging technological trends in a timely and cost-effective manner is a key factor in maintaining a competitive market position. Moody’s competitors include both established companies with significant financial resources, brand recognition, market experience and technological expertise, and smaller companies which may be more agile and better poised to quickly adopt new or emerging technologies or respond to customer requirements. Competitors may develop quantitative methodologies or related services, including services based on Gen AI, for assessing credit risk that customers and market participants may deem preferable, more cost-effective or more valuable than the credit risk assessment methods currently employed by Moody’s, or may position, price or market their products in manners that differ from those utilized by Moody’s. The increased presence of Gen AI in the market could also lead to increased expectations from customers and market participants that higher quality information will be delivered on advanced timelines. Moody’s also MOODY'S 2024 10-K 29 MOODY'S 2024 10-K 29 MOODY'S 2024 10-K 29

The markets for credit ratings, research, credit risk management services, business intelligence and analytical services are highly competitive and characterized by rapid technological change, including change based on our Gen AI offerings, changes in customer and investor demands, and evolving regulatory requirements, industry standards and market preferences. The ability to develop and successfully launch and maintain innovative products, technologies and services that anticipate customers’ and investors’ changing requirements and utilize emerging technological trends in a timely and cost-effective manner is a key factor in maintaining market share. Moody’s competitors include both established companies with significant financial resources, brand recognition, market experience and technological expertise, and smaller companies which may be better poised to quickly adopt new or emerging technologies or respond to customer requirements. Competitors may develop quantitative methodologies or related services, including services based on LLMs and Gen AI, for assessing credit risk that customers and market participants may deem preferable, more cost-effective or more valuable than the credit risk assessment methods currently employed by Moody’s, or may position, price or market their products in manners that differ from those utilized by Moody’s. Moody’s also competes indirectly against consulting firms and technology and information providers, some of whom are also suppliers to Moody’s; these indirect competitors could in the future choose to compete directly with Moody’s, cease doing business with Moody’s or change the terms under which they do business with Moody’s in a way that could negatively impact our business. In addition, customers or others may develop alternative, proprietary systems for assessing risk, including credit and climate risk. Such developments could affect demand for Moody’s products and services and its growth prospects. Further, the increased availability in recent years of free or relatively inexpensive internet information may reduce the demand for Moody’s products and services. Moody’s growth prospects and operating margins also could be adversely affected by Moody’s failure to make necessary or optimal capital infrastructure expenditures and improvements and the inability of its information technologies to provide adequate capacity and capabilities to meet increased demands of producing quality ratings and research products at levels achieved by competitors. Any inability of Moody’s to compete successfully may have a material adverse effect on its business, operating results and financial condition.

Moody's Investors Service. MIS operates in a highly regulated industry. The current U.S. laws and regulations relating to MIS, including the Reform Act and the Dodd-Frank Act: –seek to encourage, and may result in, increased competition among CRAs and in the credit rating business; –may result in alternatives to credit ratings, changes in the pricing of credit ratings, and/or diminished intellectual property protection relating to credit ratings and related research produced by MIS; –restrict the use of information in the development or maintenance of credit ratings; –increase regulatory oversight of the credit markets and CRA operations; –provide the SEC with direct jurisdiction over CRAs that seek NRSRO status, and grant authority to the SEC to inspect the operations of CRAs; and –provide for enhanced oversight standards and specialized pleading standards, which may result in increases in the number of legal proceedings claiming liability for losses suffered by investors on rated securities and aggregate legal defense costs. In addition to the extensive and evolving U.S. laws and regulations governing the credit rating industry, foreign jurisdictions have taken measures to regulate CRAs and the markets for credit ratings that significantly impact the operations and the markets for the Company's ratings-related products and services. In particular, the EU has adopted a common regulatory framework for CRAs operating in the EU, continues to monitor the credit rating industry and analyze approaches that may strengthen existing regulation. The U.K. also has adopted a regulatory framework for CRAs that is based on the EU version. Credit ratings emanating from outside the EU are subject to ESMA's oversight if they are endorsed into the EU, and ratings endorsed into the U.K. are similarly subject to oversight of the FCA. Additionally, other foreign jurisdictions, such as Australia and Hong Kong and China, have taken measures to increase regulation of CRAs and markets for credit ratings. A failure to comply with these procedural and substantive requirements also exposes MIS to the risk of regulatory enforcement action which could result in financial penalties or, in serious cases, affect its ability to conduct credit rating activities in certain jurisdictions. For example: –MIS is subject to formal regulation and periodic or other inspections in the EU and other foreign jurisdictions, such as, but not limited to, the U.K., Australia, Singapore, Japan, and Hong Kong, where it operates through registered subsidiaries. –In the EU and the U.K., applicable rules include procedural requirements with respect to credit ratings of sovereign issuers, liability for intentional or grossly negligent failure to abide by applicable regulations, mandatory analyst rotation requirements, and restrictions on CRAs or their shareholders if certain ownership thresholds are crossed. Additional procedural and substantive requirements include conditions for the issuance of credit ratings, rules regarding the organization of CRAs, restrictions on activities deemed to create a conflict of interest, including requirements that fees be based on costs and non-discriminatory, special requirements for credit ratings of structured finance instruments. –In Hong Kong, applicable rules include liability for the intentional or negligent dissemination of false and misleading information and procedural requirements for the notification of certain matters to regulators. In addition, MIS Hong Kong is subject to a code of conduct applicable to CRAs that imposes procedural and substantive requirements on the preparation and issuance of credit ratings, restrictions on activities deemed to create a conflict of interest including the disclosure of its compensation arrangements with rated entities and special requirements for credit ratings of structured finance instruments. –In China, while MIS is not a licensed CRA, it does issue global credit ratings on Chinese issuers from offices outside of China. In addition, the Company holds a 30% investment in CCXI, a domestic CRA licensed in China. China has laws applicable to domestic CRAs as well as foreign investment in such entities and entities in general (including national security review). –In Australia, unless an exemption applies, CRAs are required to hold an Australian financial services license (AFSL) if they carry on a business of providing credit ratings in Australia. MIS Australia holds an AFSL authorizing it to provide general advice to wholesale clients only by issuing a credit rating. It is therefore required to comply with obligations as an AFSL holder including the requirement to provide financial services efficiently, honestly, and fairly, to manage conflicts of interest, and to comply with the conditions of its AFSL (which conditions include specific conditions about credit ratings). Future laws and regulations could extend to products and services not currently regulated. These regulations could: –affect the need for debt securities to be rated; –expand supervisory remits to include credit ratings issued outside the home jurisdiction; –increase the level of competition for credit ratings, including the distribution of credit ratings; –establish criteria for credit ratings or limit the entities authorized to provide credit ratings; –restrict the collection, use, accuracy, correction and sharing of information by CRAs; or –regulate pricing (for example to require fees that are based on costs and are non-discriminatory) on products and services provided by MA such as those products that incorporate credit ratings and research originated by MIS. In turn, such developments may affect MIS’s communications with issuers as part of the rating assignment process, alter the manner in which MIS’s credit ratings are developed, assigned and communicated, affect the manner in which MIS or its customers or users of credit ratings operate, impact the demand for MIS’s credit ratings or alter the economics of the credit ratings business, including by restricting or mandating business models for CRAs. It is difficult to accurately assess the future impact of legislative 24 MOODY'S 2024 10-K 24 MOODY'S 2024 10-K 24 MOODY'S 2024 10-K

In addition to the extensive and evolving U.S. laws and regulations governing the credit rating industry, foreign jurisdictions have taken measures to regulate CRAs and the markets for credit ratings. In particular, the EU has adopted a common regulatory framework for CRAs operating in the EU and continues to monitor the credit rating industry and analyze approaches that may strengthen existing regulation. Credit ratings emanating from outside the EU are subject to ESMA’s oversight if they are endorsed into the EU, and ratings endorsed into the U.K. are similarly subject to oversight of the FCA. Additionally, other foreign jurisdictions have taken measures to increase regulation of CRAs and markets for credit ratings. See “Regulation” in Part 1, Item 1 of this annual report on Form 10-K for more information. The EU and other jurisdictions, as discussed further below, adopt legislation and engage in rulemaking on an ongoing basis that significantly impacts operations and the markets for the Company’s products and services. Future laws and regulations could extend to products and services not currently regulated. These regulations could: –affect the need for debt securities to be rated; –expand supervisory remits to include credit ratings issued outside the home jurisdiction and used for regulatory purposes; –increase the level of competition in the market for credit ratings, including the distribution of credit ratings; –establish criteria for credit ratings or limit the entities authorized to provide credit ratings; –restrict the collection, use, accuracy, correction and sharing of personal information by CRAs; or –regulate pricing (for example to require fees that are based on costs and are non-discriminatory) on products and services provided by MA such as those products that incorporate credit ratings and research originated by MIS. Future regulations could also affect products and services the Company offers that incorporate or are based on artificial intelligence technologies. As part of the legislative package on sustainable finance, in June 2023, the European Commission published a proposal on the transparency and integrity of ESG rating activities. The Council of the European Union, in December 2023, agreed its position on the draft regulation, which would subject ESG rating and/or score providers to formal regulation and supervision by ESMA. The draft regulation is now set for negotiations between the European Council and Parliament and is expected to be adopted in 2024. Following the Brexit implementation period that ended December 31, 2020, the MIS U.K. registered CRA ceased to be registered with and regulated by ESMA and became subject to regulation by the U.K. Financial Conduct Authority (“FCA”). MIS put arrangements in place to endorse its U.K. credit ratings into the EU and its EU credit ratings into the U.K. On December 31, 2020, the U.K. also onshored the EU CRA Regulation, with certain necessary modifications, into U.K. domestic law (the “U.K. CRA Regulation”). The U.K. CRA Regulation contains requirements for the registration, regulation and supervision of CRAs based in the U.K. It also sets out the circumstances in which U.K. financial institutions can use credit ratings for regulatory purposes, as well as specific obligations for issuers, originators and sponsors relating to structured finance instruments. It is unclear if the regulation of CRAs in the EU and the U.K. will differ over time, and divergent regulation between the EU and the U.K. over time or differing interpretations by the FCA and ESMA of CRA regulation could adversely affect MIS’s business through additional operating obligations and resulting increased cost. In February 2022, the FCA published a portfolio letter on its CRA supervision strategy. Among other things, the FCA explained that it takes a holistic approach to supervising CRAs. This means that if a CRA or the group to which it belongs also carries on unregulated activities (for example, ESG ratings), the FCA may assess these unregulated activities as part of its supervision of regulated activities. CRAs need to be able to demonstrate that they have considered, and are actively managing, potential risks from any unregulated activities. The FCA also identified its supervisory priorities for CRAs, which consist of: ratings process and methodologies; governance and oversight; market and perimeter risks; and operational resilience and resourcing. In March 2023, the FCA initiated a review of competition in the markets for certain types of wholesale market data. Credit rating data is included as one element of the FCA’s review. In August 2023, the FCA published an update, determining that its findings did not require a referral to the U.K. Competition & Markets Authority. However, the FCA also stated that it would continue its analysis and announce any potential remedies in its final report due on or before March 1, 2024. 26 MOODY'S 2023 10-K 26 MOODY'S 2023 10-K 26 MOODY'S 2023 10-K Table of Contents Table of Contents Additionally, HM Treasury published a consultation in March 2023 proposing to make firms providing ESG ratings and/or scores to U.K. users (both from the U.K. and abroad) subject to FCA supervision. The proposals mirror the IOSCO recommendations on ESG ratings and data products providers. It is unclear if and when the U.K. Government might seek to move forward legislation to enable the FCA to supervise such firms. The U.K. is also currently developing a voluntary industry-led Code of Conduct for ESG ratings and data providers. The precise scope and impact of the regulatory developments related to ESG in Europe remain unclear; however, the Company continues to assess the potential impact on both MA and MIS. Both of Moody’s segments face risks related to financial reforms outside the U.S. affecting the credit rating industry, Moody’s businesses, and Moody’s customers. For example: –MIS is a registered entity and is therefore subject to formal regulation and periodic or other inspections in the EU and other foreign jurisdictions, such as, but not limited to, Hong Kong and China, where it operates through registered subsidiaries. –In the EU and the U.K., applicable rules include procedural requirements with respect to credit ratings of sovereign issuers, liability for intentional or grossly negligent failure to abide by applicable regulations, mandatory rotation requirements of CRAs hired by issuers of securities for credit ratings of resecuritizations, and restrictions on CRAs or their shareholders if certain ownership thresholds are crossed. Additional procedural and substantive requirements include conditions for the issuance of credit ratings, rules regarding the organization of CRAs, restrictions on activities deemed to create a conflict of interest, including requirements that fees be based on costs and non-discriminatory, and special requirements for credit ratings of structured finance instruments. –In Hong Kong, applicable rules include liability for the intentional or negligent dissemination of false and misleading information and procedural requirements for the notification of certain matters to regulators. In addition, MIS Hong Kong is subject to a code of conduct applicable to CRAs that imposes procedural and substantive requirements on the preparation and issuance of credit ratings, restrictions on activities deemed to create a conflict of interest including the disclosure of its compensation arrangements with rated entities and special requirements for credit ratings of structured finance instruments. A failure to comply with these procedural and substantive requirements also exposes MIS Hong Kong to the risk of regulatory enforcement action which could result in financial penalties or, in serious cases, affect its ability to conduct credit rating activities in Hong Kong. –In China, while MIS is not a licensed CRA, it does issue global credit ratings on Chinese issuers from offices outside of China. In addition, the Company holds a 30% investment in CCXI, a domestic CRA licensed in China. China has laws applicable to domestic CRAs as well as foreign investment in such entities and entities in general (including national security review). MA is licensed in China to provide subscriptions to credit research and ratings data and other information relevant to the financial markets. Such laws are broadly crafted and the implementation, interpretation and enforcement of such laws are subject to the broad discretion of Chinese regulators, which could affect the Company’s ability to conduct business in China. –In addition, U.S. economic sanctions have increasingly targeted Chinese persons. In response, China issued a blocking statute that establishes a framework for limiting the effect of foreign sanctions on Chinese persons. Blocking statutes typically create conflicts of law. An entity that is subject to conflicting laws in multiple jurisdictions may need to determine a means to comply with such laws. Such conflicts could eventually affect the ability of entities to adhere to applicable laws. With respect to MA, regulators in Europe and other foreign markets in which MA is active have issued guidance similar to that issued in the U.S. relating to financial institutions’ assessment and management of risks associated with third-party relationships. In light of this, MA’s existing or potential bank and financial services customers subject to this guidance have sought and may further revise their third-party risk management policies and processes and the terms on which they do business with MA. This can result in delayed or reduced sales to such customers, adversely affect MA’s relationship with such customers, increase the costs of doing business with such customers and/or result in MA assuming greater financial and legal risk under its agreements with such customers. Although Moody’s will monitor developments related to financial reforms outside the U.S. affecting the credit rating industry and Moody’s customers, Moody’s cannot predict the extent of such future laws and regulations, and the effect that they will have on Moody’s business or the potential for increased exposure to liability could be significant. For example, compliance with the EU, U.K. and other foreign regulations may increase costs of operations and could have a significant negative effect on Moody’s operations, profitability or ability to compete, or the markets for its products and services, including in ways that Moody’s presently is unable to predict. In addition, exposure to increased liability under the EU, U.K. regulations and regulations of other foreign jurisdictions may further increase costs and legal risks associated with the issuance of credit ratings and materially and adversely impact Moody’s results of operations. Financial reforms in the EU, U.K. and other foreign jurisdictions may have a material adverse effect on Moody’s business, operating results and financial condition.

and regulatory requirements on MIS’s business and its customers’ businesses. If these laws and regulations, and any future rulemaking or court rulings, reduce demand for credit ratings or increase costs, MIS may be unable to pass such costs through to customers. Additionally, legislative and regulatory initiatives that apply to CRAs and credit markets generally may affect Moody’s in a disproportionate manner. Each of these developments increase the costs and legal risk associated with the issuance of credit ratings and can have a material adverse effect on Moody’s operations, profitability and competitiveness, the demand for credit ratings and the manner in which such ratings are utilized. Moody's Analytics. Certain of MA’s subscription products contain credit ratings data and related research produced by MIS, and often are used by MA customers for regulatory compliance purposes, including determination of capital charges and regulatory reporting. Regulations concerning the issuance of credit ratings and the activities of CRAs, including the dissemination of ratings data, are likely to continue to be considered in the future, including, for example, provisions regarding fair and reasonable availability of ratings data, the terms and conditions associated with such data feeds, remuneration for data and the nature of the information to be included in credit opinions. Other laws, regulations and rules are being considered or are likely to be considered in the future may impact MA products and services, for example, by requiring certain information to be provided free of charge. MA’s other products and services, in particular its offering of products and services relating to sanctions, KYC and financial crime, are potentially subject to various laws and regulations affecting the collection, processing and sale of data-driven solutions. These laws and regulations generally are designed to protect information relating to individuals and small businesses, including information used for consumer credit reporting purposes, the data rights of individuals, and to prevent the unauthorized collection, access to and use of personal or confidential information available in the marketplace and prohibit certain deceptive and unfair acts. Additionally, refer to the risk factor entitled “The Company Is Exposed to Risks Related to Protection of Confidential and Personal Information.” New laws and regulations are likely to be enacted and existing laws and regulations may change or be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible they will be interpreted and applied in ways that will materially and adversely affect our business. As a result of current and future laws and regulations, our customers’ and other third parties’ use of our products and services, as well as our use of information supplied by our suppliers and other third parties, can lead to regulatory inquiries or actions or related private litigation against us. Changes in the applicability of laws and regulations could require MA to modify its data processing practices and policies and restrict or dictate how MA collects, maintains, combines and disseminates information, which could have a material adverse effect on Moody’s business, financial condition or results of operations. In the future, the Company may be subject to significant additional expense to ensure continued compliance with laws and regulations applicable to MA and to investigate, defend or remedy actual or alleged violations. Additionally, refer to the risk factor entitled “The Company Is Exposed to Risks Related to Protection of Confidential and Personal Information.” Further, MA’s bank and financial services customers are subject to additional regulatory oversight. For example: –U.S. banking regulators, including the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System and the Consumer Financial Protection Bureau, as well as many state agencies, have issued guidance to insured depository institutions and other providers of financial services on assessing and managing risks associated with third-party relationships, which include all business arrangements between a financial services provider and another entity, by contract or otherwise, and generally requires banks and financial services providers to exercise comprehensive oversight throughout each phase of a bank or financial service provider’s business arrangement with third-party service providers, and instructs banks and financial service providers to adopt risk management processes commensurate with the level of risk and complexity of their third-party relationships. This guidance requires more rigorous oversight of third-party relationships that involve certain "critical activities." –Regulators in Europe and other foreign markets in which MA is active have issued guidance similar to that issued in the U.S. relating to financial institutions' assessment and management of risks associated with third-party relationships. For example, in December 2022, the EU adopted DORA, which will apply from early 2025 and will require EU financial institutions to have a comprehensive governance and control framework of the management of information and communications technology risks, including risks relating to third-party providers of technology and data such as MA. In light of this, MA’s existing or potential bank and financial services customers subject to this guidance have sought to and may further revise their third-party risk management policies and processes and the terms on which they do business with MA. –In China, MA is licensed to provide subscriptions to credit research and ratings data and other information relevant to the financial markets. China has laws applicable to Moody’s that are broadly crafted, and the implementation, interpretation and enforcement of such laws are subject to the broad discretion of Chinese regulators, which could affect the Company’s ability to conduct business in China. The EU AI Act has introduced a risk-based framework for regulating AI systems which applies different obligations to various actors in the AI supply chain. These rules apply to, among others, product manufacturers incorporating AI systems into regulated products sold into the EU as well as to providers whose AI systems or their outputs are made available in the EU. This Act will increase costs to MA including cost of establishing processes and procedures around applicability and implementation of the Act’s requirements for MA products and services. MA also faces a risk of cost of penalties or fines due to noncompliance. MOODY'S 2024 10-K 25 MOODY'S 2024 10-K 25 MOODY'S 2024 10-K 25

Moody’s operates in a highly regulated industry and is subject to extensive regulation by federal, state and local authorities in the U.S., including the Reform Act and the Dodd-Frank Act. These regulations are complex, continually evolving and have tended to become more stringent over time. Additionally, changes in Congress may increase the uncertainty with regard to potential changes in these laws and regulations and the enforcement of any new or existing legislation or directives by government authorities. See “Regulation” in Part I, Item 1 of this annual report on Form 10-K for more information. The current laws and regulations: –seek to encourage, and may result in, increased competition among CRAs and in the credit rating business; –may result in alternatives to credit ratings or changes in the pricing of credit ratings; –restrict the use of information in the development or maintenance of credit ratings; –increase regulatory oversight of the credit markets and CRA operations; –provide the SEC with direct jurisdiction over CRAs that seek NRSRO status, and grant authority to the SEC to inspect the operations of CRAs; and –provide for enhanced oversight standards and specialized pleading standards, which may result in increases in the number of legal proceedings claiming liability for losses suffered by investors on rated securities and aggregate legal defense costs. If these laws and regulations, and any future rulemaking or court rulings, reduce demand for credit ratings or increase costs, Moody’s may be unable to pass such costs through to customers. In addition, there may be uncertainty over the scope, interpretation, administration and enforcement of such laws and regulations. The Company’s compliance and efforts to mitigate the risk of fines, penalties or other sanctions can result in significant expenses. Legal proceedings that are increasingly lengthy can result in uncertainty over and exposure to liability. It is difficult to accurately assess the future impact of legislative and regulatory requirements on Moody’s business and its customers’ businesses. For example, new laws and regulations may affect MIS’s communications with issuers as part of the rating assignment process, alter the manner in which MIS’s credit ratings are developed, assigned and communicated, affect the manner in which MIS or its customers or users of credit ratings operate, impact the demand for MIS’s credit ratings and alter the economics of the credit ratings business, including by restricting or mandating business models for CRAs. Further, speculation concerning the impact of legislative and regulatory initiatives and the increased uncertainty over potential liability and adverse legal or judicial determinations may negatively affect Moody’s stock price. Although these legislative and regulatory initiatives apply to CRAs and credit markets generally, they may affect Moody’s in a disproportionate manner. Each of these developments increase the costs and legal risk associated with the issuance of credit ratings and can have a material adverse effect on Moody’s operations, profitability and competitiveness, the demand for credit ratings and the manner in which such ratings are utilized. MOODY'S 2023 10-K 25 MOODY'S 2023 10-K 25 MOODY'S 2023 10-K 25 Table of Contents Table of Contents In addition, MA derives a significant amount of its sales from banks and other financial services providers who are subject to regulatory oversight. U.S. banking regulators, including the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System and the Consumer Financial Protection Bureau, as well as many state agencies, have issued guidance to insured depository institutions and other providers of financial services on assessing and managing risks associated with third-party relationships, which include all business arrangements between a financial services provider and another entity, by contract or otherwise, and generally requires banks and financial services providers to exercise comprehensive oversight throughout each phase of a bank or financial service provider’s business arrangement with third-party service providers, and instructs banks and financial service providers to adopt risk management processes commensurate with the level of risk and complexity of their third-party relationships. In light of this, MA’s existing or potential bank and financial services customers subject to this guidance have sought to and may further revise their third-party risk management policies and processes and the terms on which they do business with MA. This can result in delayed or reduced sales to such customers, adversely affect MA’s relationship with such customers, increase the costs of doing business with such customers and/or result in MA assuming greater financial and legal risk under its agreements with such customers.