Visa Inc.: 10-K Risk Factor Changes

Our cybersecurity and processing systems, as well as those of financial institutions, sellers and third-party service providers, have experienced and may continue to experience errors, interruptions, delays or damage from a number of causes including but not limited to, hardware, software and network failures, computer viruses, ransomware, malware or other destructive software, use of AI technologies by bad actors, internal design, manual or user errors, advanced or persistent cyber attacks, social engineering threats, such as phishing or deepfake schemes, including those using synthetic media, insider threats, terrorism, political tensions, war or other military conflicts, or civil unrest, security breaches of our physical premises, workplace violence or wrongdoing, catastrophic events, natural disasters, severe weather conditions and other effects from climate change. Because the tactics, techniques and procedures used to obtain unauthorized access, or to disable or degrade systems change frequently, have become increasingly more complex and sophisticated, and may be difficult to detect for periods of time, we may not anticipate these acts or respond adequately or timely. For example, cybercriminals have increasingly demonstrated advanced capabilities, such as use of zero-day vulnerabilities, and rapid integration of new technology such as GenAI are being used by threat actors to create sophisticated attacks that are increasingly automated, targeted and more difficult to defend against. Our own use and deployment of GenAI technologies could expand our cybersecurity attack surface, increasing exposure to breaches, fraud, unauthorized transactions and other vulnerabilities. In addition, third-party suppliers of hardware and infrastructure that operate our data centers and support employee productivity could be impacted by supply chain disruptions, such as manufacturing, shipping delays, and service disruption due to cyber attacks. An extended supply chain or service disruption could also impact processing or delivery of technology services. Moreover, due to the interconnectivity and complexity of information systems and their reliance on common systems, software and vendors, disruptions or degradations have had, and will likely continue to have, wide-reaching consequences, including the potential to disrupt the overall financial system and other key systems in the global economy. Such attacks and breaches have resulted and may continue to result in fraudulent activity and financial losses to Visa’s financial institution clients, sellers or third-party service providers. Our visibility and role in the global payments industry also puts our company at a greater risk of being targeted by hackers. In the normal course of our business, we have been the target of malicious cyber activity. We have been, and may continue to be, impacted by attacks and data security breaches of financial institutions, sellers, and 32 32 32 32 32 32 Table of Contents Table of Contents Table of Contents third-party service providers. We are also aware of instances where governments have directed or sponsored attacks against some of our financial institution clients, and other instances where sellers and issuers have encountered substantial data security breaches affecting their customers, some of whom were Visa account holders. Given the increase in payments through ecommerce, social media and mobile channels, we continue to see increased cyber and payment fraud activity, as cybercriminals attempt phishing and social engineering scams, distributed denial of service attacks and other disruptive actions. The security measures and procedures we, our financial institution and seller clients, other sellers and third-party service providers in the payments ecosystem have in place to protect sensitive consumer data and other information may not be implemented effectively, may differ in scope and complexity across different ecosystem participants, or may not be successful or sufficient to counter all data security breaches, cyber incidents and attacks or system failures. In some cases, the mitigation efforts may be dependent on third parties who may not follow the required contractual standards, who may not be able to timely patch vulnerabilities or fix security defects, or whose hardware, software or network services may be subject to error, defect, delay, outage or lack appropriate security measures to prevent breaches or data exfiltration incidents. Cyber incidents and attacks can have cascading impacts that unfold with increasing speed across our internal networks and systems and those of our partners and clients. Furthermore, as a global financial services company, Visa is increasingly subject to complex, varied, and rapidly evolving cybersecurity regulations and cyber incident reporting requirements across numerous jurisdictions. For example, governments around the world have recently passed or are considering new critical infrastructure cybersecurity laws and regulations, some of which may apply to Visa. With the often short timeframes required for cyber incident reporting, there is a risk that Visa or its third-party service providers will fail to meet the reporting deadlines for any given incident. It may take considerable time for us to investigate and evaluate the full impact of cyber incidents, particularly for sophisticated attacks. These factors may inhibit our ability to provide prompt, full and reliable information about the cyber incident to our clients, partners and regulators, as well as to the public. In the event we are found to be out of compliance, we could be subject to monetary damages, civil and criminal penalties, litigation, investigations and proceedings, and damage to our reputation and brand. Any of these events, individually or in the aggregate, could significantly disrupt our operations; impact the availability and integrity of our systems, applications, or the systems of our third-party service providers; result in the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary, sensitive and personal information (including account data information) or data security compromises; impact our clients and consumers; increase the risk of fraudulent transactions; damage our reputation and brand; result in litigation or claims, violations of applicable privacy and other laws, and increased regulatory review or scrutiny, investigations, actions, fines or penalties; result in damages or changes to our business practices; decrease the overall use and acceptance of our products; decrease our volume, net revenue and future growth prospects; financial losses to Visa’s financial institution clients, sellers or third-party service providers, and be costly, time consuming and difficult to remedy. There can be no assurance that our efforts will prevent all such threats. In the event of damage or disruption to our business due to these occurrences, we may not be able to successfully and quickly recover all of our critical business functions, assets, and data through our business continuity program and we may not be able to notify affected third parties when appropriate. Furthermore, while we maintain insurance, our coverage may not sufficiently cover all types of losses or claims that may arise. In addition, in the case of any cyber-attack or other security incident information or security breach or technology failure arising from third-party systems impacting us, any third-party indemnification may not be applicable or sufficient to address the impact of such incidents.

Our cybersecurity and processing systems, as well as those of financial institutions, merchants and third-party service providers, have experienced and may continue to experience errors, interruptions, delays or damage from a number of causes, including power outages, hardware, software and network failures, computer viruses, ransomware, malware or other destructive software, AI technologies by bad actors, internal design, manual or user errors, cyber attacks, terrorism, political tensions, war or other military conflicts, or civil unrest, security breaches of our physical premises, workplace violence or wrongdoing, catastrophic events, natural disasters, severe weather conditions and other effects from climate change. In addition, there is risk that third-party suppliers of hardware and infrastructure required to operate our data centers and support employee productivity could be impacted by supply chain disruptions, such as manufacturing, shipping delays, and service disruption due to cyber attacks. An extended supply chain or service disruption could also impact processing or delivery of technology services. Furthermore, our visibility and role in the global payments industry also puts our company at a greater risk of being targeted by hackers. In the normal course of our business, we have been the target of malicious cyber activity. We have been, and may continue to be, impacted by attacks and data security breaches of financial institutions, merchants, and third-party service providers. We are also aware of instances where governments have directed or sponsored attacks against some of our financial institution clients, and other instances where merchants and issuers have encountered substantial data security breaches affecting their customers, some of whom were Visa account holders. Given the increase in online banking, ecommerce and other online activity, we continue to see increased cyber and payment fraud activity, as cybercriminals attempt phishing and social engineering scams, distributed denial of service attacks and other disruptive actions. Overall, such attacks and breaches have resulted, and may continue to result in, fraudulent activity and ultimately, financial losses to Visa’s financial institution clients, merchants or third-party service providers. Numerous and evolving cybersecurity threats, including advanced and persistent cyber attacks, targeted attacks against our employees and trusted partners, insider threats, social engineering threats, such as phishing or deepfake schemes, including those using synthetic media, could compromise the confidentiality, availability and integrity of data in our systems, particularly on our internet-facing applications, or the systems of our third-party service providers. Because the tactics, techniques and procedures used to obtain unauthorized access, or to disable or degrade systems change frequently, have become increasingly more complex and sophisticated, and may be difficult to detect for periods of time, we may not anticipate these acts or respond adequately or timely. For example, cybercriminals have increasingly demonstrated advanced capabilities, such as use of zero-day 30 30 30 30 30 30 Table of Contents Table of Contents Table of Contents vulnerabilities, and rapid integration of new technology such as generative AI are being used by threat actors to create sophisticated attacks that are increasingly automated, targeted, and more difficult to defend against. The security measures and procedures we, our financial institution and merchant clients, other merchants and third-party service providers in the payments ecosystem have in place to protect sensitive consumer data and other information may not be implemented effectively, may differ in scope and complexity across different ecosystem participants, or may not be successful or sufficient to counter all data security breaches, cyber incidents and attacks or system failures. In some cases, the mitigation efforts may be dependent on third parties who may not follow the required contractual standards, who may not be able to timely patch vulnerabilities or fix security defects, or whose hardware, software or network services may be subject to error, defect, delay, outage or lack appropriate malware prevention to prevent breaches or data exfiltration incidents. Cyber incidents and attacks can have cascading impacts that unfold with increasing speed across our internal networks and systems and those of our partners and clients. Despite our security measures and programs to protect our systems and data, and prevent, detect and respond to data security incidents, there can be no assurance that our efforts will prevent all such threats. In addition, as a global financial services company, Visa is increasingly subject to complex and varied cybersecurity regulations and cyber incident reporting requirements across numerous jurisdictions. With the often short timeframes required for cyber incident reporting, there is a risk that Visa or its third-party service providers will fail to meet the reporting deadlines for any given incident. It may take considerable time for us to investigate and evaluate the full impact of cyber incidents, particularly for sophisticated attacks. These factors may inhibit our ability to provide prompt, full, and reliable information about the cyber incident to our clients, partners, and regulators, as well as to the public. In the event we are found to be out of compliance, we could be subject to monetary damages, civil and criminal penalties, litigation, investigations and proceedings, and damage to our reputation and brand. Any of these events, individually or in the aggregate, could significantly disrupt our operations; result in the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary, sensitive and personal information (including account data information) or data security compromises; impact our clients and consumers; damage our reputation and brand; result in litigation or claims, violations of applicable privacy and other laws, and increased regulatory review or scrutiny, investigations, actions, fines or penalties; result in damages or changes to our business practices; decrease the overall use and acceptance of our products; decrease our volume, net revenue and future growth prospects; and be costly, time consuming and difficult to remedy. In the event of damage or disruption to our business due to these occurrences, we may not be able to successfully and quickly recover all of our critical business functions, assets, and data through our business continuity program. Furthermore, while we maintain insurance, our coverage may not sufficiently cover all types of losses or claims that may arise.

Regulators around the world have been establishing or increasing their authority to regulate various aspects of the payments industry. See Item 1—Government Regulation for more information. In the U.S. and many other jurisdictions, we have historically set default IRFs. Even though we generally do not receive any revenue related to IRFs in a payment transaction (in the context of credit and debit transactions, those fees are paid by the acquirers to the issuers; the reverse is true for certain transactions like ATM transactions), IRFs are a factor on which we compete with other payments providers and are therefore an important determinant of the volume of transactions we process. Consequently, changes to these fees, whether voluntarily or by mandate, can substantially affect our overall payments volume and net revenue. Interchange reimbursement fees, certain operating rules and related practices continue to be subject to increased government regulation globally, and regulatory authorities and central banks in a number of jurisdictions have reviewed or are reviewing these fees, rules and practices. For example: •Regulations adopted by the U.S. Federal Reserve cap the maximum U.S. debit interchange reimbursement rate received by large financial institutions at 21 cents plus 5 basis points per transaction, plus a possible fraud adjustment of 1 cent. Additionally, the Dodd-Frank Act limits issuers’ and payment networks’ ability to adopt network exclusivity and preferred routing in the debit and prepaid area, which also impacts our business. In response to seller requests, the Federal Reserve has recently taken actions to revisit its regulations that implement these aspects of the Dodd-Frank Act. For example, in October 2022, the Federal Reserve published a final rule effectively requiring issuers to ensure that at least two unaffiliated networks are available for routing ecommerce debit transactions by July 1, 2023. In October 2023, the Federal Reserve issued a proposal for comment that further lowers debit interchange rates, with a mechanism for automatic adjustment every two years. Finally, in August 2025, the District Court for the District of North Dakota ruled that the Federal Reserve exceeded its authority in implementing Regulation II, which sets debit card interchange fees. The court found the Federal Reserve improperly included various costs beyond what the Durbin Amendment allows, such as fraud losses, network fees and other fixed costs, when setting the debit interchange fee standard. As a result, the court vacated Regulation II’s debit interchange fee 21 21 21 21 21 21 Table of Contents Table of Contents Table of Contents standard. Subsequently, however, the District Court in Kentucky ruled that the Federal Reserve acted within its discretion in setting the debit interchange cap. If the District Court of North Dakota’s decision is affirmed on appeal and ultimately prevails, it could potentially result in the Federal Reserve setting a significantly lower interchange cap for relevant debit transactions in the U.S. Separately, there continues to be interest in regulation of credit interchange fees and routing practices by members of Congress and state legislators. It is possible that the Credit Card Competition Act may be reintroduced in Congress or attempted to be offered as an amendment to unrelated legislation. Previous versions of the legislation were introduced in 2022 and 2023, and required among other things, that large issuing banks offer a choice of at least two unaffiliated networks over which electronic credit transactions may be processed. Finally, some states have passed or are considering passing laws that regulate how interchange can be set and assessed. For example, in May 2024, Illinois passed a law that restricts the assessment of interchange on the state tax and gratuity portions of a transaction, and restricts financial institutions and payment networks, among others, from using payment transaction data for any purpose other than facilitating or processing a transaction. While the Illinois law remains subject to legal challenge, if such laws are allowed to go into effect, they may also impose significant technical and compliance burdens on our business. •In Europe, the EU’s IFR places an effective cap on consumer credit and consumer debit interchange fees for both domestic and cross-border transactions within the European Economic Area of 30 basis points and 20 basis points, respectively. EU member states have the ability to further reduce these interchange levels within their territories. The European Commission has announced its intention to conduct another impact assessment of the IFR, which could result in even lower caps on interchange rates and the expansion of regulation to other types of products, services and fees. •Several countries in Latin America continue to explore regulatory measures against payments networks and have either adopted or are exploring interchange caps, including Argentina, Brazil, Chile and Costa Rica. In Asia Pacific, the Reserve Bank of Australia (RBA) which already regulates interchange, recently proposed reducing existing interchange caps on domestic credit and debit transactions and not allowing differential interchange treatment for consumer and commercial transactions. Similarly, in New Zealand, the Commerce Commission recently lowered existing caps on domestic credit transactions. Interchange is also regulated in certain countries in the Central and Eastern Europe, Middle East and Africa region, including the United Arab Emirates. Finally, many governments, including but not limited to governments in India, Costa Rica, and Turkey, are using regulation to further drive down MDR, which could negatively affect the economics of our transactions. •While the focus of interchange and MDR regulation has primarily been on domestic rates, interest on cross-border rates has been growing. For example, we agreed to limit certain cross-border interchange rates in a settlement with the European Commission in 2019, which was extended through 2029. In 2020, Costa Rica became the first country to formally regulate cross-border interchange rates by regulation. In June 2022, the UK’s PSR initiated a market review focusing on post-Brexit increases in interchange rates for e-commerce transactions between the UK and Europe and is proposing to cap cross-border interchange on certain transactions in that geographic corridor. Most recently, in July 2025, New Zealand adopted interchange caps on cross-border transactions including commercial credit transactions. Australia has also proposed adopting caps for cross-border transactions. Cross-border MDR is also regulated in Costa Rica and Turkey. •With increased lobbying by sellers and other industry participants, we are also beginning to see regulatory interest in network fees. For example, the UK’s PSR is conducting a market review into scheme and processing fees. In its interim report, the PSR indicated that it is reviewing possible remedies in the areas of governance, reporting and transparency, any of which, if adopted, could impose additional complexity and burdens on our business in the UK. Other regulators, for example, those in Australia, the EU, Chile and New Zealand have expressed an interest in network fees, including issues related to transparency. Finally, in 2024, the Greek Parliament limited acquirer fees for certain small ticket transactions in some seller categories for a period of three years. •In addition, industry participants in some countries, including Argentina, Chile, Colombia, the Dominican Republic, Paraguay, Peru, South Africa and Turkey have sought intervention from competition regulators or filed claims relating to certain network rules, including Visa’s restrictions on cross-border acquiring. The Central Banks of Chile and the Dominican Republic recently enacted regulation that will permit cross-border acquiring for ecommerce transactions under certain conditions. Other countries, like Brazil, have adopted regulations that require us to seek government pre-approval for certain of our network rules, which could also impact the way we operate in those markets. 22 22 22 22 22 22 Table of Contents Table of Contents Table of Contents •Government regulations or pressure may also impact our rules and practices and require us to allow other payments networks to support Visa products or services, to have the other networks’ functionality or brand marks on our products, or to share our intellectual property with other networks. In addition, the EU’s requirement to separate scheme and processing adds costs and impacts the execution of our commercial, innovation and product strategies. •We are also subject to central bank oversight in a growing number of countries, including Brazil, India, the UK and within the EU. In several jurisdictions, we have been designated as a “systemically important payment system.” Some countries with existing oversight frameworks are looking to further enhance their regulatory powers, while regulators in other jurisdictions are considering or adopting approaches based on these regulatory principles. For example, in October 2023, VisaNet was designated as a prominent payment system in Canada. These types of designations generally result in oversight of authorization, clearing and settlement activities, including policies, procedures and requirements related to governance, client and seller access to our payment systems, reporting, cybersecurity, processing infrastructure, capital and/or credit risk management. We could also be required to adopt policies and practices designed to mitigate settlement and liquidity risks, including increased requirements to maintain sufficient levels of capital and financial resources locally, as well as localized risk management or governance. •As innovations in payment technology have enabled us to expand into new products and services, they have also expanded the potential scope of regulatory influence. For instance, new products and capabilities, including tokenization, push payments and cross-border money movement solutions could bring increased licensing or authorization requirements in the countries where the product or capability is offered. Furthermore, certain portions of our business are regulated as payment institutions or as money transmitters, subjecting us to various licensing, supervisory and other requirements. As we continue to expand our capabilities and offerings in furtherance of our multi-year growth strategy, we will need to obtain new types of licenses. These licenses could result in increased supervisory and compliance obligations that are distinct from the obligations we are subject to in our capacity as a payment card network. Regulators around the world increasingly take note of each other’s approaches to regulating the payments industry. Consequently, development in one jurisdiction may influence regulatory approaches in another. The risks created by a new law, regulation or regulatory outcome in one jurisdiction have the potential to be replicated and to negatively affect our business in another jurisdiction or in other product offerings. For example, our settlement with the European Commission on cross-border interchange rates has drawn attention from some regulators in other parts of the world. Similarly, new regulations involving one product offering may prompt regulators to extend the regulations to other product offerings. For example, credit payments could become subject to similar regulation as debit payments (or vice versa). The RBA initially capped credit interchange, but subsequently capped debit interchange as well. When we cannot set default interchange reimbursement rates at optimal levels, issuers and acquirers may find our payments system less attractive. This may increase the attractiveness of other payments systems, such as our competitors’ closed-loop payments systems with direct connections to both sellers and consumers. We believe some issuers may react to such regulations by charging new or higher fees, or reducing certain benefits to consumers, which makes our products less appealing to consumers. Some acquirers may elect to charge higher MDR regardless of the Visa interchange reimbursement rate, causing sellers not to accept our products or to steer consumers to alternative payments systems or forms of payment. In addition, in an effort to reduce the expense of their payment programs, some issuers and acquirers have obtained, and may continue to obtain, incentives from us, including reductions in the fees that we charge, which directly impacts our net revenue. The evolving and increasing regulatory focus on the payments industry could negatively impact or reduce the number of Visa products our clients issue, the volume of payments we process, our net revenue, our brands, our competitive positioning, our ability to use our intellectual property to differentiate our products and services, the quality and types of products and services we offer, the countries in which our products and services are used, and the types of consumers and sellers who can obtain or accept our products and services, all of which could harm our business and financial results. Finally, policymakers and regulatory bodies in the U.S., Europe and other parts of the world are exploring ways to reform existing competition laws to meet the needs of the digital economy, including restricting large technology companies from engaging in mergers and acquisitions, requiring them to interoperate with potential competitors, and prohibiting certain kinds of self-preferencing behaviors. While the focus of these efforts remains primarily on increasing regulation of large technology, ecommerce and social media companies, they could also have implications for other types of companies including payments networks, which could constrain our ability to 23 23 23 23 23 23 Table of Contents Table of Contents Table of Contents effectively manage our business. Recent political developments around the world, including recent shifts in trade policy, have added additional uncertainty with respect to new laws and regulations or changes in the interpretations or enforcement of existing laws and regulations, and increased risk of financial regulatory fragmentation.

Regulators around the world have been establishing or increasing their authority to regulate various aspects of the payments industry. See Item 1—Government Regulation for more information. In the U.S. and many other jurisdictions, we have historically set default interchange reimbursement fees. Even though we generally do not receive any revenue related to interchange reimbursement fees in a payment transaction (in the context of credit and debit transactions, those fees are paid by the acquirers to the issuers; the reverse is true for certain transactions like ATM), interchange reimbursement fees are a factor on which we compete with other payments providers and are therefore an important determinant of the volume of transactions we process. Consequently, changes to these fees, whether voluntarily or by mandate, can substantially affect our overall payments volumes and net revenue. Interchange reimbursement fees, certain operating rules and related practices continue to be subject to increased government regulation globally, and regulatory authorities and central banks in a number of jurisdictions have reviewed or are reviewing these fees, rules, and practices. For example: •Regulations adopted by the U.S. Federal Reserve cap the maximum U.S. debit interchange reimbursement rate received by large financial institutions at 21 cents plus 5 basis points per transaction, plus a possible fraud adjustment of 1 cent. Additionally, the Dodd-Frank Act limits issuers’ and payment networks’ ability to adopt network exclusivity and preferred routing in the debit and prepaid area, which also impacts our business. In response to merchant requests, the Federal Reserve has recently taken actions to revisit its regulations that implement these aspects of the Dodd-Frank Act. For example, in October 2022, the Federal Reserve published a final rule effectively requiring issuers to ensure that at least two unaffiliated networks 19 19 19 19 19 19 Table of Contents Table of Contents Table of Contents are available for routing CNP debit transactions by July 1, 2023. In October 2023, the Federal Reserve issued a proposal for comment which would further lower debit interchange rates, with a mechanism for automatic adjustment every two years. Separately, there continues to be interest in regulation of credit interchange fees and routing practices by members of Congress and state legislators in the U.S. In June 2023, legislation was reintroduced in the U.S. House of Representatives and Senate, which among other things, would require large issuing banks to offer a choice of at least two unaffiliated networks over which electronic credit transactions may be processed. Similar legislation was introduced in the previous Congress in 2022 but failed to advance. The current legislation has additional bipartisan support, and while the ultimate outcome of the legislation remains unclear, its sponsors continue to strongly advocate for its passage. Finally, some states in the U.S. have passed or are considering passing laws that regulate how interchange can be assessed. For example, in May 2024, Illinois passed a law that restricts the assessment of interchange on the state tax and gratuity portions of a transaction, and restricts financial institutions and payment networks, among others, from using payment transaction data for any purpose other than facilitating or processing a transaction. Such laws may also impose significant technical and compliance burdens on our business. In Europe, the EU’s IFR places an effective cap on consumer credit and consumer debit interchange fees for both domestic and cross-border transactions within the EEA (30 basis points and 20 basis points, respectively). EU member states have the ability to further reduce these interchange levels within their territories. The European Commission has announced its intention to conduct another impact assessment of the IFR, which could result in even lower caps on interchange rates and the expansion of regulation to other types of products, services and fees. •Several countries in Latin America continue to explore regulatory measures against payments networks and have either adopted or are exploring interchange caps, including Argentina, Brazil, Chile and Costa Rica. In Asia Pacific, the Reserve Bank of Australia (RBA) which already regulates interchange, continues to monitor issues related to the cost of acceptance, the potential merits of mandating merchant choice routing on dual network debit cards and competition in digital wallet payments. In 2022, the New Zealand Parliament passed legislation capping domestic interchange rates for debit and credit products, and the government remains focused on lowering costs of digital payments to businesses and consumers. Interchange is also regulated in certain countries in the Central and Eastern Europe, Middle East and Africa region, including the United Arab Emirates. Finally, many governments, including but not limited to governments in India, Costa Rica, and Turkey, are using regulation to further drive down MDR, which could negatively affect the economics of our transactions. •While the focus of interchange and MDR regulation has primarily been on domestic rates historically, there are several examples of increasing focus on cross-border rates in recent years. For example, in 2019, we agreed to limit certain cross-border interchange rates in a settlement with the European Commission. That agreement has been extended through 2029. In 2020, Costa Rica became the first country to formally regulate cross-border interchange rates by regulation. Cross-border MDR is also regulated in Costa Rica and Turkey. In June 2022, the UK’s PSR initiated a market review focusing on post-Brexit increases in interchange rates for transactions between the UK and Europe. •As referenced above, with increased lobbying by merchants and other industry participants, we are also beginning to see regulatory interest in network fees. For example, the UK’s PSR is conducting a market review into scheme and processing fees. In its interim report, the PSR indicated that it is reviewing possible remedies, any of which, if adopted, could impose additional complexity and burdens on our business in the UK. Other regulators, for example, in Australia, the EU, and Chile, have expressed an interest in network fees, including issues related to transparency. Finally, in 2024, the Greek Parliament limited acquirer fees for certain small ticket transactions in some merchant categories for a period of three years. •In addition, industry participants in some countries, including Argentina, Colombia, the Dominican Republic, Paraguay, Peru and South Africa have sought intervention from competition regulators or filed claims relating to certain network rules, including Visa’s restrictions on cross-border acquiring. The Central Bank of Chile recently enacted regulation that will permit cross-border acquiring for CNP transactions under certain conditions. Other countries, like Brazil, have adopted regulations that require us to seek government pre-approval for certain of our network rules, which could also impact the way we operate in certain markets. •Government regulations or pressure may also impact our rules and practices and require us to allow other payments networks to support Visa products or services, to have the other networks’ functionality or brand marks on our products, or to share our intellectual property with other networks. In addition, the EU’s 20 20 20 20 20 20 Table of Contents Table of Contents Table of Contents requirement to separate scheme and processing adds costs and impacts the execution of our commercial, innovation and product strategies. •We are also subject to central bank oversight in a growing number of countries, including Brazil, India, the UK and within the EU. In several jurisdictions, we have been designated as a “systemically important payment system.” Some countries with existing oversight frameworks are looking to further enhance their regulatory powers, while regulators in other jurisdictions are considering or adopting approaches based on these regulatory principles. For example, in October 2023, VisaNet was designated as a prominent payment system in Canada. These types of designations generally result in oversight of authorization, clearing and settlement activities, including policies, procedures and requirements related to governance, reporting, cybersecurity, processing infrastructure, capital, and/or credit risk management. We could also be required to adopt policies and practices designed to mitigate settlement and liquidity risks, including increased requirements to maintain sufficient levels of capital and financial resources locally, as well as localized risk management or governance. Increased oversight could also include new criteria for member participation and merchant access to our payment systems. Furthermore, as governments increase their focus on cybersecurity, parts of our business have become considered significant or critical infrastructure by certain central banks. •As innovations in payment technology have enabled us to expand into new products and services, they have also expanded the potential scope of regulatory influence. For instance, new products and capabilities, including tokenization, push payments, and new flows (e.g., Visa B2B Connect) could bring increased licensing or authorization requirements in the countries where the product or capability is offered. Furthermore, certain portions of our business are regulated as payment institutions or as money transmitters, subjecting us to various licensing, supervisory, and other requirements. As we continue to expand our capabilities and offerings in furtherance of our network of networks strategy, we will need to obtain new types of licenses. These licenses could result in increased supervisory and compliance obligations that are distinct from the obligations we are subject to in our capacity as a payment card network. Regulators around the world increasingly take note of each other’s approaches to regulating the payments industry. Consequently, a development in one jurisdiction may influence regulatory approaches in another. The risks created by a new law, regulation or regulatory outcome in one jurisdiction have the potential to be replicated and to negatively affect our business in another jurisdiction or in other product offerings. For example, our settlement with the European Commission on cross-border interchange rates has drawn preliminary attention from some regulators in other parts of the world. Similarly, new regulations involving one product offering may prompt regulators to extend the regulations to other product offerings. For example, credit payments could become subject to similar regulation as debit payments (or vice versa). The RBA initially capped credit interchange, but subsequently capped debit interchange as well. When we cannot set default interchange reimbursement rates at optimal levels, issuers and acquirers may find our payments system less attractive. This may increase the attractiveness of other payments systems, such as our competitors’ closed-loop payments systems with direct connections to both merchants and consumers. We believe some issuers may react to such regulations by charging new or higher fees, or reducing certain benefits to consumers, which make our products less appealing to consumers. Some acquirers may elect to charge higher MDR regardless of the Visa interchange reimbursement rate, causing merchants not to accept our products or to steer customers to alternative payments systems or forms of payment. In addition, in an effort to reduce the expense of their payment programs, some issuers and acquirers have obtained, and may continue to obtain, incentives from us, including reductions in the fees that we charge, which directly impacts our net revenue. Finally, policymakers and regulatory bodies in the U.S., Europe, and other parts of the world are exploring ways to reform existing competition laws to meet the needs of the digital economy, including restricting large technology companies from engaging in mergers and acquisitions, requiring them to interoperate with potential competitors, and prohibiting certain kinds of self-preferencing behaviors. While the focus of these efforts remains primarily on increasing regulation of large technology, ecommerce and social media companies, they could also have implications for other types of companies including payments networks, which could constrain our ability to effectively manage our business or potentially limit how we make our products and services available. 21 21 21 21 21 21 Table of Contents Table of Contents Table of Contents

We indemnify issuers and acquirers for settlement losses they may suffer due to the failure of another issuer or acquirer to honor its settlement obligations in accordance with the Visa operating rules. This indemnification creates settlement risk for us due to the timing difference between the date of a payment transaction and the date of subsequent settlement. Our indemnification exposure is generally limited to the amount of unsettled Visa card payment transactions at any point in time and any subsequent amounts that may fall due to adjustments for previously processed transactions. In addition, changes in the credit standing of our clients or concurrent settlement failures or insolvencies involving more than one of our largest clients, several of our smaller clients, significant sponsor banks through which non-financial institutions participate in the Visa network, or systemic operational 31 31 31 31 31 31 Table of Contents Table of Contents Table of Contents failures could expose us to liquidity risk, and negatively impact our financial position. In certain instances, we may indemnify issuers or acquirers in situations in which a transaction is not processed by our system. Even if we have sufficient liquidity to cover a settlement failure or insolvency, we may be unable to recover the amount of such payment. This could expose us to significant losses and harm our business. See Note 12—Settlement Guarantee Management to our consolidated financial statements included in Item 8 of this report.

We indemnify issuers and acquirers for settlement losses they may suffer due to the failure of another issuer or acquirer to honor its settlement obligations in accordance with the Visa operating rules. In certain instances, we may indemnify issuers or acquirers in situations in which a transaction is not processed by our system. This indemnification creates settlement risk for us due to the timing difference between the date of a payment transaction and the date of subsequent settlement. Our indemnification exposure is generally limited to the amount of unsettled Visa card payment transactions at any point in time and any subsequent amounts that may fall due relating to adjustments for previously processed transactions. Changes in the credit standing of our clients or concurrent settlement failures or insolvencies involving more than one of our largest clients, several of our smaller clients, significant sponsor banks through which non-financial institutions participate in the Visa network, or systemic operational failures could expose us to liquidity risk, and negatively impact our financial position. Even if we have sufficient liquidity to cover a settlement failure or insolvency, we may be unable to recover the amount of such 29 29 29 29 29 29 Table of Contents Table of Contents Table of Contents payment. This could expose us to significant losses and harm our business. See Note 12—Settlement Guarantee Management to our consolidated financial statements included in Item 8 of this report.

As a global payments technology company, we are subject to complex and evolving regulations that govern our operations. Such regulations may increase in quantity, complexity and scope in response to heightened geopolitical tensions. See Item 1—Government Regulation for more information on the most significant areas of regulation that affect our business. The impact of these regulations on us, our clients, and other third parties could limit our ability to enforce our payments system rules; require us to adopt new rules or change existing rules; affect our existing contractual arrangements; and increase our compliance costs. As discussed in more detail below, we may face differing rules and regulations in matters like interchange reimbursement rates, preferred routing, domestic processing and localization requirements, currency conversion, point-of-sale transaction rules and practices, privacy, data use and protection, licensing requirements and associated product technology. As a result, the Visa operating rules and our other contractual commitments may differ from country to country, state to state, or product to product. Complying with these and other regulations increases our costs and operational complexity, and reduces our revenue opportunities. If widely varying regulations come into existence worldwide, we may have difficulty rapidly adjusting our products, services, fees and other important aspects of our business to comply with the regulations. Our compliance programs and policies are designed to support our compliance with a wide array of regulations and laws, such as regulations regarding anti-money laundering, anti-corruption, competition, money transfer services, privacy and sanctions, and we continually adjust our compliance programs as regulations evolve. However, we cannot guarantee that our practices will be deemed compliant by all applicable regulatory authorities. In the event our controls should fail or we are found to be out of compliance for other reasons, we could be subject to monetary damages, civil and criminal penalties, litigation, investigations and proceedings, and damage to our global brands and reputation.

As a global payments technology company, we are subject to complex and evolving regulations that govern our operations. See Item 1—Government Regulation for more information on the most significant areas of regulation that affect our business. The impact of these regulations on us, our clients, and other third parties could limit our ability to enforce our payments system rules; require us to adopt new rules or change existing rules; affect our existing contractual arrangements; increase our compliance costs; and require us to make our technology or intellectual property available to third parties, including competitors, in an undesirable manner. As discussed in more detail below, we may face differing rules and regulations in matters like interchange reimbursement rates, preferred routing, domestic processing and localization requirements, currency conversion, point-of-sale transaction rules and practices, privacy, data use and protection, licensing requirements, and associated product technology. As a result, the Visa operating rules and our other contractual commitments may differ from country to country, state to state, or by products. Complying with these and other regulations increases our costs and operational complexity, and reduces our revenue opportunities. If widely varying regulations come into existence worldwide, we may have difficulty rapidly adjusting our products, services, fees and other important aspects of our business to comply with the regulations. Our compliance programs and policies are designed to support our compliance with a wide array of regulations and laws, such as regulations regarding anti-money laundering, anti-corruption, competition, money transfer services, privacy, and sanctions, and we continually adjust our compliance programs as regulations evolve. However, we cannot guarantee that our practices will be deemed compliant by all applicable regulatory authorities. In the event our controls should fail or we are found to be out of compliance for other reasons, we could be subject to monetary damages, civil and criminal penalties, litigation, investigations and proceedings, and damage to our global brands and reputation. Furthermore, the evolving and increased regulatory focus on the payments industry could negatively impact or reduce the number of Visa products our clients issue, the volume of payments we process, our net revenue, our brands, our competitive positioning, our ability to use our intellectual property to differentiate our products and services, the quality and types of products and services we offer, the countries in which our products are used, and the types of consumers and merchants who can obtain or accept our products, all of which could harm our business and financial results.

Our relationships with industry participants are complex and require us to balance the interests of multiple third parties. For instance, we depend significantly on relationships with our financial institution clients and on their relationships with account holders and sellers to provide our products and services, and thereby compete effectively in the marketplace. We offer incentives to sellers, acquirers, ecommerce platforms and processors to encourage routing preference and acceptance growth. We also engage in many payment card co-branding efforts with sellers, who receive incentives from us. As emerging participants such as fintechs enter the payments industry, we engage in discussions to address the role they may play in the ecosystem, whether as, for example, an issuer, seller, ecommerce platform or digital wallet provider. As these and other relationships become more prevalent and take on a greater importance to our business, our success will increasingly depend on our ability to sustain and grow these relationships. In addition, we depend on our clients and third parties, including network partners, vendors and suppliers, to submit, facilitate and process transactions properly, provide various services associated with our payments network on our behalf, and otherwise adhere to our operating rules and applicable laws. As our clients expand their global footprint, their legal and regulatory obligations can become even more complex. From time to time, our relationships may be affected by actions of our clients and industry participants that may materially and adversely impact our business, products or services, and to the extent we or such parties fail to perform or deliver 29 29 29 29 29 29 Table of Contents Table of Contents Table of Contents adequate services or comply with regulatory obligations, it may result in negative experiences for account holders or others when using their Visa-branded payment products, which could harm our business and reputation.

As noted above, our relationships with industry participants are complex and require us to balance the interests of multiple third parties. For instance, we depend significantly on relationships with our financial institution clients and on their relationships with account holders and merchants to provide our products and services, and thereby compete effectively in the marketplace. We offer incentives to merchants, acquirers, ecommerce platforms and processors to encourage routing preference and acceptance growth. We also engage in many payment card co-branding efforts with merchants, who receive incentives from us. As emerging participants such as fintechs enter the payments industry, we engage in discussions to address the role they may play in the ecosystem, whether as, for example, an issuer, merchant, ecommerce platform or digital wallet provider. As these and other relationships become more prevalent and take on a greater importance to our business, our success will increasingly depend on our ability to sustain and grow these relationships. In addition, we depend on our clients and third parties, including network partners, vendors and suppliers, to submit, facilitate and process transactions properly, provide various services associated with our payments network on our behalf, and otherwise adhere to our operating rules and applicable laws. As our clients expand their global footprint, their legal and regulatory obligations can become even more complex. From time to time, our relationships may be affected by actions of our clients and industry participants that may materially and adversely impact our business, products or services, and to the extent we or such parties fail to perform or deliver adequate services or comply with regulatory obligations, it may result in negative experiences for account holders or others when using their Visa-branded payment products, which could harm our business and reputation.

Provisions contained in our certificate of incorporation and bylaws and our capital structure could delay or prevent a merger, takeover attempt or change in control that our shareholders may consider favorable. For example, except for limited exceptions: (1) no person may beneficially own more than 15 percent of our class A common stock (or 15 percent of our total outstanding common stock on an as-converted basis), unless our board of directors approves the acquisition of such shares in advance; (2) no competitor or an affiliate of a competitor may hold more than 5 percent of our total outstanding common stock on an as-converted basis; (3) the affirmative votes of the class B-1, B-2 and C common stock and series A, B and C preferred stock are required for certain types of consolidations or mergers; (4) our shareholders may only take action during a shareholders’ meeting and may not act by written consent; and (5) only our board of directors, Chair, or CEO or any shareholders who have owned continuously for at least one year not less than 15 percent of the voting power of all shares of class A common stock outstanding may call a special meeting of shareholders. 35 35 35 35 35 35 Table of Contents Table of Contents Table of Contents

Provisions contained in our certificate of incorporation and bylaws and our capital structure could delay or prevent a merger, takeover attempt or change in control that our stockholders may consider favorable. For example, except for limited exceptions: •no person may beneficially own more than 15 percent of our class A common stock (or 15 percent of our total outstanding common stock on an as-converted basis), unless our board of directors approves the acquisition of such shares in advance; •no competitor or an affiliate of a competitor may hold more than 5 percent of our total outstanding common stock on an as-converted basis; •the affirmative votes of the class B-1, B-2 and C common stock and series A, B and C preferred stock are required for certain types of consolidations or mergers; •our stockholders may only take action during a stockholders’ meeting and may not act by written consent; and •only our board of directors, Chair, or CEO or any stockholders who have owned continuously for at least one year not less than 15 percent of the voting power of all shares of class A common stock outstanding may call a special meeting of stockholders. 33 33 33 33 33 33 Table of Contents Table of Contents Table of Contents

Our financial institution clients and sellers can reassess their commitments to us at any time or develop their own competitive services. While we have certain contractual protections, our clients, including some of our largest clients, generally have flexibility to issue non-Visa products. In certain circumstances, our financial institution clients may decide to terminate our contractual relationship on relatively short notice without paying significant early termination fees. Because a significant portion of our net revenue is concentrated among our largest clients, the loss of business from any one of these larger clients could harm our business, results of operations and financial condition. For more information, please see Note 14—Segment Information to our consolidated financial statements included in Item 8 of this report. It may also be difficult or costly for us to acquire or conduct business with financial institutions or sellers that have longstanding exclusive, or nearly exclusive, relationships with our competitors. These financial institutions or sellers may be more successful and may grow more quickly than our existing clients or sellers. If there is a consolidation or acquisition of one or more of our largest clients or co-brand partners by a financial institution client or seller with a strong relationship with one of our competitors, it could result in our business shifting to a competitor, which could put us at a competitive disadvantage and harm our business. 28 28 28 28 28 28 Table of Contents Table of Contents Table of Contents In addition, we face intense competitive pressure on the prices we charge our financial institution clients. In certain regions, we are increasingly facing competition from RTP networks, other payment facilitators offering lower pricing, and government involvement in domestic and cross-border payments. In order to stay competitive, we may need to adjust our pricing or offer incentives to our clients to grow payments volume, enter new market segments, adapt to regulatory changes, and expand their use and acceptance of Visa products and services. These include up-front cash payments, fee discounts, rebates, credits, performance-based incentives, marketing and other support payments that impact our net revenue and profitability. In addition, we offer incentives to certain sellers and acquirers to encourage them to route transactions to Visa. Pressures on pricing, incentives, fee discounts and rebates could moderate our growth. If we are not able to implement cost containment and productivity initiatives in other areas of our business or grow our volume in other ways to offset or absorb the financial impact of these incentives, fee discounts and rebates, it may harm our net revenue and profits.

Our financial institution clients and merchants can reassess their commitments to us at any time or develop their own competitive services. While we have certain contractual protections, our clients, including some of our largest clients, generally have flexibility to issue non-Visa products. Further, in certain circumstances, our financial institution clients may decide to terminate our contractual relationship on relatively short notice without paying significant early termination fees. Because a significant portion of our net revenue is concentrated among our largest clients, the loss of business from any one of these larger clients could harm our business, results of operations and financial condition. For more information, please see Note 14—Enterprise-wide Disclosures and Concentration of Business to our consolidated financial statements included in Item 8 of this report. In addition, we face intense competitive pressure on the prices we charge our financial institution clients. In certain regions, we are increasingly facing competition from RTP networks, other payment facilitators offering lower pricing, and government involvement in domestic and cross-border payments. In order to stay competitive, we may need to adjust our pricing or offer incentives to our clients to grow payments volume, enter new market segments, adapt to regulatory changes, and expand their use and acceptance of Visa products and services. These include up-front cash payments, fee discounts, rebates, credits, performance-based incentives, marketing and other support payments that impact our net revenue and profitability. In addition, we offer incentives to certain merchants and acquirers to encourage them to route transactions to Visa. Pressures on pricing, incentives, fee discounts and rebates could moderate our growth. If we are not able to implement cost containment and productivity initiatives in other areas of our business or grow our volumes in other ways to offset or absorb the financial impact of these incentives, fee discounts and rebates, it may harm our net revenue and profits. In addition, it may be difficult or costly for us to acquire or conduct business with financial institutions or merchants that have longstanding exclusive, or nearly exclusive, relationships with our competitors. These financial institutions or merchants may be more successful and may grow more quickly than our existing clients or merchants. In addition, if there is a consolidation or acquisition of one or more of our largest clients or co-brand partners by a financial institution client or merchant with a strong relationship with one of our competitors, it could 26 26 26 26 26 26 Table of Contents Table of Contents Table of Contents result in our business shifting to a competitor, which could put us at a competitive disadvantage and harm our business.

We rely in part on sellers and their relationships with our clients or their agents to maintain and expand the use and acceptance of Visa products. Certain sellers and seller-affiliated groups have been exerting their influence in the global payments system in certain jurisdictions, such as the U.S., Australia, Canada and Europe, to attempt to lower acceptance costs paid by sellers to acquirers or their agents to accept payment products or services, by lobbying for new legislation, seeking regulatory intervention, filing lawsuits and in some cases, surcharging or refusing to accept Visa products. If they are successful in their efforts, we may face increased compliance and litigation expenses, issuers may decrease their issuance of our products, and consumer usage of our products could be adversely impacted. For example, in the U.S., certain stakeholders have raised concerns regarding how payment security standards and rules may impact debit routing choice and the cost of payment card acceptance. U.S. seller-affiliated groups and processors have expressed concerns regarding the EMV certification process and the roles of industry bodies such as EMVCo and the Payment Card Industry Security Standards Council in the development of payment card standards. Moreover, many sellers have advocated for lower acceptance costs in the form of reduced interchange rates, which could result in some issuers eliminating or reducing their promotion or use of Visa’s products and services, eliminating or reducing cardholder benefits such as rewards programs, or charging account holders increased or new fees for using Visa-branded products, all of which could negatively impact Visa’s payments volume and related revenue. Finally, some sellers and processors have advocated for changes to industry practices and Visa acceptance requirements at the point of sale, including the ability for sellers to accept only certain types of Visa products, to mandate only PIN authenticated transactions, to differentiate or steer among Visa product types issued by different financial institutions, and to impose surcharges on consumers presenting Visa products as their form of payment. A number of the issues flagged in this risk factor are subject to pending litigation. For more information, please see Note 20—Legal Matters to our consolidated financial statements included in Item 8 of this report. If successful, these efforts could adversely impact consumers’ usage of our products and decrease our overall payments volume and net revenue, lead to regulatory enforcement and/or litigation that increases our compliance and litigation expenses, and ultimately harm our business.

We rely in part on merchants and their relationships with our clients or their agents to maintain and expand the use and acceptance of Visa products. Certain merchants and merchant-affiliated groups have been exerting their influence in the global payments system in certain jurisdictions, such as the U.S., Australia, Canada and Europe, to attempt to lower acceptance costs paid by merchants to acquirers or their agents to accept payment products or services, by lobbying for new legislation, seeking regulatory intervention, filing lawsuits and in some cases, surcharging or refusing to accept Visa products. If they are successful in their efforts, we may face increased compliance and litigation expenses, issuers may decrease their issuance of our products, and consumer usage of our products could be adversely impacted. For example, in the U.S., certain stakeholders have raised concerns regarding how payment security standards and rules may impact debit routing choice and the cost of payment card acceptance. In addition to ongoing litigation related to the U.S. migration to EMV-capable cards and point-of-sale terminals, U.S. merchant-affiliated groups and processors have expressed concerns regarding the EMV certification process and some policymakers have expressed concerns about the roles of industry bodies such as EMVCo and the Payment Card Industry Security Standards Council in the development of payment card standards. Additionally, many merchants have advocated for lower acceptance costs in the form of reduced interchange rates, which could result in some issuers eliminating or reducing their promotion or use of Visa’s products and services, eliminating or reducing cardholder benefits such as rewards programs, or charging account holders increased or new fees for using Visa-branded products, all of which could negatively impact Visa’s transaction volumes and related revenue. Finally, some merchants and processors have advocated for changes to industry practices and Visa acceptance requirements at the point of sale, including the ability for merchants to accept only certain types of Visa products, to mandate only PIN authenticated transactions, to differentiate or steer among Visa product types issued by different financial institutions, and to impose surcharges on customers presenting Visa products as their form of payment. If successful, these efforts could adversely impact consumers’ usage of our products and decrease our overall transaction volumes and net revenue, lead to regulatory enforcement and/or litigation that increases our compliance and litigation expenses, and ultimately harm our business.

The talents and efforts of our employees, particularly our key management, are vital to our success. The market for highly skilled workers and leaders in our industry, especially in fintech, technology, AI, cybersecurity and other specialized areas, is extremely competitive. Our management team has significant industry experience and would be difficult to replace. We may be unable to retain them or to attract, hire or retain other highly qualified employees, particularly if we do not offer employment terms that are competitive with the rest of the labor market. Ongoing changes in laws and policies regarding immigration, travel and work authorizations have made it more difficult for employees to work in, or transfer among, jurisdictions in which we have operations and could continue to impair our ability to attract, hire and retain qualified employees. Failure to attract, hire, develop, motivate and retain highly qualified employee talent, especially in light of changing worker expectations and talent marketplace variability; to adequately address potential increased scrutiny of our talent-related programs and initiatives; to develop and implement an adequate succession plan for the management team; or to maintain our strong corporate culture of fostering innovation and collaboration could impact our workforce development goals, impact our ability to achieve our business objectives, and adversely affect our business and our future success. 34 34 34 34 34 34 Table of Contents Table of Contents Table of Contents

The talents and efforts of our employees, particularly our key management, are vital to our success. The market for highly skilled workers and leaders in our industry, especially in fintech, technology, cybersecurity and other specialized areas, is extremely competitive. Our management team has significant industry experience and would be difficult to replace. We may be unable to retain them or to attract, hire or retain other highly qualified employees, particularly if we do not offer employment terms that are competitive with the rest of the labor market. Ongoing changes in laws and policies regarding immigration, travel and work authorizations have made it more difficult for employees to work in, or transfer among, jurisdictions in which we have operations and could continue to impair our ability to attract, hire and retain qualified employees. Failure to attract, hire, develop, motivate and retain highly qualified and diverse employee talent, especially in light of changing worker expectations and talent marketplace variability regarding flexible work models; to meet our goals related to fostering an inclusive and diverse culture or to adequately address potential increased scrutiny of our inclusion and diversity-related programs and initiatives; to develop and implement an adequate succession plan for the management team; to maintain our strong corporate culture of fostering innovation, collaboration and inclusion in our current hybrid model; or to design and successfully implement flexible work models that meet the expectations of employees and prospective employees could impact our workforce development goals, impact our ability to achieve our business objectives, and adversely affect our business and our future success.

More than half of our net revenue is earned outside the U.S. In addition, international cross-border transaction revenue represents a significant part of our net revenue and is an important part of our growth strategy. Our net revenue is dependent on the volume and number of payment transactions made by consumers, governments, and businesses whose spending patterns may be affected by economic, political, market, health and social events or conditions. Adverse macroeconomic conditions within the U.S. or internationally, including but not limited to recessions, inflation, rising interest rates, increase in tariff rates, high unemployment, currency fluctuations, actual or anticipated large-scale defaults or failures, rising energy prices, a slowdown or disruption of global trade, trade retaliation, government shutdowns, and reduced consumer, small business, government, and corporate spending, have a direct impact on international commerce. Our business depends on the smooth functioning of international financial systems and the free flow of commerce across borders. Any restrictions on the activities of multinational businesses, disruptions to global trade, or deterioration in international relations could materially and adversely affect our payments volume, transactions, client relationships, and net revenue. Any events or conditions that impair the functioning of the financial markets, tighten the credit market, or lead to a downgrade of our current credit rating could increase our future borrowing costs and impair our ability to access the capital and credit markets on favorable terms, which could affect our liquidity and capital resources, or significantly increase our cost of capital. Furthermore, in efforts to deal with adverse macroeconomic conditions, governments may introduce new or additional initiatives or requests to reduce or eliminate payment fees or other costs. In an overall soft global economy, such pricing measures could result in additional financial pressures on our business. Geopolitical trends towards nationalism, protectionism and restrictive visa requirements, as well as continued activity and uncertainty around economic sanctions, tariffs or trade restrictions, including restrictions on the cross-border flow of data, the potential or threat of retaliatory international and domestic policies and actions, changing perceptions of U.S.-based companies in the regions where we operate or plan to operate, could impact the expansion of our business in certain regions and have resulted in us suspending our operations in other regions. In March 2022, we suspended our operations in Russia due to economic sanctions imposed on Russia, impacting Visa and its clients. As a result, we are no longer generating revenue from domestic and cross-border activities related to Russia. The war in Ukraine and the ongoing instability in the Middle East, and any resulting conflicts in the region, 30 30 30 30 30 30 Table of Contents Table of Contents Table of Contents could have lasting impacts on the region and its economies, which could adversely affect our business. Changes in geopolitical conditions also increase the security risks described elsewhere in these risk factors. In addition, outbreaks of illnesses, pandemics like COVID-19, or other local or global health issues, political uncertainties, international hostilities, armed conflicts, wars, civil unrest, climate-related events, including the increasing frequency of extreme weather events, impacts on or failures of the power grid, and natural disasters have to varying degrees negatively impacted our operations, clients, third-party suppliers, activities, and cross-border travel and spend. Any decline in cross-border travel and spend would impact our cross-border volume, the number of cross-border transactions we process and our currency exchange activities, which in turn would reduce our international transaction revenue. These events or conditions could impact our clients as well, and their decisions could reduce the number of cards, accounts, and credit lines of their account holders, and impact overall consumption by consumers and businesses, which would ultimately impact our net revenue. In addition, our clients may implement cost-reduction initiatives that reduce or eliminate marketing budgets, and decrease spending on our value-added services.

More than half of our net revenue is earned outside the U.S. In addition, international cross-border transaction revenue represents a significant part of our net revenue and is an important part of our growth strategy. Our net revenue is dependent on the volume and number of payment transactions made by consumers, governments, and businesses whose spending patterns may be affected by economic, political, market, health and social events or conditions. Adverse macroeconomic conditions within the U.S. or internationally, including but not limited to recessions, inflation, rising interest rates, high unemployment, currency fluctuations, actual or anticipated large-scale defaults or failures, rising energy prices, or a slowdown of global trade, and reduced consumer, small business, government, and corporate spending, have a direct impact on our volumes, transactions and net revenue. Furthermore, in efforts to deal with adverse macroeconomic conditions, governments may introduce new or additional initiatives or requests to reduce or eliminate payment fees or other costs. In an overall soft global economy, such pricing measures could result in additional financial pressures on our business. In addition, outbreaks of illnesses, pandemics like COVID-19, or other local or global health issues, political uncertainties, international hostilities, armed conflicts, wars, civil unrest, climate-related events, including the increasing frequency of extreme weather events, impacts to the power grid, and natural disasters have to varying degrees negatively impacted our operations, clients, third-party suppliers, activities, and cross-border travel and spend. Geopolitical trends towards nationalism, protectionism, and restrictive visa requirements, as well as continued activity and uncertainty around economic sanctions, tariffs or trade restrictions, including restrictions on the cross-border flow of data, also limit the expansion of our business in certain regions and have resulted in us suspending our operations in other regions. During fiscal 2022, economic sanctions were imposed on Russia by the U.S., the EU, United Kingdom and other jurisdictions and authorities, impacting Visa and its clients. In March 2022, we suspended our operations in Russia and as a result, are no longer generating revenue from domestic and cross-border activities related to Russia. The war in Ukraine and any further actions by, or in response to such actions by, Russia or its allies could have lasting impacts on Ukraine as well as other regional and global economies, any or all of which could adversely affect our business. The ongoing military conflict in the Middle East, and any resulting conflicts in the region, could potentially have similar negative impacts. A decline in economic, political, market, health and social conditions could impact our clients as well, and their decisions could reduce the number of cards, accounts, and credit lines of their account holders, and impact overall consumption by consumers and businesses, which would ultimately impact our net revenue. Our clients may implement cost-reduction initiatives that reduce or eliminate marketing budgets, and decrease spending on optional or enhanced value-added services from us. Any events or conditions that impair the functioning of the financial markets, tighten the credit market, or lead to a downgrade of our current credit rating could increase our future borrowing costs and impair our ability to access the capital and credit markets on favorable terms, which could affect our liquidity and capital resources, or significantly increase our cost of capital. 28 28 28 28 28 28 Table of Contents Table of Contents Table of Contents Finally, as governments, investors and other stakeholders face additional pressures to accelerate actions to address climate change and other environmental, governance and social topics, governments are implementing regulations and investors and other stakeholders are imposing new expectations or focusing investments in ways that may cause significant shifts in disclosure, commerce and consumption behaviors that may have negative impacts on our business. As a result of any of these factors, any decline in cross-border travel and spend would impact our cross-border volumes, the number of cross-border transactions we process and our currency exchange activities, which in turn would reduce our international transaction revenue.

Our business relies on the processing of data across national borders. Legislators and regulators around the world are increasingly adopting or revising privacy, data protection, data management, data transfer, AI and cybersecurity laws and regulations. For example, our ongoing efforts to comply with complex U.S. and international privacy and data protection laws may increase the complexity of our compliance operations, entail substantial expenses, divert resources from other initiatives and projects, require us to modify our data processing practices, policies or services, and adversely impact our business. In addition, privacy laws in numerous jurisdictions, including but not limited to the U.S., China, India, Australia, New Zealand, Brazil, Kingdom of Saudi Arabia, Hong Kong and Japan, have established specific legal requirements for cross-border transfers of personal information and substantial compliance and audit obligations. Certain countries have also established specific legal requirements for data localization, such as where personal data must remain stored in the country. The global proliferation of new privacy and data protection laws may lead to inconsistent and conflicting requirements or legal interpretations, which create an uncertain regulatory environment. Noncompliance could also result in regulatory penalties and significant legal liability. Enforcement actions and investigations by regulatory authorities into companies related to data security incidents and privacy violations are generally increasing. In Europe, data protection authorities continue to apply and enforce the General Data Protection Regulation (GDPR), imposing record setting fines. As we develop integrated and personalized products and services and acquire new companies to meet the needs of a changing marketplace, we may expand our data profile through additional data types and sources, across multiple channels, and involving new partners. This potential expansion could amplify the impact of these various laws and regulations on our business. As a result, we are required to constantly monitor our privacy, data and cybersecurity practices and potentially change them when necessary or appropriate. We also may need to provide increased care in our data management, governance and quality practices, particularly as it relates to the use of data in products leveraging AI. We are also subject to a variety of laws and regulations governing the development, use and deployment of AI technologies. These laws and regulations are increasingly complex, fragmented and still evolving, and there is no single global regulatory framework for AI. Our development, deployment and use of AI and machine learning is subject to various risks at each stage of use. In the context of AI development, risks include those related to intellectual property considerations, the collection and use of personal data, third party risks, technical limitations of algorithms and the accuracy of training data, and compliance with emerging AI legal standards. The increased risk of inadvertent disclosure of confidential information or personal data in connection with the utilization of AI technologies may result in stronger regulatory scrutiny, leading to legal and regulatory investigations and 25 25 25 25 25 25 Table of Contents Table of Contents Table of Contents enforcement actions that may negatively affect our business, even if unfounded. In the context of use and deployment, risks include technical, operational and compliance considerations, and our ability to monitor and safely deploy AI systems throughout the organization with appropriate safeguards and in compliance with the various regulatory schemes related to AI technology. In particular, the adoption of agentic commerce, in which autonomous AI agents initiate and execute transactions on behalf of users, presents novel and complex regulatory, privacy and cybersecurity risks. Legal frameworks governing such autonomous agents remain nascent, with limited direct guidance specific to payments. The interplay between payments regulations, data privacy laws and evolving AI regulations may create uncertainty around compliance obligations and potential liability exposure as more participants (including sellers, fintechs, AI developers and enablers) enter the agentic commerce ecosystem. The market is still assessing how regulators may apply existing consumer protection and other laws in the context of AI. For example, as agentic commerce solutions scale, we may see increased instances of erroneous or disputed payments, increased chargebacks and reputational harm. Furthermore, reliance on agentic AI introduces challenges in monitoring cross-border, prohibited or high-risk transactions, where conflicting regulatory requirements may apply. The fragmented regulatory landscape for emerging technologies such as AI and inconsistent requirements across legal frameworks may amplify difficulties in identifying, preventing or mitigating risk with a single global approach, potentially increasing our compliance costs or stratifying our ability to leverage certain data or technologies for innovation. For instance, the EU has adopted a comprehensive AI Act that establishes harmonized rules across Europe, with key provisions for high-risk AI systems taking effect in August 2026. Meanwhile, several U.S. states, including California, Colorado and Utah, have adopted AI-specific frameworks or are considering applying existing consumer and data protection laws to regulate AI. Depending on how these different regulations are interpreted and enforced, they may limit the ability to develop and deploy AI systems or significantly increase associated compliance costs. Our development and implementation of governance frameworks aimed at complying with emerging laws and regulations applicable to our AI and machine learning systems may not be successful in mitigating all of these emerging risks.

Our business relies on the processing of data across national borders. Legal requirements relating to the collection, storage, handling, use, disclosure, transfer, disposal and security of personal data continue to evolve, and we are subject to an increasing number of privacy, data protection, cybersecurity and AI requirements around the world. For example, our ongoing efforts to comply with complex U.S. state privacy and data protection regulations, and emerging international privacy and data protection laws, may increase the complexity of our compliance operations, entail substantial expenses, divert resources from other initiatives and projects, and limit the services we are able to offer. Additionally, privacy laws in other regions, such as China’s Personal Information Protection Law and India’s Personal Data Protection Act, may have extraterritorial application and include restrictions on cross-border data transfers, extensive notification and localization requirements, and substantial compliance and audit obligations. The global proliferation of new privacy and data protection laws may lead to inconsistent and conflicting requirements, which create an uncertain regulatory environment. Noncompliance could also result in regulatory penalties and significant legal liability. Enforcement actions and investigations by regulatory authorities into companies related to data security incidents and privacy violations are generally increasing. In Europe, data protection authorities continue to apply and enforce the General Data Protection Regulation (GDPR), imposing record setting fines. We are also subject to a variety of laws and regulations governing the development, use, and deployment of AI technologies. These laws and regulations are still evolving, and there is no single global regulatory framework for AI. The market is still assessing how regulators may apply existing consumer protection and other laws in the context of AI. There is thus uncertainty on what new laws will look like and how existing laws will apply to our development, use, and deployment of AI. In the midst of this uncertainty, we may face challenges due to the complexity and rapidly changing nature of AI technology and applicable laws. Our use of AI and machine learning is subject to various risks at each stage of use. In the context of AI development, risks include those related to intellectual property considerations, the collection and use of personal information, third party risks, technical limitations of algorithms and the accuracy of training data, and compliance with emerging AI legal standards. In the context of use and deployment, risks include ethical and compliance considerations, and our ability to monitor and safely deploy AI systems throughout the organization with appropriate safeguards. The EU has adopted a comprehensive AI Act that applies harmonized rules across Europe with the aim of fostering innovation and respecting fundamental rights. The EU AI Act comes into force in stages with the key provisions related to high risk AI coming into force in August 2026. There is still limited guidance on the EU AI Act, but it could, depending on how provisions are interpreted and enforced, limit the ability to create and deploy AI systems for uses deemed high-risk in the EU or add increased compliance costs associated with these systems. Our development and implementation of governance frameworks for our AI and machine learning systems may not be successful in mitigating all of these emerging risks. Further, as we develop integrated and personalized products and services and acquire new companies to meet the needs of a changing marketplace, we may expand our data profile through additional data types and sources, across multiple channels, and involving new partners. This potential expansion could amplify the impact of these various laws and regulations on our business. As a result, we are required to constantly monitor our privacy, 23 23 23 23 23 23 Table of Contents Table of Contents Table of Contents data and cybersecurity practices and potentially change them when necessary or appropriate. We also may need to provide increased care in our data management, governance and quality practices, particularly as it relates to the use of data in products leveraging AI.

The global payments space is intensely competitive. As technology evolves and consumer expectations change, new competitors or methods of payment emerge, and existing clients and competitors assume different roles. Our products compete with cash, checks, electronic payments, virtual currency payments, global or multi-regional networks, other domestic and closed-loop payments systems, digital wallets and alternative payments providers primarily focused on enabling payments through ecommerce and mobile channels. As the global payments space becomes more complex, we face increasing competition from our clients, other emerging payment providers such as fintechs, other digital payments, technology companies that have developed payments systems enabled through online activity in ecommerce, social media, and mobile channels, other providers of CMS and VAS offerings, as well as governments in a number of jurisdictions (e.g., U.S., Brazil and India), that are developing, supporting and/or operating national schemes, RTP networks and other payment platforms. For more information, please see Item 1—Competition above. Our competitors may acquire, develop or make better use of substantially better technology, have more widely adopted delivery channels, or have greater financial resources. They may offer more effective, innovative or a wider range of programs, products and services. They may use more effective advertising and marketing strategies that result in broader brand recognition and greater use, including with respect to issuance and seller acceptance. They may also develop better solutions or offer more favorable pricing. Moreover, even if we successfully adapt to technological change and the proliferation of alternative types of payment services by developing and offering our own services in these areas, such services may provide less favorable financial terms for us, which could hurt our financial results. We expect to face more competition as AI continues to advance and GenAI and agentic AI capabilities become integrated into payments and related services in two main ways: first, by competitors successfully enhancing their products, services and external offerings with AI to achieve greater and faster product adoption; and second, by competitors providing internal AI tools to upskill their employees for greater operational efficiencies and impact. In addition, our competitors may have, or in the future may obtain, proprietary rights that would prevent, limit or interfere with our ability to design, use or sell our own AI-based offerings or services to our clients and other third parties. If we do not continue to invest in developing and supporting our AI-based initiatives, we may fall behind technological developments and evolving industry standards, which would likewise harm our reputation and ability to effectively compete, retain clients or grow our business. Certain of our competitors operate with different business models, have different cost structures or participate in different market segments. Many of these competitors are also able to use existing payment networks without being subject to many of the associated costs. Moreover, these competitors also occupy various roles in the payments ecosystem that enable them to influence payment choice of other participants. Some of our competitors, including American Express, Discover, private-label card networks, virtual currency providers, technology companies that enable the exchange of digital assets, and certain alternative payments systems like Alipay and WeChat Pay, operate closed-loop payments systems, with direct connections to both sellers and consumers. Those business models may ultimately prove more successful or more adaptable to regulatory, technological and other developments. In some cases, these competitors have the support of government mandates that prohibit, limit or otherwise hinder our ability to compete for transactions within certain countries and regions. For more information on government actions, initiatives or regulations that could impact competition, please see Item 1—Government Regulation and Item 1A—Regulatory Risks above. We expect the competitive landscape to continue to shift and evolve. For example: •We, along with our competitors, clients, network participants, and others are developing or participating in alternative payments systems or products, such as mobile payment services, ecommerce payment services, P2P payment services, real-time and faster payment initiatives, and payment services that permit 27 27 27 27 27 27 Table of Contents Table of Contents Table of Contents ACH or direct debits from or to consumer checking accounts, that could either reduce our role or otherwise disintermediate us from the transaction processing or the value-added services we provide to support such processing. Examples include initiatives from The Clearing House, an association consisting of large financial institutions that has developed its own faster payments system; Early Warning Services, which operates Zelle, a bank-offered alternative network that provides another platform for faster funds or real-time payments across a variety of payment types, including P2P, corporate and government disbursement, bill pay and deposit check transactions; and cryptocurrency, including stablecoin-based payments initiatives. •In July 2025, the U.S. enacted the Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act), establishing a comprehensive framework for regulating stablecoins. Similarly, the European Union has adopted its own legal framework for crypto assets. Many other countries, including the U.K., Japan, United Arab Emirates, Hong Kong and Singapore, are at varying stages of adopting stablecoin and digital assets-related regulatory frameworks. With more regulatory certainty and permissive or favorable regulations, stablecoins could potentially disrupt existing payment networks, including in cross-border and B2B transactions. In countries facing currency instability and controls, stablecoins could increasingly be used as an alternative to preserve and transfer asset value. In more mature markets, stablecoins could achieve broad adoption through regulated issuance by traditional banks, fintechs and other new entrants, as well as by being integrated in closed loop systems operated by large digital ecosystems and platforms. •Parties that access our payment credentials, tokens and technologies, including clients, technology solution providers or others might be able to migrate or steer account holders and other clients to alternative payment methods or use our payment credentials, tokens and technologies to establish or help bolster alternate payment methods and platforms. •Participants in the payments industry may merge, form joint ventures or enable or enter into other business combinations or bilateral agreements that strengthen their existing business propositions or create new, competing payment services. For example, parties may agree not to use our payments network for processing transactions resulting in sellers processing transactions directly with issuers, or processors processing transactions directly with issuers and acquirers. •New or revised industry standards for or related to payments set by individual countries, regions or standard setting organizations may result in additional costs and expenses for Visa and its clients, or otherwise negatively impact the functionality and competitiveness of our products and services. As the competitive landscape is quickly evolving, we may not be able to foresee or respond sufficiently to emerging risks associated with new businesses, products, services and practices. We may be asked to adjust our local rules and practices, develop or customize certain aspects of our payment services, adjust the economics or pricing for our offerings, or agree to business arrangements that may be less protective of Visa’s proprietary technology and interests in order to compete and we may face increasing operational costs and risk of litigation concerning intellectual property. Our failure to compete effectively in light of any such developments could harm our business and prospects for future growth.

The global payments space is intensely competitive. As technology evolves and consumer expectations change, new competitors or methods of payment emerge, and existing clients and competitors assume different roles. Our products compete with cash, checks, electronic payments, virtual currency payments, global or multi-regional networks, other domestic and closed-loop payments systems, digital wallets and alternative payments providers primarily focused on enabling payments through ecommerce and mobile channels. As the global payments space becomes more complex, we face increasing competition from our clients, other emerging payment providers such as fintechs, other digital payments, technology companies that have developed payments systems 24 24 24 24 24 24 Table of Contents Table of Contents Table of Contents enabled through online activity in ecommerce, social media, and mobile channels, other providers of new flows and value-added service offerings, as well as governments in a number of jurisdictions (e.g., Brazil and India) as discussed above, that are developing, supporting and/or operating national schemes, RTP networks and other payment platforms. For more information, please see Item 1—Competition above. Our competitors may acquire, develop, or make better use of substantially better technology, have more widely adopted delivery channels, or have greater financial resources. They may offer more effective, innovative or a wider range of programs, products and services. They may use more effective advertising and marketing strategies that result in broader brand recognition and greater use, including with respect to issuance and merchant acceptance. They may also develop better security solutions or more favorable pricing arrangements. Moreover, even if we successfully adapt to technological change and the proliferation of alternative types of payment services by developing and offering our own services in these areas, such services may provide less favorable financial terms for us than we currently receive from VisaNet transactions, which could hurt our financial results and prospects. Certain of our competitors operate with different business models, have different cost structures or participate in different market segments. Many of these competitors are also able to use existing payment networks without being subject to many of the associated costs. Moreover, these competitors also occupy various roles in the payments ecosystem that enable them to influence payment choice of other participants. Those business models may ultimately prove more successful or more adaptable to regulatory, technological and other developments. In some cases, these competitors have the support of government mandates that prohibit, limit or otherwise hinder our ability to compete for transactions within certain countries and regions. Some of our competitors, including American Express, Discover, private-label card networks, virtual currency providers, technology companies that enable the exchange of digital assets, and certain alternative payments systems like Alipay and WeChat Pay, operate closed-loop payments systems, with direct connections to both merchants and consumers. Government actions or initiatives such as the Dodd-Frank Act, the IFR in Europe, or RTP initiatives by governments such as the U.S. Federal Reserve’s FedNow or the Central Bank of Brazil’s Pix system may provide competitors with increased opportunities to derive competitive advantages from these business models, and may create new competitors, including in some cases the government itself. Similarly, regulation in Europe under PSD2 and the IFR may require us to open up access to, and allow participation in, our network to additional participants, and reduce the infrastructure investment and regulatory burden on competitors. In addition to the open banking provisions under PSD2, efforts to implement or facilitate open banking and open finance requirements are underway across a number of countries, including Australia, Brazil, Canada and the U.S., which could impose additional requirements on financial institutions or others regarding access to and use of financial data. We also run the risk of disintermediation due to factors such as emerging technologies and platforms, including mobile payments, alternative payment credentials, other ledger technologies or payment forms, and by virtue of increasing bilateral agreements between entities that prefer not to use our payments network for processing transactions. For example, merchants could process transactions directly with issuers, or processors could process transactions directly with issuers and acquirers. We expect the competitive landscape to continue to shift and evolve. For example: •We, along with our competitors, clients, network participants, and others are developing or participating in alternative payments systems or products, such as mobile payment services, ecommerce payment services, P2P payment services, real-time and faster payment initiatives, and payment services that permit ACH or direct debits from or to consumer checking accounts, that could either reduce our role or otherwise disintermediate us from the transaction processing or the value-added services we provide to support such processing. Examples include initiatives from The Clearing House, an association consisting of large financial institutions that has developed its own faster payments system; Early Warning Services, which operates Zelle, a bank-offered alternative network that provides another platform for faster funds or real-time payments across a variety of payment types, including P2P, corporate and government disbursement, bill pay and deposit check transactions; and cryptocurrency or stablecoin-based payments initiatives. •Many countries or regions are developing or promoting domestic networks, switches and RTP systems (e.g., U.S., Brazil, India and Europe) and in some countries the government itself owns and operates these RTP systems (e.g., Brazil). To the extent these governments mandate local banks and merchants to use and accept these systems for domestic or other transactions, prohibit international payments networks, like Visa, from participating on those systems, and/or impose restrictions or prohibitions on international payments networks from offering payment services on such transactions, we could face the risk of our business being disintermediated in those countries. For example, in some regions (Latin America, Southeast Asia and the Middle East), including through intergovernmental organizations such as the 25 25 25 25 25 25 Table of Contents Table of Contents Table of Contents Association of Southeast Asian Nations and the GCC, some countries are at varying stages of exploring or operationalizing the cross-border connectivity of such domestic systems. Similarly, India has expressed interest in expanding its digital public infrastructure, which includes its RTP system, Unified Payments Interface (UPI), outside the country and for cross-border payments. Currently, international payment networks like Visa are unable to participate in UPI. •Parties that process our transactions may try to minimize or eliminate our position in the payments value chain. •Parties that access our payment credentials, tokens and technologies, including clients, technology solution providers or others might be able to migrate or steer account holders and other clients to alternative payment methods or use our payment credentials, tokens and technologies to establish or help bolster alternate payment methods and platforms. •Participants in the payments industry may merge, form joint ventures or enable or enter into other business combinations that strengthen their existing business propositions or create new, competing payment services. •New or revised industry standards related to online checkout and web payments, cloud-based payments, tokenization or other payments-related technologies set by individual countries, regions or organizations such as the International Organization for Standardization, American National Standards Institute, World Wide Web Consortium, European Card Standards Group, PCI Co, Nexo and EMVCo may result in additional costs and expenses for Visa and its clients, or otherwise negatively impact the functionality and competitiveness of our products and services. As the competitive landscape is quickly evolving, we may not be able to foresee or respond sufficiently to emerging risks associated with new businesses, products, services and practices. We may be asked to adjust our local rules and practices, develop or customize certain aspects of our payment services, or agree to business arrangements that may be less protective of Visa’s proprietary technology and interests in order to compete and we may face increasing operational costs and risk of litigation concerning intellectual property. Our failure to compete effectively in light of any such developments could harm our business and prospects for future growth.

We are subject to dynamic, and sometimes conflicting laws, regulations and other directives that govern a wide array of issues, including some that extend beyond our core products and services. This includes, but is not limited to, matters that touch upon sustainability, climate change, people and talent management, equal opportunity and inclusion, supply chain management and human rights. A wide range of stakeholders, including governments, NGOs, consumers, partners, employees and investors, are increasingly attentive to these corporate responsibility matters and are developing expectations which at times may be discordant with each other and with Visa’s existing strategies and disclosure practices. For example, certain regulators have proposed or adopted, or plan to propose or adopt, rules or standards related to these matters that would apply to our business, including the EU’s Corporate Sustainability Reporting Directive and Corporate Sustainability Due Diligence Directive and the State of California’s legislation requiring broad disclosure of greenhouse gas emissions and other climate-related information. Our ability to achieve, or make sufficient progress towards any of our CRS objectives is subject to numerous risks, many of which are outside of our control, including the evolving legal environment and regulatory requirements for the tracking and reporting of CRS standards or disclosures and the actions of suppliers, partners, and other third parties. Accordingly, our goals may evolve from time to time, implementation of these goals may require considerable investments, and ultimately, we cannot guarantee our ability to achieve or to make sufficient progress toward, any or all of our publicly stated goals. From time to time, we may restate previously reported data to reflect updated methodologies for reporting our CRS data, an improvement in the availability and quality of data, changing assumptions, changes in the nature and scope of our operations, or other changes in circumstances. This may result in a lack of consistent or meaningful comparative data from period to period or between us and other companies in the same industry. Furthermore, where new laws or regulations are more stringent than current legal or regulatory requirements, we may experience increased compliance burdens and costs to meet such obligations. Because our stakeholders often hold differing views on our CRS-related goals and initiatives and we face conflicting directives from U.S. and international regulatory authorities, any failure, or perceived failure, to meet these evolving and varied stakeholder expectations and standards may result in negative attention in the media, reputational impacts, including an inaccurate perception or misrepresentation of our actual CRS practices, diversion of management’s attention and resources, and proxy fights, among other material adverse impacts on our business. Additionally, the goals or initiatives themselves could potentially subject us to litigation or investigations initiated by government authorities or private actors alleging that our activities related to CRS are anti-competitive, discriminatory or otherwise unlawful.

We are subject to laws, regulations and other measures that govern a wide range of topics, including those that are related to matters beyond our core products and services, such as matters that touch upon sustainability, climate change, human capital, inclusion and diversity, and human rights. A wide range of stakeholders, including governments, customers, employees, and investors, are increasingly focused on and are developing expectations regarding these corporate responsibility matters. We have established CRS-related initiatives, adopted reporting frameworks, and announced several related goals. These goals may change from time to time, implementation of these goals may require considerable investments, and ultimately, we cannot guarantee that we will achieve them. Our ability to achieve any CRS objectives is subject to numerous risks, many of which are outside of our control, including the evolving legal environment and regulatory requirements for the tracking and reporting of CRS standards or disclosures and the actions of suppliers, partners, and other third parties. Certain of our regulators have proposed or adopted, or may propose or adopt, rules or standards related to these matters that would apply to our business. New regulations have been enacted and/or are expected in several jurisdictions, including the EU’s Corporate Sustainability Reporting Directive, the SEC climate-related disclosures that could require disclosure of climate-related information and the State of California’s legislation requiring broad disclosure of greenhouse gas emissions and other climate-related information. Prevailing CRS standards and expectations may also reflect conflicting values or objectives, which can result in our practices being judged by standards that are continually evolving and are not always clear. From time to time, the methodologies for reporting our CRS data may be updated and previously reported data may be adjusted to reflect an improvement in the availability and quality of data, changing assumptions, changes in the nature and scope of our operations, and other changes in circumstances. This may result in a lack of consistent or meaningful comparative data from period to period or between us and other companies in the same industry. Further, where new laws or regulations are more stringent than current legal or regulatory requirements, we may experience increased compliance burdens and costs to meet such obligations. Our stakeholders often hold differing views on our CRS-related goals and initiatives, which may result in negative attention in traditional and social media or a negative perception of our response to concerns regarding these matters. In addition, we also face potentially conflicting supervisory directives as certain U.S. regulatory and non-U.S. authorities have prioritized CRS-related issues while Congress and certain U.S. state governments have signaled pursuing potentially conflicting priorities. These circumstances, among others, may result in pressure from investors, unfavorable reputational impacts, including inaccurate perceptions or a misrepresentation of our actual CRS practices, diversion of management’s attention and resources, and proxy fights, among other material adverse impacts on our business. Any failure, or perceived failure, by us to adhere to our public statements, comply fully with developing interpretations of CRS laws and regulations, or meet evolving and varied stakeholder expectations and standards could negatively impact our business, reputation, financial condition, and operating results.