Mastercard Incorporated

Cybersecurity and data protection · Data breaches and cyber attacks

Information security incidents or account data compromise events could disrupt our business, damage our reputation, increase our costs and cause losses. Information security risks for payments and technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies (including AI), the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, 'hacktivists', terrorists, nation-states, state-sponsored actors and other external parties.

Cybersecurity and data protection · Third party data security and vendors

Our operations rely on the secure transmission, storage and other processing of confidential, proprietary, sensitive and personal information and technology in our computer systems and networks, as well as the systems of our third-party providers. Our customers and other parties in the payments value chain, as well as account holders, rely on our digital technologies, computer systems, software and networks to conduct their operations.

Technology infrastructure · Technology systems and infrastructure failure

Service disruptions that cause us to be unable to process transactions or service our customers could reduce our operational resilience and materially affect our overall business and results of operations. Our transaction switching systems and other offerings may experience interruptions as a result of technology malfunctions, network degradation, updates and migrations to new technology and platforms, supply-chain attacks, fire, floods, earthquakes, weather events, power outages, telecommunications disruptions, terrorism, workplace violence, accidents or other catastrophic events.

Industry regulation · Regulatory compliance and changes

Global regulatory and legislative activity related to the payments industry may have a material adverse impact on our overall business and results of operations. Central banks and similar regulatory bodies have increasingly established or further expanded their authority over certain aspects of payments systems such as ours, including obligations or restrictions with respect to the types of products and services that we may offer, the countries in which our products and services may be used, the way we structure and operate our business and the types of consumers and merchants who can obtain or accept our products or services.

Data and privacy · Cross border data transfer regulations

Some jurisdictions have implemented, or are considering implementing, requirements to collect, store and/or process data within their borders, as well as prohibitions on the transfer of data abroad, leading to technological and operational implications as well as increased compliance burdens and other costs.

Legal and litigation · Litigation and legal proceedings

Liabilities or business limitations resulting from litigation could materially and adversely affect our results of operations. We are a defendant in a number of civil litigations and regulatory proceedings and investigations, including among others, those alleging violations of competition and antitrust law and those involving intellectual property claims.

Tax and financial reporting · Tax compliance and changes in tax law

We could be subject to adverse changes in tax laws, regulations and interpretations or challenges to our tax positions. We are subject to tax laws and regulations of the U.S. federal, state and local governments as well as various non-U.S. jurisdictions. Current and potential future changes in existing tax laws, including regulatory guidance, are continuously being considered and have been or may be enacted.

Economic and market conditions · Consumer spending and confidence

Consumers and businesses reducing spending, which could impact domestic and cross-border spend. Debt limit and budgetary discussions in the U.S. have affected, and could further affect, the U.S. credit rating, impacting consumer confidence and spending.

Geopolitical and trade · Regulatory and policy uncertainty

Geopolitical events and any resulting OFAC sanctions, adverse trade policies, enforcement of U.S. laws related to countering the financing of terrorism, economic sanctions and anti-corruption, or other types of government actions could lead affected or other jurisdictions to take actions in response that could adversely affect our business.

Social and demographic · Stakeholder activism and pressure

Moreover, in recent years, we have received negative feedback from stakeholders on the adequacy of our environmental, social and governance initiatives. We have also increasingly been receiving negative feedback from anti-environmental, social and governance stakeholders in opposition to such initiatives. Stakeholders from both sides of this issue may continue to view us negatively and take public action against us.

Social and demographic · Public perception and reputation

Negative brand perception may materially and adversely affect our overall business. Our brands and their attributes are key assets of our business. The ability to attract consumers to our branded products and retain them depends upon the external perception of us and our industry.

Natural and catastrophic events · Pandemic and public health crises

Cross-border activity has been, and may continue to be, adversely affected by world geopolitical, economic, health, weather and other conditions. These include or have included: Global pandemics (and related post-pandemic global economic impacts) and potential separate outbreaks of flu, viruses and other diseases (any of which could result in future epidemics or pandemics).

International and currency · Foreign exchange and currency exposure

Adverse currency fluctuations and foreign exchange controls could negatively impact our results of operations. During 2025, approximately 71% of our revenue was generated from activities outside the U.S., which could be transacted in a non-functional currency. If the U.S. dollar strengthens compared to currencies in which we generate revenue, this revenue may be translated at a materially lower amount than expected.

Credit and liquidity · Credit risk and customer defaults

Our role as guarantor, as well as other contractual obligations and discretionary actions, expose us to risk of loss or illiquidity. We are a guarantor of certain third-party obligations, including those of certain of our customers and service providers. In this capacity, we are exposed to credit and liquidity risks. We may incur significant losses in connection with transaction settlements if a customer fails to fund its daily settlement obligations due to technical problems, liquidity shortfalls, insolvency or other reasons.

Customer and revenue · Customer concentration and key customer dependence

Losing a significant portion of business from one or more of our largest customers could lead to significant revenue decreases in the longer term, which could have a material adverse impact on our business and our results of operations. A significant portion of our revenue is concentrated among our five largest customers. Loss of business from any of our large customers could have a material adverse impact on our overall business and results of operations.

Market position and competition · Competitive pressure and market share loss

Substantial and intense competition worldwide in the global payments industry may materially and adversely affect our overall business and results of operations. The global payments industry is highly competitive. Our payment programs compete against competitors both within and outside of the global payments industry and compete in all payment categories, including paper-based payments and all forms of electronic payments.

Strategic execution · Merger acquisition and divestiture risks

Our efforts to enter into acquisitions, strategic investments or new businesses could be impacted or prevented by regulatory scrutiny and could otherwise result in issues that could disrupt our business and harm our results of operations or reputation. We continue to evaluate our strategic acquisitions of, and investments in, complementary businesses, products or technologies. As we do so, we face increasing regulatory scrutiny with respect to antitrust, national security and other considerations that could impact these efforts.

Reputation and brand · Social media and digital reputation

Under some circumstances, our use of social media, or the use of social media by others as a channel for criticism or other purposes, could also cause rapid, widespread reputational harm to our brands by disseminating rapidly and globally actual or perceived damaging information about us, our products or merchants or other end users who utilize our products.

Reputation and brand · Esg environmental social governance performance

Environmental, social and governance matters and related stakeholder reaction may impact our reputation, increase legal exposure and/or have other business impacts, which could adversely affect our overall business and/or results of operations. Our brand and reputation are associated with the ways in which we impact environmental, social and governance matters. Consumers, investors, employees and other stakeholders are increasingly focused on these impacts.

Corporate governance · Shareholder rights and activism

Provisions in our organizational documents and Delaware law could be considered anti-takeover provisions and have an impact on change-in-control. Provisions contained in our amended and restated certificate of incorporation and bylaws and Delaware law could be considered anti-takeover provisions, including provisions that could delay or prevent entirely a merger or acquisition that our stockholders consider favorable.