이번 보고서
2025 연차보고서
10-K · 기간 말 2025. 12. 31. · 제출 2026. 2. 11.
비교 기준
2024 연차보고서
10-K · 기간 말 2024. 12. 31.
0
새 리스크 항목
1
신규 문단
28
수정 문단
5
삭제
+2%
분량 변화
AI 한국어 요약
한 줄 요약
관세 등 글로벌 무역정책 불확실성이 새 리스크로 들어갔고, AI가 보안 위협을 키운다는 표현이 더 강해졌어요.
주목할 변화
- 신규관세·무역정책 불확실성세계 경제 리스크 목록에 무역정책 항목이 새로 생겼어요. 소비자와 기업의 지출에 영향을 줄 수 있다고 적었어요. 원문은 "Uncertain global trade policies and related government actions (including those related to tariffs)"예요.
- 신규브라질 결제 보증 책임 확대브라질이 새 규제를 만들었어요. 마스터카드·비자 같은 결제사업자가 가맹점 정산의 안정성까지 책임지도록 하는 내용이에요. 다른 나라도 비슷한 규제를 낼 수 있다고 덧붙였어요("more jurisdictions may enact similar approaches").
- 강화AI가 키우는 보안 위협작년에는 AI가 위협을 키울 "수도 있다(may)"고 썼어요. 올해는 이미 키우고 있다고 단정했어요("is enhancing the frequency and effectiveness of threat actors"). 사기와 사이버 공격 증가도 AI 때문에 "further exacerbated"됐다고 적었어요.
- 신규카드 발급사 금리 상한 규제발급 은행에 영향을 주는 규제의 예로 "caps on issuer interest rates"를 새로 들었어요. 이미 시행된 규제뿐 아니라 추진 중인 입법까지 범위를 넓혔어요.
- 신규Recorded Future의 '비우호 기업' 지정 위험보안 자회사 Recorded Future가 일부 국가에서 "undesirable" 또는 "unreliable" 기업으로 지정될 수 있다는 문장이 추가됐어요. 회사는 이런 지정이 보안 관련 위험을 더 키울 수 있다고 봤어요.
- 강화개인정보·사이버 규제 부담법규가 "overlapping"된다는 표현과 사이버보안 범위가 더해졌어요. 사고 한 건에도 여러 기관에 각기 다른 기준과 기한으로 신고해야 할 수 있다는 문장이 새로 들어갔어요. 처벌 범위에는 "both civil and criminal"이 명시됐어요.
- 신규파트너사의 데이터 제공 거부결제 생태계 참여자들이 자체 서비스를 만들려고 마스터카드에 주던 데이터 권한을 거둘 수 있다는 문장이 생겼어요("withhold rights to data we use to power our solutions"). 그러면 마스터카드 솔루션의 효과가 떨어질 수 있다고 적었어요.
- 강화ESG 공시의 위법성 논란ESG 공시가 부정확하다는 지적에 더해 "unlawful"로 비칠 위험이 추가됐어요. "equitably", "equal opportunities" 같은 표현은 빠지고 더 일반적인 문구로 바뀌었어요.
참고
작년 보고서는 러시아 사업 중단을 직접 언급했어요. 올해는 이 부분이 "any decisions we may make relating to entering or exiting a particular market"으로 바뀌었어요. 소송 리스크 항목에는 Rules Relief Class 합의가 예시로 새로 들어갔어요.
원문 비교
- •Uncertain global trade policies and related government actions (including those related to tariffs), which could have an adverse impact on our business (including with respect to consumer and business spending) and relationships with stakeholders
- Privacy,
Data Protection,Data, AI and Information Security Stakeholder Relationships Acquisitions and Strategic Investments - •Geopolitical events and any resulting OFAC sanctions, adverse trade policies, enforcement of U.S. laws related to countering the financing of terrorism, economic sanctions and anti-corruption, or other types of government actions could lead affected or other jurisdictions to take actions in response that could adversely affect our business. Moreover, because of various concerns jurisdictions may have with respect to our business, including
our decisionany decisions we may make relating tosuspend business operations in Russia,entering or exiting a particular market, such jurisdictions may decide to begin to or increase their focus on growing local payment networks and other solutions. - Privacy,
Data Protection,Data, AI and Information Security - We are subject to increasingly complex,
fragmented andfragmented, overlapping and/or divergent laws and regulations related to privacy and data protection, data use and governance, AI and information security (including with respect to cybersecurity and cyber-risk) in the jurisdictions in which we do business.As a result, newNew or updatedprivacy and data protection and information securitylaws and regulations have led, and may continue to lead, to similar, stricter or at times conflicting requirements, creating an uncertain regulatory environment. For example, some jurisdictions have implemented or are otherwise considering requirements to collect, store and/or process data within their borders, as well as prohibitions on the transfer of and access to data abroad, leading to technological and operational implications. Other jurisdictions have adopted or are otherwise considering adopting sector-specific regulations for the payments industry and other industries in which we participate, including forced data sharing requirements or additional verification requirements. With respect to information security, any single breach could require parallel notifications to data protection authorities, cyber authorities and/or law-enforcement, often requiring different thresholds, reporting deadlines and formats. In addition, laws and regulations on AI, data governance and credit decisioning may overlap or conflict with, or diverge from, general privacy rules. Overall, these myriad laws and regulations may require us to modify or limit our data processing practices and policies, incur substantial compliance-related costs and expenses, and otherwise suffer adverse impacts on our business. Failure to comply with any of these laws, regulations and requirements (including as a result of conflicting regulations) could result in fines, sanctions or other enforcement actions orpenalties,penalties (both civil and criminal), which could materially and adversely affect our results of operations and overall business, as well as have an impact on our reputation. - As a user and deployer of AI technology, we are also subject to increasing and evolving laws and regulations related to AI governance, including the EU AI Act, and new applications of existing laws and regulations to AI. How our use and deployment of AI will be regulated is still developing as policymakers around the world consider how to regulate AI, and uncertainty remains as to how AI technology or its application (such as in agentic commerce) will continue to advance. In addition, the use of AI creates or amplifies risks that are challenging to fully prevent or mitigate. In particular, AI algorithms may generate inaccurate, unintended, unfair, biased or discriminatory outcomes (which may not be easily detectable or explainable) and may inadvertently disclose confidential information and/or breach intellectual property, privacy or other rights. Our implementation of robust AI governance and risk management
frameworks aimed at complyingframeworks, designed to ensure our responsible use of AI and help us to comply with emerging laws andregulationsregulations, may not be sufficient protection against these emerging risks. - Further, as we acquire new companies and develop integrated and personalized products and services to meet the needs of a changing marketplace, we have expanded and may further expand our data profile through additional data types and sources, across multiple channels, and involving new partners. This expansion has amplified and may continue to amplify the impact of these various laws and regulations on our business or subject us to new laws and regulations. For example,
our acquisitionas a provider ofRecorded Future, aglobal threat intelligencecompany, increases ourservices through Recorded Future, we are subject to increased exposure to certain laws and regulations, including global cybercrime and other laws and regulations in various jurisdictions. As a result, we are required to constantly monitor our data practices and potentially change them when necessary or appropriate. We also need to provide increased care in our data management,governancegovernance, quality andqualityaccuracy practices, particularly as it relates to the use of data in products leveraging AI. - New requirements and rules, or changing interpretations of existing requirements in these areas, or the development of new regulatory schemes related to the digital economy in general, may also increase our costs and/or restrict our ability to leverage data or use AI for innovation. This could impact the products and services we offer and other aspects of our business, such as fraud monitoring, the need for improved data management,
governancegovernance, quality andqualityaccuracy practices, the development of information-based products and solutions, and technology operations. In addition, these requirements may increase the costs to our customers of issuing payment products or using information products, which may, in turn, decrease the number of our products that they offer. While we intend to comply with all regulatory requirements, innovate responsibly and deploy Privacy by Design, Data by Design and AI Governance approaches to all of our product development, the speed and pace of changes in laws (as well as stakeholder interests) may not allow us to meet rapidly evolving regulatory and stakeholder expectations. Any of these developments could materially and adversely affect our overall business and results of operations. - •Issuer and Acquirer Practices Legislation and Regulation. Certain regulations or legislation that do or could impact our issuers and acquirers (such as caps on issuer interest rates) may impact various aspects of our business.
For example,Additionally, strong authentication requirements within the EU’s Payment Services Directive in the EEA could increase the number of transactions consumers abandon if we are unable to secure a frictionless authentication experience under these standards. Such an increase could adversely impact our volumes or other operational metrics. - Certain limitations have been placed on our business because of litigation and litigation settlements, such as changes to our no-surcharge rule in the U.S. and Canada. Any future limitations resulting from the outcomes of any litigation and litigation settlements (such as the Rules Relief Class settlement as described in Note 19 (Legal and Regulatory Proceedings) to the consolidated financial statements included in Part II, Item 8) or regulatory proceeding, including any changes to our rules or business practices, could impact our relationships with our customers, including reducing the volume of business that we do with them, which may materially and adversely affect our overall business and results of operations.
- •Payments industry participants may develop their own products and services to support our switched transaction and payments offerings, forcing us to change our pricing or practices for our own offerings in order to compete. Participants may also withhold rights to data we use to power our solutions in order to support their own potential future solutions, potentially impacting the effectiveness of our solutions. In addition, governments may promote their own national or international payments platforms, potentially putting us at a competitive disadvantage in those markets, or requiring us to compete differently. Moreover, as central banks experiment with CBDCs, policies and design considerations that governments adopt could impact the extent of our role in facilitating CBDC-based payment transactions, potentially impacting the transactions that we may process over our network.
- In order to increase transaction volumes, enter new markets and expand our products and services, we seek to enter into business agreements with customers through which we offer incentives, pricing discounts and other support that promote our products. In order to stay competitive, we may have to increase the amount of these incentives and pricing discounts so as to meet customer demand for better pricing arrangements and greater rebates and incentives. As a result, we may not be able to grow our volume and/or services
enoughto the extent necessary to compensate for the additional costs related to these increased incentives and pricing discounts. In addition, increased pressure on prices increases the importance of cost containment and productivity initiatives in areas other than those relating to customer incentives. - The payments industry is subject to rapid and significant technological changes, including new technologies and changes to existing technologies (such as
cryptocurrencydigital assets and blockchain, AI, machine learning, privacy enhancement and cybersecurity). These changes could result in new technologies that may be superior to, or render obsolete, the technologies we currently use in our programs and services. They may also result in new and innovative payment methods, products and services. - Additionally, there are a number of factors relating to technology change that could impact us. These include: the inability of third parties on which we rely for the development of and access to new technologies to keep pace with technological
changes;changes (including with regard to AI); potential action from third-party patent holders, including notices or inquiries threatening litigation against us or our customers for alleged patent infringement or demanding significant license fees; the scope of, as well as customer and merchant resistance to, industry-wide solutions and standards (such as those related to tokenization or othersafety andsecurity technologies); any difficulty we may experience in attracting and retaining employees with technology expertise; and the need to invest resources for new technologies, which could lead to further additional expenses. Any of these developments could impact our ability to develop and adopt new technologies, as well as improve and keep pace with current technologies and reflect such technology in our payments offerings. - Information security risks for payments and technology companies such as ours have significantly increased in recent years in part because of the proliferation of new
technologies,technologies (including AI), the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, “hacktivists”, terrorists, nation-states, state-sponsored actors and other external parties. These threats may derive from fraud or malice on the part of our employees or third parties, or may result from human error, software bugs, server malfunctions, software or hardware failure or other technological failure. These threats include cyber-attacks such as computer viruses, denial-of-service attacks, malicious code (including ransomware), social-engineering attacks (including phishing attacks) or information security breaches and could lead to the misappropriation or loss of consumer account and other information and identity theft. These types of threats have risen significantly due to a significant portion of our workforce working in a hybrid environment. The widespread use of AI, and its increasing capabilities, is enhancing the frequency and effectiveness of threat actors. - Our operations rely on the secure transmission, storage and other processing of confidential, proprietary, sensitive and personal information and technology in our computer systems and networks, as well as the systems of our third-party providers. Our customers and other parties in the payments value chain, as well as account holders, rely on our digital technologies, computer systems, software and networks to conduct their operations. In addition, to access our products and services, our customers and account holders increasingly use personal smartphones, tablet PCs and other mobile devices that may be beyond our control. We, like other financial technology organizations, routinely are subject to cyber-threats and our technologies, systems and networks, as well as the systems of our third-party providers, have been subject to attempted cyber-attacks. Because of our position in the payments value chain, we believe that we are likely to continue to be a target of such threats and attacks. Geopolitical events and resulting government activity could also lead to information security threats and attacks by affected or sympathizing jurisdictions or other actors, which could put our information and assets at risk, as well as result in network disruption. In addition, the current or future listing of Recorded Future as an “undesirable” or “unreliable” entity by certain jurisdictions could further increase our risks in this area.
- In addition, companies have generally experienced in recent years an increase in fraudulent activity and
cyber-attacks.cyber-attacks, which has been further exacerbated by the increased use of AI. Criminals are using increasingly sophisticated methods to capture consumer personal information to engage in illegal activities such as counterfeiting or other fraud and may see their effectiveness enhanced by the use of AI. As outsourcing and specialization become common in the payments industry, there are more third parties involved in processing transactions using our payment products. We continue to take measures to make card and digital payments more secure. However, increased fraud levels and cyber-attacks involving our products, services and/or network, or misconduct or negligence by third parties switching or otherwise servicing our products and services could damage our reputation and reduce the use and acceptance of our products and services and/or increase our compliance costs. Further, such occurrences have resulted in and could further result in legislative or regulatory intervention, which could lead to enhanced security requirements and liabilities. See “Risk Factors - Privacy,Data Protection,Data, AI and InformationSecurity Compliance”Security” in this Part I, Item 1A for more detail concerning related legal risks and obligations. - Our transaction switching systems and other offerings may experience interruptions as a result of technology malfunctions, network degradation, updates and migrations to new technology and platforms, supply-chain attacks, fire, floods, earthquakes, weather events, power outages, telecommunications disruptions, terrorism, workplace violence, accidents or other catastrophic events (including those related to climate change). We have experienced in limited instances, and may continue to experience, some types of these interruptions. Our visibility in the global payments industry may also put us at greater risk of attack by terrorists, activists, or hackers who intend to disrupt our facilities, networks and/or systems. Inadequate infrastructure in lesser-developed markets could also result in service disruptions, which could impact our ability to do business in those markets. Additionally, we rely on third-party service providers for the timely transmission of information across our global data network. If one of our service providers fails to provide the communications capacity or services we require, as a result of natural
disaster,disasters, operational disruptions, cybersecurity-related disruptions or failures, terrorism, hacking or any other reason, the failure could interrupt our services. Although we maintain an enterprise resiliency program to analyze risk, assess potential impacts, and develop effective response strategies, we cannot ensure that our business would be immune to these risks. Due to the intrinsic importance of our switching systems to our business, any interruption or degradation could adversely affect the perception of the reliability of products carrying our brands and materially adversely affect our overall business and our results of operations. - The industries in which our customers participate have undergone substantial, accelerated consolidation in the past. These consolidations have included customers with a substantial Mastercard portfolio being acquired by institutions with a strong relationship with a competitor. Potential future consolidation could occur as a result of bank failures, similar to those that occurred in
the U.S. inrecent years. If significant consolidation among customers were to continue, it could result in the substantial loss of business for us, which could have a material adverse impact on our business and prospects. In addition, one or more of our customers could seek to merge with, or acquire, one of our competitors, and any such transaction could also have a material adverse impact on our overall business. Consolidation could also produce a smaller number of large customers, which could increase their bargaining power and lead to lower prices and/or more favorable terms for our customers. These developments could materially and adversely affect our results of operations. - We switch a high percentage of domestic (or in-country) transactions conducted using cards with our brands. However, there are several jurisdictions in which domestic transactions are switched by our customers or other processors. Because we do not provide domestic switching services in these countries or have direct relationships with account holders, we depend on our close working relationships with our customers to effectively manage our brands, and the perception of our payments system, among consumers in these countries. We also rely on these customers to help manage our brands and perception among regulators and merchants in these countries, alongside our own relationships with them. From time to time, our customers may take actions that we do not believe to be in the best interests of our payments system overall, which may materially and adversely impact our business.
- As we increase our work with national, state and local
governments, bothgovernments (both indirectly through financialinstitutionsinstitutions, system integrators and other third party partners and with them directly as ourcustomers,customers), we may face various risks inherent in associating or contracting directly with governments. These risks include, but are not limited to, the following: - •Working or contracting with
governments, eithergovernments (either directly or via our financial institution customers, system integrators or other third party partners) can subject us to heightened reputational risks, including extensive scrutiny and publicity, as well as a potential association with the policies of those governments. Any negative publicity or negative association with a government entity, regardless of its accuracy, may adversely affect our reputation. In addition, threat intelligence gathering services provided to governments through our acquisition of Recorded Future could negatively impact how we are viewed by other jurisdictions. - •Our business may be affected by actions taken by our customers, merchants or other organizations that impact the perception of our brands or the payments industry in general. From time to time, our customers may take actions that we do not believe to be in the best interests of our brands, such as creditor practices that may be viewed as “predatory”. Moreover, adverse developments with respect to our industry or the industries of our customers or other companies and organizations that use our products and services (including certain legally permissible but high-risk merchant categories, such as adult content, firearms, alcohol and tobacco) may also, by association, impair our reputation, or result in greater public, regulatory or legislative scrutiny, as well as potential litigation. Additionally, we or our customers could take (or be perceived to take) actions related to these industries, which could be viewed negatively and result in threats or other retaliatory actions. We may also face similar scrutiny to the extent that we are unable to detect and/or prevent illegal activities using our payment products or otherwise occurring over our network.
- Our brand and reputation are associated with the ways in which we impact environmental, social and governance matters. These matters include initiatives to reduce greenhouse gas emissions, help everyone participate
equitablyin the digital economy and create a workplacethat provides equal opportunities for all of our employees.where everyone has the opportunity to succeed. Consumers, investors, employees and other stakeholders are increasingly focused on these impacts. To the extent any of our disclosures, public statements and metrics about these matters are subsequently viewed asinaccurate,inaccurate or unlawful, or we are unable to execute on these initiatives, we may be viewed negatively by stakeholders concerned about these matters. Moreover, in recent years, we have received negative feedback from stakeholders on the adequacy of our environmental, social and governance initiatives. We have also increasingly been receiving negative feedback from anti-environmental, social and governance stakeholders in opposition to such initiatives. Stakeholders from both sides of this issue may continue to view us negatively and take public action against us to the extent that we do not satisfy their conflicting views or expectations. - Our performance largely depends on the skills, capabilities and motivation of our employees (including our people leaders), as well as the environment we create for them to enable them to perform their jobs effectively. The market for specialized skill-sets remains highly competitive, particularly in emerging technologies. To the extent we are unable to differentiate our value proposition in the market, effectively develop leaders and build robust succession pipelines, it could impact our ability to deliver for our customers. Failure to attract, hire, develop, motivate and retain highly qualified
employeetalent could leave us vulnerable to notanticipating oridentifying and/or acting on emerging customer or market opportunities. In addition, broader trends such as escalations in global conflict and a rise in mental health needs arealsoimpacting the well-being of our people. To the extent we are unable to communicate effectively on these issues and provide support to our employees, we could experience a significant impact on our business, reputation and culture. Further, changes in and enforcement of immigration and work permit laws and visa regulations have made it difficult for employees to work in, or transfer among, jurisdictions where we operate, potentially impairing our ability to attract and retain talent. We also face increasing regulation with respect to new pay and benefits transparency requirements, which could subject us to liability or reputational harm if we do not adhere to these requirements in a timely manner. - As our workforce composition continues to change, our employees may have different expectations with respect to flexibility and well-being
support, and may have different career motivations (such as pursuing project-based work or other gig opportunities, as opposed to linear career paths).support. Additionally, employees may require different levels of support as to re-skilling and upskilling in order to adapt to advancements in our industry and changes in technology. Further, certain current and prospective employees may have expectations as to positions we take on environmental, social and governance matters. To the extent we are unable to effectively meet and/or balance these differentexpectations, motivationsexpectations and needs, we could experience a negative impact to the quality of our corporate culture, the productivity of ourworkforce, our ability to innovateworkforce and our ability to attract and retain talent. - To the extent we do make these acquisitions, we may not be able to successfully partner with or integrate them, despite original intentions and focused efforts. Such an integration also may divert management’s time and resources from our core business and disrupt our operations. Moreover, we have spent, and may continue to spend, time and money on acquisitions or projects that do not sufficiently meet our expectations (either strategically or financially), which has resulted (and may in the future result) in divesting from or otherwise exiting these investments or businesses. Additionally, to the extent we pay the purchase price of any acquisition in cash, it would reduce our cash reserves available to us for other uses, and to the extent the purchase price is paid with our stock, it could be dilutive to our stockholders. Furthermore, we have inherited and may in the future inherit litigation risk which has or may increase our post-acquisition costs of
operations and/or impact our ability to successfully finance that business.operations. - We are a guarantor of certain third-party obligations, including those of certain of our customers and service providers. In this capacity, we are exposed to credit and liquidity risks. We may incur significant losses in connection with transaction settlements if a customer fails to fund its daily settlement obligations due to technical problems, liquidity shortfalls, insolvency or other reasons. The occurrence of bank failures, such as those seen in recent
years in the U.S.,years, could increase the potential for such losses. Concurrent settlement failures of more than one of our larger customers or of several smaller customers either on a given day or over a condensed period of time may exceed our available resources. In addition, Brazil recently enacted regulation requiring PSOs in Brazil (including Mastercard and Visa) to extend their responsibility for the financial and settlement integrity of payments to merchants. As we continue to be subject to increased regulation across the globe, more jurisdictions may enact similar approaches from time to time. Any such changes could increase complexity and may impact our cost of operations and financial condition. As of December 31, 2024,Mastercard Foundationownedowns shares of our Class A common stock representingapproximately 9.4%greater than 5% of our general voting power. Historically, Mastercard Foundation had been restricted from selling or otherwise transferring its shares of Class A common stock prior to May 1, 2027, except to the extent necessary to satisfy its charitable disbursement requirements, for which purpose earlier sales were permitted and had occurred. In July 2023, pursuant to an application in consultation with Mastercard, Mastercard Foundation received court approval to advance that date to January 1, 2024. As a result, Mastercard Foundation is now permitted to sell all or part of its remaining shares, subject to certain conditions. In March 2024, Mastercard Foundation began selling shares pursuant to an orderly and structured plan to diversify its Mastercard shares over a seven-year period, while committing to remain a long-term Mastercard stockholder and retaining a significant holding of Mastercard shares in its portfolio. The directors of Mastercard Foundation are required to be independent of us and our customers. The ownership of Class A common stock by Mastercard Foundation, together with the seven-year diversification plan, could discourage or make more difficult acquisition proposals favored by other holders of the Class A common stock. In addition, because Mastercard Foundation intends to sell its shares over an extended period of time, it may not have the same interest in short or medium-term movements in our stock price as, or incentive to approve a corporate action that may be favorable to, our other stockholders.- While policymakers around the globe often look to the EU and the GDPR when adopting new or updated privacy and data protection laws, divergences have occurred and continue to occur.
- These threats also may be further enhanced in frequency or effectiveness through threat actors’ use of AI.
- With the exception of the U.S. and a select number of other jurisdictions, most in-country (as opposed to cross-border) transactions conducted using cards with our brands are switched by our customers or other processors.
- The market for specialized skill-sets remains highly competitive, particularly in technology and other areas that are important to the growth of our business.
- In addition, as we are subject to increased regulation across the globe, jurisdictions could require us to extend our guarantee to additional obligations, which could have an impact on our cost of operations.
- Governments and merchant groups in a number of countries have implemented or are seeking interchange rate reductions through legislation, regulation and litigation. See “Business - Government Regulation” in Part I, Item 1 and Note
2119 (Legal and Regulatory Proceedings) to the consolidated financial statements included in Part II, Item 8 for more details. - We are a defendant in a number of civil litigations and regulatory proceedings and investigations, including among others, those alleging violations of competition and antitrust law and those involving intellectual property claims (as described in Note
2119 (Legal and Regulatory Proceedings) to the consolidated financial statements included in Part II, Item 8). In the event we are found liable in any material litigations or proceedings (particularly in a large class-action lawsuit or on the basis of an antitrust claim entitling the plaintiff to treble damages or under which we were jointly and severally liable), we could be subject to significant damages, which could have a material adverse impact on our overall business and results of operations. - During
2024,2025, approximately70%71% of our revenue was generated from activities outside the U.S., which could be transacted in a non-functional currency. Impacts from currency fluctuations are included in our net income. Our risk management activities provide protection with respect to adverse changes in the value of only a limited number of currencies and are based on estimates of exposures to these currencies.