CME Group

“Our usage of mobile, web, and cloud technologies, such as those pursuant to our partnership with Google Cloud, may increase our risk of a cyber attack.”

Annual report 2025A · The company itself

“If we experience system failures or capacity constraints, our ability to conduct our operations and execute our business strategy could be materially harmed, and we could be subject to significant costs and liabilities. Our business is highly dependent on our ability to process, execute and monitor, in an efficient and uninterrupted manner, a large number of transactions, which occur at high volumes and frequencies across multiple systems and our ability to access key business data, financial information, order processing and invoicing.”

Annual report 2025A · The company itself

“On November 27, 2025, our largest data center owned and operated by CyrusOne experienced a critical cooling failure caused by human error. In response to the critical cooling failure, we made the decision to temporarily halt our markets. Our markets opened the following day on a delayed basis.”

Annual report 2025A · The company itself

“From time to time, we have experienced system errors and failures that have resulted in some customers being unable to connect to our electronic trading platforms and technology offerings, or that resulted in erroneous reporting. Such errors may result in CME Group being liable or in our voluntary assumption of financial liability.”

Annual report 2025A · The company itself

“Table of Contents Regulations relating to our trading and clearing systems generally require the handling of anticipated present and future peak trading volume. Heavy use of our systems during peak trading times or at times of unusual market volatility could exceed our available capacity based on estimated future trading volumes and cause them to operate slowly or even to fail for periods of time.”

Annual report 2025A · The company itself

“We are heavily reliant on the capacity, reliability and security of our information technology and communications and other business systems and software supporting our operations provided by third parties.”

Annual report 2025A · The company itself

“We depend on a number of suppliers, such as banking, clearing and settlement organizations, telephone companies, internet service providers, data processors, cloud hosting providers, data center providers, and software and hardware vendors, for elements of our trading, clearing, and other systems, as well as communications and networking equipment, computer hardware and software and related support and maintenance. Although we conduct due diligence and monitor important suppliers and service providers (including the resiliency of their operations), we cannot provide assurances of their performance and any interruption or cessation of their supplies or services could negatively impact our operations or those of our customers, as well as affect our reputation, financial or regulatory posture.”

Annual report 2025A · The company itself

“This includes, but is not limited to, the successful development and migration of our markets and supporting operational and business functions to the Google Cloud in the new private Google Cloud region.”

Annual report 2025A · The company itself

“We will need to continue to upgrade, expand and increase the capacity of our systems as our business grows and as we execute our business strategy. Although many of our systems are designed to accommodate additional volume and products and services without redesign or replacement, we will need to continue to make significant investments to accommodate the increases in volume of transactions and order transaction traffic and to provide processing services to third parties.”

Annual report 2025A · The company itself

“Our role in the global marketplace places us at greater risk than other public companies for a cyber attack and other cyber-security risks. Our technology, our customers, our people and our third-party service providers are vulnerable to cyber-security threats, which could result in wrongful use of our data or our customers’ data or cause interruptions in our operations, our customers' operations, or our third-party service providers' operations, which could cause us to lose customers and trading volume and result in substantial liabilities.”

Annual report 2025A · The company itself

“Our technology, our customers, our people and our third-party service providers are vulnerable to targeted attacks, such as "phishing" attacks, unauthorized access, fraud, business email compromise, computer viruses, denial of service attacks, terrorism, "ransomware" attacks, attacks created through artificial intelligence, firewall or encryption failures or other security or operational risks. Criminal groups, political activist groups and nation-state actors have targeted the financial services industry in general, including as a result of armed conflicts, and our role in the global marketplace places us at significant risk for a cyber attack and other information security threats.”

Annual report 2025A · The company itself

“Our usage of mobile, web, and cloud technologies, such as those pursuant to our partnership with Google Cloud, may increase our risk of a cyber attack.”

Annual report 2025A · The company itself

“Any security attack or breach could result in system failures and delays, malfunctions in our operations, loss of customers or lower trading volume, loss of competitive position, damage to our reputation, disruption of our business, legal liability or regulatory fines and significant costs, which in turn may cause our revenues and earnings to decline and could have a material impact on our financial condition or results of operations.”

Annual report 2025A · The company itself

“If we experience system failures or capacity constraints, our ability to conduct our operations and execute our business strategy could be materially harmed, and we could be subject to significant costs and liabilities. Our business is highly dependent on our ability to process, execute and monitor, in an efficient and uninterrupted manner, a large number of transactions, which occur at high volumes and frequencies across multiple systems and our ability to access key business data, financial information, order processing and invoicing.”

Annual report 2025A · The company itself

“On November 27, 2025, our largest data center owned and operated by CyrusOne experienced a critical cooling failure caused by human error. In response to the critical cooling failure, we made the decision to temporarily halt our markets. Our markets opened the following day on a delayed basis.”

Annual report 2025A · The company itself

“As part of our global information security (GIS) and privacy programs, we employ resources to prevent, detect and respond to cyber attacks and security risks that could impact our people, processes and technology infrastructure, including rapid response to zero-day vulnerabilities.”

Annual report 2025A · The company itself

“Our artificial intelligence-related product initiatives and offerings, or use in our internal business operations, may give rise to risks related to accuracy, bias, discrimination, intellectual property infringement, misappropriation or leakage of intellectual property, defamation, data privacy and cybersecurity, among others.”

Annual report 2025A · The company itself

“Additionally, the emergence of increasingly sophisticated and widely accessible generative artificial intelligence and its ability to create believable yet fabricated content may elevate our risk and susceptibility to fraudulent activities which could result in the wrongful transferring of funds, divulging of sensitive information or other unintended consequences.”

Annual report 2025A · The company itself

“Notwithstanding the precautions we take to protect our proprietary technology and intellectual property rights, it is possible that employees or third parties may copy, misappropriate, or otherwise obtain and use our proprietary technology without authorization or otherwise infringe on our rights. The use of certain artificial intelligence technology can give rise to intellectual property risks, including claims that the data used to train, or in connection with certain models infringes the intellectual property rights of the owner of such data.”

Annual report 2025A · The company itself

“The success of our markets depends on our ability to complete development of, successfully implement and maintain electronic trading and clearing systems that have the functionality, performance, availability, resilience, capacity, security and speed required by our customers. The success of our business depends in large part on our ability to create interactive electronic marketplaces for a wide range of products that have the required functionality, performance, availability, resilience, capacity, security and speed to attract and retain customers.”

Annual report 2025A · The company itself

“Our business is dependent on proprietary technology and intellectual property that we own or license from third parties.”

Annual report 2025A · The company itself

“BrokerTec Americas' matched principal platform facilitates anonymous trading in significant volumes from wholesale market participants, many of which are FICC members and understand that BrokerTec Americas is also a FICC member, such that their trades are expected to be novated promptly to FICC, which will be their ultimate counterparty. A failure of BrokerTec Americas to maintain its membership with FICC could adversely impact the willingness of such participants to continue trading on our platform.”

Annual report 2025A · The company itself

“Credit Risk CME Clearing House Our clearing house acts as the counterparty to all trades consummated on our exchange as well as through a third-party exchange and swaps markets for which we provide clearing services. As a result, we are exposed to significant credit risk of third parties, including clearing firms.”

Annual report 2025A · The company itself

“The success of our markets depends on our ability to complete development of, successfully implement and maintain electronic trading and clearing systems that have the functionality, performance, availability, resilience, capacity, security and speed required by our customers. The success of our business depends in large part on our ability to create interactive electronic marketplaces for a wide range of products that have the required functionality, performance, availability, resilience, capacity, security and speed to attract and retain customers.”

Annual report 2025A · The company itself

“In 2025, 93% of our overall contract volume was generated through electronic trading on our CME Globex electronic platform.”

Annual report 2025A · The company itself

“In addition, we have established a fund (currently $98.0 million) to provide payments, up to certain maximum levels, to qualified family farmers, ranchers and other agricultural industry participants who use our derivatives products and who suffer losses to their segregated account balances if their clearing firm becomes insolvent.”

Annual report 2025A · The company itself

“We may issue additional equity and/or debt as part of strategic partnerships with third parties, as was the case in connection with our partnership with Google Cloud.”

Annual report 2025A · The company itself

“Our revenue is substantially derived from fees for transactions executed and cleared in our markets.”

Annual report 2025A · The company itself

“Historically, periods of heightened uncertainty have tended to increase our trading volume due to increased hedging activity and the increased need to manage the risks associated with, or speculate on, volatility. However, in the period after a material market disturbance, there may persist extreme uncertainties, which may lead to decreased volume due to factors such as reduced risk exposure, fluctuating interest rates, central bank asset purchase programs and lack of available capital.”

Annual report 2025A · The company itself

“A reduction in overall trading volume or in certain products could render our markets less attractive to market participants as a source of liquidity, which could result in further loss of trading volume and associated transaction-based revenue. Material decreases in trading volume would have a material adverse effect on our financial condition and operating results.”

Annual report 2025A · The company itself

“Additionally, from time to time, certain customers may represent a significant portion of the open interest in our individual product lines or contracts, and a substantial decrease in their trading activity could have a negative impact on the liquidity of the particular product line or contract. If we fail to maintain trading volume, as a result of a loss of customers or decrease in trading activity; expand our product offerings or execution facilities; or are unable to attract new customers, our business and revenues will be adversely affected.”

Annual report 2025A · The company itself

“Declines in trading volume may also negatively impact market liquidity, which could lead to further loss of trading volume.”

Annual report 2025A · The company itself

“Our business is subject to the impact of financial markets volatility, which is caused by conditions that are beyond our control. Trading volume in our markets and products is largely driven by the degree of volatility - the magnitude and frequency of fluctuations - in prices and levels of the underlying commodities, securities, indices, financial benchmarks or other instruments.”

Annual report 2025A · The company itself

“Were there to be a sustained period of stability in the prices or levels of the underlying commodities, securities, indices, benchmarks or other instruments of our products, we could experience lower trading volumes, slower growth or declines in revenues. Because our cost structure is largely fixed, if demand for our current products and services declines for any reason, we may not be able to adjust our cost structure to counteract the associated decline in revenues, which would cause our net income to decline.”

Annual report 2025A · The company itself

“Our market data revenues may be reduced by decreased demand, poor overall economic conditions, regulatory changes or a significant change in how market participants trade and use market data.”

Annual report 2025A · The company itself

“Federal Reserve and other international banks' forecasted interest rates; •availability of capital to our market participants and their appetite for risk-taking; •levels of assets under our customers' management; •volatile weather patterns, droughts, natural disasters and other catastrophes; •pandemics affecting our customer base or our ability to operate our markets; and •consolidation or expansion in our customer base and within our industry.”

Annual report 2025A · The company itself

“Table of Contents Our clearing firms must meet certain capital requirements and must deposit collateral to meet performance bond and guaranty fund requirements. There is no guarantee the collateral deposited will continue to maintain its value.”

Annual report 2025A · The company itself

“Our business is subject to the impact of financial markets volatility, which is caused by conditions that are beyond our control. Trading volume in our markets and products is largely driven by the degree of volatility - the magnitude and frequency of fluctuations - in prices and levels of the underlying commodities, securities, indices, financial benchmarks or other instruments.”

Annual report 2025A · The company itself

“A substantial part of our working capital may be at risk if a clearing firm defaults on its obligations to our clearing house and its margin and guaranty fund deposits are insufficient to meet its obligations. Additionally, BrokerTec Americas is exposed to the potential risk of loss in the event a counterparty fails to meet its obligations.”

Annual report 2025A · The company itself

“There continues to be highly publicized cases involving fraud or other misconduct or manipulative activity by employees of financial services firms and other market participants. Improper trading activity on our platforms by participants could include activities such as spoofing, layering, wash trading and manipulation.”

Annual report 2025A · The company itself

“Further, allegations by regulatory or criminal authorities of improper trading activities in our markets could affect our brand and reputation and reduce the number of participants trading in our markets. If that should occur, we could face a corresponding decline in trading volume and revenue.”

Annual report 2025A · The company itself

“Additional new laws or regulations or changes in enforcement practices applicable to our businesses or those of our clients could be imposed in the U.S. or other jurisdictions, which could change, or require us to change, our business practices or the structure of our business, including its current governance, risk oversight or regulatory structure, or impose significant costs on us by, for example, requiring more of our funds to be set aside for the guaranty fund or to meet other compliance requirements. This could adversely affect our ability to compete effectively with other institutions that are not affected in the same way or impact our clients' overall trading volume and demand for our market data and other services.”

Annual report 2025A · The company itself

“The regulatory environment related to information security, privacy, data collection, data usage and use of artificial intelligence is increasingly rigorous and complex, and any failure to comply may carry significant penalties and reputational damage.”

Annual report 2025A · The company itself

“As a financial services provider, we are subject to significant litigation risk and regulatory liability and penalties. Many aspects of our business present substantial litigation risks.”

Annual report 2025A · The company itself

“These risks include, among others, potential liability from disputes over terms of a trade, the claim that a system failure or delay caused monetary losses to a customer, that we entered into an unauthorized transaction, that we provided materially false or misleading statements in connection with a transaction or that we failed to effectively fulfill our regulatory oversight responsibilities.”

Annual report 2025A · The company itself

“System failure or degradation could lead our customers to file formal complaints with industry regulatory organizations, to file lawsuits against us or to cease doing business with us or could lead our regulators to initiate inquiries or proceedings for failure to comply with applicable laws and regulations.”

Annual report 2025A · The company itself

“A reduction in overall trading volume or in certain products could render our markets less attractive to market participants as a source of liquidity, which could result in further loss of trading volume and associated transaction-based revenue. Material decreases in trading volume would have a material adverse effect on our financial condition and operating results.”

Annual report 2025A · The company itself

“Additionally, from time to time, certain customers may represent a significant portion of the open interest in our individual product lines or contracts, and a substantial decrease in their trading activity could have a negative impact on the liquidity of the particular product line or contract. If we fail to maintain trading volume, as a result of a loss of customers or decrease in trading activity; expand our product offerings or execution facilities; or are unable to attract new customers, our business and revenues will be adversely affected.”

Annual report 2025A · The company itself

“Declines in trading volume may also negatively impact market liquidity, which could lead to further loss of trading volume.”

Annual report 2025A · The company itself

“Our market data revenues may be reduced by decreased demand, poor overall economic conditions, regulatory changes or a significant change in how market participants trade and use market data.”

Annual report 2025A · The company itself

“Federal Reserve and other international banks' forecasted interest rates; •availability of capital to our market participants and their appetite for risk-taking; •levels of assets under our customers' management; •volatile weather patterns, droughts, natural disasters and other catastrophes; •pandemics affecting our customer base or our ability to operate our markets; and •consolidation or expansion in our customer base and within our industry.”

Annual report 2025A · The company itself

“Negative publicity regarding our company or actual, alleged or perceived issues regarding our company, products or services, including social and environmental concerns relating to our company or certain commodity products and increased impact from climate change or criticism or market reaction to the performance of our market in periods of extreme volatility, could give rise to reputational risk, which could significantly harm our business prospects.”

Annual report 2025A · The company itself

“As our consolidated financial statements are presented in U.S. dollars, we must translate our foreign subsidiaries’ financial statements from local currencies into U.S. dollars at exchange rates in effect during or at the end of each reporting period. Therefore, any increases or decreases in the value of the U.S. dollar against the other currencies may affect our operating income and the value of balance sheet items denominated in foreign currencies.”

Annual report 2025A · The company itself

“Foreign Currency Exchange Rate Risk Foreign Currency Transaction Risk We have foreign currency transaction risk related to changes in exchange rates on monetary assets, liabilities, revenues and expenses held at subsidiaries where those balances and activity are denominated in a currency other than the subsidiary's functional currency. Gains and losses on foreign currency transactions result primarily from cash, debt and other monetary assets, liabilities, revenues and expenses denominated in British pounds, euros and Japanese yen.”

Annual report 2025A · The company itself

“We may be at greater risk from terrorism, which poses physical security risks and cybersecurity risks, than other companies. Given our role in the global financial services industry, we may be more likely than other companies to be a direct target of, or an indirect casualty of, attacks by terrorists or terrorist organizations.”

Annual report 2025A · The company itself

“While we have implemented significant physical security protection measures, business continuity plans, and established backup sites to provide operational resiliency, in the event of an attack or a threat of an attack, these security measures and contingency plans may be inadequate to prevent significant disruptions in our business, technology or access to the infrastructure necessary to maintain our business. Such an attack may result in harm to our personnel or the closure of our facilities or render our backup data and recovery systems inoperable, or have similar consequences for our third-party service providers.”

Annual report 2025A · The company itself

“Some of our clearing house's largest clearing firms have indicated their belief that clearing facilities should not be owned or controlled by exchanges and should be operated as utilities and not for profit. These clearing firms have sought, and may seek in the future, legislative or regulatory changes that would, if adopted, enable them to use alternative clearing services 17 Table of Contents for positions established on our exchanges or to freely move open positions among clearing houses in order to take advantage of our liquidity.”

Annual report 2025A · The company itself

“The market for such transactions is highly competitive, especially in light of historical merger and acquisition activity in our industry.”

Annual report 2025A · The company itself

“The regulatory environment related to information security, privacy, data collection, data usage and use of artificial intelligence is increasingly rigorous and complex, and any failure to comply may carry significant penalties and reputational damage.”

Annual report 2025A · The company itself

“The trading volumes in our markets are directly affected by domestic and international factors that are beyond our control, including: •economic, political and geopolitical market conditions, including the instability caused by trade policies and wars; •legislative and regulatory changes, including any direct or indirect restrictions on or increased costs associated with trading in our markets or our clearing services; •broad trends in the industry and financial markets; •changes in price levels, trading volumes and volatility in the derivatives, cash and OTC markets and in their underlying markets; •shifts in demand or supply in commodities underlying our products; •competition; •changes in government monetary policies and the U.S.”

Annual report 2025A · The company itself

“Federal Reserve and other international banks' forecasted interest rates; •availability of capital to our market participants and their appetite for risk-taking; •levels of assets under our customers' management; •volatile weather patterns, droughts, natural disasters and other catastrophes; •pandemics affecting our customer base or our ability to operate our markets; and •consolidation or expansion in our customer base and within our industry.”

Annual report 2025A · The company itself

“Federal Reserve and other international banks' forecasted interest rates; •availability of capital to our market participants and their appetite for risk-taking; •levels of assets under our customers' management; •volatile weather patterns, droughts, natural disasters and other catastrophes; •pandemics affecting our customer base or our ability to operate our markets; and •consolidation or expansion in our customer base and within our industry.”

Annual report 2025A · The company itself

“Legislation may be proposed, both domestically and internationally, that could, for example, add a transaction tax on our products or change the way our market participants are taxed on the products they trade on our markets. If such proposals were to become law, they could have a negative impact on our industry and on us by making transactions more costly to market participants, which may reduce trading and could make our markets less competitive, with a resulting negative impact on our business, financial condition and operating results.”

Annual report 2025A · The company itself