Mastercard

“Our ability to compete may also be affected by regulatory and legislative initiatives, as well as the outcomes of litigation, competition-related regulatory proceedings and both central bank and legislative activity. If we are not able to differentiate ourselves from our competitors, drive value for our customers and/or effectively align our resources with our goals and objectives, we may not be able to compete effectively against these threats. Our failure to compete effectively against any of the foregoing threats could materially and adversely affect our overall business and results of operations.”

Annual report 2025A · The company itself

“•Payments industry participants may develop their own products and services to support our switched transaction and payments offerings, forcing us to change our pricing or practices for our own offerings in order to compete. Participants may also withhold rights to data we use to power our solutions in order to support their own potential future solutions, potentially impacting the effectiveness of our solutions.”

Annual report 2025A · The company itself

“Continued intense pricing pressure may materially and adversely affect our overall business and results of operations. In order to increase transaction volumes, enter new markets and expand our products and services, we seek to enter into business agreements with customers through which we offer incentives, pricing discounts and other support that promote our products. In order to stay competitive, we may have to increase the amount of these incentives and pricing discounts so as to meet customer demand for better pricing arrangements and greater rebates and incentives. As a result, we may not be able to grow our volume and/or services to the extent necessary to compensate for the additional costs related to these increased incentives and pricing discounts.”

Annual report 2025A · The company itself

“In the future, we may not be able to enter into agreements with our customers if they require terms that we are unable or unwilling to offer, and we may be required to modify existing agreements in order to maintain relationships and compete with others in the industry. Some of our competitors are larger with greater financial resources and accordingly may be able to charge lower prices.”

Annual report 2025A · The company itself

“Our customers also may implement cost reduction initiatives that reduce or eliminate payment product marketing or increase requests for greater incentives or greater cost stability.”

Annual report 2025A · The company itself

“Additionally, we face pricing pressure related to real-time account-based payment schemes. These pressures impact both domestic pricing (such as the increased use of schemes that offer increasingly lower or subsidized P2M pricing) and cross-border pricing (including from both competing schemes and global initiatives to lower the cost of cross-border payments to end users).”

Annual report 2025A · The company itself

“Damage to our reputation or brands resulting from an account data breach of our systems and networks or those of our customers, merchants and other third parties could decrease the use and acceptance of our products and services. Such events could also slow or reverse the trend toward electronic payments.”

Annual report 2025A · The company itself

“Cross-border Volume Growth measures the growth of cross-border dollar volume during the period, on a local currency basis and U.S. dollar-converted basis, for all Mastercard-branded programs. Switched Transactions measures the number of transactions switched by Mastercard, which is defined as the number of transactions initiated and switched through our network during the period.”

Annual report 2025A · The company itself

“Net revenue from our payment network increased 12%, on both an as-reported and currency-neutral basis, in 2025 versus the prior year. The increase was primarily driven by growth in domestic and cross-border dollar volumes and an increase in the number of switched transactions, reflecting growth trends across all of our key drivers.”

Annual report 2025A · The company itself

“Interchange fees reflect the value merchants receive from accepting our products and play a key role in balancing the costs and benefits that consumers and merchants derive. Generally, interchange fees are collected from acquirers and paid to issuers to reimburse the issuers for a portion of the costs incurred.”

Annual report 2025A · The company itself

“Working with new customers and end users as we continue to expand our products and services can present operational and onboarding challenges, be costly and result in reputational damage if the new products or services do not perform as intended. The payments markets in which we compete are characterized by rapid technological change, new product introductions, evolving industry standards and changing customer and consumer needs. In order to remain competitive and meet the needs of the payments markets, we are continually involved in developing and implementing complex multi-rail solutions and diversifying our products and services.”

Annual report 2025A · The company itself

“The following chart provides gross dollar volume (“GDV”) and number of cards featuring our brands in 2025 for select programs and solutions: GDV Cards Year Ended December 31, 2025 As of December 31, 2025 Mastercard-branded Programs 1 (in billions) % Increase from December 31, 2024 (Local) % of Total GDV (in millions) % Increase from Consumer Credit $ 3,878 8 % 37 % 1,083 3 % Consumer Debit and Prepaid 2 5,349 9 % 50 % 2,134 11 % Commercial Credit and Debit 1,405 11 % 13 % 174 14 % 1Excludes Maestro and Cirrus cards and volume generated by those cards.”

Annual report 2025A · The company itself

“Consumer Credit. We offer products that enable issuers to provide consumers with credit, allowing them to defer payment.”

Annual report 2025A · The company itself

“Consumer Debit. We support a range of payment products and solutions that allow our customers to provide consumers with convenient access to funds in deposit and other accounts. Our debit and deposit access programs can be used to make purchases and to obtain cash from bank branches, at ATMs and, in some cases, at the point of sale.”

Annual report 2025A · The company itself

“Prepaid accounts are a type of electronic payment that enables consumers to pay from pre-funded accounts whether or not they previously had a bank account or a credit history. These accounts can be tailored to meet specific program, customer or consumer needs, such as paying bills, sending person-to-person payments or withdrawing cash from an ATM. Our focus ranges from digital accounts (such as fintech and gig economy platforms) to business programs such as employee payroll, health savings accounts and solutions for small business owners.”

Annual report 2025A · The company itself

“This could impact the products and services we offer and other aspects of our business, such as fraud monitoring, the need for improved data management, governance, quality and accuracy practices, the development of information-based products and solutions, and technology operations.”

Annual report 2025A · The company itself

“Business Overview Mastercard is a technology company in the global payments industry. We connect consumers, financial institutions, merchants, governments, digital partners, businesses and other organizations worldwide by enabling electronic payments and making those payment transactions secure, simple, smart and accessible. We make payments easier and more efficient by providing a wide range of payment solutions and services using our family of well-known and trusted brands, including our primary brand Mastercard®, as well as our Maestro® and Cirrus® brands.”

Annual report 2025A · The company itself

“Through our unique and proprietary global payments network, we switch (authorize, clear and settle) payment transactions. We have additional payments capabilities that include automated clearing house (“ACH”) transactions (both batch and real-time account-based payments). Using these capabilities, we offer consumer and commercial payment products, capture new payment flows and provide services and solutions.”

Annual report 2025A · The company itself

“Financial Results Net Revenue The components of net revenue were as follows: For the Years Ended December 31, Increase/(Decrease) 2025 2024 2023 2025 2024 ($ in millions) Payment network $ 19,476 $ 17,335 $ 15,824 12% 10% Value-added services and solutions 13,315 10,832 9,274 23% 17% Total net revenue $ 32,791 $ 28,167 $ 25,098 16% 12% Net revenue increased 16%, or 15% on a currency-neutral basis, in 2025 versus the prior year, which included a 1 percentage point increase from acquisitions completed in 2024 (“Acquisitions”). The remaining increase in net revenue was attributable to organic growth in our payment network and value-added services and solutions.”

Annual report 2025A · The company itself

“Our Privacy by Design, Data by Design and AI Governance processes are designed to ensure we embed multiple layers of privacy, data protection and information security controls in all our products and services, keeping a clear focus on protecting customers’ and individuals’ data and privacy, as well as making our AI more accurate and effective.”

Annual report 2025A · The company itself

“We employ a multi-layered approach to help protect the global payments ecosystem, including a robust program designed to protect our network from cyber and information security threats. Our network and platforms incorporate multiple layers of protection, providing greater resiliency and security protection.”

Annual report 2025A · The company itself

“Our programs are assessed by third parties and incorporate benchmarking and other data from peer companies and consultants. We engage in many efforts to mitigate information security challenges, including maintaining an information security program, an enterprise resilience program and insurance coverage, as well as regularly testing our systems to address potential vulnerabilities.”

Annual report 2025A · The company itself

“With respect to information security, any single breach could require parallel notifications to data protection authorities, cyber authorities and/or law-enforcement, often requiring different thresholds, reporting deadlines and formats.”

Annual report 2025A · The company itself

“For example, as a provider of global threat intelligence services through Recorded Future, we are subject to increased exposure to certain laws and regulations, including global cybercrime and other laws and regulations in various jurisdictions.”

Annual report 2025A · The company itself

“Furthermore, the complexity of this payment technology requires careful management to address information security vulnerabilities that are different from those faced on our payment network. Operational difficulties, such as the temporary unavailability of our services or products, or information security breaches on our real-time account-based payments network could cause a loss of business for these products and services, result in potential liability for us and adversely affect our reputation.”

Annual report 2025A · The company itself

“Information security risks for payments and technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies (including AI), the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, “hacktivists”, terrorists, nation-states, state-sponsored actors and other external parties. These threats may derive from fraud or malice on the part of our employees or third parties, or may result from human error, software bugs, server malfunctions, software or hardware failure or other technological failure. These threats include cyber-attacks such as computer viruses, denial-of-service attacks, malicious code (including ransomware), social-engineering attacks (including phishing attacks) or information security breaches and could lead to the misappropriation or loss of consumer account and other information and identity theft.”

Annual report 2025A · The company itself

“In addition to information security risks for our systems and networks, we also routinely encounter account data compromise events involving merchants and third-party payment processors that process, store or transmit payment transaction data, which affect millions of Mastercard, Visa, Discover, American Express and other types of account holders.”

Annual report 2025A · The company itself

“However, increased fraud levels and cyber-attacks involving our products, services and/or network, or misconduct or negligence by third parties switching or otherwise servicing our products and services could damage our reputation and reduce the use and acceptance of our products and services and/or increase our compliance costs. Further, such occurrences have resulted in and could further result in legislative or regulatory intervention, which could lead to enhanced security requirements and liabilities.”

Annual report 2025A · The company itself

“Data and AI. We create a range of products and services for our customers using our data and artificial intelligence (“AI”) assets, technology, platforms and expertise. These products and services are designed to make commerce smarter, more secure and more personal.”

Annual report 2025A · The company itself

“We focus on securing transactions by replacing card numbers with secure tokens, scaling Mastercard Authentication (including enabling device-based biometrics, such as fingerprints or facial scans, through Mastercard Payment Passkey Service) and streamlining online checkout by eliminating manual entry (through Click to Pay and Secure Card on File). We aim to improve the effectiveness of those transactions by increasing the number of transactions we switch through our differentiated services, increasing approval rates by utilizing inputs from our network and lifting spend and activation rates through personalized campaigns and data-driven strategies.”

Annual report 2025A · The company itself

“Our Privacy by Design, Data by Design and AI Governance processes are designed to ensure we embed multiple layers of privacy, data protection and information security controls in all our products and services, keeping a clear focus on protecting customers’ and individuals’ data.”

Annual report 2025A · The company itself

“Security Solutions We offer products and services designed to safeguard the payments and digital ecosystem from fraud and cyber-attacks and to enhance security for payments across card and non-card rails. Our security solutions suite provides organizations with the ability to adapt to the dynamic and multifaceted nature of threats while maintaining continuity and confidence in their operations. This includes: •Prevention solutions designed to help customers establish and strengthen measures that keep systems, applications and data secure from potential security risks.”

Annual report 2025A · The company itself

“•Identification solutions designed to help banks and merchants verify identities and authenticate consumers during digital interactions like account openings, account access and money movements using identity data and identity signals, device intelligence, biometric technologies and behavioral user data assessments. Key 2025 Developments •In 2025, we launched Mastercard Threat Intelligence, which combines Mastercard’s payment expertise and global network visibility with Recorded Future’s leading cyber threat intelligence capabilities in order to prevent payment fraud by proactively detecting cyberattacks.”

Annual report 2025A · The company itself

“•In 2025, we announced Mastercard Account-to-Account Protect, a new solution designed to combine our fraud prevention technology with a new dispute resolution framework in order to safeguard consumers when making account-to-account payments. •In 2025, we launched Merchant Cloud, a unified platform designed to offer a single point of entry to cutting-edge payment services (including payment gateways, security solutions and data) to simplify and support commerce growth in the global acceptance ecosystem and deliver exceptional experiences for end users. •Detection solutions designed to both spot and take action to stop fraudulent behavior and cyber-attacks.”

Annual report 2025A · The company itself

“•Remediation solutions designed to facilitate the flow of information to ensure consumers have transparency of their transaction data, as well as solutions designed to communicate and remediate disputes related to either fraud or failures in delivery of services to consumers. •Business continuity solutions designed to enable uninterrupted commerce, fostering trust and reliability for both merchants and consumers. These solutions include Mastercard’s Stand-In processing, which is designed to ensure transaction continuity when a card issuer’s systems are unavailable.”

Annual report 2025A · The company itself

“Within our value-added services and solutions, we generate revenue primarily related to the following: •Security solutions •Consumer acquisition and engagement services •Business and market insights •Digital and authentication solutions •Processing and gateway •Other solutions (including ACH batch and real-time account-based payments and solutions, bill payments, cross-border services and open finance) See “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Revenue” in Part II, Item 7 and Note 3 (Revenue) to the consolidated financial statements included in Part II, Item 8 for more detail about our revenue.”

Annual report 2025A · The company itself

“To enable our business strategy effectively, our aim is to: •attract and retain talent with the key skills and capabilities needed to achieve short-term and long-term goals •develop an agile workforce to collaborate and compete in a fast-paced, innovative environment •build and sustain an inclusive and high-performing culture Attract talent. •We continuously recruit talent by leveraging the strength of our brand and utilizing a variety of sources, channels and initiatives in order to support our growth across sectors, markets and emerging industries •Our acquisition activity has also provided a strong source of talent with differentiated skills Develop and retain talent. We develop and retain our employees, with a focus on staying competitive and being responsive to changing market dynamics.”

Annual report 2025A · The company itself

“The payments industry is subject to rapid and significant technological changes, including new technologies and changes to existing technologies (such as digital assets and blockchain, AI, machine learning, privacy enhancement and cybersecurity). These changes could result in new technologies that may be superior to, or render obsolete, the technologies we currently use in our programs and services. They may also result in new and innovative payment methods, products and services.”

Annual report 2025A · The company itself

“Additionally, there are a number of factors relating to technology change that could impact us. These include: the inability of third parties on which we rely for the development of and access to new technologies to keep pace with technological changes (including with regard to AI); potential action from third-party patent holders, including notices or inquiries threatening litigation against us or our customers for alleged patent infringement or demanding significant license fees; the scope of, as well as customer and merchant resistance to, industry-wide solutions and standards (such as those related to tokenization or other security technologies); any difficulty we may experience in attracting and retaining employees with technology expertise; and the need to invest resources for new technologies, which could lead to further additional expenses.”

Annual report 2025A · The company itself

“The widespread use of AI, and its increasing capabilities, is enhancing the frequency and effectiveness of threat actors.”

Annual report 2025A · The company itself

“In addition, companies have generally experienced in recent years an increase in fraudulent activity and cyber-attacks, which has been further exacerbated by the increased use of AI. Criminals are using increasingly sophisticated methods to capture consumer personal information to engage in illegal activities such as counterfeiting or other fraud and may see their effectiveness enhanced by the use of AI.”

Annual report 2025A · The company itself

“Talent and Culture We may not be able to attract and retain a highly qualified workforce, or maintain our corporate culture, which could harm our overall business and results of operations. Our performance largely depends on the skills, capabilities and motivation of our employees (including our people leaders), as well as the environment we create for them to enable them to perform their jobs effectively. The market for specialized skill-sets remains highly competitive, particularly in emerging technologies.”

Annual report 2025A · The company itself

“Data and AI. We create a range of products and services for our customers using our data and artificial intelligence (“AI”) assets, technology, platforms and expertise. These products and services are designed to make commerce smarter, more secure and more personal.”

Annual report 2025A · The company itself

“Key 2025 Developments •We launched Mastercard Agent Pay™, a new framework designed to enable secure, scalable and trusted payments in agentic commerce. The solution enables AI-assisted and fully automated agent-based payments across Mastercard's acceptance network.”

Annual report 2025A · The company itself

“Data and AI We create a range of products and services for our customers that use our data and AI assets, technology, platforms and expertise. These products and services are designed to make commerce smarter, more secure and more personal. Our data comes from an increasing variety of sources, such as transaction data (including from gateway, card and real-time payments), open finance, digital identities, buyer/supplier payment preferences, device attributes, digital threat assessments, rewards redemptions and unstructured data (such as our manuals and publications).”

Annual report 2025A · The company itself

“We are implementing governance and processes to help test and mitigate for bias when we use advanced analytics, including AI and machine learning, to create fair and inclusive solutions that reflect individual, group and societal interests •Fostering inclusion and advancing positive social impact.”

Annual report 2025A · The company itself

“•Personalization services, which leverage AI to help businesses provide personalized digital experiences for their customers. Our personalization platform and decision engine delivers product recommendations, offers and content to consumers across digital channels. •Issuer and merchant loyalty services, which blend strategy, services, data and technology to deliver loyalty solutions designed to drive consumer engagement with measurable results for our customers.”

Annual report 2025A · The company itself

“•Advanced analytics and AI solutions consisting of proprietary and privacy-first data solutions, AI models and analytics software designed to power strategy optimization, business experimentation and transformation, as well as risk management to address complex business challenges and unlock new value. •Consulting and agentic solutions consisting of strategic advisory, rapid prototyping, technical implementation and hands-on support across the payments ecosystem (including agentic solutions), designed to accelerate transformation and scale innovation through global expertise and localized execution. •Payments and portfolio optimization solutions consisting of expertise and technology designed to enhance payment processes, customer engagement and portfolio performance through targeted strategies and data-driven recommendations.”

Annual report 2025A · The company itself

“Within our value-added services and solutions, we generate revenue primarily related to the following: •Security solutions •Consumer acquisition and engagement services •Business and market insights •Digital and authentication solutions •Processing and gateway •Other solutions (including ACH batch and real-time account-based payments and solutions, bill payments, cross-border services and open finance) See “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Revenue” in Part II, Item 7 and Note 3 (Revenue) to the consolidated financial statements included in Part II, Item 8 for more detail about our revenue.”

Annual report 2025A · The company itself

“In addition, we own a number of patents and patent applications relating to payment solutions, transaction processing, smart cards, contactless, mobile, biometrics, AI, security systems, blockchain and other technologies, which are important to our business operations.”

Annual report 2025A · The company itself

“Our payment network switches transactions throughout the world when the merchant country and country of issuance are different (“cross-border transactions”), providing account holders with the ability to use, and merchants to accept, our products and services across country borders.”

Annual report 2025A · The company itself

“Within our payment network, revenue is primarily generated from charging fees to our customers based on GDV (which includes both domestic and cross-border volume) on the cards that carry our brands and for providing switching and other network-related services.”

Annual report 2025A · The company itself

“•Regional groups of countries are considering, or may consider, efforts to restrict our switching of regional transactions. •Governments have been increasingly creating and expanding local payments structures, which are increasingly being considered as alternatives to traditional domestic payment solutions and schemes such as ours.”

Annual report 2025A · The company itself

“Such developments prevent us from utilizing our global switching capabilities for domestic or regional customers.”

Annual report 2025A · The company itself

“Cross-border Volume Growth measures the growth of cross-border dollar volume during the period, on a local currency basis and U.S. dollar-converted basis, for all Mastercard-branded programs. Switched Transactions measures the number of transactions switched by Mastercard, which is defined as the number of transactions initiated and switched through our network during the period.”

Annual report 2025A · The company itself

“We switch substantially all cross-border transactions using Mastercard, Maestro and Cirrus-branded cards and generate a significant amount of revenue from cross-border volume fees and fees related to switched transactions. Revenue from switching cross-border and currency conversion transactions for our customers fluctuates with the levels and destinations of cross-border travel and our customers’ need for transactions to be converted into their base currency.”

Annual report 2025A · The company itself

“We focus on capturing opportunities in commercial payments (both point-of-sale purchases and invoiced payments) and disbursements and remittances (specifically, through Mastercard Move, our collection of money movement capabilities that provides solutions for money transfers to consumers from other consumers, businesses or governments).”

Annual report 2025A · The company itself

“Payment Network Our payment network links issuers and acquirers around the globe to facilitate the switching of transactions, permitting account holders to use our products at hundreds of millions of acceptance locations and digital access points worldwide. This network facilitates an efficient and secure means for making and receiving payments, a convenient, quick and secure payment method for consumers to access their funds and a channel for the delivery of value-added data insights to our customers. We enable transactions for our customers through our payment network in more than 150 currencies and in more than 220 countries and territories.”

Annual report 2025A · The company itself

“We switch more than 70% of all transactions for Mastercard and Maestro-branded cards, including nearly all cross-border transactions.”

Annual report 2025A · The company itself

“New requirements and rules, or changing interpretations of existing requirements in these areas, or the development of new regulatory schemes related to the digital economy in general, may also increase our costs and/or restrict our ability to leverage data or use AI for innovation. This could impact the products and services we offer and other aspects of our business, such as fraud monitoring, the need for improved data management, governance, quality and accuracy practices, the development of information-based products and solutions, and technology operations. In addition, these requirements may increase the costs to our customers of issuing payment products or using information products, which may, in turn, decrease the number of our products that they offer.”

Annual report 2025A · The company itself

“The payments industry is subject to rapid and significant technological changes, including new technologies and changes to existing technologies (such as digital assets and blockchain, AI, machine learning, privacy enhancement and cybersecurity). These changes could result in new technologies that may be superior to, or render obsolete, the technologies we currently use in our programs and services. They may also result in new and innovative payment methods, products and services.”

Annual report 2025A · The company itself

“Our future success will depend, in part, on our ability to anticipate, develop or adapt to technological changes and evolving industry standards. If we fail to sufficiently develop and adopt new technologies, or improve and keep pace with current technologies and reflect such technology in our payments offerings, our payments offerings could be negatively impacted and/or we could be put at a competitive disadvantage. This could impact our ability to compete with new technologies and products, as well as encourage customers that use our technology to enhance and deliver their payment-related products and services (including fintechs and technology companies) to use their own technology to compete against us.”

Annual report 2025A · The company itself

“Data and AI We create a range of products and services for our customers that use our data and AI assets, technology, platforms and expertise. These products and services are designed to make commerce smarter, more secure and more personal. Our data comes from an increasing variety of sources, such as transaction data (including from gateway, card and real-time payments), open finance, digital identities, buyer/supplier payment preferences, device attributes, digital threat assessments, rewards redemptions and unstructured data (such as our manuals and publications).”

Annual report 2025A · The company itself

“As more players enter the global payments ecosystem, the layers between our brand and consumers and merchants increase. We often partner with other consumer brands on payment solutions, including large digital companies and other technology companies who are our customers and use our networks to build their own acceptance brands. In some cases, our brand may not be featured in the payment solution or may be secondary to other brands.”

Annual report 2025A · The company itself

“Our open finance platform enables data providers and third parties, on a permissioned basis, to reliably access, securely transmit and confidently manage consumer and small business data to improve the customer experience. Our platform enables individuals to have choice of financial services, providing them the ability to access, control and benefit from the use of their data. This choice provides individuals with an improved digital experience.”

Annual report 2025A · The company itself

“To enable our business strategy effectively, our aim is to: •attract and retain talent with the key skills and capabilities needed to achieve short-term and long-term goals •develop an agile workforce to collaborate and compete in a fast-paced, innovative environment •build and sustain an inclusive and high-performing culture Attract talent. •We continuously recruit talent by leveraging the strength of our brand and utilizing a variety of sources, channels and initiatives in order to support our growth across sectors, markets and emerging industries •Our acquisition activity has also provided a strong source of talent with differentiated skills Develop and retain talent. We develop and retain our employees, with a focus on staying competitive and being responsive to changing market dynamics.”

Annual report 2025A · The company itself

“Talent and Culture We may not be able to attract and retain a highly qualified workforce, or maintain our corporate culture, which could harm our overall business and results of operations. Our performance largely depends on the skills, capabilities and motivation of our employees (including our people leaders), as well as the environment we create for them to enable them to perform their jobs effectively. The market for specialized skill-sets remains highly competitive, particularly in emerging technologies.”

Annual report 2025A · The company itself

“The merchant discount rate is established by the acquirer to cover its costs of both participating in the four-party system and providing services to merchants. The rate takes into consideration the amount of the interchange fee which the acquirer generally pays to the issuer. Additionally, acquirers may charge merchants processing and related fees in addition to the merchant discount rate.”

Annual report 2025A · The company itself

“These include: the inability of third parties on which we rely for the development of and access to new technologies to keep pace with technological changes (including with regard to AI); potential action from third-party patent holders, including notices or inquiries threatening litigation against us or our customers for alleged patent infringement or demanding significant license fees; the scope of, as well as customer and merchant resistance to, industry-wide solutions and standards (such as those related to tokenization or other security technologies); any difficulty we may experience in attracting and retaining employees with technology expertise; and the need to invest resources for new technologies, which could lead to further additional expenses.”

Annual report 2025A · The company itself

“We have established a framework for examining pay practices annually, supported by third-party analysis and benchmarked to the external market.”

Annual report 2025A · The company itself

“RISK FACTORS Exclusive/near exclusive relationships certain customers have with our competitors may have a material adverse impact on our business. While we have exclusive, or nearly-exclusive, relationships with certain of our customers to issue payment products, other customers have similar exclusive, or nearly-exclusive, relationships with our competitors. These relationships may make it difficult or cost-prohibitive for us to do significant amounts of business with these customers to increase our revenues.”

Annual report 2025A · The company itself

“Consolidation amongst our customers could materially and adversely affect our overall business and results of operations. The industries in which our customers participate have undergone substantial, accelerated consolidation in the past. These consolidations have included customers with a substantial Mastercard portfolio being acquired by institutions with a strong relationship with a competitor.”

Annual report 2025A · The company itself

“Consolidation could also produce a smaller number of large customers, which could increase their bargaining power and lead to lower prices and/or more favorable terms for our customers. These developments could materially and adversely affect our results of operations.”

Annual report 2025A · The company itself

“We continue to evaluate our strategic acquisitions of, and investments in, complementary businesses, products or technologies. As we do so, we face increasing regulatory scrutiny with respect to antitrust, national security and other considerations that could impact these efforts.”

Annual report 2025A · The company itself

“In turn, our customers’ success depends on a variety of factors over which we have little or no influence, including economic conditions in global financial markets or their disintermediation by competitors or emerging technologies, as well as regulation. If our customers become financially unstable, we may lose revenue or we may be exposed to settlement risk.”

Annual report 2025A · The company itself

“Adverse economic trends in key countries in which we operate may adversely affect our financial performance.”

Annual report 2025A · The company itself

“Business and Market Insights We offer solutions that provide data insights, analytics and advisory services, all of which are designed to help our customers operate with agility, optimize performance and profitability, and innovate for future growth. Offerings within this area include: •Business and operational intelligence solutions consisting of real-time business insights, industry research, economic intelligence and expert-driven recommendations designed to support informed decision-making, monitor performance and respond to macro trends.”

Annual report 2025A · The company itself

“Our Privacy by Design, Data by Design and AI Governance processes are designed to ensure we embed multiple layers of privacy, data protection and information security controls in all our products and services, keeping a clear focus on protecting customers’ and individuals’ data.”

Annual report 2025A · The company itself

“We practice robust data and AI governance aimed at ensuring that we have appropriate controls and oversight over the use of our data and technology •Practicing data minimization. We practice collecting and retaining only the personal information that is needed for a given product or service, and limiting the amount and type of personal information shared with third parties •Being transparent and providing control.”

Annual report 2025A · The company itself

“The following chart provides gross dollar volume (“GDV”) and number of cards featuring our brands in 2025 for select programs and solutions: GDV Cards Year Ended December 31, 2025 As of December 31, 2025 Mastercard-branded Programs 1 (in billions) % Increase from December 31, 2024 (Local) % of Total GDV (in millions) % Increase from Consumer Credit $ 3,878 8 % 37 % 1,083 3 % Consumer Debit and Prepaid 2 5,349 9 % 50 % 2,134 11 % Commercial Credit and Debit 1,405 11 % 13 % 174 14 % 1Excludes Maestro and Cirrus cards and volume generated by those cards.”

Annual report 2025A · The company itself

“Consumer Bill Payments. Our solutions enable consumers and small businesses to pay their billers in a seamless and secure way, providing an experience that offers flexibility and benefits consumers, financial institutions and billers. Utilizing our merchant acceptance network (which includes many billers), we offer consumers the choice of paying their bills in a convenient and secure manner using credit, debit or prepaid as well as account-based payments methods.”

Annual report 2025A · The company itself

“Consumer Acquisition and Engagement Services We offer solutions that drive customer acquisition, increase activation, deepen engagement and build loyalty, including: •Marketing services, which drive business growth and profitability through end-to-end, data- and technology-driven marketing. We advance our customers’ growth by helping them to acquire new customers, as well as increase engagement with existing customers, through a curated set of direct marketing solutions and strategies. We focus on business outcomes and combine our proprietary data and insights with our marketing expertise to create innovative solutions that span the entire customer lifecycle, from brand design and product adoption to customer retention and portfolio optimization.”

Annual report 2025A · The company itself

“Our personalization platform and decision engine delivers product recommendations, offers and content to consumers across digital channels. •Issuer and merchant loyalty services, which blend strategy, services, data and technology to deliver loyalty solutions designed to drive consumer engagement with measurable results for our customers. We enable a loyalty ecosystem (deeply integrated within our global payments network) that benefits merchants, financial institutions and consumers via personalized offers, rewards and redemptions, empowering our customers to create experiences unique to their brand and consumers and achieve long-lasting loyalty.”

Annual report 2025A · The company itself

“◦Our Click to Pay checkout experience is designed to provide consumers convenience and security in a digital environment, make it easier for merchants to implement secure digital payments and provide issuers with improved fraud detection and prevention capabilities. This experience enables a faster, more secure checkout experience across internet and mobile sites, mobile apps and connected devices. •Enhancing security and effectiveness of transactions.”

Annual report 2025A · The company itself

“This new service complements our existing cybersecurity intelligence, fraud scoring and defense functionalities. •In 2025, we launched Mastercard Commerce Media™, a new digital media network aimed at making advertising more personalized, relevant and effective. Mastercard Commerce Media helps advertisers provide tailored offers to the right consumer at the right time by using our proprietary spend insights as well as measuring the effectiveness of the advertisements.”

Annual report 2025A · The company itself

“Our offerings include fraud scoring technology that scans billions of data points across millions of transactions each day while increasing approvals and reducing false declines, alerts when accounts are exposed to data breaches or security incidents, and network-level monitoring on a global scale to help detect the occurrence of widespread fraud attacks when a customer may be unable to detect or defend against them.”

Annual report 2025A · The company itself

“Digital and Authentication We offer global digital enablement and authentication capabilities that operate across all digital channels including in-store environments, e-commerce platforms and agentic interfaces. These capabilities include: •Digital enablement and checkout services that allow issuers, acquirers, merchants, digital wallets and channel partners (such as payment service providers, gateways, payment facilitators, independent software vendors and payment orchestrators) to provision, access and use tokenized payment credentials that help make commerce more seamless and more secure •Authentication services that help customers grow digital commerce by enabling the verification of cardholder accounts and transactions for issuers and merchants.”

Annual report 2025A · The company itself

“•Payment gateways that offer a single interface to enable e-commerce merchants to process secure online and in-app payments and offer other solutions, including outsourced electronic payments, fraud prevention and alternative payment options. Other Solutions We provide several additional solutions to help differentiate our payments products.”

Annual report 2025A · The company itself

“We are a guarantor of certain third-party obligations, including those of certain of our customers and service providers. In this capacity, we are exposed to credit and liquidity risks. We may incur significant losses in connection with transaction settlements if a customer fails to fund its daily settlement obligations due to technical problems, liquidity shortfalls, insolvency or other reasons.”

Annual report 2025A · The company itself

“Our business significantly depends on the continued success and competitiveness of our issuing and acquiring customers and, in many jurisdictions, their ability to effectively manage or help manage our brands. While we work directly with many stakeholders in the payments system (including merchants, governments, fintechs and large digital companies and other technology companies), we are, and will continue to be, significantly dependent on our relationships with our issuers and acquirers and their respective relationships with account holders and merchants to support our programs and services.”

Annual report 2025A · The company itself

“Mastercard is not a financial institution. We do not issue cards, extend credit, determine or receive revenue from interest rates or other fees charged to account holders by issuers (the account holders’ financial institutions), nor do we establish the rates charged by acquirers (the merchants’ financial institutions) in connection with merchants’ acceptance of our products.”

Annual report 2025A · The company itself

“A significant portion of our net revenue is concentrated among our five largest customers. In 2025, the net revenue from these customers was approximately $6.9 billion, or 21%, of total net revenue. The loss of any of these customers or their significant card programs could adversely impact our revenue.”

Annual report 2025A · The company itself

“We also offer solutions designed to enable businesses or governments to make invoiced payments to businesses with whom they have a trusted relationship for goods and services. As part of our solutions, we offer a platform to optimize supplier payment enablement campaigns for financial institutions.”

Annual report 2025A · The company itself

“The following chart provides gross dollar volume (“GDV”) and number of cards featuring our brands in 2025 for select programs and solutions: GDV Cards Year Ended December 31, 2025 As of December 31, 2025 Mastercard-branded Programs 1 (in billions) % Increase from December 31, 2024 (Local) % of Total GDV (in millions) % Increase from Consumer Credit $ 3,878 8 % 37 % 1,083 3 % Consumer Debit and Prepaid 2 5,349 9 % 50 % 2,134 11 % Commercial Credit and Debit 1,405 11 % 13 % 174 14 % 1Excludes Maestro and Cirrus cards and volume generated by those cards.”

Annual report 2025A · The company itself

“Commercial We offer commercial credit, debit and prepaid payment products and solutions that meet the payment needs of large corporations, midsize companies, small businesses and government entities at the point of sale. Our point-of-sale solutions streamline procurement and payment processes, manage information and expenses (such as travel and entertainment) and reduce administrative costs.”

Annual report 2025A · The company itself

“Examples include digital wallet providers, point-of-sale financing/buy-now-pay-later providers, mobile operator services, mobile phone-based money transfer and microfinancing services, device manufacturers, B2B accounts payable and accounts receivable providers. •Digital Public Infrastructure and Other Government-Backed Solutions.”

Annual report 2025A · The company itself

“With respect to government-backed solutions, including those involving DPI, government participation in structures could prevent us from entering into, or substantially restrict us from participating in, particular geographies.”

Annual report 2025A · The company itself

“In addition, governments may promote their own national or international payments platforms, potentially putting us at a competitive disadvantage in those markets, or requiring us to compete differently.”

Annual report 2025A · The company itself

“As we increase our work with national, state and local governments (both indirectly through financial institutions, system integrators and other third party partners and with them directly as our customers), we may face various risks inherent in associating or contracting directly with governments. These risks include, but are not limited to, the following: •Governmental entities typically fund projects through appropriated monies.”

Annual report 2025A · The company itself

“•Working or contracting with governments (either directly or via our financial institution customers, system integrators or other third party partners) can subject us to heightened reputational risks, including extensive scrutiny and publicity, as well as a potential association with the policies of those governments.”

Annual report 2025A · The company itself

“In the retail industry, we believe a set of larger merchants with increasingly global scope and influence are having a significant impact on all participants in the global payments industry, including Mastercard. Some large merchants have supported the legal, regulatory and legislative challenges to interchange fees that Mastercard has been defending, including the U.S. merchant litigations.”

Annual report 2025A · The company itself

“This new service complements our existing cybersecurity intelligence, fraud scoring and defense functionalities. •In 2025, we launched Mastercard Commerce Media™, a new digital media network aimed at making advertising more personalized, relevant and effective. Mastercard Commerce Media helps advertisers provide tailored offers to the right consumer at the right time by using our proprietary spend insights as well as measuring the effectiveness of the advertisements.”

Annual report 2025A · The company itself

“We use our technologies and security protocols to develop solutions to make digital shopping and selling experiences, such as on smartphones and other connected devices (both online and in person), simpler, faster and more secure for consumers, businesses and merchants. We also offer products that make it easier for merchants to accept payments and expand their customer base. ◦Our contactless payment solutions help deliver a simple and intuitive way to pay.”

Annual report 2025A · The company itself

“Merchants’ continued focus on acceptance costs may lead to additional litigation and regulatory proceedings and/or increase our incentive program costs, which could materially and adversely affect our profitability. Merchants are important constituents in our payments system. We rely on both our relationships with them, as well as their relationships with our issuer and acquirer customers, to continue to expand the acceptance of our products and services.”

Annual report 2025A · The company itself

“Our point-of-sale offerings include: •Small business cards (credit, debit and prepaid) tailored to small and medium businesses Key 2025 Developments •As of the end of 2025, we had embedded our virtual card technology in more than 10 global B2B and travel and expense platforms (more than double the number of platforms in 2024), increasing the opportunity for financial institutions and businesses to integrate card payments into their existing corporate invoice payment workflows.”

Annual report 2025A · The company itself

“Commercial We offer commercial credit, debit and prepaid payment products and solutions that meet the payment needs of large corporations, midsize companies, small businesses and government entities at the point of sale. Our point-of-sale solutions streamline procurement and payment processes, manage information and expenses (such as travel and entertainment) and reduce administrative costs.”

Annual report 2025A · The company itself

“We also offer products that make it easier for merchants to accept payments and expand their customer base. ◦Our contactless payment solutions help deliver a simple and intuitive way to pay. Solutions such as SmartPOS and SoftPOS reduce the barrier to entry for merchants (including small businesses). Our Tap on Phone acceptance technology enables businesses of all sizes to accept payments from any contactless card or mobile wallet directly from their device, providing a turnkey and cost-effective solution without any additional hardware required.”

Annual report 2025A · The company itself

“Examples include digital wallet providers, point-of-sale financing/buy-now-pay-later providers, mobile operator services, mobile phone-based money transfer and microfinancing services, device manufacturers, B2B accounts payable and accounts receivable providers. •Digital Public Infrastructure and Other Government-Backed Solutions.”

Annual report 2025A · The company itself

“Moreover, as central banks experiment with CBDCs, policies and design considerations that governments adopt could impact the extent of our role in facilitating CBDC-based payment transactions, potentially impacting the transactions that we may process over our network.”

Annual report 2025A · The company itself

“We continue to expand our capabilities to support emerging blockchain‑based payment models through a controlled and risk‑managed framework, applying robust due‑diligence and monitoring standards for partners operating in the digital asset ecosystem. Our solutions enable consumers to use our cards to purchase digital assets and spend those balances across our acceptance network using crypto co-brand cards.”

Annual report 2025A · The company itself

“From time to time, our customers may take actions that we do not believe to be in the best interests of our brands, such as creditor practices that may be viewed as “predatory”. Moreover, adverse developments with respect to our industry or the industries of our customers or other companies and organizations that use our products and services (including certain legally permissible but high-risk merchant categories, such as adult content, firearms, alcohol and tobacco) may also, by association, impair our reputation, or result in greater public, regulatory or legislative scrutiny, as well as potential litigation.”

Annual report 2025A · The company itself

“•Commercial travel and entertainment, procurement and fleet cards, consisting mostly of credit cards and associated platforms for corporations to manage travel and expense, procurement and fleet expenses. Our Mastercard Smart Data™ platform provides expense management and reporting capabilities.”

Annual report 2025A · The company itself

“Key 2025 Developments •In 2025, Mastercard announced it would become the official naming partner of the McLaren Formula 1 Team, starting with the 2026 season.”

Annual report 2025A · The company itself

“Key 2025 Developments In 2025, we launched products aimed at driving top-of-wallet behavior by consumers (including offerings aimed at affluent consumers) such as: •The Mastercard Collection™, a comprehensive set of premium benefits •World Legend™ Mastercard, our most prestigious consumer card that is available to issuers globally •Mastercard One Credential™, which provides consumers greater control and choice of their preferred funding option across a wide range of our payments solutions Prepaid. Prepaid accounts are a type of electronic payment that enables consumers to pay from pre-funded accounts whether or not they previously had a bank account or a credit history.”

Annual report 2025A · The company itself

“In addition, we own a number of patents and patent applications relating to payment solutions, transaction processing, smart cards, contactless, mobile, biometrics, AI, security systems, blockchain and other technologies, which are important to our business operations.”

Annual report 2025A · The company itself

“From time to time, our customers may take actions that we do not believe to be in the best interests of our brands, such as creditor practices that may be viewed as “predatory”. Moreover, adverse developments with respect to our industry or the industries of our customers or other companies and organizations that use our products and services (including certain legally permissible but high-risk merchant categories, such as adult content, firearms, alcohol and tobacco) may also, by association, impair our reputation, or result in greater public, regulatory or legislative scrutiny, as well as potential litigation.”

Annual report 2025A · The company itself

“Our strategic expansion of our products and services has also created the need for us to obtain new types and increasing numbers of regulatory licenses, resulting in increased supervision and additional compliance burdens distinct from those imposed on our payment network activities. For example, certain of our subsidiaries maintain money transfer licenses that typically impose supervisory and examination requirements, as well as capital, safeguarding, risk management and other business obligations.”

Annual report 2025A · The company itself

“We are subject to increasingly complex, fragmented, overlapping and/or divergent laws and regulations related to privacy and data protection, data use and governance, AI and information security (including with respect to cybersecurity and cyber-risk) in the jurisdictions in which we do business. New or updated laws and regulations have led, and may continue to lead, to similar, stricter or at times conflicting requirements, creating an uncertain regulatory environment.”

Annual report 2025A · The company itself

“Government Regulation As a technology company in the global payments industry, we are subject to government regulation that impacts key aspects of our business. In particular, we are subject to the laws and regulations that affect the payments industry in the many countries in which our products and services are used.”

Annual report 2025A · The company itself

“Central banks and similar regulatory bodies have increasingly established or further expanded their authority over certain aspects of payments systems such as ours, including obligations or restrictions with respect to the types of products and services that we may offer, the countries in which our products and services may be used, the way we structure and operate our business and the types of consumers and merchants who can obtain or accept our products or services. Similarly, jurisdictions that regulate a particular product may consider extending their jurisdiction to other products.”

Annual report 2025A · The company itself

“Key 2025 Developments •In July 2025, the EU introduced its revised systemic importance regulation, covering companies such as ours that have been designated as systemically important. The revision introduces a framework for cyber resilience and detailed rules for managing outsourcing risks.”

Annual report 2025A · The company itself

“•In November 2025, the Central Bank of Brazil established a new regulation for all Payment Scheme Operators (PSOs) in Brazil (including Mastercard and Visa), enhancing governance, risk management and transparency standards across the payments ecosystem. The new regulation reinforces the PSOs’ accountability for the financial and settlement integrity of payments to merchants (including in cases of default, operational failure or insolvency of any of their scheme participants) and, in particular, requires payment networks to extend their settlement guarantees to previously non-guaranteed transactions (such as merchant installment transactions).”

Annual report 2025A · The company itself

“For example, some jurisdictions have implemented or are otherwise considering requirements to collect, store and/or process data within their borders, as well as prohibitions on the transfer of and access to data abroad, leading to technological and operational implications. Other jurisdictions have adopted or are otherwise considering adopting sector-specific regulations for the payments industry and other industries in which we participate, including forced data sharing requirements or additional verification requirements.”

Annual report 2025A · The company itself

“Other Regulation Regulations that directly or indirectly apply to Mastercard as a result of our participation in the global payments industry may materially and adversely affect our overall business and results of operations. We are subject to regulations that affect the payments industry in the many jurisdictions in which our products and services are used.”

Annual report 2025A · The company itself

“Examples include: •Anti-Money Laundering, Countering the Financing of Terrorism, Economic Sanctions and Anti-Corruption. We are subject to AML and CFT laws and regulations globally.”

Annual report 2025A · The company itself

“Certain regulations or legislation that do or could impact our issuers and acquirers (such as caps on issuer interest rates) may impact various aspects of our business. Additionally, strong authentication requirements within the EU’s Payment Services Directive in the EEA could increase the number of transactions consumers abandon if we are unable to secure a frictionless authentication experience under these standards. Such an increase could adversely impact our volumes or other operational metrics.”

Annual report 2025A · The company itself

“Increased regulatory focus on us has resulted and may continue to result in significant compliance and governance burdens or otherwise increase our costs. Similarly, increased regulatory focus on our customers and other stakeholders may cause them to reduce the volume of transactions processed through our systems, or may otherwise impact the competitiveness of our products.”

Annual report 2025A · The company itself

“Additionally, our compliance with new economic sanctions and related laws with respect to particular jurisdictions or customers could result in a loss of business, which could be significant. Moreover, while our risk-based compliance program obligates issuers and acquirers to comply with U.S., EU and local sanctions programs (among other obligations), the failure of those issuers and acquirers to identify potential non-compliance issues either during or after their customer onboarding processes could ultimately impact our compliance with economic sanctions and related laws.”

Annual report 2025A · The company itself

“•Regulation may disintermediate issuers by enabling third-party providers opportunities to route payment transactions toward their own forms of payment by offering account information or payment initiation services directly to our product users. Such regulation may also provide these processors with the opportunity to commoditize the data that are included in the transactions they are servicing. Disintermediation of our customers’ business could diminish demand for our products and services.”

Annual report 2025A · The company itself

“In addition, to the extent that we offer discounts or incentives under such agreements, we will need to further increase transaction volumes or the amount of services provided in order to benefit from such agreements and to increase revenue and profit, and we may not be successful in doing so, particularly in the current regulatory environment.”

Annual report 2025A · The company itself

“Moreover, regulatory or government requirements could continue to require us to host and deliver certain products and services on-soil in certain markets. As a result, we may need to alter our technology and delivery model, potentially resulting in additional expenses and/or other operational impacts.”

Annual report 2025A · The company itself

“Operating a real-time account-based payments network presents risks that could materially affect our business. U.K. regulators have designated Vocalink, our real-time account-based payments network platform, to be a “specified service provider” and regulators in other countries may in the future expand their regulatory oversight of real-time account-based payments systems in similar ways.”

Annual report 2025A · The company itself

“Our failure to effectively design and deliver these products and services could make our other offerings less desirable to these customers, or put us at a competitive disadvantage. In addition, if there is a delay in the implementation of our products or services (which could include compliance obligations, such as AML and CFT, and licensing requirements for applicable products and services), if our products or services do not perform as anticipated, or we are unable to otherwise adequately anticipate risks related to new types of customers, we could face additional regulatory scrutiny, fines, sanctions or other penalties, which could materially and adversely affect our overall business and results of operations, as well as negatively impact our brand and reputation.”

Annual report 2025A · The company itself

“Changes in governmental priorities or other political developments, including disruptions in governmental operations, could impact approved funding and result in scope changes or termination of the arrangements or contracts we or financial institutions enter into with respect to our products and services. •Our work with governments is heavily regulated, subjecting us to additional potential exposure under U.S. and international anti-corruption laws (including the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act), as well as compliance with various procurement and other laws, regulations, standards and contract terms.”

Annual report 2025A · The company itself

“For example, governments in some countries (such as South Africa) mandate switching of domestic payments either entirely in that country or by only domestic companies. Some jurisdictions are currently considering adopting or have adopted data localization requirements, which mandate the collection, storage, and/or other processing of data within their borders.”

Annual report 2025A · The company itself

“We are subject to anti-money laundering (“AML”) and countering the financing of terrorism (“CFT”) laws and regulations globally, including the U.S. Bank Secrecy Act and the USA PATRIOT Act, as well as the various economic sanctions programs, including those imposed and administered by the U.S. Office of Foreign Assets Control (“OFAC”) and the European Union.”

Annual report 2025A · The company itself

“Governments in some countries have acted, or in the future may act, to provide resources, preferential treatment or other protection to selected national or domestic payment and switching providers, or have created, or may in the future create, their own national provider. These actions may displace us from, prevent us from entering into, or substantially restrict us from participating in, particular geographies, and may prevent us from competing effectively against those providers.”

Annual report 2025A · The company itself

“In addition, several governments are promoting, or considering promoting, local networks for domestic switching.”

Annual report 2025A · The company itself

“Geopolitical events and resulting government activity could also lead to information security threats and attacks by affected or sympathizing jurisdictions or other actors, which could put our information and assets at risk, as well as result in network disruption.”

Annual report 2025A · The company itself

“•Working or contracting with governments (either directly or via our financial institution customers, system integrators or other third party partners) can subject us to heightened reputational risks, including extensive scrutiny and publicity, as well as a potential association with the policies of those governments. Any negative publicity or negative association with a government entity, regardless of its accuracy, may adversely affect our reputation.”

Annual report 2025A · The company itself

“Cross-border activity has been, and may continue to be, adversely affected by world geopolitical, economic, health, weather and other conditions. These include or have included: •Global pandemics (and related post-pandemic global economic impacts) and potential separate outbreaks of flu, viruses and other diseases (any of which could result in future epidemics or pandemics) •Current and potential future geopolitical conflicts, as well as expansion into regional or global conflicts, and the resulting impacts to our business •The threat of terrorism and major environmental and extreme weather events (including those related to climate change) The impact of and uncertainty that could result from any of these events or factors could ultimately decrease cross-border activity.”

Annual report 2025A · The company itself

“Russia’s invasion of Ukraine. In addition to the cross-border impacts described above, our compliance with sanctions and our decision to suspend our business operations in Russia has led, and could further lead, to other legal ramifications and operational challenges, including fines, the nationalization of our subsidiary and any resulting impacts, and/or lawsuits.”

Annual report 2025A · The company itself

“Information security risks for payments and technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies (including AI), the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, “hacktivists”, terrorists, nation-states, state-sponsored actors and other external parties. These threats may derive from fraud or malice on the part of our employees or third parties, or may result from human error, software bugs, server malfunctions, software or hardware failure or other technological failure. These threats include cyber-attacks such as computer viruses, denial-of-service attacks, malicious code (including ransomware), social-engineering attacks (including phishing attacks) or information security breaches and could lead to the misappropriation or loss of consumer account and other information and identity theft.”

Annual report 2025A · The company itself

“We, like other financial technology organizations, routinely are subject to cyber-threats and our technologies, systems and networks, as well as the systems of our third-party providers, have been subject to attempted cyber-attacks. Because of our position in the payments value chain, we believe that we are likely to continue to be a target of such threats and attacks.”

Annual report 2025A · The company itself

“However, future attacks or breaches could lead to security breaches of the networks, systems (including third-party provider systems) or devices that our customers use to access our products and services, which in turn could result in the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary, sensitive and personal information (including account data information) or data security compromises. Such attacks or breaches could also cause service interruptions, malfunctions or other failures in the physical infrastructure, networks or operations systems that support our business and customers (such as the lack of availability of our services), as well as the operations of our customers or other third parties.”

Annual report 2025A · The company itself

“Moreover, while most of the lawsuits resulting from account data breaches do not involve direct claims against us and while we have releases from many issuers and acquirers, we could still face damage claims, which, if upheld, could materially and adversely affect our results of operations.”

Annual report 2025A · The company itself

“In addition, companies have generally experienced in recent years an increase in fraudulent activity and cyber-attacks, which has been further exacerbated by the increased use of AI. Criminals are using increasingly sophisticated methods to capture consumer personal information to engage in illegal activities such as counterfeiting or other fraud and may see their effectiveness enhanced by the use of AI.”

Annual report 2025A · The company itself

“We switch substantially all cross-border transactions using Mastercard, Maestro and Cirrus-branded cards and generate a significant amount of revenue from cross-border volume fees and fees related to switched transactions. Revenue from switching cross-border and currency conversion transactions for our customers fluctuates with the levels and destinations of cross-border travel and our customers’ need for transactions to be converted into their base currency.”

Annual report 2025A · The company itself

“In addition, the revenue we generate in entities with non-U.S. dollar functional currencies is subject to unpredictable currency fluctuations, including where the values of other currencies change relative to the U.S. dollar. If the U.S. dollar strengthens compared to currencies in which we generate revenue, this revenue may be translated at a materially lower amount than expected.”

Annual report 2025A · The company itself

“Furthermore, we may become subject to exchange control regulations that might restrict or prohibit the conversion into U.S. dollars of our other revenue currencies and financial assets. The occurrence of currency fluctuations or exchange controls could have a material adverse impact on our results of operations.”

Annual report 2025A · The company itself

“Our operations rely on the secure transmission, storage and other processing of confidential, proprietary, sensitive and personal information and technology in our computer systems and networks, as well as the systems of our third-party providers. Our customers and other parties in the payments value chain, as well as account holders, rely on our digital technologies, computer systems, software and networks to conduct their operations.”

Annual report 2025A · The company itself

“Service disruptions that cause us to be unable to process transactions or service our customers could reduce our operational resilience and materially affect our overall business and results of operations. Our transaction switching systems and other offerings may experience interruptions as a result of technology malfunctions, network degradation, updates and migrations to new technology and platforms, supply-chain attacks, fire, floods, earthquakes, weather events, power outages, telecommunications disruptions, terrorism, workplace violence, accidents or other catastrophic events (including those related to climate change).”

Annual report 2025A · The company itself

“Additionally, we rely on third-party service providers for the timely transmission of information across our global data network. If one of our service providers fails to provide the communications capacity or services we require, as a result of natural disasters, operational disruptions, cybersecurity-related disruptions or failures, terrorism, hacking or any other reason, the failure could interrupt our services.”

Annual report 2025A · The company itself

“Privacy, Data, AI and Information Security Regulation and enforcement of privacy, data, AI, information security and the digital economy could increase our costs and lead to legal claims and fines, as well as negatively impact our growth and reputation.”

Annual report 2025A · The company itself

“New requirements and rules, or changing interpretations of existing requirements in these areas, or the development of new regulatory schemes related to the digital economy in general, may also increase our costs and/or restrict our ability to leverage data or use AI for innovation. This could impact the products and services we offer and other aspects of our business, such as fraud monitoring, the need for improved data management, governance, quality and accuracy practices, the development of information-based products and solutions, and technology operations. In addition, these requirements may increase the costs to our customers of issuing payment products or using information products, which may, in turn, decrease the number of our products that they offer.”

Annual report 2025A · The company itself

“Our transaction switching systems and other offerings may experience interruptions as a result of technology malfunctions, network degradation, updates and migrations to new technology and platforms, supply-chain attacks, fire, floods, earthquakes, weather events, power outages, telecommunications disruptions, terrorism, workplace violence, accidents or other catastrophic events (including those related to climate change).”

Annual report 2025A · The company itself

“Cross-border activity has been, and may continue to be, adversely affected by world geopolitical, economic, health, weather and other conditions. These include or have included: •Global pandemics (and related post-pandemic global economic impacts) and potential separate outbreaks of flu, viruses and other diseases (any of which could result in future epidemics or pandemics) •Current and potential future geopolitical conflicts, as well as expansion into regional or global conflicts, and the resulting impacts to our business •The threat of terrorism and major environmental and extreme weather events (including those related to climate change) The impact of and uncertainty that could result from any of these events or factors could ultimately decrease cross-border activity.”

Annual report 2025A · The company itself

“Brand, Reputational Impact and Environmental, Social and Governance Negative brand perception may materially and adversely affect our overall business. Our brands and their attributes are key assets of our business. The ability to attract consumers to our branded products and retain them depends upon the external perception of us and our industry: •Our business may be affected by actions taken by our customers, merchants or other organizations that impact the perception of our brands or the payments industry in general.”

Annual report 2025A · The company itself

“Environmental, social and governance matters and related stakeholder reaction may impact our reputation, increase legal exposure and/or have other business impacts, which could adversely affect our overall business and/or results of operations. Our brand and reputation are associated with the ways in which we impact environmental, social and governance matters.”

Annual report 2025A · The company itself

“During 2025, approximately 71% of our revenue was generated from activities outside the U.S., which could be transacted in a non-functional currency.”

Annual report 2025A · The company itself

“Years ended December 31, 2025 2024 Increase/(Decrease) Increase/(Decrease) 2025 2024 2023 As reported Currency-neutral As reported Currency-neutral ($ in millions) Domestic assessments $ 11,029 $ 10,245 $ 9,566 8% 8% 7% 9% Cross-border assessments 12,021 10,181 8,409 18% 17% 21% 22% Transaction processing assessments 15,930 13,602 12,067 17% 16% 13% 14% Other network assessments 1,018 936 963 9% 8% (3)% (3)% Foreign Currency Currency Impact Our primary functional currencies are the U.S. dollar, euro, British pound and the Brazilian real. Our overall operating results are impacted by currency translation, which represents the effect of translating operating results where the functional currency is different than our U.S. dollar reporting currency.”

Annual report 2025A · The company itself

“Years ended December 31, 2025 2024 Increase/(Decrease) Increase/(Decrease) 2025 2024 2023 As reported Currency-neutral As reported Currency-neutral ($ in millions) Domestic assessments $ 11,029 $ 10,245 $ 9,566 8% 8% 7% 9% Cross-border assessments 12,021 10,181 8,409 18% 17% 21% 22% Transaction processing assessments 15,930 13,602 12,067 17% 16% 13% 14% Other network assessments 1,018 936 963 9% 8% (3)% (3)% Foreign Currency Currency Impact Our primary functional currencies are the U.S. dollar, euro, British pound and the Brazilian real. Our overall operating results are impacted by currency translation, which represents the effect of translating operating results where the functional currency is different than our U.S. dollar reporting currency.”

Annual report 2025A · The company itself

“Cross-border activity has been, and may continue to be, adversely affected by world geopolitical, economic, health, weather and other conditions. These include or have included: •Global pandemics (and related post-pandemic global economic impacts) and potential separate outbreaks of flu, viruses and other diseases (any of which could result in future epidemics or pandemics) •Current and potential future geopolitical conflicts, as well as expansion into regional or global conflicts, and the resulting impacts to our business •The threat of terrorism and major environmental and extreme weather events (including those related to climate change) The impact of and uncertainty that could result from any of these events or factors could ultimately decrease cross-border activity.”

Annual report 2025A · The company itself

“Russia’s invasion of Ukraine. In addition to the cross-border impacts described above, our compliance with sanctions and our decision to suspend our business operations in Russia has led, and could further lead, to other legal ramifications and operational challenges, including fines, the nationalization of our subsidiary and any resulting impacts, and/or lawsuits.”

Annual report 2025A · The company itself

“For example, governments in some countries (such as South Africa) mandate switching of domestic payments either entirely in that country or by only domestic companies. Some jurisdictions are currently considering adopting or have adopted data localization requirements, which mandate the collection, storage, and/or other processing of data within their borders.”

Annual report 2025A · The company itself

“•Some jurisdictions have implemented, or are considering implementing, requirements to collect, store and/or process data within their borders, as well as prohibitions on the transfer of data abroad, leading to technological and operational implications as well as increased compliance burdens and other costs. •Geopolitical events and any resulting OFAC sanctions, adverse trade policies, enforcement of U.S. laws related to countering the financing of terrorism, economic sanctions and anti-corruption, or other types of government actions could lead affected or other jurisdictions to take actions in response that could adversely affect our business.”

Annual report 2025A · The company itself

“Additionally, any regulation of interregional interchange fees could also negatively impact our cross-border activity (for example, the targets announced by the G20 Financial Stability Board related to cross-border payments).”

Annual report 2025A · The company itself

“Further, changes in and enforcement of immigration and work permit laws and visa regulations have made it difficult for employees to work in, or transfer among, jurisdictions where we operate, potentially impairing our ability to attract and retain talent.”

Annual report 2025A · The company itself

“Our data comes from an increasing variety of sources, such as transaction data (including from gateway, card and real-time payments), open finance, digital identities, buyer/supplier payment preferences, device attributes, digital threat assessments, rewards redemptions and unstructured data (such as our manuals and publications).”

Annual report 2025A · The company itself

“These types of threats have risen significantly due to a significant portion of our workforce working in a hybrid environment.”

Annual report 2025A · The company itself

“Inadequate infrastructure in lesser-developed markets could also result in service disruptions, which could impact our ability to do business in those markets.”

Annual report 2025A · The company itself