Moody's Corporation

“Moody’s is subject to extensive regulation by federal, state and local authorities in the U.S. and by foreign jurisdictions. These regulations, the most important of which are discussed in further detail below, are complex, continually evolving and have tended to become more stringent over time.”

Annual report 2025A · The company itself

“In addition to the extensive and evolving U.S. laws and regulations governing the credit rating industry, foreign jurisdictions have taken measures to regulate CRAs and the markets for credit ratings that significantly impact the operations and the markets for the Company's ratings-related products and services. In particular, the EU has adopted a common regulatory framework for CRAs operating in the EU, continues to monitor the credit rating industry and analyzes approaches that may strengthen existing regulation.”

Annual report 2025A · The company itself

“Future laws and regulations could extend to products and services not currently regulated. These regulations could: –affect the need for debt securities to be rated; –expand supervisory remits to include credit ratings issued outside the home jurisdiction; –increase the level of competition for credit ratings, including the distribution of credit ratings; –establish criteria for credit ratings or limit the entities authorized to provide credit ratings; –restrict the collection, use, accuracy, correction and sharing of information by CRAs; or –regulate pricing (for example, to require fees that are based on costs and are non-discriminatory) on products and services provided by MA such as those products that incorporate credit ratings and research originated by MIS.”

Annual report 2025A · The company itself

“Certain of MA’s subscription products contain credit ratings data and related research produced by MIS, and often are used by MA customers for regulatory compliance purposes, including determination of capital charges and regulatory reporting. Regulations concerning the issuance of credit ratings and the activities of CRAs, including the dissemination of ratings data, are likely to continue to be considered in the future, including, for example, provisions regarding fair and reasonable availability of ratings data, the terms and conditions associated with such data feeds, remuneration for data and the nature of the information to be included in credit opinions.”

Annual report 2025A · The company itself

“MA’s other products and services, in particular its offering of products and services relating to sanctions, KYC and financial crime, are potentially subject to various laws and regulations affecting the collection, processing and sale of data-driven solutions. These laws and regulations generally are designed to protect information relating to individuals and small businesses, including information used for consumer credit reporting purposes, the data rights of individuals, and to prevent the unauthorized collection, access to and use of personal or confidential information available in the marketplace and prohibit certain deceptive and unfair acts.”

Annual report 2025A · The company itself

“Further, MA’s bank and financial services customers are subject to additional regulatory oversight. For example: –U.S. banking regulators, including the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System and the Consumer Financial Protection Bureau, as well as many state agencies, have issued guidance to insured depository institutions and other providers of financial services on assessing and managing risks associated with third-party relationships, which include all business arrangements between a financial services provider and another entity, by contract or otherwise, and generally requires banks and financial services providers to exercise comprehensive oversight throughout each phase of a bank or financial service provider’s business arrangement with third-party service providers, and instructs banks and financial service providers to adopt risk management processes commensurate with the level of risk and complexity of their third-party relationships.”

Annual report 2025A · The company itself

“Moody’s faces exposure to litigation and government and regulatory proceedings, investigations and inquiries (including market studies) related to MIS’s ratings actions, as well as other business practices and products within both MIS and MA. When the market value of credit-dependent instruments has declined or defaults have occurred, whether as a result of difficult economic times, rapid changes in interest rates, decreased liquidity, turbulent markets or otherwise, the number of investigations and legal proceedings that Moody’s has faced has increased significantly.”

Annual report 2025A · The company itself

“Moody’s policies and procedures to identify, evaluate and manage the Company’s risks, including risks resulting from acquisitions and from Gen AI developments (such as maintaining the quality and integrity of data of Gen AI product offerings), may not be fully effective, and Moody’s employees or agents may engage in misconduct, fraud or other errors. It is not always possible to deter such errors, and the precautions the Company takes to prevent and detect this activity may not be effective in all cases.”

Annual report 2025A · The company itself

“Furthermore, in some of the countries in which Moody’s operates, governments may provide financial or other support to local rating agencies.”

Annual report 2025A · The company itself

“Several regulatory oversight regimes for ESG ratings providers which may impose new regulatory requirements on Moody’s include the EU regulation on the transparency and integrity of ESG rating activities, adopted by the European Parliament and Council in November 2024 and published in the Official Journal of the EU in December 2024, or draft legislation published by the United Kingdom in 2024 to empower the FCA to supervise ESG rating providers.”

Annual report 2025A · The company itself

“The Company Is Exposed to Risks Related to Protection of Confidential and Personal Information To conduct its operations, the Company regularly moves data across national borders, and consequently is subject to a variety of continuously evolving and developing laws and regulations in the U.S. and abroad regarding privacy, data protection and data security, such as the Federal Trade Commission Act in the U.S., the GDPR in the EU, the GDPR in the U.K., the Cyber Security Law, the Data Security Law, and the Personal Information Protection Law in China and various other international, federal, state and local laws and regulations.”

Annual report 2025A · The company itself

“MIS operates in a highly regulated industry. The current U.S. laws and regulations relating to MIS, including the Reform Act and the Dodd-Frank Act: –seek to encourage, and may result in, increased competition among CRAs and in the credit rating business; –may result in alternatives to credit ratings, changes in the pricing of credit ratings, and/or diminished intellectual property protection relating to credit ratings and related research produced by MIS; –restrict the use of information in the development or maintenance of credit ratings; –increase regulatory oversight of the credit markets and CRA operations; –provide the SEC with direct jurisdiction over CRAs that seek NRSRO status, and grant authority to the SEC to inspect the operations of CRAs; and –provide for enhanced oversight standards and specialized pleading standards, which may result in increases in the number of legal proceedings claiming liability for losses suffered by investors on rated securities and aggregate legal defense costs.”

Annual report 2025A · The company itself

“Additionally Moody’s development of new technologies, including Gen AI and agentic AI product offerings may introduce new risks. Large language models, agentic workflows and related AI-technologies licensed by or developed by the Company, and the data used to train or power them may be incomplete or inadequate, our Gen AI or agentic AI products or platforms may result in adverse impacts to our business operations or reputation and increased regulatory scrutiny and exposure to litigation.”

Annual report 2025A · The company itself

“In addition, the Company’s operating results can be adversely affected by inadequate or changing legal and technological protections for intellectual property and proprietary rights in some jurisdictions and markets, including if and how rights in these markets evolve to address unauthorized or unintended use of intellectual property from new technologies like Gen AI.”

Annual report 2025A · The company itself

“The markets for credit ratings, research, credit risk management services, business intelligence and analytical services are highly competitive and characterized by rapid technological change, including change based on our Gen AI offerings, disruption by the Gen AI offerings of others, changes in customer and investor demands, and evolving regulatory requirements, industry standards and market preferences.”

Annual report 2025A · The company itself

“Competitors may develop quantitative methodologies or related services, including services based on Gen AI or utilizing agentic AI workflows, for assessing credit or climate risk that customers and market participants may deem preferable, more cost-effective or more valuable than the risk assessment methods currently employed by Moody’s.”

Annual report 2025A · The company itself

“Further, the increased availability in recent years of free or relatively inexpensive information, online and through the use of Gen AI, may reduce the demand for Moody’s products and services.”

Annual report 2025A · The company itself

“In addition, the emergence of Gen AI and other technologies may further intensify these pressures, as the Company's competitors may use these tools to deliver solutions at lower prices, or these tools may be used in a way that significantly increases access to publicly available information.”

Annual report 2025A · The company itself

“Also, the emergence and adoption Gen AI technologies and progress towards digitalization of the global economy has required and will continue to require upskilling and additional training of Moody's employees, making retention and training increasingly important, particularly in roles where demand for experienced individuals with the right skill set may exceed supply in the labor market.”

Annual report 2025A · The company itself

“The ability to develop, successfully launch and maintain innovative products, technologies and services that anticipate customers’ and investors’ changing requirements and utilize emerging technological trends in a timely and cost-effective manner is a key factor in maintaining a competitive market position.”

Annual report 2025A · The company itself

“Moody's Analytics. Certain of MA’s subscription products contain credit ratings data and related research produced by MIS, and often are used by MA customers for regulatory compliance purposes, including determination of capital charges and regulatory reporting.”

Annual report 2025A · The company itself

“Revenue ⇑ $72 million Global DS revenue for the years ended December 31, 2025 and 2024 was comprised as follows: Global DS revenue increased 12% driven by growth in both the U.S. (18%) and internationally (8%). DS recurring revenue grew 15%. Organic constant currency revenue(1) and organic constant currency recurring revenue(1) growth for DS was 8% and 11%, respectively, and ARR(2) grew 10%.”

Annual report 2025A · The company itself

“Moody’s regularly evaluates and enters into acquisitions, dispositions or other strategic transactions, partnerships and investments to strengthen its business and grow the Company.”

Annual report 2025A · The company itself

“For example, DORA requires EU financial institutions to have a comprehensive governance and control framework of the management of ICT risks, including risks relating to third-party providers of technology and data such as MA.”

Annual report 2025A · The company itself

“The Company may be exposed to additional threats as it migrates its data from legacy systems to cloud-based solutions, and increased dependence on third-parties to store cloud-based data subjects the Company to further cyber risks.”

Annual report 2025A · The company itself

“The Company also relies on third-party providers, including, increasingly, cloud-based service providers, to provide certain essential services. While the Company believes that such providers are generally reliable, the Company has limited control over the performance of such providers.”

Annual report 2025A · The company itself

“Moody’s relies on Third-Party Technology in connection with its product development and offerings and operations.”

Annual report 2025A · The company itself

“The Company depends on the ability of Third-Party Technology providers to deliver and support reliable products, provide sufficient cloud computing capacity to meet demand, enhance their current products, develop new products on a timely and cost-effective basis, provide data necessary to develop and maintain its products and respond to emerging industry standards and other technological changes.”

Annual report 2025A · The company itself

“Growth in global revenue reflected increases in both MA and MIS, both in the U.S. and internationally.”

Annual report 2025A · The company itself

“Purchase Obligations Purchase obligations generally include multi-year agreements with vendors to purchase goods or services and mainly include data center/cloud hosting fees and fees for information technology licensing and maintenance. As of December 31, 2025, these purchase obligations totaled approximately $650 million, of which approximately 60% is expected to be paid in the next twelve months and another approximate 40% expected to be paid over the next two subsequent years, with the remainder to be paid thereafter.”

Annual report 2025A · The company itself

“Technology Risks The Company Is Exposed to Risks Related to Cybersecurity and Protection of Confidential Information.”

Annual report 2025A · The company itself

“The risks the Company faces range from cyber-attacks common to most industries, to more advanced threats that target the Company because of its prominence in the global marketplace, or due to its ratings of sovereign debt and corporate issuers.”

Annual report 2025A · The company itself

“The Company and its third-party service providers, including our vendors, regularly experience cyber-attacks and data breaches of varying degrees.”

Annual report 2025A · The company itself

“Cyber-attacks targeting Moody’s or Moody’s vendors’ technology and systems, whether from circumvention of security systems, exploitation of security vulnerabilities, denial-of-service attacks, ransomware, malware, hacking, social engineering or "phishing" attacks, deepfake attacks, computer viruses, employee or insider threats, malfeasance, supply chain attacks, physical breaches, vendor email compromise, payment fraud or other cyber-attacks some of which may be carried out by state-sponsored actors, may result in unauthorized access, exfiltration, manipulation, encryption or corruption of sensitive data, material interruptions or malfunctions in the Company’s or such vendors’ web sites or systems, applications, data processing, or disruption of other business operations.”

Annual report 2025A · The company itself

“In addition, certain aspects of the Company’s business rely on a concentrated group of vendors, and a cybersecurity breach or event and/or an error caused by one or more of such vendors could have a significant impact on the Company’s operations, as well as the operations of the Company's customers and other Third-Party Technology.”

Annual report 2025A · The company itself

“Current market, economic and government factors could negatively impact the volume of debt securities issued in global capital markets and the demand for credit ratings, which could materially and adversely affect the Company’s business, operating results and financial condition. These factors include increases in or uncertainty around interest rates (as well as related monetary policy by governments in the response to factors such as inflation, inflationary pressures, increases or volatility in mortgage rates, widening credit spreads, regulatory and political developments (including evolving government policies in the U.S. and abroad, the enactment of the OBBBA, and geopolitical uncertainty in various jurisdictions where Moody's operates), difficult economic conditions, growth in the use of alternative sources of credit, and defaults by significant issuers.”

Annual report 2025A · The company itself

“The increase in CFG revenue of 9% reflects increases in both the U.S (7%) and internationally (14%). Transaction revenue increased $144 million compared to the prior year, which primarily reflected: –higher issuance activity for investment-grade bonds, which reflected continued tight credit spreads and investor demand for higher quality credits, and includes the impact of several jumbo transactions in the technology sector; and –higher issuance activity for high-yield bonds as issuers took advantage of favorable conditions, including tight spreads and lower interest rates, primarily to refinance debt.”

Annual report 2025A · The company itself

“(8%) and internationally (8%). The increase in revenue reflected growth across all asset classes, supported by tight credit spreads and strong investor demand.”

Annual report 2025A · The company itself

“The repayment schedule for the Company’s borrowings outstanding at December 31, 2025 is as follows: Future interest payments and fees associated with the Company's debt and credit facility are expected to be $3.7 billion. Of this amount, approximately $300 million is expected to be paid in each of the next two years, approximately $200 million in each of the subsequent three years, with the remaining balance expected to be paid thereafter.”

Annual report 2025A · The company itself

“Moody’s success depends upon its ability to recruit, retain and motivate highly skilled, experienced professionals, including financial analysts, data scientists and software engineers.”

Annual report 2025A · The company itself

“Competition for skilled individuals in the financial services and technology industries is intense, and Moody’s ability to attract high-quality employees could be impaired if it is unable to offer competitive compensation and other incentives or if the regulatory environment mandates restrictions on or disclosures about individual employees that would not be necessary in competing industries.”

Annual report 2025A · The company itself

“Rising expenses including wage inflation, and global labor shortages could adversely affect Moody’s ability to attract and retain high-quality employees.”

Annual report 2025A · The company itself

“Moody’s is highly dependent on the continued services of Robert Fauber, the Company's President and Chief Executive Officer, and other senior officers and key employees.”

Annual report 2025A · The company itself

“The increase in CFG revenue of 9% reflects increases in both the U.S (7%) and internationally (14%). Transaction revenue increased $144 million compared to the prior year, which primarily reflected: –higher issuance activity for investment-grade bonds, which reflected continued tight credit spreads and investor demand for higher quality credits, and includes the impact of several jumbo transactions in the technology sector; and –higher issuance activity for high-yield bonds as issuers took advantage of favorable conditions, including tight spreads and lower interest rates, primarily to refinance debt.”

Annual report 2025A · The company itself

“(8%) and internationally (8%). The increase in revenue reflected growth across all asset classes, supported by tight credit spreads and strong investor demand.”

Annual report 2025A · The company itself

“Moody’s ability to conduct business may be materially and adversely impacted by a disruption in the infrastructure that supports its businesses and the communities in which Moody’s has large employee populations, including: (i) New York City, the location of Moody’s headquarters, (ii) India, (iii) major cities worldwide in which Moody’s has offices, and (iv) locations that may be affected by the Russia-Ukraine military conflict and the military conflicts in the Middle East. This may include a disruption involving physical or technological infrastructure (whether or not controlled by the Company), including the Company’s electronic delivery systems, the Company's data center facilities, or the Internet, used by the Company or third parties with or through whom Moody’s conducts business.”

Annual report 2025A · The company itself

“Current market, economic and government factors could negatively impact the volume of debt securities issued in global capital markets and the demand for credit ratings, which could materially and adversely affect the Company’s business, operating results and financial condition. These factors include increases in or uncertainty around interest rates (as well as related monetary policy by governments in the response to factors such as inflation, inflationary pressures, increases or volatility in mortgage rates, widening credit spreads, regulatory and political developments (including evolving government policies in the U.S. and abroad, the enactment of the OBBBA, and geopolitical uncertainty in various jurisdictions where Moody's operates), difficult economic conditions, growth in the use of alternative sources of credit, and defaults by significant issuers.”

Annual report 2025A · The company itself

“Table of Contents Market Risk FX risk: Moody’s maintains a presence in more than 40 countries. In 2025, approximately 39% of the Company’s revenue and approximately 38% of the Company's expenses were denominated in functional currencies other than the U.S. dollar, principally in the British pound and the euro.”

Annual report 2025A · The company itself

“Table of Contents Market Risk FX risk: Moody’s maintains a presence in more than 40 countries. In 2025, approximately 39% of the Company’s revenue and approximately 38% of the Company's expenses were denominated in functional currencies other than the U.S. dollar, principally in the British pound and the euro.”

Annual report 2025A · The company itself

“Speculation concerning the impact of legislative, regulatory and government initiatives, including initiatives related to the emerging technology of AI systems, operational resilience, data privacy and climate-related risks, among others, that our products and services incorporate, and the increased uncertainty over potential liability and adverse legal or judicial determinations may negatively affect Moody's stock price, affect demand for our products and services, increase our costs of operations and impact our future business plans.”

Annual report 2025A · The company itself

“Certain products currently offered by MIS may fall into scope of the EU Regulation on ESG Rating Activities, which could impose new substantive and procedural requirements on MIS relating to those products similar to those applicable to credit ratings. In addition, EU CRAs are also subject to DORA, which imposes a range of requirements in relation to the management of ICT risk, regulatory reporting, testing and the management of risks related to ICT services provided by third-parties.”

Annual report 2025A · The company itself

“The EU AI Act has introduced a risk-based framework for regulating AI systems which applies different obligations to various participants in the AI supply chain. Compliance with the regulation, in its current form, could increase the Company’s costs and expose it to the risk of penalties or fines for noncompliance; however, the ultimate impact of the EU AI Act on the Company remains uncertain, as the European Commission has proposed measures intended to reduce the regulatory burden on businesses.”

Annual report 2025A · The company itself

“Certain products currently offered by MIS may fall into scope of the EU Regulation on ESG Rating Activities, which could impose new substantive and procedural requirements on MIS relating to those products similar to those applicable to credit ratings. In addition, EU CRAs are also subject to DORA, which imposes a range of requirements in relation to the management of ICT risk, regulatory reporting, testing and the management of risks related to ICT services provided by third-parties.”

Annual report 2025A · The company itself

“Our Reputation or Business Could Be Negatively Impacted by Sustainability Matters and Our Reporting of Such Matters Over the past several years, both in the United States and internationally, regulators, certain investors and other stakeholders have focused on various sustainability matters, including environmental impact, human capital, and human rights.”

Annual report 2025A · The company itself

“In addition, there has been a recent increase in “anti-ESG” sentiment in the United States by certain activists, institutions and governmental entities criticizing ESG or climate-focused products and services.”

Annual report 2025A · The company itself

“Growth in global revenue reflected increases in both MA and MIS, both in the U.S. and internationally.”

Annual report 2025A · The company itself

“Purchase Obligations Purchase obligations generally include multi-year agreements with vendors to purchase goods or services and mainly include data center/cloud hosting fees and fees for information technology licensing and maintenance. As of December 31, 2025, these purchase obligations totaled approximately $650 million, of which approximately 60% is expected to be paid in the next twelve months and another approximate 40% expected to be paid over the next two subsequent years, with the remainder to be paid thereafter.”

Annual report 2025A · The company itself

“Transaction revenue increased $144 million compared to the prior year, which primarily reflected: –higher issuance activity for investment-grade bonds, which reflected continued tight credit spreads and investor demand for higher quality credits, and includes the impact of several jumbo transactions in the technology sector; and –higher issuance activity for high-yield bonds as issuers took advantage of favorable conditions, including tight spreads and lower interest rates, primarily to refinance debt.”

Annual report 2025A · The company itself

“Moody’s conducts operations in various countries outside the U.S. and derives a significant portion of its revenue from foreign sources. Changes in the economic condition of the various foreign economies in which the Company operates have an impact on the Company’s business.”

Annual report 2025A · The company itself

“Furthermore, MIS incorporates climate and other sustainability-related risks in its rating process, which also could cause reputational risk or could lead to regulatory action or litigation.”

Annual report 2025A · The company itself

“These factors include increases in or uncertainty around interest rates (as well as related monetary policy by governments in the response to factors such as inflation, inflationary pressures, increases or volatility in mortgage rates, widening credit spreads, regulatory and political developments (including evolving government policies in the U.S. and abroad, the enactment of the OBBBA, and geopolitical uncertainty in various jurisdictions where Moody's operates), difficult economic conditions, growth in the use of alternative sources of credit, and defaults by significant issuers.”

Annual report 2025A · The company itself

“Transaction revenue increased $144 million compared to the prior year, which primarily reflected: –higher issuance activity for investment-grade bonds, which reflected continued tight credit spreads and investor demand for higher quality credits, and includes the impact of several jumbo transactions in the technology sector; and –higher issuance activity for high-yield bonds as issuers took advantage of favorable conditions, including tight spreads and lower interest rates, primarily to refinance debt.”

Annual report 2025A · The company itself

“Table of Contents Market Risk FX risk: Moody’s maintains a presence in more than 40 countries.”

Annual report 2025A · The company itself

“DS: Global Revenue ⇑ $176 million U.S. Revenue ⇑ $104 million Non-U.S. Revenue ⇑ $72 million Global DS revenue for the years ended December 31, 2025 and 2024 was comprised as follows: Global DS revenue increased 12% driven by growth in both the U.S.”

Annual report 2025A · The company itself

“Table of Contents Market Risk FX risk: Moody’s maintains a presence in more than 40 countries.”

Annual report 2025A · The company itself

“Any significant failure, compromise, cyber-breach, interruption or a significant slowdown of operations of the Company’s infrastructure, whether due to human error, capacity constraints, hardware failure or defect, weather (including climate-related risks), natural disasters, fire, power loss, telecommunication failures, break-ins, sabotage, intentional acts of vandalism, acts of terrorism, political unrest, pandemic, war or otherwise, may impair the Company’s ability to deliver its products and services.”

Annual report 2025A · The company itself

“Table of Contents Market Risk FX risk: Moody’s maintains a presence in more than 40 countries.”

Annual report 2025A · The company itself