Marsh McLennan

“The consulting business faces competition from global, regional and local firms, including independent consulting, broking and outsourcing firms affiliated with accounting, technology and financial services and new entrants utilizing generative AI.”

Annual report 2025A · The company itself

“In particular, the advance of AI and large language models has given rise to additional vulnerabilities and potential entry points for cyber threats. With generative AI, threat actors may have additional tools to automate breaches or persistent attacks, evade detection, or generate sophisticated phishing emails or other forms of digital impersonation, doing so quickly and without requiring deep technical understanding of potential exploits. Attackers may develop AI agents to fully automate the attack cycle, which could discover new and unexploited applications and dynamically create ways to exploit these weaknesses faster than security tools can adapt to and detect these new attack methods.”

Annual report 2025A · The company itself

“These investments may be costly and require significant capital expenditures, may not be profitable or may be less profitable than what we have experienced historically. In addition, investments in technology systems may not deliver the benefits or perform as expected, or may be replaced or become obsolete more quickly than expected, which could result in operational difficulties or additional costs.”

Annual report 2025A · The company itself

“In addition, to remain competitive in many of our business areas, we must anticipate and respond effectively to the threat of digital disruption and other technological change such as generative AI. The threat comes from traditional players, such as insurers, through disintermediation as well as from new entrants, such as technology companies, "Insurtech" start-up companies and others.”

Annual report 2025A · The company itself

“In the past few years, there has been a substantial increase in private equity investments into these Insurtech companies. These players are focused on using technology and innovation, including AI, digital platforms, data analytics, robotics and blockchain, to simplify and improve the client experience, increase efficiencies, alter business models and effect other potentially disruptive changes in the industries in which we operate.”

Annual report 2025A · The company itself

“These risks may include operational disruptions or failures, reputational harm, enhanced governmental or regulatory scrutiny, litigation or ethical concerns.”

Annual report 2025A · The company itself

“The models underlying AI tools may be incorrectly or inadequately designed or implemented and trained on, or otherwise use, data or algorithms that are (and the output generated by such AI tools also may be) biased, unethical, discriminatory, incomplete, inaccurate, misleading or poor-quality, any of which may not be easily detectable.”

Annual report 2025A · The company itself

“If any of our employees, contractors, consultants, vendors or service providers use any third-party AI powered software in connection with our business or the services they provide to us, it may lead to the inadvertent disclosure or incorporation of our confidential information into publicly available training sets, which may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or confidential information, harming our competitive position and business.”

Annual report 2025A · The company itself

“Some of our competitors also may be able to invest more significant capital in technology and digital solutions.”

Annual report 2025A · The company itself

“Our business performance and growth plans could be negatively affected if we are not able to develop and implement improvements in technology or respond effectively to the threat of digital disruption and other technological change such as AI. We depend in large part on our technology systems for conducting business, as well as for providing the data and analytics we use to manage our business. As a result, our business success is dependent on maintaining the effectiveness of existing technology systems and on continuing to develop and enhance technology systems that support our business processes and strategic initiatives in a cost and resource efficient manner, particularly as our business processes become more digital.”

Annual report 2025A · The company itself

“We have a number of strategic initiatives involving investments in, or partnerships with, technology companies as part of our growth strategy, as well as investments in technology, including generative AI, and infrastructure to support our own systems.”

Annual report 2025A · The company itself

“We are actively investing in generative AI tools. While our internal generative AI tool, LenAI, was designed to meet our standards for data security and to address and mitigate the risks associated with this new technology, our use of generative AI in certain products, services and operations may present risks and challenges that remain uncertain due to the relative novelty of this technology.”

Annual report 2025A · The company itself

“In the third quarter of 2025, the Company launched a three-year program, Thrive (the "Program"), which focuses on brand strategy, delivering greater value to clients, accelerating growth and improving efficiency. The Company also announced the formation of Business Client Services ("BCS"), to accelerate innovation and centralize investments in operational excellence, data, artificial intelligence and other analytics.”

Annual report 2025A · The company itself

“Oliver Wyman includes the following specializations: Actuarial, AI Transformation, Climate and Sustainability, Customer Innovation and Growth, Finance, Risk and Restructuring, Mergers and Acquisitions and Performance Transformation.”

Annual report 2025A · The company itself

“Competition is based on service sophistication, range, quality, and cost. Attracting and retaining qualified colleagues is also highly competitive and competition for talent continues to intensify.”

Annual report 2025A · The company itself

“Our policies, employee training (including phishing prevention training), procedures and technical safeguards may also be insufficient to prevent, detect or remediate improper access to confidential, personal or proprietary information. In addition, the competition for talent in the data privacy and cybersecurity space is intense, and we may also be unable to hire, develop or retain suitable talent capable of adequately detecting, mitigating or remediating these risks.”

Annual report 2025A · The company itself

“Competitive Risks The loss of members of our senior management team or other key colleagues, or if we are unsuccessful in our efforts to attract, retain and develop talent, could have a material adverse effect on our business. We rely upon the contributions of our senior management team to establish and implement our business strategy and to manage the future growth of our business.”

Annual report 2025A · The company itself

“We may be unable to retain them, particularly if we do not offer employment terms that are competitive with the rest of the labor market. The loss of any of the senior management team could limit our ability to successfully execute our business strategy or adversely affect our ability to retain existing and attract new clients.”

Annual report 2025A · The company itself

“Across all of our businesses, our colleagues are critical to developing and retaining client relationships as well as performing the services on which our revenues are earned. It is therefore important for us to attract, incentivize and retain significant revenue-producing employees and the key managerial and other professionals who support them.”

Annual report 2025A · The company itself

“We face numerous challenges in this regard, including the intense competition for talent, which has accelerated in recent years. Such challenges include the increased mobility of colleagues in light of more flexible working models, market dislocation resulting from proposed and actual combinations in the industry, raids by competitors, and fostering an inclusive workplace.”

Annual report 2025A · The company itself

“In some cases, competitors have used increasingly aggressive tactics to recruit talent across the industry, including orchestrated team lifts and the theft or misuse of confidential information. We have pursued, and continue to pursue, litigation and other remedies in response to such conduct.”

Annual report 2025A · The company itself

“Losing colleagues who manage or support substantial client relationships or possess substantial experience or expertise could adversely affect our ability to secure and complete client engagements, which could adversely affect our results of operations. If a key employee were to join an existing competitor or form a competing company, some of our clients could choose to use the services of a competitor instead of our services.”

Annual report 2025A · The company itself

“Our ability to compete successfully depends on a variety of factors, including the quality and expertise of our colleagues, our geographic reach, the sophistication and quality of our services, our pricing relative to competitors, our clients’ ability to self-insure or use internal resources instead of consultants, and our ability to respond to changes in client demand and industry conditions.”

Annual report 2025A · The company itself

“The profitability of our Consulting segment may decline if we are unable to achieve or maintain adequate utilization and pricing rates for our consultants. The profitability of our Consulting businesses depends in part on ensuring that our consultants maintain adequate utilization rates (i.e., the percentage of our consultants' working hours devoted to billable activities).”

Annual report 2025A · The company itself

“Mercer is a provider in delivering advice, solutions and products that help organizations meet the health, wealth and career needs of a changing workforce.”

Annual report 2025A · The company itself

“The potential for changes in premium rates is significant, due to the normal cycles of pricing in the commercial insurance and reinsurance markets. For example, the property and casualty insurance market has seen softer pricing recently, which may continue to impact profitability.”

Annual report 2025A · The company itself

“Revenues can be affected by premium rate levels in the insurance and reinsurance markets, the amount of risk retained by insurance and reinsurance clients, and by the value of the risks that have been insured since commission-based compensation is frequently related to the premiums paid by insureds and reinsureds.”

Annual report 2025A · The company itself

“In Risk and Insurance Services, underlying revenue growth in 2025 was driven by higher new business and renewal revenue at Marsh Risk and Guy Carpenter, partially offset by declining insurance and reinsurance premium rates.”

Annual report 2025A · The company itself

“This other compensation includes, among other things, payments for consulting and analytics services provided to insurers; compensation for administrative and other services (including fees for underwriting services and services provided to or on behalf of insurers relating to the administration and management of quota shares, panels and other facilities in which insurers participate), and contingent commissions, which are paid by insurers based on factors such as volume or profitability of Marsh Risk's placements, primarily driven by Marsh McLennan Agency ("MMA") and parts of Marsh Risk's international operations.”

Annual report 2025A · The company itself

“In addition, our liability insurance, which includes cyber insurance, may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related data and system incidents. Further, we cannot be sure that our existing coverage will continue to be available on acceptable terms or at all or that our insurers will not deny coverage as to any future claim.”

Annual report 2025A · The company itself

“A significant portion of our Risk and Insurance Services revenue consists of commissions paid to us out of the premiums that insurers and reinsurers charge our clients for coverage. We do not determine the insurance premiums on which our commissions are generally based. Our revenues and profitability are subject to change to the extent that premium rates fluctuate or trend in a particular direction.”

Annual report 2025A · The company itself

“The Company conducts business through two segments: •Risk and Insurance Services: risk management activities and insurance/reinsurance broking and services, conducted through Marsh Risk and Guy Carpenter. •Consulting: health, wealth and career advice, solutions and products, and specialized management, strategic, economic and brand consulting services conducted through Mercer and Marsh Management Consulting.”

Annual report 2025A · The company itself

“The process of integrating the information systems of any businesses we acquire is complex and exposes us to additional risk. For instance, we may not adequately identify weaknesses and vulnerabilities in an acquired entity’s information systems, either before or after the acquisition, which could affect the value we are able to derive from the acquisition, expose us to unexpected liabilities or make our own systems more vulnerable to a cyberattack.”

Annual report 2025A · The company itself

“In the past few years, there has been a substantial increase in private equity investments into these Insurtech companies. These players are focused on using technology and innovation, including AI, digital platforms, data analytics, robotics and blockchain, to simplify and improve the client experience, increase efficiencies, alter business models and effect other potentially disruptive changes in the industries in which we operate.”

Annual report 2025A · The company itself

“We face significant competitive pressures in each of our businesses, including from disintermediation, as our competitive landscape continues to evolve. As a global professional services firm, the Company faces competition in each of its businesses, and the competitive landscape continues to change and evolve.”

Annual report 2025A · The company itself

“In recent years, private equity sponsors have invested tens of billions of dollars into the insurance brokerage sector, transforming existing players and creating new ones to compete with large brokers.”

Annual report 2025A · The company itself

“We have a history of making acquisitions and investments, including a total of 102 in the period from 2021 to 2025, including our acquisitions of McGriff Insurance Services, LLC ("McGriff") and Gerolamo Holding S.À.R.L. ("Cardano"). We may not be able to successfully integrate the businesses that we acquire into our own business, or achieve any expected cost savings or synergies from the integration of such businesses, including McGriff and Cardano.”

Annual report 2025A · The company itself

“The Company completed the acquisition of McGriff, an affiliate of TIH Insurance Holdings (the "McGriff Transaction") in November 2024 for $7.75 billion in cash consideration, subject to certain customary adjustments. McGriff is an insurance broking and risk management services provider in the U.S.”

Annual report 2025A · The company itself

“In addition, to remain competitive in many of our business areas, we must anticipate and respond effectively to the threat of digital disruption and other technological change such as generative AI. The threat comes from traditional players, such as insurers, through disintermediation as well as from new entrants, such as technology companies, "Insurtech" start-up companies and others.”

Annual report 2025A · The company itself

“In the third quarter of 2025, the Company launched a three-year program, Thrive (the "Program"), which focuses on brand strategy, delivering greater value to clients, accelerating growth and improving efficiency. The Company also announced the formation of Business Client Services ("BCS"), to accelerate innovation and centralize investments in operational excellence, data, artificial intelligence and other analytics.”

Annual report 2025A · The company itself

“The Company conducts business through two segments: •Risk and Insurance Services: risk management activities and insurance/reinsurance broking and services, conducted through Marsh Risk and Guy Carpenter. •Consulting: health, wealth and career advice, solutions and products, and specialized management, strategic, economic and brand consulting services conducted through Mercer and Marsh Management Consulting.”

Annual report 2025A · The company itself

“Within the U.S. and Canada, Marsh Risk advises on health benefits brokerage and consulting services through MMA.”

Annual report 2025A · The company itself

“Mercer operates in the following areas: •Health: assisting employers in managing employee health programs, compliance and outsourcing benefits.”

Annual report 2025A · The company itself

“Mercer, Marsh Management Consulting and MMA help public and private sector employers design and manage employee health and welfare programs. Their services include plan design, brokering of insurance programs, administration and other consulting, actuarial and specialty services.”

Annual report 2025A · The company itself

“Mercer, principally through its health line of business, also earns revenue in the form of commissions received from insurance companies for the placement of group (and occasionally individual) insurance contracts, primarily health, life and accident coverages.”

Annual report 2025A · The company itself

“Mercer's revenue increased $447 million, or 8%, to $6.2 billion in 2025, compared to $5.7 billion in 2024.”

Annual report 2025A · The company itself

“Health reflected growth across all regions.”

Annual report 2025A · The company itself

“Some of our competitors also may be able to invest more significant capital in technology and digital solutions.”

Annual report 2025A · The company itself

“Our business performance and growth plans could be negatively affected if we are not able to develop and implement improvements in technology or respond effectively to the threat of digital disruption and other technological change such as AI. We depend in large part on our technology systems for conducting business, as well as for providing the data and analytics we use to manage our business. As a result, our business success is dependent on maintaining the effectiveness of existing technology systems and on continuing to develop and enhance technology systems that support our business processes and strategic initiatives in a cost and resource efficient manner, particularly as our business processes become more digital.”

Annual report 2025A · The company itself

“In the third quarter of 2025, the Company launched a three-year program, Thrive (the "Program"), which focuses on brand strategy, delivering greater value to clients, accelerating growth and improving efficiency. The Company also announced the formation of Business Client Services ("BCS"), to accelerate innovation and centralize investments in operational excellence, data, artificial intelligence and other analytics.”

Annual report 2025A · The company itself

“This segment includes: ◦Victor Insurance Managers (Victor) serves as underwriting managers of professional liability, catastrophe and other specialty insurance programs worldwide. ◦Affinity focuses on insurance programs sold to insureds or vendors through a corporate sponsor using an affinity distribution model.”

Annual report 2025A · The company itself

“◦High net-worth individuals and family offices are served by MMA in the US and other Marsh personal lines businesses globally.”

Annual report 2025A · The company itself

“The Company conducts business through two segments: •Risk and Insurance Services: risk management activities and insurance/reinsurance broking and services, conducted through Marsh Risk and Guy Carpenter. •Consulting: health, wealth and career advice, solutions and products, and specialized management, strategic, economic and brand consulting services conducted through Mercer and Marsh Management Consulting.”

Annual report 2025A · The company itself

“Marsh Risk is an insurance broker and risk advisor, offering risk management, insurance broking, insurance program management, risk consulting, analytical modeling and alternative risk financing services to a wide range of businesses, government entities, professional service organizations and individuals in over 130 countries.”

Annual report 2025A · The company itself

“Marsh Risk is an insurance broker and risk advisor, offering risk management, insurance broking, insurance program management, risk consulting, analytical modeling and alternative risk financing services to a wide range of businesses, government entities, professional service organizations and individuals in over 130 countries.”

Annual report 2025A · The company itself

“This segment includes: ◦Victor Insurance Managers (Victor) serves as underwriting managers of professional liability, catastrophe and other specialty insurance programs worldwide. ◦Affinity focuses on insurance programs sold to insureds or vendors through a corporate sponsor using an affinity distribution model.”

Annual report 2025A · The company itself

“•Corporate serves middle-market clients globally and is also serviced through Marsh McLennan Agency (MMA). ◦Marsh McLennan Agency (MMA) provides business insurance, employee health and benefits, retirement and wealth management and private client insurance solutions to individuals and mid-market organizations. MMA advises on insurance program structure and market dynamics, along with industry expertise and transactional capability.”

Annual report 2025A · The company itself

“Our businesses provide numerous professional services, including the placement of insurance and the provision of consulting, investment advisory, investment management and actuarial services to clients around the world. As a result, the Company and its subsidiaries are subject to a significant number of errors and omissions, breach of fiduciary duty, breach of contract and similar claims, which we refer to collectively as "E&O claims."”

Annual report 2025A · The company itself

“Our information technology systems and information security control systems, and those of our numerous third-party providers, as well as the control systems of critical infrastructure they rely on, such as power grids, and undersea cables, are potentially vulnerable to unauthorized access, damage or interruption from a variety of external threats, including software bugs, physical attack, cyberattacks, computer viruses and other malware, malicious or destructive code, ransomware, social engineering attacks (including phishing, business e-mail compromise and digital or telephonic impersonation), hacking theft, denial-of-service attacks and other types of data and systems-related modes of attack. The techniques used to achieve such unauthorized access, damage or interruption change frequently and new techniques may not be identified until they are launched against a target, and we may be unable to anticipate these techniques or implement adequate preventative or remedial measures, resulting in potential data loss, data unavailability, data corruption or other damage to information technology systems.”

Annual report 2025A · The company itself

“In addition, remote and hybrid work arrangements have increased the risk of phishing and other cybersecurity attacks, unauthorized dissemination of personal, confidential, proprietary or sensitive data, and unauthorized access to company computing assets.”

Annual report 2025A · The company itself

“Our systems are also subject to compromise from internal threats such as fraud, mistakes, misconduct or other improper action by employees, vendors and other third parties with otherwise legitimate access to our systems. Moreover, we face the ongoing challenge of managing access controls in a complex environment. The latency of a compromise is often measured in months but could be years, and we may not be able to detect a compromise in a timely manner, and even if detected, there can be no assurance that we can mitigate or remediate such compromise in an adequate or timely manner.”

Annual report 2025A · The company itself

“Cyberattacks are increasing in frequency and evolving in nature. We are at risk of attack by a variety of adversaries, including nation states, state-sponsored organizations, opportunistic attacks, and organized crime and hackers, through use of increasingly sophisticated methods of attack, including the deployment of AI to find and exploit vulnerabilities, "deep fakes", long-term, persistent attacks (referred to as advanced persistent threats) and the use of the IT supply chain to introduce malware through software updates or compromised suppliers accounts or hardware.”

Annual report 2025A · The company itself

“In particular, the advance of AI and large language models has given rise to additional vulnerabilities and potential entry points for cyber threats. With generative AI, threat actors may have additional tools to automate breaches or persistent attacks, evade detection, or generate sophisticated phishing emails or other forms of digital impersonation, doing so quickly and without requiring deep technical understanding of potential exploits. Attackers may develop AI agents to fully automate the attack cycle, which could discover new and unexploited applications and dynamically create ways to exploit these weaknesses faster than security tools can adapt to and detect these new attack methods.”

Annual report 2025A · The company itself

“Further, we are at increased risk of a cyberattack during periods of heightened geopolitical conflict, such as the war in Ukraine and the conflict throughout the Middle East, as diplomatic events and economic policies may trigger espionage or retaliatory cyber incidents. Additionally, nation states may deploy threat actors masquerading as potential candidates for hire at target companies to perform corporate espionage or execute internal cyber threat activities.”

Annual report 2025A · The company itself

“As the breadth and complexity of the technologies we use and the software and platforms we develop continue to grow, including as a result of the use of mobile devices, cloud services, "open source" software, social media tools and the increased reliance on devices connected to the Internet (known as the "Internet of Things"), the potential risk of security breaches and cyber-attacks also increases. Despite ongoing efforts to improve our ability to protect data from compromise, we may not be able to protect all of our data across our diverse systems.”

Annual report 2025A · The company itself

“Our policies, employee training (including phishing prevention training), procedures and technical safeguards may also be insufficient to prevent, detect or remediate improper access to confidential, personal or proprietary information. In addition, the competition for talent in the data privacy and cybersecurity space is intense, and we may also be unable to hire, develop or retain suitable talent capable of adequately detecting, mitigating or remediating these risks.”

Annual report 2025A · The company itself

“In addition, managing and integrating multiple cloud environments with our internal systems increases the risk of configuration errors or vulnerabilities that could be exploited. Should an attacker gain access to our network using compromised credentials of an authorized user, we are at risk that the attacker might successfully leverage that access to compromise additional systems and data.”

Annual report 2025A · The company itself

“Certain measures that could increase the security of our systems, such as data encryption (including encryption of data at rest), heightened monitoring and logging, scanning for source code errors or deployment of multi-factor authentication, take significant time and resources to deploy broadly, and such measures may not be deployed in a timely manner or be effective against an attack. The inability to implement, maintain and upgrade adequate safeguards could have a material adverse effect on our business.”

Annual report 2025A · The company itself

“Our information systems must be continually updated, patched, and upgraded to protect against known vulnerabilities. The volume of new software and infrastructure vulnerabilities continues to increase markedly, as has the criticality of patches and other mitigation and remedial measures. In addition to mitigating and remediating newly identified vulnerabilities, previously identified vulnerabilities must also be continuously addressed.”

Annual report 2025A · The company itself

“Due to the large number and age of the systems and platforms that we operate, the increased frequency at which vendors are issuing security patches to their products, the need to test patches and, in some cases, coordinate with clients and vendors, before they can be deployed, we perpetually face the substantial risk that we cannot deploy patches in a timely manner.”

Annual report 2025A · The company itself

“We are at risk of a cyberattack involving a vendor or other third parties, which could result in a breakdown of such third party’s data protection processes or the cyberattackers gaining access to our infrastructure or data through a supply chain attack. Highly publicized data security breaches, such as the October 2025 Salesloft/Drift attack, may embolden malicious actors to target the IT supply chain and providers of business software.”

Annual report 2025A · The company itself

“Our systems’ availability could be impacted by poor or improperly tested software code and updates deployed to our environment by a third-party through normal and expected processes, which occurred with the CrowdStrike event in July 2024. Our reliance on third-party software components and open-source libraries as part of our software supply chain exposes us to significant cybersecurity risks, including malicious code insertion, vulnerabilities and compromised updates. Incidents such as the Shai Hulud NPM Worm, which spread through widely used JavaScript packages by exploiting trust in open-source dependencies, illustrate how supply chain attacks can lead to unauthorized access, data breaches, or disruption of critical applications, sometimes evading traditional security controls.”

Annual report 2025A · The company itself

“The complexity and scale of modern software supply chains make it difficult to fully vet and monitor all dependencies, increasing the likelihood that similar incidents could affect our systems and operations and result in business disruption, reputational damage and regulatory or legal consequences. Our control over and ability to monitor the cybersecurity practices of our third-party and fourth-party vendors and service providers, and other third parties with whom we do business, remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the development processes or cybersecurity infrastructure or IT controls owned or controlled by such third parties.”

Annual report 2025A · The company itself

“The process of integrating the information systems of any businesses we acquire is complex and exposes us to additional risk. For instance, we may not adequately identify weaknesses and vulnerabilities in an acquired entity’s information systems, either before or after the acquisition, which could affect the value we are able to derive from the acquisition, expose us to unexpected liabilities or make our own systems more vulnerable to a cyberattack.”

Annual report 2025A · The company itself

“We have experienced data incidents and cybersecurity breaches, such as malware incursions (including computer viruses and ransomware), vulnerabilities in the software on which we rely, users exceeding their data access authorization, employee misconduct and incidents resulting from human error, such as emails sent to the wrong recipient, loss of portable and other data storage devices or misconfiguration of software or hardware resulting in inadvertent exposure of personal, sensitive, confidential or proprietary information or reduction of system availability. Like many companies, we are also subject to social engineering attacks such as WhatsApp scams and regular phishing email campaigns directed at our employees that can result in malware infections, fraud and data loss.”

Annual report 2025A · The company itself

“In the event of a cyberattack, we might have to take our systems offline, which could interfere with services to our clients or damage our reputation. A cyberattack may also result in systems or data being encrypted or otherwise unavailable due to ransomware or other malware.”

Annual report 2025A · The company itself

“Privacy or AI-related legal or regulatory violations, including unauthorized use disclosure or transfer of sensitive, personal or confidential client or Company data, whether through systems failure, employee negligence, fraud or misappropriation, by the Company, our vendors or other parties with whom we do business (if they fail to meet the standards we impose) could damage our reputation and subject us to significant litigation, monetary damages, regulatory enforcement actions, fines and criminal prosecution in one or more jurisdictions where we operate.”

Annual report 2025A · The company itself

“If any of our employees, contractors, consultants, vendors or service providers use any third-party AI powered software in connection with our business or the services they provide to us, it may lead to the inadvertent disclosure or incorporation of our confidential information into publicly available training sets, which may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or confidential information, harming our competitive position and business.”

Annual report 2025A · The company itself

“These third parties also face their own technology, operating, business and economic risks, and any significant failures by them, including the improper use or disclosure of our confidential client, employee, or Company information or failure to comply with applicable law, could cause harm to our reputation or otherwise expose us to liability.”

Annual report 2025A · The company itself

“Our operations depend in particular upon our ability to protect our technology infrastructure against damage. If a business continuity event occurs, we could lose client or Company data or experience interruptions to our operations or delivery of services to our clients, which could have a material adverse effect.”

Annual report 2025A · The company itself

“A cyberattack or other business continuity event affecting us or a key vendor or other third party could result in a significant and extended disruption in the functioning of our information technology systems or operations or our ability to recover data, requiring us to incur significant expense to address and remediate or otherwise resolve such issues.”

Annual report 2025A · The company itself

“Our activities are subject to extensive regulation under the laws of the U.S. and its various states, the United Kingdom, the European Union and its member states, Australia and the other jurisdictions in which we operate.”

Annual report 2025A · The company itself

“The U.S. and foreign laws and regulations that apply to our operations are complex and may change rapidly, and our efforts to comply and keep up with them require significant resources. In some cases, these laws and regulations may decrease the need for our services, increase our costs, negatively impact our revenues or impose operational limitations on our business, including on the products and services we may offer or on the amount or type of compensation we may collect.”

Annual report 2025A · The company itself

“At the international level, we are subject to an increasing number of comprehensive privacy laws including, for example, those passed in Indonesia, the Kingdom of Saudi Arabia, India and Australia. Many of these laws, which are modeled after the GDPR, have greatly increased the jurisdictional reach of privacy laws and added a broad array of requirements for handling personal data, such as the public disclosure of data breaches, data protection impact assessments, data portability and the appointment of data protection officers in some cases.”

Annual report 2025A · The company itself

“Given the breadth and depth of changes in data protection obligations, including classifying data and committing to a range of administrative, technical and physical controls to protect data and enable data transfers across borders, our compliance with such laws will continue to require time, resources and review of the technology and systems we use. Despite a proliferation of regulatory guidance papers, there remains uncertainty in key areas related to these laws, and that uncertainty could result in potential liability for our failure to meet our obligations, including the possibility of significant fines some of which can amount to 4% or more of our global revenue.”

Annual report 2025A · The company itself

“Some of the global laws enacted in recent years, including those in China and the Kingdom of Saudi Arabia, also include data localization elements that will require that certain personal data stay within their borders. These requirements are complex and our efforts to comply with them require significant resources, and we cannot guarantee we are or will be in full compliance with such laws at all times.”

Annual report 2025A · The company itself

“At the U.S. federal level, we are subject to various privacy laws and regulations, including those promulgated under the authority of the U.S. Federal Trade Commission, which has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including with respect to data privacy and cybersecurity.”

Annual report 2025A · The company itself

“At the U.S. state level, we are subject to laws and regulations related to privacy, such as the CCPA, which introduced concepts such as transparency and rights like access and deletion, that have been enacted by over twenty states with more such laws expected to pass in future years. These laws establish a privacy 16 framework for covered businesses, including various obligations imposed on them related to the personal information they collect and use, and offer various rights for their state residents. Some of these laws provide a private right of action for violations and in some cases damages may be significant.”

Annual report 2025A · The company itself

“Many of these laws diverge from the CCPA and create their own set of rules, and this proliferation of inconsistent state level privacy laws will add operational complexity and increased risk of noncompliance or violations which could trigger enforcement action or litigation.”

Annual report 2025A · The company itself

“In addition to data protection and data privacy laws, foreign countries and U.S. states are enacting cybersecurity laws and regulations. For example, in November 2025, the final amendments made by the New York State Department of Financial Services (NYDFS) to its previous cybersecurity regulations came into effect, which imposed obligations on companies such as Marsh, including for example, requiring companies to provide evidence of how they are implementing their data retention, data governance and data classifications policies and procedures.”

Annual report 2025A · The company itself

“A number of states have also adopted laws covering data collected by insurance licensees that include security and breach notification requirements. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may divert resources from other initiatives and projects and could restrict the way services involving data are offered, all of which may adversely affect our results of operations.”

Annual report 2025A · The company itself

“Many statutory requirements, both in the U.S. and abroad, include obligations for companies to notify individuals of security breaches involving certain personal information, which could result from breaches experienced by us or our vendors. For example, laws in all 50 U.S. states generally require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a breach.”

Annual report 2025A · The company itself

“Many of these laws and rules also include strict notification requirements for organizations related to confirmed or suspected breaches. This narrow notification window is often too short to fully validate the facts, and there is an increased risk of reporting a false alarm or immaterial breach, which may lead to reputational damage despite there not being an actual data breach.”

Annual report 2025A · The company itself

“We post public privacy notices and other documentation regarding our collection, use, disclosure, cross-border transfer, retention, and other processing of personal information. Although we endeavor to comply with our published notices and other documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees, contractors, service providers, vendors or other third parties with whom we do business fail to comply with our published notices and documentation. Such failures could carry similar consequences or subject us to potential enforcement actions or investigations if they are found to be deceptive, unfair or misrepresentative of our actual practices.”

Annual report 2025A · The company itself

“Furthermore, U.S. and global regulators continue to focus their enforcement actions and investigations on website-related practices, including the proper use of "cookies", pixels and other online trackers, as well as the use of online session recording tools. As we use such tools in our website environment, we are at risk of being impacted by such activity, including fines and cease and desist orders.”

Annual report 2025A · The company itself

“Privacy or AI-related legal or regulatory violations, including unauthorized use disclosure or transfer of sensitive, personal or confidential client or Company data, whether through systems failure, employee negligence, fraud or misappropriation, by the Company, our vendors or other parties with whom we do business (if they fail to meet the standards we impose) could damage our reputation and subject us to significant litigation, monetary damages, regulatory enforcement actions, fines and criminal prosecution in one or more jurisdictions where we operate.”

Annual report 2025A · The company itself

“Given the complexity of operationalizing the various privacy, data security, data protection and AI laws and regulations mentioned above, the complexity of proposed compliance frameworks and the continued lack of certainty on how to implement their requirements, we and our clients are at risk of enforcement actions taken by applicable regulators or authorities around the world or litigation from third parties, including consumer advocacy groups acting on behalf of data subjects. Additionally, due to the ongoing fast pace of legislative and regulatory activity, we may not be able to respond quickly or effectively to new legislative, regulatory and other developments.”

Annual report 2025A · The company itself

“These changes may also impair our ability to offer our existing or planned products and services and increase our cost of doing business in various countries.”

Annual report 2025A · The company itself

“Moreover, if we acquire a business operating in regions or industries subject to heightened regulatory scrutiny, we may face significant costs or risks in bringing their operations into compliance with applicable laws and our internal policies.”

Annual report 2025A · The company itself

“Adverse legal developments and future regulations concerning how intermediaries are compensated by insurers or clients, as well as allegations of anti-competitive behavior or conflicts of interest, could have a material adverse effect on our business, results of operations and financial condition. The ways in which insurance intermediaries are compensated receive scrutiny from regulators in part because of the potential for anti-competitive behavior and conflicts of interest.”

Annual report 2025A · The company itself

“The healthcare industry, inclusive of health insurance, is regulated by federal, state and local governments in the U.S., and by regulators and governments in other countries where we do business. The laws and rules governing the healthcare industry and interpretations of those laws and rules are subject to frequent and often unpredictable change. For example, legislation or regulatory action that has the impact of disincentivizing U.S. companies from offering employer-sponsored health insurance could ultimately reduce the revenue we receive when consulting on and broking these policies on behalf of our corporate clients.”

Annual report 2025A · The company itself

“Legislation seeking to regulate pharmacy benefit management services introduced or enacted at the federal or state level could impact the compensation structure and how much we are paid where we advise clients on prescription drug coverage.”

Annual report 2025A · The company itself

“Mercer’s Wealth business is subject to a number of risks, including risks related to public and private capital market fluctuations, third-party asset managers and custodians, operations and technology risks, trading and execution risks, conflicts of interest, sustainability and greenwashing, asset performance and regulatory compliance, that, if realized, could result in significant damage to our business.”

Annual report 2025A · The company itself

“Mercer’s Investments business is subject to a number of risks, including risks related to litigation (both by clients and by plan participants, particularly when we act in a fiduciary capacity), liquidity and market volatility, an inability to obtain contractual limitations of liability for errors & omissions in certain jurisdictions or parts of our business, third-parties, our operations and technology (including the use of AI), trading and execution errors, conflicts of interest, asset performance and regulatory compliance and scrutiny, which could arise in connection with these offerings.”

Annual report 2025A · The company itself

“Asset classes may perform poorly, or asset managers may underperform their benchmarks, due to poor market performance, a downturn in the global markets, negligence or other reasons, resulting in poor returns or loss of client assets. Changes in the value of equity, debt, currency, real estate, commodities, alternatives or other asset classes, in particular as a result of a downturn in the global markets, could cause the value of assets under management or advisement, and the fees earned by Mercer to decline.”

Annual report 2025A · The company itself

“Revenues for the services provided by our Consulting segment may decline for various reasons, including as a result of changes in economic conditions, the value of equity, debt and other asset classes, our clients’ or an industry's financial condition or government regulation or an accelerated trend away from actively managed investments to passively managed investments.”

Annual report 2025A · The company itself

“In addition, some of Mercer's Investments business generate fees based upon the value of the clients’ assets under management, advisement or administration. Changes in the value of equity, debt, currency, real estate, commodities, alternatives or other asset classes could cause the value of assets under management, advisement or administration, and the fees received by Mercer, to decline. Such changes could also cause clients to withdraw funds from Mercer’s Investments business in favor of other investment service providers.”

Annual report 2025A · The company itself

“Many clients, particularly in the public sector, have sizeable pension deficits and are subject to impact from volatility in the global markets and interest rate fluctuations. A number of Mercer's clients have frozen or curtailed their defined benefit plans and have moved to defined contribution plans resulting in reduced revenue for Mercer's retirement business.”

Annual report 2025A · The company itself

“Revenue for Mercer’s investment management business and certain of Mercer’s defined benefit and contribution administration services consists principally of fees based on assets under management or administration.”

Annual report 2025A · The company itself

“Revenues from investment management services and retirement trust and administrative services are significantly affected by the level of assets under management or administration, which is impacted by securities market performance.”

Annual report 2025A · The company itself

“The Company has significant defined benefit pension obligations to its current and former employees, totaling approximately $11.7 billion, and related plan assets of approximately $13.1 billion, at December 31, 2025 in accordance with U.S.”

Annual report 2025A · The company itself

“Lower interest rates have led to a decline in our fiduciary income.”

Annual report 2025A · The company itself

“The maintenance and growth of our business, including our ability to finance acquisitions, the payment of dividends and our ability to make share repurchases rely on our access to capital, which depends in large part on cash flow generated by our business and the availability of equity and debt financing. Certain of our businesses also rely on financings by the Company to fund the underwriting of their client's debt and equity capital raising transactions. There can be no assurance that our operations will generate sufficient positive cash flow to finance all of our capital needs or that we will be able to obtain equity or debt financing on favorable terms, particularly in an environment of rising interest rates.”

Annual report 2025A · The company itself

“Pension plan assets could decrease as the result of poor future asset performance. In addition, the estimated return on plan assets would likely be impacted by changes in the interest rate environment and other factors, including equity valuations, since these factors reflect the starting point used in the Company’s projection models. For example, a reduction in interest rates may result in a reduction in the estimated return on plan assets.”

Annual report 2025A · The company itself

“Factors affecting defined benefit pension plans and the services we provide relating to those plans could adversely affect Mercer. Mercer currently provides plan sponsors, plan trustees, multi-employer and public entity clients with actuarial, consulting and administration services relating to defined benefit pension plans.”

Annual report 2025A · The company itself

“Many clients, particularly in the public sector, have sizeable pension deficits and are subject to impact from volatility in the global markets and interest rate fluctuations. A number of Mercer's clients have frozen or curtailed their defined benefit plans and have moved to defined contribution plans resulting in reduced revenue for Mercer's retirement business.”

Annual report 2025A · The company itself

“Additionally, a rapid rise in interest rates could result in higher defined benefit pension plan funding levels. In some markets, this could accelerate clients’ desire to conduct a buyout or third-party risk transfer. Such a transaction could result in additional short-term revenue for Mercer to the extent we advise the client on the transaction, but a loss in longer term recurring revenue related to the plan.”

Annual report 2025A · The company itself

“Interest earned on fiduciary funds decreased $94 million to $403 million in 2025, compared to $497 million in 2024, due to lower average interest rates compared to the prior year.”

Annual report 2025A · The company itself

“Interest Expense Interest expense was $960 million in 2025, compared to $700 million in 2024. Interest expense increased $260 million in 2025 due to debt raised to fund the McGriff acquisition.”

Annual report 2025A · The company itself

“The Company has significant defined benefit pension obligations to its current and former employees, totaling approximately $11.7 billion, and related plan assets of approximately $13.1 billion, at December 31, 2025 in accordance with U.S.”

Annual report 2025A · The company itself

“These conditions, including inflationary expense pressure with our clients, may reduce demand for our services or depress pricing for those services, which could have a material adverse effect on our results of operations.”

Annual report 2025A · The company itself

“Macroeconomic or geopolitical conditions, such as a slower economic growth or recession, the war in Ukraine and the conflict throughout the Middle East, inflationary pressures or supply chain challenges, could result in financial difficulties for our clients, which could cause clients to delay payments to us, request modifications to their payment arrangements that could increase our receivables balance or default on their payment obligations to us.”

Annual report 2025A · The company itself

“Results in our Risk and Insurance Services segment may be adversely affected by a general decline in economic activity. Demand for many types of insurance and reinsurance generally rises or falls as economic growth expands or slows. This dynamic affects the level of commissions and fees generated by Marsh Risk and Guy Carpenter. To the extent our clients become adversely affected by declining business conditions, they may choose to limit their purchases of risk services and insurance and reinsurance coverage, for example, by choosing to retain more risk, 26 which would adversely impact our commission revenue and other revenue based on premiums placed and services provided by us.”

Annual report 2025A · The company itself

“Revenues for the services provided by our Consulting segment may decline for various reasons, including as a result of changes in economic conditions, the value of equity, debt and other asset classes, our clients’ or an industry's financial condition or government regulation or an accelerated trend away from actively managed investments to passively managed investments.”

Annual report 2025A · The company itself

“Global economic conditions, including slower GDP growth or recession, inflationary pressure and foreign exchange rate volatility, may negatively impact businesses and financial institutions. Many of our clients, including financial institutions, corporations, government entities and pension plans, have reduced expenses, including amounts spent on consulting services, and used internal resources instead of consultants during difficult economic periods.”

Annual report 2025A · The company itself

“Revenue in the Consulting segment is affected by, among other things, global economic conditions, including changes in clients’ particular industries and markets.”

Annual report 2025A · The company itself

“Geopolitical and macroeconomic conditions, including from multiple major wars and global conflicts, social unrest, tariffs or changes in trade policies, slower GDP growth or recession, fluctuations in foreign exchange rates, lower interest rates, capital markets volatility, inflation and changes in insurance premium rates affect our clients' businesses and the markets they serve.”

Annual report 2025A · The company itself

“Cyberattacks are increasing in frequency and evolving in nature. We are at risk of attack by a variety of adversaries, including nation states, state-sponsored organizations, opportunistic attacks, and organized crime and hackers, through use of increasingly sophisticated methods of attack, including the deployment of AI to find and exploit vulnerabilities, "deep fakes", long-term, persistent attacks (referred to as advanced persistent threats) and the use of the IT supply chain to introduce malware through software updates or compromised suppliers accounts or hardware.”

Annual report 2025A · The company itself

“Further, we are at increased risk of a cyberattack during periods of heightened geopolitical conflict, such as the war in Ukraine and the conflict throughout the Middle East, as diplomatic events and economic policies may trigger espionage or retaliatory cyber incidents. Additionally, nation states may deploy threat actors masquerading as potential candidates for hire at target companies to perform corporate espionage or execute internal cyber threat activities.”

Annual report 2025A · The company itself

“Many of these providers are located outside the U.S., which exposes us to business disruptions and political risks inherent when conducting business outside of the U.S.”

Annual report 2025A · The company itself

“Macroeconomic or geopolitical conditions, such as a slower economic growth or recession, the war in Ukraine and the conflict throughout the Middle East, inflationary pressures or supply chain challenges, could result in financial difficulties for our clients, which could cause clients to delay payments to us, request modifications to their payment arrangements that could increase our receivables balance or default on their payment obligations to us.”

Annual report 2025A · The company itself

“The costs to comply with, or our failure to comply with, U.S. and foreign laws related to privacy, data security and data protection, such as the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act, (CCPA), Australia's CPS 234, as well as emerging AI-related laws such as the EU's AI Act, could adversely affect our financial condition, operating results and our reputation.”

Annual report 2025A · The company itself

“Given the complexity of operationalizing the various privacy, data security, data protection and AI laws and regulations mentioned above, the complexity of proposed compliance frameworks and the continued lack of certainty on how to implement their requirements, we and our clients are at risk of enforcement actions taken by applicable regulators or authorities around the world or litigation from third parties, including consumer advocacy groups acting on behalf of data subjects. Additionally, due to the ongoing fast pace of legislative and regulatory activity, we may not be able to respond quickly or effectively to new legislative, regulatory and other developments.”

Annual report 2025A · The company itself

“While we have implemented certain mitigation measures and governance related to the proliferation of AI tools, these measures may be inadequate or may not satisfy a growing number of legal and regulatory requirements related to AI. Moreover, if we are perceived to exaggerate the effectiveness, safety or ethical design of AI systems, this could lead to regulatory enforcement, litigation or reputational harm.”

Annual report 2025A · The company itself

“Further, despite developments such as the U.S.- E.U. Data Privacy Framework and the U.S.- U.K. Data Bridge, there remains a high level of uncertainty concerning the flow of personal information between the U.S. and EU, between the U.S. and the U.K. and between the U.K. and the EU. This uncertainty may impair our ability to offer our existing and planned products and services or increase our cost of doing business.”

Annual report 2025A · The company itself

“Approximately 51% of our total revenue reported in 2025 was from business outside of the U.S. We are subject to exchange rate movement because we must translate the financial results of our foreign subsidiaries into U.S. dollars and also because some of our subsidiaries receive revenue other than in their functional currencies. Exchange rate movements may change over time, and they could have a material adverse impact on our financial results and cash flows reported in U.S. dollars.”

Annual report 2025A · The company itself

“We rely on a large number of vendors and other third parties to perform key functions of our business operations and to provide services to our clients. These vendors and third parties may act or fail to act in ways that could harm our business. We rely on a large number of vendors and other third parties, and in some cases subcontractors, to provide services, data and information such as technology, information security, funds transfers, business process management, and administration and support functions that are critical to the operations of our business.”

Annual report 2025A · The company itself

“As we do not control many of the actions of these third parties, we are subject to the risk that their decisions or operations may adversely impact us and replacing these service providers could create significant delay in services or operations and additional expense. A failure by the third parties to (i) comply with service level agreements in a high quality and timely manner, particularly during periods of our peak demand for their services, (ii) maintain adequate internal controls that may impact our own financial reporting, or (iii) adequately maintain the confidentiality of any of our data or trade secrets or adequately protect or properly use other intellectual property to which they may have access, could result in economic and reputational harm to us.”

Annual report 2025A · The company itself

“Geopolitical and macroeconomic conditions, including from multiple major wars and global conflicts, social unrest, tariffs or changes in trade policies, slower GDP growth or recession, fluctuations in foreign exchange rates, lower interest rates, capital markets volatility, inflation and changes in insurance premium rates affect our clients' businesses and the markets they serve.”

Annual report 2025A · The company itself

“In addition, the U.S. Department of Justice Bulk Data Transfer Rule recently effected rules restricting the sending of certain data to "countries of concern" and requiring regular compliance monitoring around such transfers.”

Annual report 2025A · The company itself

“In operating our business and providing services and solutions to clients, we collect, use, store, transmit and otherwise process certain electronic information, including personal, confidential, proprietary and sensitive data such as financial records, health care, mergers and acquisitions and personal data of our clients, colleagues and vendors. We rely on the efficient, uninterrupted and secure operation of complex information technology systems and networks to operate our business and securely process, transmit and store electronic information. In the normal course of business, we also share electronic information with our vendors and other third parties, which in some cases is critical to our ability to deliver services to our clients. This electronic information comprises sensitive and confidential data, including information related to financial records, health care, mergers and acquisitions and clients’ personal data.”

Annual report 2025A · The company itself

“Geopolitical and macroeconomic conditions, including from multiple major wars and global conflicts, social unrest, tariffs or changes in trade policies, slower GDP growth or recession, fluctuations in foreign exchange rates, lower interest rates, capital markets volatility, inflation and changes in insurance premium rates affect our clients' businesses and the markets they serve.”

Annual report 2025A · The company itself

“Improper collection, use, disclosure, cross border transfer, retention and other processing of confidential, personal, or proprietary data could result in regulatory scrutiny, legal and financial liability, or harm to our reputation. In operating our business and providing services and solutions to clients, we store and transfer sensitive employee and client data, including personal data, in and across multiple jurisdictions.”

Annual report 2025A · The company itself

“As these reporting requirements and standards evolve, we continue to evaluate and update our public disclosures in these areas, including refining our disclosure of metrics and sustainability goals in accordance with the guidance and our own business responsibility assessments and priorities. These disclosures, metrics and sustainability goals and any failure to accurately report or comply with federal, state or international laws and regulations, or achieve progress on our metrics and sustainability goals on a timely basis, or at all, may result in legal and regulatory proceedings against us and negatively impact our reputation.”

Annual report 2025A · The company itself

“In addition, heightened regulatory scrutiny of environmental and sustainability-related products, funds, investment strategies and advice has increased the risk that we could be perceived as, or accused of, making inaccurate or misleading statements, or that we have otherwise run afoul of regulation. Such perceptions or accusations could damage our reputation, result in litigation or regulatory enforcement actions, and adversely affect our business.”

Annual report 2025A · The company itself

“Organizations that provide information to investors on corporate governance and related matters have also developed ratings processes for evaluating companies on their approach to business responsibility, and unfavorable ratings of our company or our industries may lead to negative investor sentiment and the diversion of investment to other companies or industries, exclusion of our stock from business responsibility-oriented indices or investment funds or harm our relationships with regulators and the communities in which we operate.”

Annual report 2025A · The company itself

“The impact of new laws and regulations, negative public perception, adverse publicity or negative comments in social media could damage our reputation, and be costly to defend, if we do not, or are not perceived to, adequately address these issues. Any harm to our reputation could impact colleague engagement and retention and the willingness of clients and our partners to do business with us.”

Annual report 2025A · The company itself

“Further, a disruption of physical infrastructure could impact our ability to conduct business and service clients. This may include deliberate or unintentional disruption of service to electrical systems, satellite communications, undersea or terrestrial cable systems, Internet services, or other systems our colleagues or third parties rely on us to conduct business in a multitude of jurisdictions across the globe. Disruptions may be the result of weather, natural disaster, war, terrorism, pandemic, or other natural or geopolitical events.”

Annual report 2025A · The company itself

“Certain measures that could increase the security of our systems, such as data encryption (including encryption of data at rest), heightened monitoring and logging, scanning for source code errors or deployment of multi-factor authentication, take significant time and resources to deploy broadly, and such measures may not be deployed in a timely manner or be effective against an attack. The inability to implement, maintain and upgrade adequate safeguards could have a material adverse effect on our business.”

Annual report 2025A · The company itself

“Our increasing reliance on software-as-a-service ("SaaS") cloud solutions and other cloud-based vendors to support critical business operations also exposes us to risks associated with the availability, security, and resilience of these third-party platforms. These arrangements create dependencies on the vendors’ ability to maintain continuous service and protect against outages, disruptions or cyber incidents and on the sufficiency of their security controls and incident response.”

Annual report 2025A · The company itself

“We have numerous vendors and other third parties who receive personal information from us in connection with the services we offer our clients and our employees. We also use hundreds of IT vendors and software providers to maintain and secure our global information systems infrastructure. In addition, we have migrated certain data, and may increasingly migrate data, to the cloud where it is hosted by third-party providers. Some of these vendors and third parties also have direct access to our systems or data.”

Annual report 2025A · The company itself

“Our activities are subject to extensive regulation under the laws of the U.S. and its various states, the United Kingdom, the European Union and its member states, Australia and the other jurisdictions in which we operate.”

Annual report 2025A · The company itself

“In addition, regulation or legislation impacting the workforce may lead to increased uncertainty and competition for talent.”

Annual report 2025A · The company itself

“Demand for many of Mercer's benefits services is affected by government regulation and tax laws, rulings, policies and interpretations, which drive our clients' needs for benefits-related services. Significant changes in government regulations affecting the value, use or delivery of benefits and human resources programs, including changes in regulations relating to health and welfare plans, defined contribution plans or defined benefit plans, may adversely affect the demand for or profitability of Mercer's services.”

Annual report 2025A · The company itself

“For example, fluctuations in interest rates and foreign exchange rates between the U.S. dollar and foreign currencies may adversely affect our results of operations.”

Annual report 2025A · The company itself

“Continued weakening of the U.S. dollar against foreign currencies would further increase the translated U.S. dollar value of the Company’s net investments in its non-U.S. subsidiaries, as well as the translated U.S. dollar value of cash repatriations from those subsidiaries.”

Annual report 2025A · The company itself

“If foreign exchange rates of major currencies (Euro, British Pound, Australian dollar and Canadian dollar) moved 10% in the same direction against the U.S. dollar compared with the foreign exchange rates in 2025, the Company estimates 54 net operating income would increase or decrease by approximately $109 million.”

Annual report 2025A · The company itself

“If our clients reduce their headcounts, they will have fewer employee lives covered under their health plans, which may reduce premiums and the commission or supplemental compensation Mercer may receive.”

Annual report 2025A · The company itself

“Revenue is also affected by competition due to the introduction of new products and services, broad trends in employee demographics, including levels of employment and the effect of government policies and regulations.”

Annual report 2025A · The company itself

“In addition, remote and hybrid work arrangements have increased the risk of phishing and other cybersecurity attacks, unauthorized dissemination of personal, confidential, proprietary or sensitive data, and unauthorized access to company computing assets.”

Annual report 2025A · The company itself

“Such risks have increased significantly due to hybrid and remote work environments.”

Annual report 2025A · The company itself

“In some cases, we also depend on key vendors and partners to provide technology and other support for our strategic initiatives. If these vendors or partners fail to perform their obligations or otherwise cease to work with us, our ability to execute on our strategic initiatives could be adversely affected.”

Annual report 2025A · The company itself

“Revenue in the Consulting segment is affected by, among other things, global economic conditions, including changes in clients’ particular industries and markets.”

Annual report 2025A · The company itself

“In addition, the U.S. Department of Justice Bulk Data Transfer Rule recently effected rules restricting the sending of certain data to "countries of concern" and requiring regular compliance monitoring around such transfers.”

Annual report 2025A · The company itself

“If foreign exchange rates of major currencies (Euro, British Pound, Australian dollar and Canadian dollar) moved 10% in the same direction against the U.S. dollar compared with the foreign exchange rates in 2025, the Company estimates 54 net operating income would increase or decrease by approximately $109 million.”

Annual report 2025A · The company itself

“In 2025, approximately 51% of the Company's total revenue was generated from operations outside the U.S., and over one-half of our employees were located outside the U.S.”

Annual report 2025A · The company itself

“Consolidated Revenue and Expense Revenue – Non-GAAP Revenue and Components of Change The Company advises clients in 130 countries.”

Annual report 2025A · The company itself

“U.S./Canada rose 3% on an underlying basis. Total International produced underlying revenue growth of 5%, reflecting growth of 6% in EMEA, 4% in Asia Pacific, and 2% in Latin America.”

Annual report 2025A · The company itself

“Consolidated Revenue and Expense Revenue – Non-GAAP Revenue and Components of Change The Company advises clients in 130 countries.”

Annual report 2025A · The company itself

“U.S./Canada rose 3% on an underlying basis. Total International produced underlying revenue growth of 5%, reflecting growth of 6% in EMEA, 4% in Asia Pacific, and 2% in Latin America.”

Annual report 2025A · The company itself

“It employs approximately 52,000 colleagues and generated approximately 54% of the Company's total revenue in 2025.”

Annual report 2025A · The company itself

“In 2025, approximately 51% of the Company's total revenue was generated from operations outside the U.S., and over one-half of our employees were located outside the U.S.”

Annual report 2025A · The company itself

“Consolidated Revenue and Expense Revenue – Non-GAAP Revenue and Components of Change The Company advises clients in 130 countries.”

Annual report 2025A · The company itself

“U.S./Canada rose 3% on an underlying basis. Total International produced underlying revenue growth of 5%, reflecting growth of 6% in EMEA, 4% in Asia Pacific, and 2% in Latin America.”

Annual report 2025A · The company itself