Financial regulation

“These laws and regulations continue to evolve, are increasing in complexity and number and increasingly conflict among the various countries in which we operate, which has resulted in greater compliance risk and cost for us. Various privacy laws impose compliance obligations regarding the handling of personal data, including localization of data and the cross-border transfer of data, and significant financial penalties for noncompliance. For example, failure to comply with the GDPR may lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, orders to discontinue certain data processing operations, civil lawsuits, or reputational damage.”

Annual report 2025A · The company itself

“The Organization for Economic Co-operation and Development (“OECD”), a global coalition of member countries, further developed a two-pillar plan to reform international taxation. The plan aims to prevent the proliferation of separate new digital taxes and to ensure a fairer distribution of profits among countries by creating a new global system to tax income based on the location of users, and to impose a floor on tax competition through the introduction of a global minimum tax. Ireland and other countries where we operate have enacted Pillar Two, the OECD’s global minimum tax rate, which applies to us beginning with fiscal year 2025.”

Annual report 2025A · The company itself

“Similarly, we periodically are and in the future could become the target of litigation, investigations, or other proceedings initiated by government authorities or private actors alleging that our activities or positions related to ESG (including inclusion and diversity) are anti-competitive, discriminatory or otherwise unlawful.”

Annual report 2025A · The company itself

“The inherent limitations of internal controls may not prevent or detect all improper or illegal activities. •On January 21, 2025, an executive order was issued requiring U.S. federal contractors to certify that they do not operate any programs promoting diversity, equity and inclusion that violate any applicable federal anti-discrimination laws. Additionally, various U.S federal and state government agencies and departments may initiate legal proceedings asserting our actions or programs violate the U.S False Claims Act, civil rights laws or other similar federal or state orders, laws or regulations. A violation of these or similar federal or state orders, laws or regulations, may expose us to penalties and sanctions discussed above and jeopardize our ability to continue to do work with the U.S. federal government and certain state governments, which may materially adversely affect our future results of operations.”

Annual report 2025A · The company itself

“Our global operations expose us to numerous and sometimes conflicting legal and regulatory requirements, and violation of these regulations could harm our business. We are subject to numerous, changing, and sometimes conflicting, legal regimes on matters as diverse as anticorruption, import/export controls, content requirements, trade restrictions, tariffs, taxation, sanctions, boycotts, immigration, internal and disclosure control obligations, securities regulation, including ESG regulation and reporting requirements, anti-competition, anti-money-laundering, data privacy and protection, government compliance, wage-and-hour standards, employment and labor relations, product liability, health and safety, environmental, human rights and AI regulations, such as the European Union’s AI Act.”

Annual report 2025A · The company itself

“Further, a disruption in global financial markets could impair our banking partners, on which we rely for operating cash management, capital market transactions and derivative programs. Such disruption could also negatively impact our customers’ ability to pay us due to delays or inability to access their existing cash.”

Annual report 2025A · The company itself

“Table of Contents Increasing regulatory focus on privacy and security issues and expanding laws and regulatory requirements could impact our business models and expose us to increased liability. We are subject to global data protection, privacy and security laws, regulations and codes of conduct that relate to our various business units and data processing activities, which may include sensitive, confidential, and personal information. These laws, regulations and codes are increasing in number, expanding in scope, inconsistent across jurisdictions and subject to evolving and differing (sometimes conflicting) interpretations.”

Annual report 2025A · The company itself

“For example, European data transfers outside the European Economic Area are highly regulated and litigated. The mechanisms that we and many other companies rely upon for European data transfers (for example, Standard Contractual Clauses and the EU - US Data Privacy Framework) are the subject of legal challenge, regulatory interpretation and judicial decisions by the Court of Justice of the European Union.”

Annual report 2025A · The company itself

“Certain other countries in which we do business have also established specific legal requirements for cross-border transfers of personal information and data localization. If these or other countries implement more restrictive regulations for cross-border data transfers or do not permit data to leave the country of origin, such developments could adversely impact our business and our enterprise customers’ business, our financial condition and our results of operations in those jurisdictions.”

Annual report 2025A · The company itself

“Regulated Rate of Return and Tariff — In exchange for the right to sell or distribute electricity in a service territory, our utility businesses are subject to government regulation. This regulation sets the framework for the prices ("tariffs") that our utilities are allowed to charge customers for electricity and establishes service standards that we are required to meet. Our utilities are generally permitted to earn a regulated rate of return on assets, determined by the regulator based on the utility's allowed regulatory asset base, capital structure, and cost of capital.”

Annual report 2025A · The company itself

“The regulatory authority of the IURC over AES Indiana's business is typical of regulation generally imposed by state public utility commissions. The IURC sets tariff rates for electric service provided by AES Indiana. The IURC considers all allowable costs for ratemaking purposes, including a fair return on assets used and useful to providing service to customers.”

Annual report 2025A · The company itself

“Regulatory Framework and Market Structure — AES Ohio is regulated by the PUCO for its distribution services and facilities, retail rates and charges, reliability of service, compliance with renewable energy portfolio requirements, energy efficiency program requirements, and certain other matters.”

Annual report 2025A · The company itself

“Among other items, the PUCO Order approving the ESP 1 rate plan included reinstating the non-bypassable RSC Rider, which provided annual revenue of approximately $79.0 million. The OCC has appealed to the Ohio Supreme Court the PUCO’s decision approving the reversion to ESP 1 as well as argued for a refund of the RSC revenue dating back to August 2021.”

Annual report 2025A · The company itself

“A fundamental premise of the Application was the continued availability of rider recovery of Smart Grid investments through the plan period. However, with the recent enactment of House Bill 15 described above, which prohibits AES Ohio from applying for a new electric security plan which includes certain rider recovery mechanisms, as well as the near-term financial uncertainty created by the statute, AES Ohio withdrew its Smart Grid Phase 2 Application on May 23, 2025.”

Annual report 2025A · The company itself

“Maritza is contracted under a 15-year PPA that expires in May 2026.”

Annual report 2025A · The company itself

“•The Superintendence of Electricity's main responsibilities include monitoring compliance with legal provisions, rules, and technical procedures governing generation, transmission, distribution, and commercialization of electricity. They monitor behavior in the electricity market in order to prevent monopolistic practices. In addition to the two agencies responsible for monitoring compliance with the General Electricity Law, the Ministry of Industry and Commerce supervises commercial and industrial activities in the Dominican Republic as well as the fuels and natural gas commercialization to end users.”

Annual report 2025A · The company itself

“AES El Salvador distribution rates are regulated by the General Superintendence of Electricity and Telecommunications and are established through a traditional cost-based rate-setting process. AES El Salvador is permitted to recover its costs of providing distribution services as well as earn a regulated rate of return on assets, determined by the regulator, based on the utility's allowed regulated asset base, capital structure, and cost of capital.”

Annual report 2025A · The company itself

“Bulgaria The electricity sector in Bulgaria is regulated by the Bulgarian Energy Act. The Bulgarian electricity market allows both regulated and competitive segments.”

Annual report 2025A · The company itself

“Mexico’s new Electricity Sector Law (LSE) and its Regulations (RLSE), enacted in 2025, replaced the previous framework to centralize control under the state-owned CFE. The reform reinforces the State’s leading role in the electricity industry, preserving transmission and distribution as exclusive state services, while redefining the conditions for private participation in generation and commercialization.”

Annual report 2025A · The company itself

“In addition to the Ministry of Energy, three main agencies are responsible for regulating market agents and their activities, monitoring compliance with laws and regulations, and surveillance of operational compliance and management of the wholesale electricity market: •The Energy Regulatory Commission is responsible for the establishment of directives, orders, methodologies, and standards to regulate the electric and fuel markets, as well as granting permits. •The National Center for Energy Control, as an ISO, is responsible for managing the wholesale electricity market, transmission and distribution infrastructure, planning network developments, guaranteeing open access to network infrastructure, executing competitive mechanisms to cover regulated demand, and setting transmission charges. •The Electricity Federal Commission ("CFE") owns the transmission and distribution grids and is also the country's basic supplier. CFE is the offtaker for IPP generators, and together with its own power units has more than 50% of the current generation market share.”

Annual report 2025A · The company itself

“The regulatory landscape underwent a significant transformation with SE Resolution 400/25, effective November 2025, which instituted new rules for the wholesale energy market and its progressive adaptation. The new remuneration framework requires generators to manage their fuel supply and declare their variable production cost based on established reference values, while allowing the contracting of energy and/or capacity based on bilaterally negotiated terms.”

Annual report 2025A · The company itself

“At the end of November 2024, a new electricity law was passed by the National Assembly. The new law provides for a comprehensive reform of the legal framework in the power and energy sector of Vietnam after two decades under the current electricity law of 2004. It provides an improved legal environment for the energy sector, including but not limited to imported LNG power, green hydrogen and ammonia, offshore wind, nuclear power, low-emission conversion, emergency power projects, minimum long-term contracted electricity output, DPPA, and a fuel cost pass-through mechanism.”

Annual report 2025A · The company itself

“In December 2020, we received a Notice of Proposed Adjustment (“NOPA”) from the IRS for the 2013 tax year relating to the valuation of our international intellectual property which was sold to a subsidiary in 2013. The notice proposed an increase to our U.S. taxable income that could result in additional income tax expense and cash tax liability of $1.3 billion, plus penalties and interest, which exceeds our current reserve recorded in our consolidated financial statements by more than $1.0 billion.”

Annual report 2025A · The company itself

“Our payments operations are subject to extensive, complex, overlapping, and frequently changing government regulation and oversight and any failure or perceived failure to comply with such laws, rules, regulations, policies, legal interpretations, and regulatory guidance could materially adversely affect our business, results of operations, and financial condition. Our payments platform is subject to various laws, rules, regulations, policies, legal interpretations, and regulatory guidance, including those governing: cross-border and domestic money transmission and funds transfers; stored value and prepaid access; foreign exchange; data privacy, data security, and cybersecurity; banking secrecy; payment services (including payment processing and settlement services); consumer protection; economic and trade sanctions; anti-corruption and anti-bribery; and anti-money laundering (“AML”) and counter-terrorist financing (“CTF”).”

Annual report 2025A · The company itself

“(“Airbnb Payments”), is regulated as a “Money Services Business” by the Financial Crimes Enforcement Network and requires state licenses to act as a money transmitter. Compliance involves handling customer funds, record-keeping, and reporting, with potential licensing needs in unlicensed states due to regulatory changes.”

Annual report 2025A · The company itself

“Table of Contents Airbnb Payments Luxembourg SA (“APLux”) operates as a licensed payments institution across the European Economic Area (“EEA”) from Luxembourg, Airbnb Payments UK Limited (“APUK”) is licensed as an electronic money institution (“EMI”) providing payment services from the United Kingdom, and Airbnb Payments Canada Inc. is registered as a payment service provided (“PSP”) in Canada. Compliance with EEA, UK, and Canadian regulations, such as the EU Digital Operational Resilience Act Regulation, the Luxembourg implementation of the EU Second Payment Services Directive (“PSD2”), the UK's Payment Services Regulations 2017 (“UK PSR”), and Canada’s Retail Payment Activities Act (“RPAA”), involves complex and potentially onerous requirements, including ICT risk and operational-resilience and payment security and strong customer authentication, which may increase compliance costs, raise risk of non-compliance, and impact the ease of usage of the payment features and of our platform.”

Annual report 2025A · The company itself

“In the event that our current credit ratings are downgraded or removed, we would most likely incur higher borrowing costs and experience greater difficulty in obtaining additional financing, which in turn would have a material adverse impact on our financial condition, results of operations, cash flows, and liquidity.”

Annual report 2025A · The company itself

“There is no assurance that we will be able to continue to access the unsecured bond market on favorable terms. Our ability to borrow additional amounts through the issuance of unsecured bonds may be negatively impacted by periods of illiquidity in the bond market.”

Annual report 2025A · The company itself

“It is also possible that our tenants or venture investments within these industries may be adversely affected by crises involving financial institutions with which they have business relationships. On March 10, 2023, Silicon Valley Bank (“SVB”), the 16th largest bank in the U.S. at the time and headquartered in California, was closed by the California Department of Financial Protection and Innovation, which appointed the FDIC as receiver. SVB was a provider of commercial and private banking products and services to industries including life science, technology, and healthcare.”

Annual report 2025A · The company itself

“Significant funding requirements for product research and development •Some of our life science industry tenants and venture investment portfolio companies require significant funding to develop and commercialize their products and technologies, which must be obtained from venture capital firms; private investors; public markets; other companies in the life science industry; or federal, state, and local governments. Such funding may become unavailable or difficult to obtain. The ability of each tenant or venture investment portfolio company to raise capital will depend on its financial and operating condition, viability of its products and technology, and the overall condition of the financial, banking, and economic environment, as well as government budget policies.”

Annual report 2025A · The company itself

“Significant funding requirements for product research and development and sales growth •Some of our technology industry tenants and venture investment portfolio companies require significant funding to develop and commercialize their products and technologies, which must be obtained from venture capital firms; private investors; public markets; companies in the technology industry; or federal, state, and local governments. Such funding may become unavailable or difficult to obtain. The ability of each tenant or venture investment portfolio company to raise capital will depend on its financial and operating condition, viability of their products, and the overall condition of the financial, banking, governmental budget policies, and economic environment.”

Annual report 2025A · The company itself

“Legal, Regulatory and Compliance Risks We are subject to antitrust and competition regulations, litigation and enforcement that may result in fines, penalties, restrictions on our business practices, and product, services or operational changes which could materially impact our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“Governments and regulators are actively developing new competition laws, regulations and actions aimed at the technology sector, AI and digital platforms, and global activities and expansion, including in large markets such as the United States, the EU, and China.”

Annual report 2025A · The company itself

“Failure to obtain or maintain approvals or comply with regulations and government actions regarding our products or services or those of our suppliers could materially harm our sales, result in substantial penalties and fines, interrupt our supply chain and cause harm to our reputation.”

Annual report 2025A · The company itself

“We and certain of our third-party vendors must also comply with and adhere to facility registration and product listing requirements for Quality System regulations. The FDA enforces its Quality System regulations through periodic unannounced inspections. Failure to satisfactorily correct an adverse inspection finding or comply with applicable regulations can result in enforcement actions, or require us to find alternative manufacturers, which could be a long and costly process and may cause reputational harm.”

Annual report 2025A · The company itself

“We are also subject to anti-corruption and anti-bribery (“ABAC”) laws such as the Foreign Corrupt Practices Act (“FCPA”) and the U.K. Bribery Act of 2010, which generally prohibit payments to foreign officials for the purpose of obtaining or maintaining business, securing an advantage and directing business to another.”

Annual report 2025A · The company itself

“We are or may become, or alleged to be or become, subject to stringent federal, state, and foreign laws and regulations, such as HIPAA, which regulates the security and privacy of patient healthcare information applicable to healthcare providers and their business associates, and the California Consumer Protection Act, as amended by the California Privacy Rights Act, which regulates privacy, data security, content regulation and consumer protection.”

Annual report 2025A · The company itself

“For example, the collection and use of health data and other personal information is governed in the EU by the EU GDPR, which imposes significant obligations upon companies and rights for individuals, with substantial penalties for noncompliance.”

Annual report 2025A · The company itself

“Several jurisdictions, including the EU, United States, China, Australia, and Japan, have enacted data export restrictions and international transfer laws and regulations that established legal requirements for cross-border transfers of all or certain personal information and certain jurisdictions have also established legal requirements for data localization, which may require us to maintain separate servers located in those countries so that all or certain personal information are maintained locally.”

Annual report 2025A · The company itself

“These laws, regulations and other obligations relating to privacy, data protection, data governance and cybersecurity are constantly evolving and may be created, interpreted or enforced in ways that could impose new, substantially uncertain, and relatively burdensome obligations on our global operations, restrict our activities and our ability to provide our products and services in certain jurisdictions, require us to cease operations or modify our policies and business practices in a materially limiting manner, prevent us from resolving issues quickly or force us to resolve them in unanticipated ways, require us to engage in additional contractual negotiations, increase our costs and obligations and limit our ability to efficiently transfer personal data across borders, cause us to incur significant costs, expenses and damages, and present challenges in adapting our policies and practices to address their requirements.”

Annual report 2025A · The company itself

“Moreover, independent actions by competitors, customers, or others have alleged that our efforts to enforce our IP rights constitute unfair competition or violations of antitrust laws.”

Annual report 2025A · The company itself

“Price pressures mandated by authorities can have a significant impact on the company’s earning capacity. In most of the countries in which ALK operates, prescription drugs are subject to reimbursement from, and price controls by national authorities and healthcare providers. This often results in significant price differences between individual markets.”

Annual report 2025A · The company itself

“Risks Related to Laws and Regulations Our utility business is significantly impacted by government legislation, regulation and oversight - Our utility financial condition is influenced by how regulatory authorities, including the IUC, the PSCW and FERC, establish the rates we can charge our customers, our authorized rates of return and common equity levels, and the costs that may be recovered from customers. Our ability to timely obtain rate adjustments to earn authorized rates of return depends upon timely regulatory action under applicable statutes and regulations, and cannot be guaranteed.”

Annual report 2025A · The company itself

“In addition, our operations are subject to extensive regulation primarily by the IUC, the PSCW and FERC. We are also subject to oversight and monitoring by organizations such as the North American Electric Reliability Corporation, the Midwest Reliability Organization, the Pipeline and Hazardous Materials Safety Administration, the Midcontinent Independent System Operator, Inc. (MISO) and the Department of Homeland Security Transportation Security Administration.”

Annual report 2025A · The company itself

“Energy industry changes could have a negative effect on our businesses - We operate in a highly regulated business environment. The advent of new and unregulated markets has the potential to significantly impact our financial condition and results of operations.”

Annual report 2025A · The company itself

“Additional regulations or new requirements may emerge from the activities of various regulatory entities, including the Federal Reserve Board, FIO, FSOC, the National Association of Insurance Commissioners (“NAIC”), and the International Association of Insurance Supervisors, that are evaluating solvency and capital standards for insurance company groups.”

Annual report 2025A · The company itself

“Rate regulation Nearly all states and D.C (collectively, “locations”) have insurance laws requiring personal property and casualty insurers to file rating plans, policy or coverage forms, and other information with the location’s regulatory authority. In many cases, such rating plans, policy forms, or both must be approved prior to use.”

Annual report 2025A · The company itself

“From time to time, the personal lines insurance industry comes under pressure from state regulators, legislators, and special-interest groups to reduce, freeze, or set rates at levels that do not correspond with underlying costs, catastrophe loss exposure, and expenses. We expect this kind of pressure to persist.”

Annual report 2025A · The company itself

“We may not be able to mitigate the impact associated with changes in capital requirements Regulatory requirements affect the amount of capital to be maintained by our subsidiary insurance companies. Changes to requirements or regulatory interpretations may result in additional capital held in our insurance companies and could require us to increase prices, reduce sales of certain products, or accept a return on equity below original levels assumed in pricing.”

Annual report 2025A · The company itself

“Evolving privacy and data security regulation and increased focus on enforcement could impact our business, increase costs and any violations could subject us to regulatory fines and reputational impact Personal information is subject to an increasing number of federal, state, local and international laws and regulations regarding privacy and data security, as well as contractual commitments. Any failure or perceived failure by us to comply with such obligations may result in governmental enforcement actions and fines, litigation or public statements against us by consumer advocacy groups or others and could cause our employees and customers to lose trust in us, which could have an adverse effect on our reputation and business.”

Annual report 2025A · The company itself

“We are subject to extensive regulation, and uncertainty around the interpretation and implementation of regulations in the U.S. and internationally, and potential further restrictive regulation may increase operating costs and limit growth We largely operate in the highly regulated insurance and broader financial services sectors and are subject to extensive laws, regulations, executive orders and directives that are complex and subject to change. Changes may lead to additional expenses, increased legal exposure, delays or increased reserve or capital requirements limiting our ability to grow or to achieve targeted profitability.”

Annual report 2025A · The company itself

“Losses from legal and regulatory actions may be material to the results of operations, cash flows and financial condition We are involved in various legal actions, including class action litigation challenging a range of company practices; including coverages provided by insurance products, some of which involve claims for substantial or indeterminate amounts. We are also involved in various regulatory actions and inquiries, including market conduct exams by state insurance regulatory agencies.”

Annual report 2025A · The company itself

“We conduct business outside of the United States, including customer, vendor and business partner relationships, process and information technology operations, and outsourcing of certain business functions. Our operations, vendors and business partnerships outside of the U.S. are subject to additional regulatory requirements and operating and political risks. Changes in tax policy or imposition of fees and restrictions could increase the cost of operations or disrupt or limit our ability to operate outside of the U.S., whether directly through our operations or indirectly through our vendors, suppliers, or service providers. In addition, governments outside of the U.S. have in the past and may in the future adopt laws and regulations applicable to our non-U.S. subsidiaries, including laws related to privacy, data security, human rights and the environment, that carry penalties for non-compliance based on consolidated enterprise revenue.”

Annual report 2025A · The company itself

“Insufficient reinsurance capacity or reinsurance at unacceptable prices may limit our ability to profitably write business Market conditions impact the availability and cost of the reinsurance we purchase. Reinsurance may not remain continuously available to us to the same extent and on the same terms and rates as were historically available or is currently available.”

Annual report 2025A · The company itself

“We are also subject to payment card association operating rules, including data security rules, certification requirements, and rules governing electronic funds transfers, which could change or be reinterpreted to make it difficult or impossible for us to comply. Failure to comply with these rules or requirements, as well as any breach, compromise, or failure to otherwise detect or prevent fraudulent activity involving our data security systems, could result in our being liable for card issuing banks’ costs, subject to fines and higher transaction fees, and loss of our ability to accept credit and debit card payments from our customers, process electronic funds transfers, or facilitate other types of online payments, and our business and operating results could be adversely affected.”

Annual report 2025A · The company itself

“We are also subject to or voluntarily comply with a number of other laws and regulations relating to payments, money laundering, international money transfers, privacy, data use, data protection, data security, data localization, network security, consumer protection, and electronic fund transfers. If we were found to be in violation of applicable laws or regulations, we could be subject to additional requirements and civil and criminal penalties, or forced to cease providing certain services.”

Annual report 2025A · The company itself

“In addition, regulators and lawmakers are increasingly focused on controlling additional aspects of the operations of technology companies and companies they have characterized to be online “gatekeepers” through the application of existing regulations and laws and the adoption of new regulations and laws, which increases our compliance costs and limits the operation of our business. Unfavorable regulations, laws, decisions, or interpretations by government or regulatory authorities applying those laws and regulations, or inquiries, investigations, or enforcement actions threatened or initiated by them, could cause us to incur substantial costs, expose us to unanticipated civil and criminal liability or penalties (including substantial monetary fines), diminish the demand for, or availability of, our products and services, increase our cost of doing business, require us to change our business practices in a manner materially adverse to our business, damage our reputation, impede our growth, or otherwise have a material effect on our operations.”

Annual report 2025A · The company itself

“An increasing number of jurisdictions are considering or have adopted laws or administrative practices that impose new tax measures, including revenue-based taxes, targeting online commerce and the remote selling of goods and services. These include new obligations to withhold or collect sales, consumption, value added, or other taxes on online marketplaces and remote sellers, or other requirements that may result in liability for third party obligations.”

Annual report 2025A · The company itself

“For example, non-U.S. jurisdictions have proposed or enacted taxes on online advertising and marketplace service revenues.”

Annual report 2025A · The company itself

“REGULATORY AND LEGISLATIVE RISKS We are subject to extensive regulation of our businesses. We are subject to federal, state, and local regulation. The extensive regulatory frameworks, some of which are more specifically identified in the following risk factors, regulate, among other matters, the electric and natural gas utility industries; the rate and cost structure of utilities, including an allowed ROE; the operation of nuclear power plants; the construction and operation of generation, transmission, and distribution facilities; the acquisition, disposal, depreciation and amortization of assets and facilities; the electric transmission system reliability; and wholesale and retail competition.”

Annual report 2025A · The company itself

“The rates that we are allowed to charge for our utility services significantly influence our results of operations, financial position, and liquidity. The electric and natural gas utility industry is highly regulated. The utility rates charged to customers are determined by governmental entities, including the MoPSC, the ICC, and the FERC.”

Annual report 2025A · The company itself

“We are subject to FERC regulations, rules, and orders, including standards issued by the NERC. As owners and operators of bulk power transmission systems and electric energy centers, we are subject to mandatory NERC reliability standards, including cybersecurity standards.”

Annual report 2025A · The company itself

“Compliance with these reliability standards, rules, and regulations may subject us to higher operating costs and may result in increased capital expenditures. We may also incur higher operating costs to comply with potential new executive orders, regulations, or interpretations of existing regulations issued by these regulatory bodies.”

Annual report 2025A · The company itself

“These sales are made at rates approved by the state utility commissions of the states in which they operate, and in some instances, approved by the FERC.”

Annual report 2025A · The company itself

“AEP’s public utility subsidiaries currently provide service at rates approved by one or more regulatory commissions. If these regulatory commissions do not approve adjustments to the rates charged, affected AEP subsidiaries would not be able to recover the costs associated with their investments.”

Annual report 2025A · The company itself

“(Applies to all Registrants) The rates customers pay to AEP regulated utility businesses are subject to approval by the FERC and the respective state utility commissions of Arkansas, Indiana, Kentucky, Louisiana, Michigan, Ohio, Oklahoma, Tennessee, Texas, Virginia and West Virginia.”

Annual report 2025A · The company itself

“Certain elements of AEP’s transmission formula rates have been challenged, which could result in lowered rates and/or refunds of amounts previously collected.”

Annual report 2025A · The company itself

“Table of Contents SUPERVISION AND REGULATION Overview We are subject to evolving and extensive government regulation and supervision in jurisdictions around the world, and the costs of ongoing compliance are substantial.”

Annual report 2025A · The company itself

“For example, legislators and regulators in various countries in which we operate have focused on the offering of consumer financial products and the operation of payment networks, resulting in changes to certain practices or pricing of card issuers, merchant acquirers and payment networks, and, in some cases, the establishment of broad and ongoing regulatory oversight regimes.”

Annual report 2025A · The company itself

“Regulatory and legislative changes may also significantly alter the competitive landscape, including by facilitating alternative payment or financing mechanisms, such as recent legislation in the U.S. establishing a regulatory framework for stablecoins, or by imposing constraints on payment or financing mechanisms, such as proposals to cap credit card interest rates.”

Annual report 2025A · The company itself

“In the United States, our marketing, sale and servicing of consumer financial products and our compliance with certain federal consumer financial laws are supervised and examined by the CFPB, which has broad rulemaking and enforcement authority over providers of credit, savings and payment services and products, and authority to prevent “unfair, deceptive or abusive” acts or practices. The CFPB has the authority to write regulations under federal consumer financial protection laws, to enforce those laws and to examine for compliance.”

Annual report 2025A · The company itself

“Pricing for card acceptance, including interchange fees (that is, the fee paid by the bankcard merchant acquirer to the card issuer in payment networks like Visa and Mastercard), has been a focus of legislators and regulators in Australia, Canada, the EU, the United States and other jurisdictions.”

Annual report 2025A · The company itself

“Among other things, regulation of bankcard fees has negatively impacted, and may continue to negatively impact, the discount revenue we earn, including as a result of downward pressure on our merchant discount rates from decreases in competitor pricing in connection with caps on interchange fees.”

Annual report 2025A · The company itself

“In jurisdictions allowing surcharging, we have seen an increase in merchant surcharging on American Express cards, particularly in certain merchant categories. Surcharging is an adverse customer experience and could have a material adverse effect on us, particularly where it only or disproportionately impacts credit card usage or card usage generally, our Card Members or our business.”

Annual report 2025A · The company itself

“Compliance risk arises from violations of, or failure to conform or comply with, laws and/or regulations, internal policies and procedures and related practices, or ethical standards. We need to continually update and enhance our control environment to address operational and compliance risks, and our control environment and related systems have in certain instances not sufficiently detected, and may in the future not sufficiently detect, errors or omissions. Operational and compliance failures, deficiencies in our control environment or an inability to maintain high standards of business conduct can expose us to reputational and legal risks as well as fines, civil money penalties or payment of damages and can lead to diminished business opportunities and diminished ability to expand key operations.”

Annual report 2025A · The company itself

“We face heightened and evolving regulatory expectations and scrutiny in the U.S. and globally, which significantly affects our business and requires continual enhancement of our compliance efforts. Supervision efforts and the enforcement of existing laws and regulations impact the scope and profitability of our existing business activities, limit our ability to pursue certain business opportunities and adopt new technologies, compromise our competitive position (particularly where we may be treated differently from our competitors), and affect our relationships with Card Members, partners, merchants, service providers and other third parties.”

Annual report 2025A · The company itself

“This focus has included fees, interest rates and rewards associated with card and banking products, such as recent proposals to cap credit card interest rates.”

Annual report 2025A · The company itself

“Any new requirements or increased enforcement of existing requirements could materially and adversely impact our revenue growth and profitability, including, as a result of increased scrutiny of our pricing, underwriting and account management practices; the imposition of fines and customer remediation; higher compliance costs; reputational harm; impacts to our ability to issue cards or extend credit to current and prospective Card Members, appropriately price for the value of our products or work with certain business partners; and changes to our business practices generally.”

Annual report 2025A · The company itself

“As regulators increase their focus with respect to these financial crimes laws, new technologies such as digital currencies develop, near real-time money movement solutions are adopted, we introduce new products and geopolitical tensions increase, we face increased costs related to oversight, supervision and potential fines.”

Annual report 2025A · The company itself

“Compliance with current or future laws in the aforementioned areas could significantly impact our business operations, including our collection, use, sharing, retention and safeguarding of consumer, partner and/or colleague information and could restrict our ability to fully maximize our integrated payments platform or provide certain products and services or work with certain service providers, which could materially and adversely affect our profitability.”

Annual report 2025A · The company itself

“For example, guidelines issued by the Organization for Economic Cooperation and Development introduced a global minimum tax of 15 percent on the global profits of multinational enterprises, such as us. The global minimum tax increased our tax liability in 2025 as it came into effect in various jurisdictions where we operate and we expect the global minimum tax will continue to increase our tax liability in 2026 if it continues to be in effect in its current form.”

Annual report 2025A · The company itself

“Additionally, a decrease in confidence in the soundness of us or in the banking sector more broadly, such as following the occurrence of bank failures, or in the level of insurance available on deposits may cause rapid deposit withdrawals or an unwillingness to maintain deposits with us, which could materially adversely affect us and our ability to fund our business.”

Annual report 2025A · The company itself

“The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), signed into law in 2010, brought about extensive changes to financial regulation in the United States and established the Federal Insurance Office (FIO) to serve as the central insurance authority in the federal government. While not serving a regulatory function, FIO performs certain duties related to the business of insurance and has authority to collect information on the insurance industry and recommend prudential standards.”

Annual report 2025A · The company itself

“Solvency II governs the insurance industry’s solvency framework for the EU, including minimum capital and solvency requirements, governance requirements, risk management and public reporting standards applicable to AIG’s subsidiaries operating in the EU.”

Annual report 2025A · The company itself

“The FSB has also been engaging with member jurisdictions in order to encourage greater adherence to its “Key Attributes for Effective Resolution Regimes for the Insurance Sector” to ensure that large, internationally active insurers can exit the market in an orderly fashion and avoid the need for taxpayer bailouts. Starting in December 2024, the FSB began publishing an annual list of insurers, including AIG, that are subject to resolution planning requirements which impose on AIG an obligation to provide to our key global regulators a comprehensive resolution plan for the Company along with periodic updates.”

Annual report 2025A · The company itself

“As part of ComFrame, the IAIS also developed a risk-based global Insurance Capital Standard (ICS) applicable to IAIGs. The IAIS formally adopted the ICS at its annual general meeting in December 2024.”

Annual report 2025A · The company itself

“In October 2017, the NAIC adopted the Insurance Data Security Model Law (NAIC Data Security Model Law), which, among other things, requires insurers, insurance producers and other entities required to be licensed under state insurance laws to develop and maintain a written information security program, conduct risk assessments, and oversee the data security practices of third-party service providers.”

Annual report 2025A · The company itself

“In addition, on March 1, 2019, the NYDFS’s cybersecurity regulation became fully effective, requiring covered financial institutions, including insurance entities licensed in New York, to, among other things, implement a cybersecurity program designed to protect information systems. The 2023 amendments to this cybersecurity regulation added obligations for large insurers including enhanced and updated governance, risk assessment, and technology requirements, new notification obligations, and clarifying changes regarding enforcement.”

Annual report 2025A · The company itself

“LIQUIDITY, CAPITAL AND CREDIT AIG Parent’s ability to access funds from our subsidiaries is limited, and our sources of liquidity may be insufficient to meet our needs, including providing capital that may be required by our subsidiaries. As a holding company, AIG Parent depends on dividends and other payments from its subsidiaries to fund operations, pay dividends, repurchase shares, meet debt service obligations and meet the capital and liquidity needs of our subsidiaries. The majority of our investments are held by our regulated subsidiaries.”

Annual report 2025A · The company itself

“In the ordinary course of our business, we are required to post collateral for our insurance company subsidiaries from time to time. We may be required to post additional collateral due to regulatory changes from time to time, which could adversely impact our business, financial condition, results of operations and cash flows.”

Annual report 2025A · The company itself

“A downgrade by one or more of the rating agencies in the Insurer Financial Strength ratings of our insurance companies could limit their ability to write or prevent them from writing new business and impair their retention of customers and in-force business, and a downgrade in our credit ratings could adversely affect our business, results of operations, financial condition and liquidity. Downgrades of the Insurer Financial Strength (IFS) ratings of our insurance companies could (i) prevent these companies from selling, or make it more difficult for them to succeed in selling, products and services, (ii) make it more difficult for them to obtain new reinsurance or obtain it on reasonable pricing and other terms, and/or (iii) result in increased policy cancellations or return of premiums.”

Annual report 2025A · The company itself

“We have also provided and may provide financial guarantees and indemnities in connection with the businesses we have sold or may sell, as described in greater detail in Note 15 to the Consolidated Financial Statements. While we do not currently believe that claims under these indemnities will be material, it is possible that significant indemnity claims could be made against us. Any such claim or claims, if successful, could have a material adverse effect on our results of operations, cash flows and liquidity.”

Annual report 2025A · The company itself

“Significant legal or regulatory proceedings may adversely affect our business, results of operations or financial condition. In the normal course of business, we face significant risk from regulatory and governmental investigations and civil actions, litigation and other forms of dispute resolution in various domestic and foreign jurisdictions. We frequently engage in litigation and arbitration concerning the scope of coverage under insurance and reinsurance contracts, and face litigation and arbitration in which our subsidiaries defend or indemnify their insureds under insurance contracts.”

Annual report 2025A · The company itself

“REGULATION Our businesses are heavily regulated and changes in laws and regulations may affect our operations, increase our insurance subsidiary capital requirements or reduce our profitability. Our operations generally, and our insurance subsidiaries in particular, are subject to extensive and potentially conflicting laws and regulations in the jurisdictions in which we operate. Our business and financial condition are also subject to supervision and regulation by authorities in the various jurisdictions in which we do business.”

Annual report 2025A · The company itself

“The application of and compliance with the laws and regulations applicable to our businesses, operations and legal entities, including maintenance of all required licenses and approvals, may be subject to interpretation, evolving industry practices and regulatory expectations that could result in increased compliance costs. The relevant authorities may not agree with our interpretation of these laws and regulations or with our policies and procedures adopted to address evolving industry practices or meet regulatory expectations. Such authorities’ interpretations and views may also change from time to time.”

Annual report 2025A · The company itself

“If we are found not to have complied with applicable legal or regulatory requirements, these authorities could preclude or temporarily suspend us from carrying on some or all of our activities, impose substantial administrative penalties such as fines or require corrective actions, which individually or in the aggregate could interrupt our operations and materially and adversely affect our reputation, business, results of operations and financial condition.”

Annual report 2025A · The company itself

“Regulators in jurisdictions in which we do business have adopted capital (including in the U.S., RBC), solvency and liquidity standards applicable to insurers operating in their jurisdiction. Failure to comply with such capital, solvency, liquidity and similar requirements, or as otherwise may be agreed by us or one of our insurance company subsidiaries with an insurance regulator, would generally permit the insurance regulator to take certain regulatory actions that could materially impact the affected company’s operations. Those actions range from requiring an insurer to submit a plan describing how it would regain a specified RBC or solvency ratio to a mandatory regulatory takeover of the company.”

Annual report 2025A · The company itself

“Furthermore, efforts to address systemic risks within the financial services industry, including insurance services, may lead regulators to apply new or heightened standards and safeguards for activities or practices that we and other insurers or other nonbank financial services companies engage in. The Financial Stability Oversight Council has authority under Dodd-Frank to determine that certain nonbank financial companies, including insurers, be designated as nonbank SIFIs subject to supervision by the Board of Governors of the Federal Reserve System and enhanced prudential standards, and has in place guidance and procedures intended to govern any such designations.”

Annual report 2025A · The company itself

“It is possible such laws, regulations or standards, including, without limitation, Solvency II and European Data Protection Board Cross Border Data Transfer, Corporate Sustainability Reporting Directive, and Corporate Sustainability Due Diligence Directive in the EU, and standard-setting initiatives by the FSB and the IAIS, including, but not limited to, the IAIS’ Common Framework for the Supervision of IAIGs, its global Insurance Capital Standard, which was recently adopted as a group-level prescribed capital requirement, and its holistic framework for the assessment and mitigation of systemic risk, may significantly alter our business practices. Regulators have imposed and may continue to impose new requirements, and regulators and other international organizations may continue to update, revise or overhaul regulatory regimes to which we are subject in order to address existing and emerging risks. They may also limit our ability to engage in capital or liability management, require us to raise additional capital, or impose requirements and additional costs that may be burdensome.”

Annual report 2025A · The company itself

“New laws and regulations or new interpretations of current laws and regulations, both domestically and internationally, may affect our businesses, results of operations, financial condition and ability to compete effectively. Legislators, regulators, self-regulatory and other organizations have in the past, and may in the future, periodically consider various proposals that, if enacted, may affect or restrict, among other things, our business practices and activities, product designs and distribution relationships, how we market, sell or service certain products we offer, the investment assets we hold and our investment management practices, our capital, reserving and accounting requirements, or the profitability of certain of our businesses.”

Annual report 2025A · The company itself

“Further, new laws, regulations or guidance may affect or significantly limit our ability to conduct certain businesses at all, including restrictions on the type of activities in which financial institutions are permitted to engage. Changes in legislation or regulation could also impose additional taxes on a limited subset of financial institutions and insurance companies (either based on size, activities, geography or other criteria), limit our ability to engage in capital or liability management, require us to raise additional capital, or impose burdensome requirements and additional costs. It is uncertain whether and how these and other changes in legislation or regulation would apply to us, those who sell or service our products, or our competitors or how they could impact our ability to compete effectively, as well as our business, consolidated results of operations, liquidity and financial condition.”

Annual report 2025A · The company itself

“CREDIT RISK Credit risk is defined as the risk that our customers or counterparties are unable or unwilling to repay their contractual obligations when they become due.”

Annual report 2025A · The company itself

“Title VII of Dodd-Frank provides for significantly increased regulation of, and restrictions on, derivatives markets and transactions that have affected various activities of insurance and other financial services companies, including (i) regulatory reporting for swaps, including security-based swaps, (ii) mandated clearing through central counterparties and execution through regulated swap execution facilities for certain swaps (other than security-based swaps) and (iii) margin and collateral requirements.”

Annual report 2025A · The company itself

“Third parties performing regulated activities on our behalf, such as sales and servicing of insurance products, pose a heightened risk as we may be held accountable for their conduct in circumstances where it fails to comply with applicable law. Some of the third-party providers we use are located outside the U.S., which exposes us to business disruption and political risks inherent to conducting business across multiple jurisdictions.”

Annual report 2025A · The company itself

“Regulation and Rate Making The operations of the Company’s Regulated Businesses are generally subject to regulation by PUCs in the states in which they operate, with the primary responsibility of the PUCs being the promotion of the overall public interest by balancing the interest of customers and utility investors. Specific authority might differ from state to state, but in most states, PUCs review and approve rates charged to customers, accounting treatments, long-term financing applications and cost of capital, operation and maintenance (“O&M”) expenses, capital expenditures, taxes, affiliated transactions and relationships, reorganizations, mergers and acquisitions, and dispositions, along with imposing certain penalties or granting certain incentives.”

Annual report 2025A · The company itself

“Environmental, Health and Safety, Water Quality and Other Regulation The Company’s water and wastewater operations, including the services provided by its Regulated Businesses and MSG, are subject to extensive federal, state and local laws and regulations governing the protection of the environment, health and safety, the provision of water and wastewater services, particularly with respect to the quality of water the Company delivers to its customers, and the manner in which it collects, treats, discharges, recycles and disposes of wastewater. In the United States, these regulations are developed under federal legislation including the Safe Drinking Water Act, the Reduction of Lead in Drinking Water Act and the Clean Water Act, and under a variety of applicable state laws.”

Annual report 2025A · The company itself

“Regulation Nearly all aspects of our business, including the activities of Ameriprise Financial, are subject to various federal, state, local and foreign laws and regulations. These laws and regulations provide broad regulatory, administrative and enforcement powers to supervisory agencies and other bodies, including U.S. federal and state regulatory and law enforcement agencies, foreign government agencies or regulatory bodies and U.S. and foreign securities exchanges. The costs of complying with such laws and regulations are significant and increasing, and the consequences for failing to comply may include civil or criminal charges, fines, censure, the suspension of individual employees, restrictions on or prohibitions from engaging in certain lines of business (or in certain states or countries), revocation of certain registrations and reputational damage.”

Annual report 2025A · The company itself

“Regulatory developments, both in and outside of the U.S., have resulted or are expected to result in greater regulatory oversight and internal compliance obligations for firms across the financial services industry.”

Annual report 2025A · The company itself

“Globally and regionally, we continue to see enhanced legislative and regulatory interest regarding retirement investing and fiduciary initiatives, cybersecurity, technology, and operational resilience; the use of artificial intelligence (“AI”); responsible information and data collection, storage and use; financial crime prevention; and privacy matters, and we will continue to closely review and monitor any legislative or regulatory proposals and changes.”

Annual report 2025A · The company itself

“Furthermore, several states have either issued their own best interest or fiduciary rules or are considering doing so and those rules may be limited to certain types of products (e.g., insurance and annuities, financial planning, etc.) or may broadly cover all recommendations made by financial advisors.”

Annual report 2025A · The company itself

“Insurance Regulation Our insurance subsidiaries are subject to supervision and regulation by states and other territories where they are domiciled or otherwise licensed to do business. These regulations impact our Retirement & Protection Solutions segment and our closed blocks included in Corporate & Other segment.”

Annual report 2025A · The company itself

“We operate in a highly scrutinized regulatory environment that remains subject to change.”

Annual report 2025A · The company itself

“•Financial Resilience: U.K. regulators have revised the prudential regime applying to asset managers. This is being phased in over a five-year period and introduces a number of new capital requirements. •FCA Consumer Duty: The FCA recently introduced the Consumer Duty that sets higher expectations for the standard of care that firms provide to retail consumers. •Sustainability Disclosure Requirements: The FCA has introduced requirements relating to new sustainability product labels, naming and marketing rules, additional disclosure requirements both at an entity and product level, and an anti-greenwashing rule covering client communications. •Non-Financial Conduct: The FCA consultation incorporated additional rules around firms’ handling of non-financial misconduct in the context of adherence to the FCA’s conduct and fitness and propriety regimes.”

Annual report 2025A · The company itself

“For example, certain of our asset management subsidiaries are required to comply with the Markets in Financial Instruments Directive (“MiFID II”), the Alternative Investment Fund Managers Directive (“AIFMD”), the European Market Infrastructure Regulation (“EMIR”), UCITS, the Sustainable Finance Disclosure Regulation (“SFDR”) and the Packaged Retail and Insurance-based Investment Products Regulation (“PRIIPs”).”

Annual report 2025A · The company itself

“Our businesses are heavily regulated, and changes to the laws and regulations applicable to our businesses may have an adverse effect on our operations, reputation and financial condition. Virtually all aspects of our business, including the activities of our parent company and our various subsidiaries, are subject to various federal, state and international laws and regulations.”

Annual report 2025A · The company itself

“As a Savings and Loan Holding Company, we are subject to supervision by the FRB and various prudential standards that may limit our activities and strategies. Ameriprise Financial is subject to ongoing supervision by the FRB, including supervision and prudential standards, capital requirements, stress-testing, resolution planning, information security and privacy, and risk management requirements.”

Annual report 2025A · The company itself

“Changes in corporate tax laws and regulations and changes in the interpretation of such laws and regulations, as well as adverse determinations regarding the application of such laws and regulations, could adversely affect our earnings and could make some of our products less attractive to clients. We are subject to the income tax laws of the U.S., its states and municipalities and those of the foreign jurisdictions in which we have significant business operations.”

Annual report 2025A · The company itself

“We are a long-standing leader in financial planning and advice offering a broad range of products and services designed to assist individual and institutional clients achieve their financial objectives. Our strategy is centered on helping clients confidently achieve their goals by providing holistic advice and by managing and protecting their assets and income.”

Annual report 2025A · The company itself

“As part of the Dodd-Frank Act, Congress established the Consumer Financial Protection Bureau to supervise and regulate institutions that provide certain financial products and services to consumers. In addition, the Gramm-Leach-Bliley Act of 1999 implemented fundamental changes in the regulation of the financial services industry in the U.S. and includes privacy and security requirements for financial institutions, including obligations to protect and safeguard consumers’ nonpublic personal information and records, limitations on the re-disclosure and re-use of such information and requirements to notify customers and other individuals about their policies and practices relating to their collection and disclosure of such information and their practices relating to protecting the security and confidentiality of that information.”

Annual report 2025A · The company itself

“Government agencies and insurance standard setters in the U.S. and worldwide have become increasingly interested in potential risks posed by the insurance industry as a whole, and to commercial and financial activities and systems in general, as indicated by the adoption in 2019 of the Common Framework for the Supervision of Internationally Active Insurance Groups (“ComFrame”) by the International Association of Insurance Supervisors (“IAIS”). ComFrame applies to all large internationally active insurance groups (“IAIGs”) designated as an IAIG by their group-wide supervisor.”

Annual report 2025A · The company itself

“Capital Requirements Regulators of each jurisdiction in which we operate have discretionary authority in connection with our insurance and reinsurance subsidiaries’ continued licensing to limit or prohibit sales to policyholders within their respective jurisdiction or to restrict continued operation of insurers or reinsurers domiciled in their respective jurisdiction if, in their judgment, such entities have not maintained the required level of minimum surplus or capital or that the further transaction of business would be hazardous to policyholders or reinsurance counterparties.”

Annual report 2025A · The company itself

“Further, governmental and regulatory authorities periodically review legislative and regulatory initiatives, and may promulgate new or revised, or adopt changes in the interpretation and enforcement of existing, rules and regulations at any time that may impact our investments. Such changes in regulatory requirements could disrupt market liquidity, make it more difficult for us to source and invest in attractive private investments, and cause securities that are not publicly traded to lose value, any of which could have a material and adverse effect on our business, financial condition or results of operations.”

Annual report 2025A · The company itself

“Table of Contents The amount of statutory capital that our insurance and reinsurance subsidiaries have, or that they are required to hold, can vary significantly from time to time and is sensitive to a number of factors outside of our control. The U.S. insurance subsidiaries of our retirement services business are subject to state regulations that provide for minimum capital requirements (“MCR”) based on RBC formulas for life insurance companies relating to insurance, business, asset, interest rate and certain other risks.”

Annual report 2025A · The company itself

“If a subsidiary’s solvency or capital ratios reach certain minimum levels, it could subject us to further examination or corrective action imposed by our insurance regulators. Corrective actions may include limiting our subsidiaries’ ability to write additional business, increased regulatory supervision, or seizure or liquidation of the subsidiary’s business, each of which could materially and adversely affect our business, financial condition, results of operations, cash flows and prospects.”

Annual report 2025A · The company itself

“In the event that any of our employees obtains such material non-public information, we may be restricted in acquiring or disposing of investments on behalf of the funds we manage, which could impact the returns generated for such funds. Notwithstanding the maintenance of restricted securities lists and other internal controls, it is possible that the internal controls relating to the management of material non-public information could fail and result in us, or one of our investment professionals, buying or selling a security while, at least constructively, in possession of material non-public information.”

Annual report 2025A · The company itself

“Many of these laws and regulations empower regulators, including U.S. and foreign government agencies and self-regulatory organizations, as well as state securities commissions and insurance departments in the U.S., to conduct investigations and administrative proceedings that can result in penalties, fines, suspensions or revocations of licenses and/or other regulatory approvals, third-party oversight of various business processes, divestiture of certain investments, suspensions of personnel or other sanctions, including censure, the issuance of cease-and-desist orders, enforcement actions and settlements, or the suspension or expulsion of an investment adviser from registration or memberships. Even if an investigation or proceeding does not result in a sanction or the sanction imposed against us or our personnel by a regulator is small in monetary amount, the adverse publicity relating to the investigation, proceeding or imposition of these sanctions could harm our reputation and cause us to lose existing investors or fail to gain new investors.”

Annual report 2025A · The company itself

“Pillar One will, broadly, re-allocate taxing rights over 25% of the residual profits of multinational enterprises (“MNEs”) with global turnover in excess of 20 billion euros (excluding extractives and regulated financial services) to the jurisdictions where the customers and users of those MNEs are located. While the OECD continues to seek agreement regarding the form and timing of implementation of Pillar One, no concrete proposal has yet been achieved. The form, scope and timing of measures to implement Pillar One and their impact on our business and the taxes we pay remain unclear and subject to ongoing negotiations and, therefore, we cannot currently say whether these measures have an adverse effect on our business.”

Annual report 2025A · The company itself

“In addition, depending on how the model GloBE Rules are implemented or clarified by additional commentary or guidance in the future, they may result in material additional tax being payable by our business and the businesses of the companies in which we invest. The ultimate implementation of the BEPS project may also increase the complexity and the burden and costs of compliance and advice relating to our ability to efficiently fund, hold and realize investments, and could necessitate or increase the probability of some restructuring of our group or business operations.”

Annual report 2025A · The company itself

“Many of the products that our retirement services business sells and reinsures benefit from one or more forms of tax-favored status under current U.S. federal and state income tax regimes. For example, our retirement services business sells and reinsures annuity contracts that allow the policyholders to defer the recognition of taxable income earned within the contract.”

Annual report 2025A · The company itself

“Future changes in U.S. federal or state tax law could reduce or eliminate the attractiveness of such products, which could affect the sale of retirement services’ products or increase the expected lapse rate with respect to products that have already been sold. Decreases in product sales or increases in lapse rates, in either case, brought about by changes in U.S. tax law, may result in a decrease in net invested assets and therefore investment income and may have a material and adverse effect on our business, financial position, results of operations and cash flows.”

Annual report 2025A · The company itself

“However, there is considerable uncertainty as to whether a foreign corporation is engaged in a trade or business (or has a permanent establishment) in the U.S., as the law is unclear and the determination is highly factual and must be made annually. Therefore, there can be no assurance that the IRS will not successfully contend that a Non-U.S. Subsidiary that does not intend to be treated as engaged in a trade or business (or as having a permanent establishment) in the U.S. does, in fact, so engage (or have such a permanent establishment).”

Annual report 2025A · The company itself

“Certain of our investments may be in foreign corporations or may be acquired through foreign subsidiaries that would be classified as corporations for U.S. federal income tax purposes. Such entities may be passive foreign investment companies (“PFICs”) or controlled foreign corporations (“CFCs”) for U.S. federal income tax purposes.”

Annual report 2025A · The company itself

“The Company is subject to complex and changing laws and regulations worldwide, which exposes the Company to potential liabilities, increased costs and other adverse effects on the Company’s business.”

Annual report 2025A · The company itself

“Risks and costs related to new and changing laws, regulations, executive orders, directives, and enforcement priorities increase as the Company’s products and services are introduced into specialized applications, including health and financial services, or as the Company expands the use of technologies, such as machine learning and artificial intelligence features, and must navigate new legal, regulatory and ethical considerations relating to such technologies.”

Annual report 2025A · The company itself

“The technology industry, including, in some instances, the Company, is subject to intense media, political and regulatory scrutiny, which exposes the Company to increasing regulation, government investigations, legal actions and penalties.”

Annual report 2025A · The company itself

“Globally, several jurisdictions have adopted, or may in the future adopt, competition-related laws and regulations imposing wide-ranging obligations on technology companies and significant limitations on businesses, including the Company. For example, the Company has implemented changes to iOS, iPadOS, the App Store and Safari® in the EU as it seeks to comply with the Digital Markets Act (“DMA”), including new business terms and alternative fee structures for iOS and iPadOS apps, alternative methods of distribution for iOS and iPadOS apps, alternative payment processing for apps across the Company’s operating systems, and additional tools and application programming interfaces for developers.”

Annual report 2025A · The company itself

“The Company is also currently subject to antitrust investigations and litigation in various jurisdictions around the world, which can result in legal proceedings and claims against the Company that could, individually or in the aggregate, have a material adverse impact on the Company’s business, results of operations, financial condition and stock price. For example, the Company is subject to civil antitrust lawsuits in the U.S. alleging monopolization or attempted monopolization in the markets for “performance smartphones” and “smartphones” generally in violation of U.S. antitrust laws.”

Annual report 2025A · The company itself

“In addition, the Company is the subject of investigations in Europe and other jurisdictions relating to App Store terms and conditions.”

Annual report 2025A · The company itself

“A reversal of the order on appeal could result in imposition of certain remedies initially proposed by the DOJ, such as those prohibiting Google from offering the Company commercial terms for search distribution.”

Annual report 2025A · The company itself

“Any failure or perceived failure by the Company to comply with these public statements or with federal, state or international privacy or data protection laws and regulations could result in inquiries, proceedings and penalties from governmental entities or others.”

Annual report 2025A · The company itself

“In addition to the risks generally relating to the collection, use, retention, protection and transfer of personal data, the Company is also subject to specific obligations relating to the collection and processing of data associated with minors, as well as information considered sensitive under applicable laws, such as health, biometric, financial and payment card data. Health, biometric, financial and payment card data are subject to additional privacy, security and breach notification requirements, and the Company is subject to audit by governmental authorities regarding the Company’s compliance with these obligations.”

Annual report 2025A · The company itself

“The Company is also subject to new and changing laws and regulations regarding online safety, including enhanced protections for minors and mandatory age verification requirements. These laws and regulations can increase regulatory risks by requiring complex compliance measures and significant modifications to the Company’s products, services and operations, and may lead to operational disruptions, heightened privacy and data security risks, increased costs and potential liability and fines, all of which can have a material adverse impact on the Company’s business, financial condition, results of operations and stock price.”

Annual report 2025A · The company itself

“The Company is also subject to the examination of its tax returns and other tax matters by the U.S. Internal Revenue Service and other tax authorities and governmental bodies.”

Annual report 2025A · The company itself

“If our distribution of the shares of Versigent to our shareholders fails to qualify as tax-free for U.S. federal income tax purposes, certain of our subsidiaries and our U.S. shareholders could be subject to significant tax liabilities. It is a condition to the distribution of the shares of Versigent to our shareholders as part of the Separation that we receive one or more tax opinions from our tax advisors, satisfactory to our Board of Directors in its sole discretion, regarding the qualification of the Separation as a distribution under Section 355(a)(1) of the Internal Revenue Code of 1986, as amended (the “Code”).”

Annual report 2025A · The company itself

“RATINGS Our ability to underwrite business is affected by the quality of our claims paying ability and financial strength ratings as evaluated by independent agencies. Such ratings from third party internationally recognized statistical rating organizations or agencies are instrumental in establishing the financial security of companies in our industry. The primary users of such ratings include commercial and investment banks, policyholders, brokers, ceding companies and investors.”

Annual report 2025A · The company itself

“Our U.S. based insurance operating subsidiaries are subject to extensive governmental regulation and supervision by the states and jurisdictions in which they are domiciled, licensed and/or approved to conduct business. The insurance laws and regulations of the state of domicile have the most significant impact on operations.”

Annual report 2025A · The company itself

“State insurance regulation and supervision is designed to protect policyholders rather than investors. Generally, state regulatory authorities have broad regulatory powers over such matters as licenses, standards of solvency, premium rates, policy forms, marketing practices, claims practices, investments, methods of accounting, form and content of financial statements, certain aspects of governance, ERM, amounts we are required to hold as reserves for future payments, minimum capital and surplus requirements, annual and other report filings and transactions among affiliates.”

Annual report 2025A · The company itself

“In addition to regulation applicable generally to U.S. insurance and reinsurance companies, our U.S. mortgage insurance operations are affected by federal and state regulation relating to mortgage insurers, mortgage lenders, and the origination, purchase and sale of residential mortgages.”

Annual report 2025A · The company itself

“Arch Insurance Company and Arch Reinsurance Company are approved by BFS as “Certified Companies” meaning that they are permitted to insure and reinsure surety bond business, including federal surety bonds, subject to certain underwriting restrictions and BFS supervision.”

Annual report 2025A · The company itself

“The financial requirements require an eligible mortgage insurer’s available assets, which generally include only the most liquid assets of an insurer to meet or exceed “minimum required assets” as of each quarter end. In August 2024, the GSEs updated PMIERs to incorporate new deductions to the definition of available assets for investment risk. This update became effective March 31, 2025, but the impact will be phased in through September 30, 2026.”

Annual report 2025A · The company itself

“The objectives of the PRA are to promote the safety and soundness of all firms it supervises and to secure an appropriate degree of protection for policyholders.”

Annual report 2025A · The company itself

“Arch Insurance (U.K.), and the corporate members of our Lloyd’s Syndicates are required to meet economic risk-based solvency requirements based on Solvency II.”

Annual report 2025A · The company itself

“However, in 2022, HM Treasury set out the U.K. government’s final reform package on the Solvency II framework in the U.K. Significant changes introduced by these reforms included the reduction in risk margin by 30% for non-life insurers and the removal of branch capital requirements.”

Annual report 2025A · The company itself

“Beginning June 30, 2026, the PRA can request submission of a U.K. insurer’s Solvent Exit Analysis (“SEA”). U.K. insurers (other than those in passive run-off, third country branches and Lloyd’s managing agents) are expected to provide and maintain an SEA documenting preparations for an orderly solvent exit.”

Annual report 2025A · The company itself

“Under FSMA, the prior consent of the PRA or FCA, as applicable, is required, before any person can become a controller or increase its control over any regulated company, including Arch Insurance (U.K.), or over the parent undertaking of any regulated company. Therefore, the PRA's or FCA's prior consent, as applicable, is required before any person can become a controller of Arch Capital.”

Annual report 2025A · The company itself

“U.K. insurance regulatory laws do not prohibit the payment of dividends, but the PRA or FCA, as applicable, requires that insurance companies, insurance intermediaries and other regulated entities maintain certain solvency margins and may restrict the payment of a dividend by Arch Insurance (U.K.) or AMAL, for example.”

Annual report 2025A · The company itself

“Arch Re Europe and Arch Insurance (EU) are required to comply with Solvency II requirements.”

Annual report 2025A · The company itself

“Arch Re Europe and Arch Insurance (EU) are required to meet economic risk-based solvency requirements imposed under Solvency II.”

Annual report 2025A · The company itself

“Under Irish law, the prior consent of the CBI is required before any person can acquire or increase a qualifying holding in an Irish insurer or reinsurer, including Arch Insurance (EU) and Arch Re Europe, or their parent undertakings.”

Annual report 2025A · The company itself

“Solvency II took effect in full on January 1, 2016. Solvency II imposes economic risk-based solvency requirements across all EU Member States and consists of three pillars: Pillar I-quantitative capital requirements, based on a valuation of the entire balance sheet; Pillar II-qualitative regulatory review, which includes governance, internal controls, enterprise risk management and supervisory review process; and Pillar III-market discipline, which is accomplished through reporting of the insurer’s financial condition to regulators and the public.”

Annual report 2025A · The company itself

“In addition to the above Solvency II reform proposals, the European Commission continues to promote the development of the Insurance Recovery and Resolution Directive (“IRRD”). The IRRD aims to harmonize national laws on recovery and resolution of (re)insurance undertakings. The European Parliament and the Council voted to adopt the IRRD in April 2024 and November 2024 respectively. The IRRD entered into force on January 28, 2025 and will apply two years from this date.”

Annual report 2025A · The company itself

“The Digital Operational Resilience Act (“DORA”) entered into force in January 2023. The core aim of DORA is to prevent and mitigate cyber threats and sets uniform requirements for the security of network and information systems of financial sector entities (including (re)insurers) as well as critical third parties which provide ICT (information and communication technology)-related services, such as cloud platforms or data analytics services. Certain of our in-scope Irish entities are required to comply with the obligations set out under DORA since January 17, 2025.”

Annual report 2025A · The company itself

“In August 2025, EIOPA issued an Opinion on Artificial Intelligence Governance and Risk management. The opinion provides guidance on the interpretation of insurance-focused legislation in the context of AI systems which may not have existed when the legislation entered into force. It sets out expectations, which are risk-based and proportionate in approach, relating to insurers’ governance and risk-management systems in the context of AI and seeks to ensure consistency among national supervisory authorities in their approach to supervision of AI.”

Annual report 2025A · The company itself

“In 2022, the European Commission adopted a proposal for the Corporate Sustainability Due Diligence Directive (“CSDDD”). The CSDDD entered into force in July 2024 and its obligations will come into effect on a phased basis depending on an in-scope entity’s turnover threshold, employee count and jurisdiction of incorporation. The main focus of the CSDDD is for in-scope entities to conduct due diligence on human rights and environmental impacts within such in-scope entities, their subsidiaries and across its value chain.”

Annual report 2025A · The company itself

“•Our insurance, reinsurance and mortgage subsidiaries are subject to supervision and regulation. Changes to existing regulation and supervisory standards, or failure to comply with applicable requirements, could adversely affect our business and results of operations. •We are subject to ongoing legal and policy actions around climate change which may result in additional requirements that could prompt us to shift our risk selection and business strategy in ways which may adversely impact our results of operations. •Sanctions imposed by the U.S., U.K. and EU on Russia and Russia-related businesses have impacted certain sectors in which we write business. •Certain U.S. policies and actions have created geopolitical risks which are not possible to manage or predict, some of which may result in uncertainty in the global markets.”

Annual report 2025A · The company itself

“Our insurance, reinsurance and mortgage subsidiaries are subject to supervision and regulation. Changes to existing regulation and supervisory standards, or failure to comply with applicable requirements, could adversely affect our business and results of operation. Our insurance and reinsurance subsidiaries conduct business globally and are subject to varying degrees of regulation in the various jurisdictions in which they conduct business, including by state, federal and national insurance regulators.”

Annual report 2025A · The company itself

“In August 2024, we were added to the list of IAIGs, subjecting our global operations to additional regulation and scrutiny.”

Annual report 2025A · The company itself

“We are subject to many laws and regulations relating to the adequacy of cybersecurity programs and business resiliency, including the SEC Cybersecurity Rules, and comprehensive privacy, security and business resiliency laws in the EU such as GDPR and DORA.”

Annual report 2025A · The company itself

“Our operational risks include the ongoing obligation to comply with applicable laws, regulations, regulatory expectations, and legal standards across all jurisdictions where Arch conducts business. Additionally, operational risk and losses can result from, among other things, fraud, errors, failure to document transactions properly or to obtain proper internal authorization, failure to comply with regulatory requirements across all jurisdictions where Arch conducts business, information technology or information security failures and failure to train employees appropriately or adequately.”

Annual report 2025A · The company itself

“The proposal would increase the capital charges for mortgages held in portfolio and eliminate the capital relief currently afforded mortgage loans protected by private mortgage insurance, which could adversely affect the volume of mortgages originated by banks subject to the rule and the demand for mortgage insurance.”

Annual report 2025A · The company itself

“The proposed SECR and CRR amendments improve the capital relief EU banks receive from insurance-based SRT transactions in which the Company participates.”

Annual report 2025A · The company itself

“As a result, our income may be taxed in jurisdictions where it is not currently taxed and at higher rates of tax than currently taxed, which may substantially increase our effective tax rate.”

Annual report 2025A · The company itself

“Thus, with effect from January 1, 2025, Arch Capital is subject to tax on income or profits under the Bermuda CIT Act. It is expected that the Bermuda CIT Act generally will prevent or mitigate the risk of other adopting countries from collecting “top-up” taxes from Bermuda companies to reach the 15% minimum rate, although the continued evolution of the implementation of Pillar II may in some cases mean that the Bermuda CIT Act does not avoid a “top-up” tax in all scenarios.”

Annual report 2025A · The company itself

“In the U.S., we employ a sales force to directly sell mortgage insurance products and services to our customers, which include mortgage originators such as mortgage bankers, mortgage brokers, commercial banks, savings institutions, credit unions and community banks.”

Annual report 2025A · The company itself

“Regulatory and Compliance Matters Our businesses, as well as the financial services industry, generally are subject to extensive regulation, including periodic examinations and potential investigations by governmental agencies and self-regulatory organizations or exchanges in the U.S. and foreign jurisdictions in which we operate relating to, among other things, the management of our funds, antitrust laws, foreign investment review regimes, anti-money laundering laws, anti-bribery laws relating to foreign officials, tax laws and data privacy laws with respect to client and other information.”

Annual report 2025A · The company itself

“In addition, the SEC requires investment advisers registered or required to register with the SEC under the Investment Advisers Act that advise one or more private funds and have at least $150 million in private fund assets under management to periodically file reports on Form PF. We have filed, and will continue to file, quarterly reports on Form PF, which has resulted in increased administrative costs and a significant amount of attention and time to be spent by our personnel.”

Annual report 2025A · The company itself

“In the EU, an amending directive to AIFMD, commonly referred to as “AIFMD II”, was published on March 26, 2024 and will become effective April 16, 2026, subject to the grandfathering period for certain of the loan origination provisions and certain Annex IV disclosure requirements which will become effective a year later (see “—Alternative Investment Fund Managers Directive” for further detail).”

Annual report 2025A · The company itself

“Table of Contents In addition, the EU Digital Operational Resilience Act (“DORA”), which became applicable in January 2025, imposes requirements on a wide range of EU financial entities (including certain alternative investment fund managers) relating to information and communications technology (“ICT”) risk management, incident reporting, operational resilience testing and oversight of third-party ICT service providers. Compliance with DORA may require enhancements to our technology, risk management and vendor oversight practices.”

Annual report 2025A · The company itself

“In addition, pursuing investment opportunities outside the U.S. presents challenges not faced by U.S. investments, such as different legal and tax regimes and currency fluctuations, which require additional resources to address. To accommodate the needs of global investors and strategies we must structure investment products in a manner that addresses tax, regulatory and legislative provisions in different, and sometimes multiple, jurisdictions.”

Annual report 2025A · The company itself

“Further, in conducting business in foreign jurisdictions, we are often faced with the challenge of ensuring that our activities and those of our funds and, in some cases, our funds’ portfolio companies, are consistent with U.S. or other laws with extraterritorial application, such as the USA PATRIOT Act and the U.S. Foreign Corrupt Practices Act (the “FCPA”).”

Annual report 2025A · The company itself

“Entry into certain lines of business may subject us to new laws and regulations with which we are not familiar, or from which we are currently exempt, and may lead to increased litigation and regulatory risk.”

Annual report 2025A · The company itself

“As a result, funds that utilize swaps (whether or not related to a physical commodity) may fall within the statutory definition of a commodity pool. If a fund qualifies as a commodity pool, then, absent an available exemption, the operator of such fund is required to register with the CFTC as a CPO. Registration with the CFTC renders such CPO subject to regulation, including with respect to disclosure, reporting, recordkeeping and business conduct, which could significantly increase operating costs by requiring additional resources.”

Annual report 2025A · The company itself

“Certain classes of interest rate swaps and certain classes of credit default swaps are subject to mandatory clearing, unless an exemption applies. Many of these swaps are also subject to mandatory trading on designated contract markets or swap execution facilities. Mandatory clearing and trade execution requirements may change the cost and availability of the swaps that we use, and expose our funds to the credit risk of the clearing house through which any cleared swap is cleared.”

Annual report 2025A · The company itself

“In addition, federal bank regulatory authorities and the CFTC have adopted initial and variation margin requirements for swap dealers, security-based swap dealers and swap entities, including permissible forms of margin, custodial arrangements and documentation requirements for uncleared swaps and security-based swaps. As a result of these variation margin requirements, some of our funds are required to post collateral to satisfy the variation margin requirements which has made transacting in uncleared swaps more expensive.”

Annual report 2025A · The company itself

“Position limits imposed by various regulators, self-regulatory organizations or trading facilities on derivatives may also limit our ability to effect desired trades. The Dodd-Frank Act also authorizes the SEC to establish position limits on security-based swaps, which rules could have a similar impact on our business. These rules and any additional proposals could affect our ability and the ability for our funds to enter into derivatives transactions.”

Annual report 2025A · The company itself

“The SEC has adopted Regulation Best Interest which requires broker-dealers, or natural persons who are associated persons of broker-dealers, to act in the best interest of a retail customer when making a recommendation of any securities transaction or investment strategy involving securities. Regulation Best Interest requires such broker-dealers to evaluate available alternatives, including those that may have lower expenses and/or lower investment risk than our investment funds. Regulation Best Interest may negatively impact whether certain broker-dealers and their associated persons are willing to recommend investment products, including certain of our funds, to retail customers, which may adversely impact our ability to distribute our products to certain investors.”

Annual report 2025A · The company itself

“A number of states and regulatory authorities require investment managers to register as lobbyists. We have registered as such in a number of jurisdictions, including California, Illinois, New York, Pennsylvania, Louisiana, Texas and Kentucky. Other states or municipalities may consider similar legislation or adopt regulations or procedures with 53 Table of Contents similar effect.”

Annual report 2025A · The company itself

“Compliance with existing and new or changing laws and regulations subjects us to significant costs. Moreover, our failure to comply with applicable laws or regulations, including labor and employment laws, could result in fines, censure, suspensions of personnel or other sanctions, including revocation of the registration of our relevant subsidiaries as investment advisers or registered broker-dealers.”

Annual report 2025A · The company itself

“Most of the regulations to which our businesses are subject are designed primarily to protect investors in our funds and portfolio companies and to ensure the integrity of the financial markets. They are not designed to protect our stockholders.”

Annual report 2025A · The company itself

“In the past several years, the financial services industry, and private equity and alternative asset managers in particular, has been the subject of heightened scrutiny by regulators around the globe. In particular, the SEC and its staff have focused more narrowly on issues relevant to alternative asset management firms, including by forming specialized units devoted to examining such firms and, in certain cases, bringing enforcement actions against the firms, their principals and employees. In recent periods there have been a number of enforcement actions within the industry, and it is expected that the SEC will continue to pursue enforcement actions against private fund managers.”

Annual report 2025A · The company itself

“In December 2025, the European Commission renewed its adequacy decisions for the U.K., which permit the transfer of personal data from the EEA to the U.K., until December 27, 2031, subject to periodic review and potential renewal. While we currently rely on the adequacy decisions and other transfer mechanisms, the adequacy decisions could be modified, suspended or withdrawn in the future, which could require us and our portfolio companies to implement additional data transfer mechanisms and could increase costs and complexity.”

Annual report 2025A · The company itself

“Effective March 31, 2024, new legislation became operative in Bermuda (subject to certain transitional and grandfathering arrangements) which relates to changes to the calculation of the technical provisions framework of insurers and insurance groups, amendments to the computation and flexibility of the Bermuda Solvency Capital Requirement, updates to the prudential rules and reporting forms to modify capital requirements and revisions to the fees charged to life insurers regulated by the BMA. In 2024, the National Association of Insurance Commissioners (“NAIC”) in the U.S. adopted changes to its Financial Analysis Handbook to provide additional guidance to regulators reviewing affiliated investment management agreements and added new regulatory considerations and guidance to assist regulators in assessing complex ownership structures.”

Annual report 2025A · The company itself

“We may be the target or subject of, or may have indemnification obligations related to, litigation, enforcement investigations or regulatory scrutiny. Regulators and other authorities generally have the power to bring administrative or judicial proceedings against insurance companies, which could result in, among other things, suspension or revocation of licenses, cease and desist orders, fines, civil penalties, criminal penalties or other disciplinary action.”

Annual report 2025A · The company itself

“Table of Contents Securitisation Regulation The EU Securitisation Regulation (the “Securitisation Regulation”) includes requirements in relation to transparency and risk retention and restricts AIFMs from investing in securitizations which do not comply with its provisions (“non-compliant securitizations”). The Securitisation Regulation also imposes an obligation on AIFMs to divest any interest in a non-compliant securitization. It is currently unclear if the Regulation applies to non-EU AIFMs marketing one or more alternative investment funds in the EEA under a national private placement regime.”

Annual report 2025A · The company itself

“Our U.K., other European and Asian operations and our investment activities worldwide are subject to a variety of regulatory regimes that vary by country. In the EU, examples of further legislation may include proposals for further changes to or reviews of the extent and interpretation of pay regulation, including under the EU Regulation on the prudential requirements of investment firms (Regulation (EU) 2019/2033) and its accompanying Directive (Directive (EU) 2019/2034) or the U.K. version, the Investment Firms Prudential Regime (which may have an impact on the retention and recruitment of key personnel), proposals for enhanced regulation of loan origination (see “—Alternative Investment Fund Managers Directive”) and new reporting requirements in relation to securities financing transactions.”

Annual report 2025A · The company itself

“In the U.K., additional rule changes have affected the approval of certain Ares professionals in the U.K. to work in the regulated financial services sector. Implementation of these new rules may increase our compliance burden and costs.”

Annual report 2025A · The company itself

“Table of Contents Each of the regulatory bodies with jurisdiction over us has regulatory powers dealing with many aspects of financial services, including the authority to grant, and in specific circumstances to cancel, permissions to carry on particular activities. We are involved regularly in trading activities that implicate a broad number of foreign (as well as U.S.) securities law regimes, including laws governing trading on inside information and market manipulation and a broad number of technical trading requirements that implicate fundamental market regulation policies. Violation of these laws could result in severe restrictions or prohibitions on our activities and damage to our reputation, which in turn could have a material adverse effect on our businesses in a number of ways, making it harder for us to raise new funds and discouraging others from doing business with us.”

Annual report 2025A · The company itself

“Alternative Investment Fund Managers Directive AIFMD applies to: (i) AIFMs established in the EEA that manage EEA or non-EEA AIFs; (ii) non-EEA AIFMs that manage EEA AIFs; and (iii) non-EEA AIFMs that market their AIFs to professional investors within the EEA. Non-EEA AIFMs do not currently benefit from marketing passport rights and may only market AIFs to investors in some EEA jurisdictions in accordance with national private placement regimes.”

Annual report 2025A · The company itself

“AIFMD II imposes a range of requirements on AIFMs which may increase the cost of doing business for AM Lux and Ares’ non-EEA AIFMs (including AMUKL) to the extent they market funds in the EEA and potentially disadvantages our funds as investors in private companies located in EEA member states compared to non-AIF/AIFM competitors that may not be subject to such requirements.”

Annual report 2025A · The company itself

“HM Treasury and the FCA are progressing a separate reform of the U.K’s alternative investment fund manager regime and in April 2025, each respectively published a consultation on a new U.K.-specific framework and a Call for Input. The proposed changes include (i) replacing the existing “full-scope” and “sub-threshold” AIFM categories with a more flexible tiering based on an AIFM’s size, investment base and investment activities; (ii) abolishing the “small registered AIF” category (except in respect of managers of social enterprise funds and registered venture capital funds) and requiring all AIFMs to become FCA-authorized; and (iii) implementing a streamlined regime for investment trust and REIT managers.”

Annual report 2025A · The company itself

“BDCs may issue and sell common stock at a price below net asset value per share only in limited circumstances, one of which is after obtaining stockholder approval for such issuance in accordance with the Investment Company Act. ARCC’s stockholders have, in the past, approved such issuances so that during the subsequent 12-month period, ARCC may, in one or more public or private offerings of its common stock, sell or otherwise issue shares of its common stock at a price below the then-current net asset value per share, subject to certain conditions including parameters on the amount of shares sold, approval of the sale by the directors and a requirement that the sale price be not less than approximately the market price of the shares of its common stock at specified times, less the expenses of the sale.”

Annual report 2025A · The company itself

“Certain of our vehicles have elected to be treated as a RIC or a REIT for U.S. federal income tax purposes. To maintain their status as a RIC or a REIT, such vehicles must meet, among other things, certain source of income, asset diversification and annual distribution requirements. Funds that have elected to be treated as RICs are required to generally distribute to their respective stockholders at least 90% of their respective investment company taxable income to maintain their RIC status.”

Annual report 2025A · The company itself

“Funds that have qualified as REITs must distribute at least 90% of their taxable income to their stockholders and meet, on a continuing basis, certain other complex requirements under the Code.”

Annual report 2025A · The company itself

“In addition, subject to certain exceptions, our BDCs 59 Table of Contents are generally prohibited from issuing and selling their common stock at a price below net asset value per share and from incurring indebtedness (including for this purpose, preferred stock), if the BDCs’ respective asset coverage ratio, as calculated pursuant to the Investment Company Act, equals less than 150% after giving effect to such incurrence.”

Annual report 2025A · The company itself

“As we have a significant number of public pension plans that are investors in our funds, these rules could impose significant economic sanctions on our businesses if we or one of the other persons covered by the rules make any such contribution or payment, whether or not material or with an intent to secure an investment from a public pension plan.”

Annual report 2025A · The company itself

“In addition, such investigations may require the attention of senior management and may result in fines if any of our funds are deemed to have violated any regulations, thereby imposing additional expenses on us. Any failure on our part to comply with these rules could cause us to lose compensation for our advisory services or expose us to significant penalties and reputational damage.”

Annual report 2025A · The company itself

“The U.K. continues to review its financial services and markets regime, introducing measures via initiatives such as the Edinburgh Reforms to diverge from aspects of the EU regime. To the extent such measures result in a material divergence between the U.K. and EU regulatory regime continues, compliance with two diverging regulatory regimes may increase the operational burden and cost to our operations in these jurisdictions. These complex issues and other by-products of Brexit may increase the costs of having operations, conducting business and making investments in the U.K. and Europe.”

Annual report 2025A · The company itself

“In recent years, the U.S. Department of Justice and the SEC have devoted greater resources to enforcement of the FCPA.”

Annual report 2025A · The company itself

“On September 1, 2025, the U.K. also introduced, under the ECCTA, a new failure to prevent fraud offence which will hold certain large companies criminally liable for fraud committed by the employees or associated persons. While we have developed and implemented policies and procedures designed to ensure strict compliance by us and our personnel with the FCPA, the U.K. Bribery Act and ECCTA, these policies and procedures may not be effective in all instances to prevent violations.”

Annual report 2025A · The company itself

“In addition, we could be adversely affected as a result of actual or alleged misconduct by personnel of portfolio companies, properties or projects in which our funds invest, if there are failures to comply with regulations or other legal and regulatory requirements that could expose us to litigation or regulatory action and otherwise adversely affect our businesses and reputation. Such misconduct could negatively affect the valuation of a fund’s investments and consequently affect our funds’ performance and negatively impact our businesses.”

Annual report 2025A · The company itself

“Under existing regulations, FERC and public utility commissions may, in some circumstances, slow, or impose restrictions on, investments in or transfers of regulated assets. Changes to regulations, or changes to interpretations thereof, by FERC or public utility commissions may similarly make regulated investments, acquisitions or dispositions more challenging or time-consuming, and may subject previously-exempt classes of transactions to new authorization requirements. While our investments are exposed to FERC and public utility commission regulation in a manner that is consistent with other participants in the power, infrastructure and energy sector, such regulations could nonetheless result in delays in making investments, delays in exiting investments or limitations or conditions that may adversely affect the ability of our funds to execute on their investment strategy with respect to such transactions as well as limit our flexibility in structuring or financing certain transactions.”

Annual report 2025A · The company itself

“Many of our funds’ investments are in critical infrastructure sectors, such as transportation systems, energy and digital infrastructure, which are generally subject to heightened regulatory scrutiny at the time of investment and ongoing compliance requirements.”

Annual report 2025A · The company itself

“The ARPA added a new subsection to Section 162(m) of the Code to expand the disallowance for deduction of certain compensation paid by publicly held corporations to cover the next five most highly compensated employees for the taxable year, which expansion will be effective for tax years beginning after December 31, 2026. The expansion of Section 162(m) is expected to generally reduce the amount of tax deductions available to us.”

Annual report 2025A · The company itself

“The IRA introduced a 15% minimum tax (“CAMT”) for corporations whose average annual adjusted financial statement income for any consecutive three-tax-year period preceding the tax year exceeds $1 billion and a 1% excise tax on the fair market value of stock repurchased by certain corporations after December 31, 2022. The IRA has not had a material impact on our income tax liability for 2025, but if we were to reach the applicable financial statement income thresholds, the CAMT rules could increase tax compliance complexity and result in additional administrative costs and income tax liabilities.”

Annual report 2025A · The company itself

“The U.K. has implemented two corporate criminal offenses: failure to prevent facilitation of U.K. tax evasion and failure to prevent facilitation of overseas tax evasion. Liability under these offences can be mitigated where the relevant business has in place reasonable prevention procedures. The scope of these offences is extremely wide and could have an impact on Ares’ global businesses.”

Annual report 2025A · The company itself

“Many of the jurisdictions in which our funds will make investments have now ratified, accepted and approved the OECD’s draft Multilateral Instrument (“MLI”) which brings into force a number of relevant changes to double tax treaties within scope. The MLI is intended to facilitate the speedy introduction by participating states of double tax treaty-related BEPS recommendations. While these changes continue to be introduced, there remains significant uncertainty as to whether and, if so, to what extent our funds or their subsidiaries may benefit from the protections afforded by such treaties and whether our funds may look to their partners in order to derive tax treaty or other benefits.”

Annual report 2025A · The company itself

“The proposals (commonly referred to as “BEPS 2.0”) are based on two “pillars”, involving the reallocation of taxing rights (“Amount A of Pillar One”), and a new global minimum corporate tax rate (“Pillar Two”). Under Amount A of Pillar One, multinational enterprises (“MNEs”) with total group revenues exceeding EUR 20 billion (or equivalent) in a given period and pre-tax profitability exceeding 10% calculated using an averaging mechanism will be subject to rules allocating 25% of profits in excess of a 10% profit margin to the jurisdictions within which they carry on business (subject to threshold rules). Certain entities are excluded, including certain investment funds and real estate investment vehicles (as respectively defined) which are the ultimate parent entity of the MNE group (and certain holding vehicles of such entities). There are also specific exclusions for MNEs carrying on specific low-risk activities, including “regulated financial services” (as defined).”

Annual report 2025A · The company itself

“Pillar Two imposes a minimum effective tax rate of 15% on MNEs that have consolidated revenues of at least EUR 750 million in at least two out of the last four years (i.e., broadly those MNEs which are required to undertake country by country reporting). Pillar Two introduces two related tax measures (the “GloBE Rules”): the income inclusion rule (“IIR”) imposes a top up tax on a parent entity where a constituent member of the MNE group has low taxed income while the undertaxed payment rule (“UTPR”) applies as a backstop if the constituent member’s income is not taxed by an IIR. Specified classes of entities which are typically exempt from tax are outside the scope of the Pillar Two GloBE Rules, including investment funds and real estate investment vehicles (as respectively defined) which are the ultimate parent entity of the MNE group (and certain holding vehicles of such entities).”

Annual report 2025A · The company itself

“Subject to the development and implementation of both Amount A of Pillar One and Pillar Two (including the implementation of the EU minimum tax directive by EU member states) and the details of any domestic legislation, double taxation treaty amendments and multilateral agreements which are necessary to implement them, effective tax rates could increase within the fund structure or on its investments, including by way of higher levels of tax being imposed than is currently the case, possible denial of deductions or increased withholding taxes and/or profits being allocated differently and/or penalties could be due. This could 90 Table of Contents adversely affect the returns of investors in our funds.”

Annual report 2025A · The company itself

“Congress and the current Presidential administration may consider legislation to further extend the holding period for carried interest to qualify for long-term capital gains treatment, have carried interest taxed as ordinary income rather than as capital gain, impose surcharges on carried interest or increase the capital gains tax rate. Tax authorities and legislators in other jurisdictions in which Ares has investments or employees could clarify, modify or challenge their treatment of carried interest.”

Annual report 2025A · The company itself

“In addition, cybersecurity is a priority for regulators in the U.S. and around the world. The SEC has adopted cybersecurity disclosure rules for public companies and has adopted amendments to Regulation S-P that require, among other things, written incident response programs, customer notification in certain circumstances and enhanced oversight of service providers. In June 2025, the SEC formally withdrew certain pending proposed rules relating to cybersecurity risk management for investment advisers and certain funds; however, regulators continue to focus on cybersecurity through examinations, 93 Table of Contents enforcement activity and guidance, and future rulemaking could re-emerge.”

Annual report 2025A · The company itself

“Many jurisdictions in which we operate have laws and regulations relating to data protection, privacy, cybersecurity and information security to which we may be subject, including the CCPA, the New York SHIELD Act, the GDPR and the U.K. GDPR (collectively, “Privacy Laws”). These Privacy Laws and related regulations continue to evolve and may conflict with one another, resulting in compliance challenges.”

Annual report 2025A · The company itself

“Moreover, to the extent that these laws and regulations or the enforcement of the same become more stringent, or if new laws or regulations are enacted, our financial performance or plans for growth may be adversely impacted. In addition, compliance with applicable Privacy Laws may require adhering to stringent legal and operational requirements, which could increase compliance costs for us and require the dedication of additional time and 94 Table of Contents resources to compliance.”

Annual report 2025A · The company itself

“In May 2024, the SEC adopted cybersecurity regulations as an amendment to Regulation S-P designed to establish a federal “minimum standard” for covered institutions to adopt an incident response program to govern their response to any unauthorized access of customer information. The adopted rule requires compliance as of December 2025 and applies to us as it includes broker-dealers, investment companies and registered investment advisers.”

Annual report 2025A · The company itself

“There may be substantial financial penalties or fines for breach of Privacy Laws (which may include insufficient security for our personal or other sensitive information). For example, the maximum penalty for breach of the GDPR is the greater of 20 million Euros and 4% of group annual worldwide turnover, and fines for each violation of the California Consumer Privacy Act are $2,500 per violation, or $7,500 per violation for intentional violations.”

Annual report 2025A · The company itself

“Regulations impacting the insurance industry could adversely affect our business and our operations, and our provision of products and services to insurance companies, including through Aspida, subjects us to a variety of risks and uncertainties. The insurance industry is subject to significant regulatory oversight, both in the U.S. and abroad. Regulatory authorities in many relevant jurisdictions have broad administrative, and in some cases discretionary, authority with respect to insurance companies and/or their investment advisers, which may include, among other things, the investments insurance companies may acquire and hold, marketing practices, affiliate transactions, reserve requirements, capital adequacy including insurance company licensing and examination, agent licensing, establishment of reserve requirements and solvency standards, premium rate regulation, admissibility of assets, policy form approval, unfair trade and claims practices, advertising, maintaining policyholder privacy, payment of dividends and distributions to shareholders, investments, review and/or approval of transactions with affiliates, reinsurance, acquisitions, mergers and other matters.”

Annual report 2025A · The company itself

“The BMA considers us to be the “shareholder controller” (as defined in the Bermuda Insurance Act) of Aspida Re, a Bermuda Class E insurance company. Aspida Re is subject to regulation and supervision by the BMA, and compliance with all applicable Bermuda law and Bermuda insurance statutes and regulations, including but not limited to the Bermuda Insurance Act.”

Annual report 2025A · The company itself

“Medicintekniska produkter omges av omfattande regelverk, särskilt inom EU och i USA. Arjo säkerställer att koncernens produkter följer lagar och regler på samtliga marknader där bolaget är verksamt.”

Annual report 2024A · The company itself

“90 procent av produkterna som Arjo producerar är CE-märkta.”

Annual report 2024A · The company itself

“G1 - Affärsetik Mutor och korruption Potentiell negativ påverkan Mutor och korruption Potentiell negativ påverkan kopplat till bristande affärsetik, till exempel mutor och korruption.”

Annual report 2024A · The company itself

“Långsiktiga relationer med både kunder och leverantörer är därmed baserade på god affärsetik och tydliga principer för regelefterlevnad. Arjo har ett stort nätverk av leverantörer och andra affärspartners, och ställer samma höga krav på dem som på den egna verksamheten, med nolltolerans mot alla typer av korruption, bedrägerier och mutor.”

Annual report 2024A · The company itself

“In addition, in the U.S., legislators are continuing to enact comprehensive cybersecurity laws. For example, we are subject to the New York State Department of Financial Services Cybersecurity Regulation for Financial Services Companies, which were substantively amended in 2023.”

Annual report 2025A · The company itself

“Many of our activities throughout the world, especially regulated businesses such as our insurance brokerage, securities broker-dealer and investment advisory services, are subject to supervision and regulations promulgated by regulatory or self-regulatory bodies such as the SEC, the NYSE, the DOJ, the IRS, the Financial Crimes Enforcement Network, the FTC and FINRA in the U.S., the FCA in the U.K., the Australian Securities and Investments Commission in Australia and insurance regulators in nearly every jurisdiction in which we operate. Our retirement-related consulting and investment advisory services are subject to pension law and financial regulation in many countries. Our activities are also subject to a variety of other laws, rules and regulations addressing licensing, cybersecurity, data privacy, AI, wage-and-hour standards, employment and labor relations, competition, anti-corruption, currency, the conduct of business, reserves and the amount of local investment with respect to our operations in certain countries.”

Annual report 2025A · The company itself

“The agreements governing our debt include covenants that, among other things, restrict our ability to dispose of assets, incur additional debt, engage in certain asset sales, mergers, acquisitions or similar transactions, create liens on assets, engage in certain transactions with affiliates, change our business or make investments, and require us to comply with certain financial and legal covenants. The restrictions in the agreements governing our debt may prevent us from taking actions that we believe would be in the best interest of our business and our stockholders and may make it difficult for us to execute our business strategy successfully or effectively compete with companies that are not similarly restricted.”

Annual report 2025A · The company itself

“År 2022 påminner FDA sjukvården om att säkerhetsinformation bör ges till patienter innan de får GBCA-injektioner. Myndigheten uppger att “... vi kräver flera åtgärder för att varna vårdpersonal och patienter om gadoliniumretention efter en MR med en GBCA. Dessa inkluderar att kräva en patientmedicineringsguide som varje patient kommer att bli ombedd att läsa innan de får en GBCA.”

Annual report 2024A · The company itself

“Stora driftstörningar Oförmåga att attrahera och behålla engagerade nyckelpersoner En kultur av kvalitet och regelefterlevnad med rutiner för hantering av kritiska händelser är etablerad och upprätthålls Lämpliga urval och styrning av kritiska leverantörer är etablerat och utvärderas kontinuerligt IT-infrastruktur, säkerhet och relaterade processer utvecklas och övervakas kontinuerligt Medarbetarengagemang främjas med en stark kultur och konkurrenskraftiga arbetsvillkor Affärsmiljö och kommersialisering Förändringar i den politiska, ekonomiska eller hälsovårdsmässiga miljön kan påverka kommersiellaoch partnermöjligheter och värdet av tillgångarna i Ascelia Pharma. Förändringarna kan inkludera nya rekommendationer från betalare eller medicinska organisationer för hantering av en patientgrupp till nya konkurrerande läkemedel som vänder sig till samma målgrupp eller otillfredsställda behov.”

Annual report 2024A · The company itself

“Our domestic and international insurance subsidiaries are subject to extensive regulatory oversight, including: restrictions and requirements related to licensing; capital, surplus and dividends; underwriting limitations; the ability to enter, exit and continue to operate in markets; statutory accounting and other disclosure requirements; the ability to provide, terminate or cancel certain coverages; premium rates, including regulatory ability to disapprove or reduce the premium rates companies may charge; trade and claims practices; product forms, including regulatory ability to disapprove new product filings; content of disclosures to consumers; type, amount and valuation of investments; assessments or other surcharges for guaranty funds and companies’ ability to recover assessments through premium increases; and market conduct and sales practices.”

Annual report 2025A · The company itself

“The U.S. and foreign laws and regulations that apply to our operations are complex and may change rapidly, and our efforts to comply with them require significant resources and increase the costs and risks of doing business. The regulations we are subject to have become more stringent over time, may decrease the need for our services, impose significant operational limits on our business and may be inconsistent across jurisdictions. Further, the laws and regulations affecting our business are subject to change as a result of, among other things, new interpretations and judicial decisions, and any such changes may increase the regulatory requirements imposed on us, impact the way we are able to do business, impact efforts to protect intellectual and other property, and significantly harm our business and results of operations.”

Annual report 2025A · The company itself

“Among other things, the terms of the RSA require more frequent rate filings for lender-placed insurance. This could result in downward pressure on premium rates for these products. If such filings result in significant decreases in premium rates for our lender-placed insurance products, our cash flows and results of operations could be materially adversely affected.”

Annual report 2025A · The company itself

“In the normal course of business, as a regulated entity, we often need to place assets in service and establish historical test periods before rate cases that seek to adjust our allowed returns to recover that investment can be filed. Further, the regulatory review process can be lengthy in the context of traditional ratemaking. Because of this process, we could suffer the negative financial effects of having placed assets in service without the benefit of rate relief, which is commonly referred to as “regulatory lag.””

Annual report 2025A · The company itself

“PHMSA requires pipeline operators to develop integrity management programs to comprehensively evaluate certain areas along their pipelines and to take additional measures to protect pipeline segments located in “high consequence areas” where a leak or rupture could potentially do the most harm. As a pipeline operator, the Company is required to: •perform ongoing assessments of pipeline integrity; •identify and characterize applicable threats to pipeline segments that could impact a “high consequence area”; •improve data collection, integration, and analysis; •repair and remediate the pipeline as necessary; and •implement preventative and mitigating actions. The Company incurs significant costs to comply with existing PHMSA and comparable state regulations.”

Annual report 2025A · The company itself

“Similar to most companies, we rely upon access to both short-term and long-term credit and capital markets to 17 Table of Contents satisfy our liquidity requirements. If adverse credit conditions were to cause a significant limitation on our access to the private credit and public capital markets, we could see a reduction in our liquidity.”

Annual report 2025A · The company itself

“(2)Regulatory excess deferred taxes represent changes in our net deferred tax liability related to our cost of service ratemaking due to the enactment of the Tax Cuts and Jobs Act of 2017 (the "TCJA"), a Kansas legislative change enacted in fiscal 2020, and a Louisiana legislative change enacted in fiscal 2025.”

Annual report 2025A · The company itself

“Risk arises from non-compliance or breaches to existing processes and procedures implemented. Regulatory changes can also influence the markets and local operations, either in a positive or in a negative way.”

Annual report 2024A · The company itself

“B2 Impact continued to strengthen its risk management throughout 2024, increasing and aligning oversight with regulatory requirements to ensure alignment and compliance with the European NPL Directive requirements framework, which governs the management, servicing, and purchase of non-performing loans (NPLs) across the European Union.”

Annual report 2024A · The company itself

“The NPL sector is strictly regulated and as a publicly listed company within this industry we need to ensure compliance and maintain licenses to operate. • Desktop research • Conferences and seminars • Audits • All sustainability topics, but in particular E1 Climate change Sustainability Statement Stakeholder group Stakeholder description Engagement activities Interest and views Employees Includes current and potential employees.”

Annual report 2024A · The company itself

“We operate in accordance with the General Data Protection Regulation (GDPR) requirements, in addition to any local legislation in the countries where we operate.”

Annual report 2024A · The company itself

“Regulation General BD's operations are global and are affected by complex state, federal and international laws relating to healthcare, environmental protection, occupational health and safety, antitrust, anti-corruption, marketing, fraud and abuse (including anti-kickback and false claims laws), export control, transportation, product safety and efficacy, employment, labor, privacy and data protection, customs, exports, artificial intelligence (“AI”) and other areas. Many of the agencies enforcing these laws have increased their enforcement activities with respect to medical device manufacturers in recent years.”

Annual report 2025A · The company itself

“The Consent Decree authorizes the FDA, in the event of any violations in the future, to order us to cease manufacturing and distributing infusion pumps, recall products and take other actions. We may be required to pay damages of $15,000 per day per violation if we fail to comply with any provision of the Consent Decree, up to $15 million per year.”

Annual report 2025A · The company itself

“BlackRock’s business may be impacted by numerous regulatory reform initiatives occurring around the world. Any such initiative, or any new laws or regulations or changes to, or in the enforcement of, existing laws or regulations, could materially and adversely impact the scope or profitability of BlackRock’s business activities, lead to business disruptions, require BlackRock to alter its business or operating activities and expose BlackRock to additional costs (including compliance and legal costs) as well as reputational harm.”

Annual report 2025A · The company itself

“The application of tax regulations involves numerous uncertainties and, in the normal course of business, US and non-US tax authorities may review and challenge tax positions adopted by BlackRock. These challenges may result in adjustments to, or impact the timing or amount of, taxable income, deductions or other tax allocations, which may adversely affect BlackRock’s effective tax rate and overall financial condition.”

Annual report 2025A · The company itself

“SEC US Treasury Clearing Mandate In December 2023, the SEC adopted rules mandating central clearing of US Treasury repurchases and certain other Treasury transactions. The rules require many market participants, including a large number of BlackRock funds and accounts, to clear Treasury repurchase transactions and potentially certain cash Treasury securities transactions through a clearing agency registered with the SEC, which could increase transaction costs for BlackRock’s clients.”

Annual report 2025A · The company itself

“Beneficial Ownership Reporting In 2025, the SEC clarified its guidance on when a 5% shareholder’s engagement with an issuer could lead to the shareholder being considered to hold shares with the “purpose or effect of changing or influencing control of the issuer,” and therefore cause the shareholder to lose eligibility to report its beneficial ownership on short-form Schedule 13G. The guidance explains that shareholder engagement that “exerts pressure on management to implement specific measures or changes to a policy” may be considered “influencing” control of the issuer.”

Annual report 2025A · The company itself

“Financial Crimes Enforcement Network (“FinCEN”) Rule for Registered Investment Advisers In 2024, FinCEN issued a final rule requiring registered investment advisers to adopt new anti-money laundering requirements. Under the rule, registered investment advisers will be required to establish written risk-based anti-money laundering programs and report suspicious activity to FinCEN under the Bank Secrecy Act of 1970 (the “Bank Secrecy Act”), as well as comply with Bank Secrecy Act reporting and recordkeeping requirements, which may increase BlackRock’s compliance burdens and costs.”

Annual report 2025A · The company itself

“SEC Rules on Form PF In 2024, the SEC adopted new rules and amendments to Form PF for registered investment advisers requiring new disclosures, filing obligations and enhanced reporting. In September 2025, the SEC extended the compliance deadline until October 2026. Implementing these rules and amendments may significantly increase BlackRock’s reporting, disclosure and compliance obligations and create operational complexity for BlackRock’s alternatives products.”

Annual report 2025A · The company itself

“INTERNATIONAL REGULATORY REFORM Enhanced Regulatory Scrutiny of Technology Service Providers to Financial Services Firms The EU’s Digital Operational Resilience Act (“DORA”), which focuses on direct regulation of providers and users of technology and data services, became applicable in 2025. DORA, among other things: (1) introduced additional governance, risk management, incident reporting, resilience testing and information sharing requirements to several of BlackRock’s European entities and certain Aladdin clients; and (2) may potentially subject Aladdin to additional oversight. The European Supervisory Authorities are using data collected under DORA to assess which third party suppliers should be designated as critical to the EU financial system and become subject to further regulatory oversight.”

Annual report 2025A · The company itself

“Retail Investment Strategy The EU continues to consider a proposed Retail Investment Strategy package of amendments intended to improve retail investor access to financial markets while ensuring investor protections. When enacted, these changes could impact clients’ product preferences and may increase costs for BlackRock in European markets due to additional requirements on distributors and product providers.”

Annual report 2025A · The company itself

“EMIR 3.0 The EU legislative package known as “EMIR 3.0” introduces key changes to derivatives clearing, margining and reporting requirements in the European Market Infrastructure Regulation (EMIR), including: (1) a requirement to hold an “active account” with an EU central counterparty for clearing certain euro-denominated instruments; (2) new reporting requirements for cleared trades; (3) revised clearing thresholds for financial and non-financial counterparties; and (4) amendments related to clearing to the UCITS directive. EMIR 3.0 was adopted in December 2024 and is being implemented in phases, with initial compliance obligations effective from June 2025 and further reporting obligations expected through 2026. EMIR 3.0 is expected to impact EU counterparties as well as UK and non-EU entities trading with EU firms, and the collective impact of the package may increase operational complexity, necessitate a reassessment of clearing and trading strategies, and lead to higher transaction costs for BlackRock and its clients.”

Annual report 2025A · The company itself

“EU Supervisory Reform In December 2025, the EC published a proposal for wide-ranging reforms to EU capital markets rules, including changes to the supervisory regime for asset managers. Depending on the terms of the final reforms, such changes could add additional layers of supervisory oversight to asset managers at the EU level and slow supervisory outcomes and authorisations.”

Annual report 2025A · The company itself

“Conduct Regulation The FCA continues to focus on conduct regulation, including the effectiveness of implementation of the Consumer Duty by all asset management firms, including BlackRock’s UK subsidiaries and across a range of product types sold to retail investors including those related to digital assets. The Consumer Duty rules require firms to act to deliver good outcomes for retail customers in their manufacture and distribution of products and services, in respect of price and value, consumer understanding and consumer support. Any failure to meet the FCA’s regulatory expectations could expose BlackRock to regulatory sanctions and increased reputational risk.”

Annual report 2025A · The company itself

“Consumer Composite Investments The FCA has finalized product information requirements for consumer composite investments (CCIs) replacing the current PRIIPs regime, which was derived from EU law and was assimilated into UK law after Brexit. The transition to the CCI regime may increase operational complexity and regulatory compliance costs for BlackRock.”

Annual report 2025A · The company itself

“US Banking Regulation One of BlackRock’s subsidiaries, BTC, is organized as a nationally-chartered limited purpose trust company that does not accept deposits or make commercial loans. Accordingly, BTC is examined and supervised by the OCC and is subject to various banking laws and regulations enforced by the OCC, such as laws and regulations governing capital adequacy, fiduciary activities, conflicts of interest, self-dealing, and the prevention of financial crime, including money laundering. BTC is also a member of the Federal Reserve System and is subject to various Federal Reserve regulations applicable to member institutions, such as regulations restricting transactions with affiliates.”

Annual report 2025A · The company itself

“Operating in international markets increases BlackRock’s operational, political, regulatory and other risks. As a result of BlackRock’s extensive international operations, investments and clients, the Company faces associated operational, regulatory, reputational, political and foreign exchange rate risks, many of which are outside of the Company’s control.”

Annual report 2025A · The company itself

“Additionally, our ability to deploy capital in certain countries may be adversely impacted by U.S. and foreign government policy changes and regulations. Any potential time delay associated with approval may make it more difficult for our funds to deploy capital, as well as to exit and realize value from investments.”

Annual report 2025A · The company itself

“For example, certain states have, and others may in the future, increased state regulatory review measures of investments by private equity into the patient-facing healthcare industry.”

Annual report 2025A · The company itself

“Presidential administration issued an executive order in January 2026 seeking to restrict institutional investor ownership of single-family homes, and certain states have considered, and others may seek to enact, legislation aimed at doing so.”

Annual report 2025A · The company itself

“Regulatory measures aimed at reducing burden on U.S. banks, such as less onerous bank regulatory capital requirements, may create additional competition for certain of our credit strategies. See “—Financial regulatory changes in the United States could adversely affect our business.””

Annual report 2025A · The company itself

“Data security and privacy compliance obligations to which we are subject impose compliance costs on us, which could increase significantly as laws and regulations evolve globally. Our compliance obligations include those relating to U.S. laws and regulations, including, without limitation, state regulations such as the CPRA, which provides for enhanced consumer protections for California residents, a private right of action for data breaches and statutory fines and damages for data breaches or other California Consumer Privacy Act (“CCPA”) violations, as well as a requirement of “reasonable” cybersecurity.”

Annual report 2025A · The company itself

“Table of Contents Any inability, or perceived inability, by us or our funds’ portfolio companies to adequately address data protection or privacy concerns, or comply with applicable laws, regulations, policies, industry standards and guidance, contractual obligations, or other legal obligations, even if unfounded, could result in significant legal, regulatory and third-party liability, increased costs, disruption of our and our funds’ portfolio companies’ business and operations, and a loss of client (including investor) confidence and other reputational damage. Many regulators have indicated an intention to take more aggressive enforcement actions regarding data security and privacy matters, and private litigation resulting from such matters is increasing and resulting in progressively larger judgments and settlements. Specifically, the SEC’s stated 2026 examination priorities include an intended focus on adviser’s policies and practices as it relates to the prevention of interruptions to mission-critical services and protection of investor information, records and assets.”

Annual report 2025A · The company itself

“Extensive regulation of our businesses affects our activities and creates the potential for significant liabilities and penalties. The possibility of increased regulatory focus could result in additional burdens on our business. Our business is subject to extensive regulation, including periodic examinations, inquiries and investigations, by governmental agencies and self-regulatory organizations in the jurisdictions in which we operate around the world.”

Annual report 2025A · The company itself

“In recent years, the SEC has proposed, and in some instances, adopted, a number of rules related to private funds and private fund advisors that impact our business and operations, including by increasing our operational and compliance costs to comply effectively. The SEC and other of our regulators can be expected to continue to propose rules that impact our operations, including by increasing compliance burdens and costs, enhancing the risk of regulatory action, which could adversely impact our reputation and our fundraising efforts, and imposing limitations on our operations or investing activities.”

Annual report 2025A · The company itself

“The FSOC can designate certain financial companies as nonbank financial companies subject to supervision by the Board of Governors of the Federal Reserve System (the “Federal Reserve Board”). If we were to be designated as such by the FSOC, or if any of our business activities were to be identified by the FSOC as warranting enhanced regulation or supervision by certain regulators, we could be subject to a materially greater regulatory burden. This could adversely impact our compliance and other costs, the implementation of certain of our investment strategies and our profitability.”

Annual report 2025A · The company itself

“Whistleblower claims have been substantial since the enactment of these provisions. Addressing such claims could generate significant expenses and take up significant management time for us and our funds’ portfolio companies, even if such claims are frivolous or without merit.”

Annual report 2025A · The company itself

“Regulation Best Interest requires such broker-dealers to evaluate available alternatives, including those that may have lower expenses and/or lower investment risk than our investment funds. The continued regulatory focus on Regulation Best Interest may negatively impact whether certain broker-dealers and their associated persons are willing to recommend investment products, including certain of our funds, to retail customers, which may adversely impact our ability to distribute our products to certain investors.”

Annual report 2025A · The company itself

“Regulatory authorities in many relevant jurisdictions have broad regulatory (including through certain regulatory support organizations), administrative, and in some cases discretionary, authority with respect to insurance companies and/or their investment advisors, which may include, among other things, the investments insurance companies may acquire and hold, marketing practices, affiliate transactions, reserve requirements and capital adequacy. These requirements are primarily concerned with the protection of policyholders, and regulatory authorities often have wide discretion in applying the relevant restrictions and regulations to insurance companies, which may indirectly affect us.”

Annual report 2025A · The company itself

“Regulators have also increasingly focused on the risk profile of certain investments held by insurance companies (including, without limitation, all or certain tranches of collateralized loan obligations and other structured securities), appropriateness of investment ratings (including private ratings) and potential conflicts of interest, including affiliated investments, and potential misalignment of incentives and any potential risks from these and other aspects of an insurance company’s relationship with alternative or private credit asset managers that may impact the insurance company’s risk profile. This enhanced scrutiny may increase the risk of regulatory actions against us and could result in new or amended regulations that limit our ability, or make it more burdensome or costly, to enter into new investment management agreements with insurance companies and thereby grow our insurance strategy.”

Annual report 2025A · The company itself

“Many of the investment products and strategies we originate or develop for, or other assets or investments we include in, insurance company portfolios will be rated and a ratings downgrade or any other negative action by a rating agency or the 44 Table of Contents NAIC’s Securities Valuation Office (“SVO”), as applicable, with respect to such products, assets or investments could make them less attractive and limit our ability to offer such products to, or invest or deploy capital on behalf of, insurers. Furthermore, insurance companies are subject to certain minimum capital and surplus requirements that vary by the jurisdiction where the insurance company is domiciled and are generally subject to change over time.”

Annual report 2025A · The company itself

“In Europe we are subject to, among others, the EU Alternative Investment Fund Managers Directive (“AIFMD”), the EU regulation on over-the-counter (“OTC”) derivative transactions, central counterparties and trade repositories (“EMIR”), the EU Central Securities Depositories Regulation (“CSDR”) and the Markets in Financial Instruments Directive 2014 (2014/65/EU) (“MiFID II”). These regimes and regulations involve enhanced internal governance, disclosure and reporting requirements, create significant compliance and administrative burdens, and may require meaningful changes to the ways in which we conduct our business and operations. In addition, certain changes to AIFMD that comes into effect in 2026 may limit the use of leverage in certain funds, which could impact their fund returns, as well as may restrict certain alternative investment funds from marketing in specific EEA jurisdictions, which may impact our ability to raise capital from EEA investors.”

Annual report 2025A · The company itself

“Table of Contents Certain regulatory requirements in the EU and U.K. intended to enhance protection for retail investors and impose additional obligations on the distribution of certain products to retail investors may lead to increased costs and limit our ability to access capital from retail investors in certain jurisdictions. These include EU and U.K. rules requiring that retail investors in packaged retail investment and insurance products receive key information documents and U.K. rules enhancing duties related to distribution of financial products to retail investors.”

Annual report 2025A · The company itself

“For example, the SEC will be responsible for examining investment advisers’ compliance with a U.S. Department of Treasury’s Financial Crimes Enforcement Network (“FinCEN”) rule currently scheduled to go into effect January 2028 that requires certain investment advisers and to, among other measures, adopt an anti-money laundering and countering the financing of terrorism (“AML/CFT”) program, file certain reports with FinCEN and to maintain records related to such activities. The application of these rules would impose significant compliance costs on us.”

Annual report 2025A · The company itself

“Further, many of our funds’ infrastructure investments are in critical infrastructure sectors, such as transportation systems, energy and digital infrastructure, which are generally subject to heightened regulatory scrutiny at the time of investment and ongoing compliance requirements. Such requirements are likely to expand our compliance burdens, costs and enforcement risks.”

Annual report 2025A · The company itself

“Any actual or perceived failure to comply with these requirements may result in, among other things, revocation of required licenses or registrations, loss of approved status, private litigation, regulatory or governmental investigations, administrative enforcement actions, sanctions, civil and criminal liability, monetary penalties, and constraints on our ability to continue to operate. It is also possible that current or future laws or regulations could be interpreted or applied in a manner that would prohibit, alter, or impair our existing or planned products and services, or that could require costly, time-consuming, or otherwise burdensome compliance measures from us.”

Annual report 2025A · The company itself

“Payments Regulation Various laws and regulations govern the payments industry in the United States and globally. For example, certain jurisdictions in the United States require a license to offer money transmission services, such as Cash App’s peer-to-peer payments, and we maintain a license in each of those jurisdictions and comply with new license requirements as they arise.”

Annual report 2025A · The company itself

“We are subject to a wide variety of local, state, federal, and international laws, regulations, licensing schemes, and industry standards in the United States and in other countries in which we operate.”

Annual report 2025A · The company itself

“These laws, rules, regulations, and standards are enforced by multiple authorities and governing bodies in the United States, including federal agencies, such as the FDIC, the SEC, FinCEN, the Consumer Financial Protection Bureau ("CFPB"), the Department of Justice ("DOJ"), the Federal Trade Commission, the IRS and Office of Foreign Assets Control, self-regulatory organizations, and numerous state and local agencies, such as state money transmission license regulators and virtual currency regulators.”

Annual report 2025A · The company itself

“As a licensed money transmitter and virtual currency business, we are subject to important obligations and restrictions. We have obtained licenses to operate as a money transmitter and to engage in virtual currency business activity in the U.S. and in the states where this is required, as well as in some non-U.S. jurisdictions, including but not limited to the EU, the U.K., and Australia.”

Annual report 2025A · The company itself

“For example, in January 2025, we entered into a settlement agreement and consent order with various state money transmission license regulators related to aspects of our Bank Secrecy Act/anti-money laundering program.”

Annual report 2025A · The company itself

“We are subject to a number of regulatory risks in the BNPL space. The regulation of BNPL products is evolving, and states or countries have and may continue to pass new or additional regulations or additional and changing legal, regulatory, tax, licensing, and compliance requirements and industry standards that could adversely impact our BNPL products.”

Annual report 2025A · The company itself

“As a licensed entity, we are subject to obligations and restrictions including with respect to the investment of customer funds, reporting requirements, bonding requirements, and inspection by state and federal regulatory agencies concerning those aspects of our business considered money transmission and regulated virtual currency business.”

Annual report 2025A · The company itself

“The FDIC’s approval is also contingent on us maintaining a Capital and Liquidity Maintenance Agreement as well as a Parent Company Agreement. The Capital and Liquidity Maintenance Agreement requires, among other things, that we maintain a third-party line of credit for the benefit of Square Financial Services acceptable to the FDIC; purchase any loan from Square Financial Services at the greater of the cost basis or fair market value, if deemed necessary by the FDIC or Square Financial Services; and establish and maintain a reserve deposit of $50 million at an unaffiliated third-party bank that Square Financial Services could draw upon in the event that we fail to provide sufficient funds to maintain Square Financial Services’ capital ratios at the required levels.”

Annual report 2025A · The company itself

“Government Regulation Our business operates globally and is subject to a wide range and sometimes conflicting set of evolving laws and regulations across multiple jurisdictions including those relating to payments, the digital marketplace, data protection and privacy, competition, consumer protection, and the travel industry (e.g., the EU's Travel Package Directive).”

Annual report 2025A · The company itself

“For example, following the European Commission's designation of us as a gatekeeper under the Digital Markets Act ("DMA") and Booking.com as a "Very Large Online Platform" under the Digital Services Act ("DSA"), we became subject to new requirements and scrutiny. Similarly, as we expand our payment offerings, any failure by us to comply with changes in European payment services regulation, including Payments Services Directive 3 and the proposed Payment Services Regulation, could limit our ability to offer certain payment features in the European Union.”

Annual report 2025A · The company itself

“In addition, as our payment processing activities develop or expand into different geographies, we are subject to additional regulations, including financial services and export controls regulations, which would result in increased compliance costs and complexities, including those associated with the implementation of new or advanced internal controls.”

Annual report 2025A · The company itself

“Regulators (or we) may determine, and in some cases are likely to determine, that certain aspects of our business are subject to laws that govern payments activities, such as money transmission and online payments processing, which could require us to obtain licenses to continue to operate in certain jurisdictions or result in modification or interruption of our business plans, which would materially adversely affect our business and results of operations.”

Annual report 2025A · The company itself

“Regulatory Environment As a global company, we are governed by federal, state, local and international laws of general applicability relating to, among other things, employment, labor, privacy and data protection, governance and securities, anti-corruption, fraud and abuse (including anti-kickback and false claims laws), competition, trade and export controls. In general, the scope and complexity of regulations applicable to our business has increased over time.”

Annual report 2025A · The company itself

“We are subject to a wide range of global privacy, data‑protection, and cross‑border data‑transfer laws. In the United States, federal and state regulations govern the confidentiality and security of personal information, including health data. In the European Union, the General Data Protection Regulation (GDPR) imposes strict requirements and significant potential penalties. China’s data‑protection and cross‑border transfer laws, including requirements under the Personal Information Protection Law (PIPL) and related regulations, impose strict obligations on how data involving Chinese individuals may be handled, along with similar regulations in other jurisdictions, impose additional obligations on how personal data may be collected, stored, and transferred, including data‑localization and government‑approval requirements.”

Annual report 2025A · The company itself

“Our manufacturing facilities in Costa Rica operate under the Free Trade Zone regime, and we also benefit from tax holidays and tax incentive grants in various other countries. Unless these incentives and grants are extended, they will expire between 2028 and 2034.”

Annual report 2025A · The company itself

“Regulation The securities and financial services industries are subject to extensive regulation in the U.S. and in other jurisdictions. As a matter of public policy, regulatory bodies in the U.S. and the rest of the world are charged with safeguarding the integrity of the securities and other financial markets and with protecting the interests of investors participating in those markets. Due to the nature of our services and the markets we serve, these regulatory bodies impact our businesses in various manners.”

Annual report 2026A · The company itself

“In the U.S., the securities and financial services industries are subject to regulation under both federal and state laws. At the federal level, the SEC regulates the securities industry, along with the Financial Industry Regulatory Authority, Inc. (“FINRA”), the various stock exchanges, and other SROs. In addition, SEC rules require public companies to reimburse banks and broker-dealers for the expense of distributing certain stockholder communications to beneficial owners of securities held in street name, and those reimbursement rates, as well as fees that can be charged for proxy services are set by the NYSE.”

Annual report 2026A · The company itself

“As a provider of services to financial institutions and issuers of securities, our services, such as our proxy and shareholder report processing and distribution services, are provided in a manner that assist our clients in complying with the laws and regulations to which they are subject. As a result, the services we provide may be required to change as applicable laws and regulations are adopted or revised.”

Annual report 2026A · The company itself

“As a provider of technology services to financial institutions, certain aspects of our U.S. operations are subject to regulatory examination by the Federal Financial Institutions Examination Council (“FFIEC”), an interagency body of the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, the National Credit Union Administration, and the Consumer Financial Protection Bureau. Periodic examinations by the FFIEC generally include areas such as internal audit, risk management, business continuity planning, information security, systems development, operational resiliency, and third-party vendor management to identify potential risks related to our services that could adversely affect our banking and financial services clients.”

Annual report 2026A · The company itself

“In addition, our business process outsourcing, fund processing, registered fund distribution, and transfer agency solutions, as well as the entities providing those services, are subject to regulatory oversight. Our business process outsourcing and mutual fund processing services are performed by a broker-dealer, Broadridge Business Process Outsourcing, LLC (“BBPO”). BBPO is registered with the SEC, is a member of FINRA and is required to participate in the Securities Investor Protection Corporation (“SIPC”).”

Annual report 2026A · The company itself

“Matrix Trust Company (“Matrix Trust”) is a Colorado state chartered, non-depository trust company and National Securities Clearing Corporation trust member, whose primary business is to provide cash agent, custodial, and directed trustee services to institutional customers, and investment management services to its collective investment trust funds (“CITs”). As a result, Matrix Trust is subject to various regulatory capital requirements administered by the Colorado Division of Banking and the Arizona Department of Insurance and Financial Institutions, as well as the National Securities Clearing Corporation. Specific capital guidelines that involve quantitative measures of assets, liabilities, and certain off-balance sheet items, when applicable, must be met.”

Annual report 2026A · The company itself

“Our transfer agency business, Broadridge Corporate Issuer Solutions, is subject to certain SEC rules and regulations, including regarding annual reporting, examination, internal controls, proper safeguarding of issuer and shareholder funds and securities, maintaining a written Identity Theft Prevention Program, and other obligations relating to its operations. Our transfer agency business is subject to certain NYSE requirements concerning operational standards as a transfer agent or registrar for NYSE-listed companies and is also subject to IRS regulations regarding tax reporting and withholding.”

Annual report 2026A · The company itself

“In January 2026, we acquired Acolin Group Holdco Limited (“Acolin”), a European provider of cross-border fund distribution and regulatory services and included in the Company’s ICS reportable segment. Certain subsidiaries of Acolin are subject to supervision by the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, “Bafin”) in Germany, and by the Swiss Financial Market Supervisory Authority (“FINMA”) in Switzerland. Acolin is therefore subject to regulations concerning many aspects of its businesses, including conduct requirements, minimum capital requirements, anti-money laundering prevention, the protection of client assets where applicable, record retention, and the oversight of outsourced functions, as well as the supervision of directors, officers, and employees.”

Annual report 2026A · The company itself

“Certain of our business units are required to comply with anti-money laundering (“AML”) laws and regulations in the U.S., such as the Bank Secrecy Act, as amended by the USA PATRIOT Act of 2001 (collectively, the “BSA”), the BSA implementing regulations of the Financial Crimes Enforcement Network (“FinCEN”), a bureau of the U.S. Department of the Treasury, the AML laws and regulation in Germany, such as the German Anti-Money Laundering Act, and similar laws and regulations in foreign jurisdictions where we do business. Our U.S. business units are also subject to the relevant aspects of regulations and guidance published by FinCEN (as discussed below), which includes the Know Your Customer (“KYC”) requirements promulgated by FinCEN.”

Annual report 2026A · The company itself

“Privacy laws and regulations in the U.S. and foreign countries apply to the access, collection, transfer, use, storage, and destruction of personal information. In the U.S., our financial institution clients are required to comply with privacy regulations imposed under the Gramm-Leach-Bliley Act (“GLBA”), in addition to other regulations. As a processor of personal information in our role as a provider of services to financial institutions, we comply with the Federal Trade Commission (“FTC”) Safeguards Rule implementing certain provisions of GLBA with respect to maintenance of information security safeguards. We perform services for healthcare companies and are, therefore, subject to compliance with laws and regulations regarding healthcare information, including in the U.S., the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).”

Annual report 2026A · The company itself

“Privacy laws and regulations may require notification to affected individuals, federal and state regulators, and consumer reporting agencies in the event of a security breach that results in unauthorized access to, or disclosure of, certain personal information. Privacy laws outside the U.S. may require different compliance requirements than U.S. laws and regulations, and may impose additional duties on us in the performance of our services. We are subject to privacy laws and regulations such as the California Privacy Rights Act (“CPRA”), the European Union’s General Data Protection Regulation (“GDPR”) and its UK equivalent, and Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), and certain business lines are subject to state-level data brokerage laws.”

Annual report 2026A · The company itself

“In addition, legislation, regulation, litigation, court rulings, or other events regarding privacy and information security could expose Broadridge to increased costs, liability, and possible damage to our reputation.”

Annual report 2026A · The company itself

“Legal Compliance Regulations issued by the Office of Foreign Assets Control (“OFAC”) of the U.S. Department of Treasury place prohibitions and restrictions on all U.S. citizens and entities, including us, with respect to transactions by U.S. persons with specified countries and individuals and entities identified on OFAC's sanctions lists and Specially Designated Nationals and Blocked Persons List, which is a published list of individuals and companies owned or controlled by, or acting for or on behalf of, countries subject to certain economic and trade sanctions, as well as terrorists, terrorist organizations and narcotics traffickers identified by OFAC under programs that are not country specific.”

Annual report 2026A · The company itself

“Compliance with global laws and regulations that are applicable to our businesses can be complex and may increase our cost of doing business in international jurisdictions. Our international business could expose us to fines and penalties if we fail to comply with these regulations.”

Annual report 2026A · The company itself

“We provide technology solutions to financial services firms that are generally subject to extensive regulation globally. As a provider of products and services to financial institutions and issuers of securities, our products and services are provided in a manner designed to assist our clients in complying with the laws and regulations to which they are subject. Changes in laws and regulations could require changes in the services we provide, the manner in which we provide our services, and the fees we charge for our services, or they could result in a reduction or elimination of the demand for our services. Such changes in laws or regulations could result in a material negative impact on our business and financial results.”

Annual report 2026A · The company itself

“Some of our services and related fees, such as our proxy communications, shareholder report and prospectus distribution, and other regulatory or customer communications services, are particularly sensitive to changes in laws and regulations, including those governing the financial services industry and the securities markets such as applicable SEC or stock exchange rules, regulations or interpretations. For example, the SEC’s recently proposed Regulation E-Delivery would permit our clients to change the default delivery method for certain communications required under the federal securities laws from paper to electronic delivery. If the rule is adopted as proposed, the volume of physically delivered communications we process would decrease.”

Annual report 2026A · The company itself

“The regulatory framework governing tokenized securities and other digital assets continues to evolve in the U.S. and internationally. Currently, there is no uniform approach to the regulatory treatment of these assets, and changes in their classification or regulation, or in broader regulatory positions regarding such assets, could affect the pace of market adoption, alter the obligations of our clients, intermediaries, and service providers, and require us to modify our business model, products, or services in ways that are difficult to predict. This uncertainty could adversely affect our business, results of operations, or financial condition.”

Annual report 2026A · The company itself

“In addition, new regulations governing our clients could result in significant expenditures that could cause them to reduce their use of our services, seek to renegotiate existing agreements, cease or curtail their operations, or otherwise alter their business relationship with us, all of which could adversely impact our business. Further, an adverse regulatory action that changes a client’s business or adversely affects its financial condition could decrease their ability to purchase, or their demand for our products and services.”

Annual report 2026A · The company itself

“In addition, we run the risk of disintermediation due to emerging technologies, fintech start-ups and new market entrants. If we fail to adapt or keep pace with new technologies in a timely manner, it could harm our ability to compete, decrease the value of our products and services to our clients, and harm our business and impact our future growth.”

Annual report 2026A · The company itself

“The legislative and regulatory environment of the financial services industry is continuously changing. The SEC, FINRA, DOL, various stock exchanges and other U.S. and foreign governmental or regulatory authorities continuously review legislative and regulatory initiatives and may adopt new or revised laws and regulations or provide revised interpretations or they may change their priorities, including those related to enforcement, with respect to existing laws and regulations. These legislative and regulatory initiatives impact the way in which we conduct our business, requiring changes to the way we provide our services or additional investment which may make our business less profitable.”

Annual report 2026A · The company itself

“Our business process outsourcing, fund processing, registered fund distribution, and transfer agency solutions as well as the entities providing those services are subject to regulatory oversight. Our provision of these services must comply with applicable rules and regulations of the SEC, FINRA, DOL, various stock exchanges and other regulatory bodies charged with safeguarding the integrity of the securities markets and other financial markets and protecting the interests of investors participating in these markets.”

Annual report 2026A · The company itself

“The inability to properly perform our services or operational errors in the performance of our services could lead to liability for claims, client loss and result in reputational damage. Our clients operate in highly regulated industries and rely on our services to meet some of their regulatory requirements and the demands of their customers.”

Annual report 2026A · The company itself

“Our mutual fund and exchange-traded fund processing services and our transfer agency services involve the settlement of transactions on behalf of our clients and third parties. With these activities, we may be exposed to risk in the event our clients, or broker-dealers, banks, clearing organizations, or depositories are unable to fulfill contractual obligations.”

Annual report 2026A · The company itself

“We are subject to a variety of continuously evolving and developing laws and regulations globally regarding privacy, data protection and data security, including those related to the collection, storage, retention, handling, use, processing, disclosure, cross-border transfer, destruction and security of personal data.”

Annual report 2025A · The company itself

“For example, the European Union’s General Data Privacy Regulation (“GDPR”) requires companies to satisfy requirements regarding the handling of personal and sensitive data, including its processing, protection and the ability of persons whose data is stored to correct or delete such data about themselves. Failure to comply with GDPR requirements could result in penalties of up to 4% of worldwide revenue.”

Annual report 2025A · The company itself

“Many statutory requirements, both in the United States and abroad, include obligations for companies to notify individuals, or the applicable regulatory authority, of security breaches involving certain personal information before we fully understand or appreciate the extent of the breach, which could result from breaches experienced by us or our vendors.”

Annual report 2025A · The company itself

“The business practices and compensation arrangements of the insurance intermediary industry, including our practices and arrangements, are subject to uncertainty due to investigations by various governmental authorities. Many of our offices are parties to agreements with certain insurance companies, including agreements providing for potential payment of revenue-sharing commissions by insurance companies based primarily on the overall profitability of the aggregate business written with those insurance companies and/or additional factors such as retention ratios and the overall volume of business that an office or offices place with those insurance companies.”

Annual report 2025A · The company itself

“Various state legislatures or 21 legislatures in the international jurisdictions in which we operate may adopt new laws addressing contingent commission arrangements, including laws prohibiting such arrangements, and addressing disclosure of such arrangements to insureds. Various state departments of insurance or other international regulators may also adopt new regulations addressing these matters which could adversely affect our results of operations.”

Annual report 2025A · The company itself

“We conduct business throughout all of the United States of America and are subject to comprehensive regulation and supervision by government agencies in each of those states. The primary purpose of such regulation and supervision is to provide safeguards for policyholders rather than to protect the interests of our shareholders, and it is difficult to anticipate how changes in such regulation would be implemented and enforced.”

Annual report 2025A · The company itself

“As a result, such regulation and supervision could reduce our profitability or growth by increasing compliance costs, technology compliance, restricting the products or services we may sell, the markets we may enter, the methods by which we may sell our products and services, or the prices we may charge for our services and the form of compensation we may accept from our customers, carriers and third parties.”

Annual report 2025A · The company itself

“Under the Basel III Capital Rules, we must maintain a minimum common equity Tier 1 (“CET1”) capital ratio of 4.5%, a Tier 1 capital ratio of 6.0% and a total capital ratio of 8.0%, in each case in relation to risk-weighted assets. In addition, we must maintain a minimum leverage ratio of 4.0% and a minimum supplementary leverage ratio of 3.0%.”

Annual report 2025A · The company itself

“In October 2025, the Federal Reserve proposed revisions to its supervisory stress testing framework. The first proposal included requirements for the Federal Reserve to annually disclose its supervisory stress test models and provide a formal public comment period on material changes to these models and the design of annual stress test scenarios, as well as shifting the “as of” or “jump-off” date of the stress test data from December 31 to September 30 (the “Stress Testing Transparency Proposal”).”

Annual report 2025A · The company itself

“Regulation of Consumer Lending Activities The activities of the Bank as a consumer lender are subject to regulation under various federal laws, including, for example, the Truth in Lending Act (“TILA”), the Equal Credit Opportunity Act, the Fair Credit Reporting Act (“FCRA”), the CRA, the Servicemembers Civil Relief Act and the Military Lending Act, as well as under various state laws. TILA, as amended, and together with its implementing rule, Regulation Z, imposes a number of restrictions on credit card practices impacting rates and fees, requires that a consumer’s ability to pay be taken into account before issuing credit or increasing credit limits, and imposes revised disclosures required for open-end credit.”

Annual report 2025A · The company itself

“Debit Card Interchange Fees For debit cards issued on networks not owned by the Company, the Bank earns interchange fees when customers use its debit cards to make transactions at merchants. The Bank is subject to the Federal Reserve’s Regulation II (Debit Card Interchange Fees and Routing) for those debit cards issued on networks not owned by the Company, which limits the amount of interchange fees that can be received per debit card transaction by debit card issuers with over $10 billion in assets and places certain prohibitions on payment routing restrictions and network exclusivity.”

Annual report 2025A · The company itself

“Privacy, Data Protection and Data Security We are, or may become, subject to a variety of continuously evolving and developing laws and regulations in the United States at the federal, state and local level regarding privacy, data protection and data security, including those related to the collection, storage, handling, use, disclosure, transfer and other processing of personal information. For example, at the federal level, we are currently subject to the Gramm-Leach-Bliley Act (“GLBA”) and the FCRA, among other laws and regulations, and expect additional privacy, data protection and data security requirements, including cyber incident reporting requirements, to apply to us as a result of future laws or regulations.”

Annual report 2025A · The company itself

“At the state level, California has enacted the California Consumer Privacy Act (“CCPA”) and continues to issue regulations thereunder, and various other states also have enacted or are in the process of enacting state-level privacy, data protection and/or data security laws and regulations, with which we may be required to comply.”

Annual report 2025A · The company itself

“•Compliance with new and existing domestic and foreign laws, regulations and regulatory expectations is costly and complex, and any significant changes may adversely affect our business. •Our required compliance with applicable laws and regulations related to privacy, data protection and data security, in addition to compliance with our own privacy policies and contractual obligations to third parties, may increase our costs, reduce our revenue, increase our legal exposure and limit our ability to pursue business opportunities. •Our businesses are subject to the risk of increased litigation, government investigations and regulatory enforcement. •We face intense competition in all of our markets, which could have a material adverse effect on our business and results of operations. •A change in market preference towards other operators of payment networks and alternative payment providers could result in reduced transaction volume, limited merchant acceptance of our cards and limited issuance of cards on our networks by third parties, and in turn may impact our revenue margins.”

Annual report 2025A · The company itself

“The Company, including Discover’s business acquired in the Transaction, may be subject to increased scrutiny by, and/or may require additional regulatory compliance with, governmental authorities in connection with the Transaction as a result of an increase in the size, scope and complexity of the combined company’s business operations, which may have an adverse effect on our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“Failure to comply with these laws and regulations and effectively navigate this complex regulatory landscape, even if the failure is inadvertent, results from human error or reflects a difference in interpretation or conflicting legal requirements, could subject us to restrictions on our business activities, fines, criminal sanctions and other penalties and/or damage to our reputation with regulators, our customers or the public.”

Annual report 2025A · The company itself

“The legislative, regulatory and supervisory environment is beyond our control, may change rapidly and unpredictably, and may negatively influence our revenue, costs, operations, transaction volumes, earnings, growth, liquidity and capital levels. There have been efforts to impose price controls and other impositions. Such changes, among others, could impact credit availability, affect our ability or willingness to provide certain products or services, necessitate changes to our business practices or materially reduce our revenues.”

Annual report 2025A · The company itself

“We are subject to a variety of continuously evolving and developing laws and regulations in the United States at the federal, state and local level regarding privacy, data protection and data security, including those related to the collection, storage, handling, use, disclosure, transfer, security and other processing of personal information. These laws and regulations, and similar laws and regulations in other jurisdictions, impose strict requirements regarding the collection, storage, handling, use, disclosure, transfer, security and other processing of personal information, which may have adverse consequences, including significant compliance costs and severe monetary penalties for non-compliance.”

Annual report 2025A · The company itself

“Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other statements that provide promises and assurances about privacy, data protection and data security can subject us to potential government or legal action if they are found to be deceptive, unfair or misrepresentative of our actual practices.”

Annual report 2025A · The company itself

“Our businesses are subject to the risk of increased litigation, government investigations and regulatory enforcement. Our businesses are subject to increased litigation, government investigations and other regulatory enforcement risks as a result of a number of factors and from various sources, including the highly regulated nature of the financial services industry, the focus of state and federal prosecutors on banks and the financial services industry and the structure of the credit card industry.”

Annual report 2025A · The company itself

“We have been subject to enforcement actions by many of these and other regulators and may continue to be involved in such actions, including governmental inquiries, investigations and enforcement proceedings.”

Annual report 2025A · The company itself

“In December 2025, the OCC issued a report of preliminary findings of its ongoing supervisory review, in accordance with Executive Order 14331 “Guaranteeing Fair Banking for All Americans,” of the nine largest OCC-regulated banks, including the Bank, to determine whether those banks may have debanked or discriminated against customers or potential customers on the basis of their political or religious beliefs or lawful business activities. In the report, the OCC states that its review is ongoing and, once its supervisory review has concluded, it intends to hold the banks reviewed accountable for any unlawful debanking activities, including by making referrals to the Attorney General.”

Annual report 2025A · The company itself

“Over the last several years, federal and state regulators have focused on risk management, compliance with anti-money laundering (“AML”) and sanctions laws, privacy, data protection and data security, use of service providers, fair access and lending, unfair or deceptive practices, and other consumer protection issues and new technologies. Regulators have indicated the potential for escalating consequences for banks that do not timely resolve open issues or have repeat issues.”

Annual report 2025A · The company itself

“Some of our competitors, including new and emerging competitors in the digital and mobile payments space and other financial technology providers and payment networks, are not subject to the same regulatory requirements or scrutiny to which we are subject, which also could place us at a competitive disadvantage, in particular in the development of new technology platforms or the ability to rapidly innovate.”

Annual report 2025A · The company itself

“In the United States, the Federal Reserve’s Regulation II places limits on the interchange fees that issuers may charge, and requires additional routing requirements for, debit cards issued on four-party networks, such as the remaining debit cards issued by the Bank on networks other than the Global Payment Network.”

Annual report 2025A · The company itself

“In October 2023, the Federal Reserve released a notice of proposed rulemaking to revise Regulation II to further reduce the cap on interchange fees that debit card issuers covered by Regulation II can receive for covered debit card transactions.”

Annual report 2025A · The company itself

“In August 2025, a North Dakota district court ruled that the Federal Reserve exceeded its statutory authority when it originally promulgated Regulation II in 2011. As a result, the court vacated Regulation II, although the court stayed the vacatur order to allow time for the resolution of an appeal and allowed the Federal Reserve’s 2023 proposed rule to go into effect if it becomes finalized.”

Annual report 2025A · The company itself

“In addition, in Canada, Visa and Mastercard payment networks have entered into voluntary agreements with the Department of Finance Canada to maintain an agreed-upon average interchange rate.”

Annual report 2025A · The company itself

“Changes to the terms or implementation of Regulation II or the adoption of other laws and regulations that impose limitations on the fees that can be charged by issuers or networks on debit or credit card transactions or require merchants to be provided an alternative network for transaction routing could have an adverse effect on our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“For example, if a change in law or regulation results in debit card transactions on three-party networks, such as debit cards issued by the Bank on the Global Payment Network being subject to the Regulation II cap on interchange fees, it could result in the Company not recognizing a significant majority of the network revenue synergies that the Company anticipated to be realized in connection with the Transaction.”

Annual report 2025A · The company itself

“Our efforts to comply with the GLBA, the FCRA, the CCPA, the PIPEDA and provincial privacy laws, EU GDPR, U.K. GDPR and other privacy, data protection and data security laws and regulations, as well as our posted privacy policies, and related contractual obligations to third parties, entail substantial expenses, may divert resources from other initiatives and projects, and could limit the services we are able to offer.”

Annual report 2025A · The company itself

“As described in the "Business" section, products that we manufacture, source, distribute, or market must comply with U.S. federal, state, and foreign and regulatory requirements. Noncompliance or concerns over noncompliance, including noncompliance by suppliers, has in the past, and may in the future result in suspension of our licenses or ability to distribute, import, manufacture, or source products, recalls, safety alerts or seizures, or criminal or civil sanctions, which, in turn, could result in product liability claims and legal action, including government investigations and enforcement actions and class action lawsuits.”

Annual report 2026A · The company itself

“For example, in November 2023, we received a Civil Investigative Demand ("CID") from the Department of Justice focused on potential violations of the Anti-Kickback Statute and False Claims Act in connection with a 2022 transaction in which we purchased a group purchasing organization and a minority ownership interest in a rheumatology managed services organization.”

Annual report 2026A · The company itself

“During fiscal 2026, we received two Notices of Proposed Adjustment ("NOPA") from the IRS in connection with their audit of our fiscal years 2015-2020. Under one of these NOPAs, the IRS is challenging the tax deductibility of self-insurance pre-tax losses and related carryback claims taken under the Coronavirus Aid, Relief and Economic Security Act, which could result in approximately $400 million in additional tax expense (plus interest) and approximately $1.4 billion in additional tax liability (plus interest).”

Annual report 2026A · The company itself

“There have been increasing efforts in the United States by Congress, the Executive Branch and state and federal agencies, including state boards of pharmacy, departments of health, the FDA, DEA, FTC and others to regulate the pharmaceutical supply chain in an attempt to prevent diversion and the introduction of counterfeit, adulterated and mislabeled pharmaceutical products into the pharmaceutical distribution system and to ensure the integrity of products in the supply chain. Consequently, we are subject to the risk of changes in various laws, which may require changes to our operational, record keeping or security practices.”

Annual report 2026A · The company itself

“And any reduction in Medicare and Medicaid programs as a result of The One Big Beautiful Bill Act, could result in a change in utilization of the healthcare system that may adversely affect demand for our products and services and could have an effect on our results of operations and financial condition.”

Annual report 2026A · The company itself

“In April 2022, an agreement settling the vast majority of opioid-related lawsuits filed against us by state and local governmental entities became effective. It includes injunctive relief terms relating to distributors' controlled substance anti-diversion programs, with which we must comply. It is possible that the maintenance of the required changes to distributors' controlled substance anti-diversion programs may result in unforeseen costs or operational challenges which could have an adverse impact on our results of operations or performance.”

Annual report 2026A · The company itself

“For example, in April 2024, the FDA issued a warning letter to Cardinal Health asserting that plastic syringes sourced from a third party manufacturer in China did not have appropriate 510(k) clearance and restating some of the observations from a December 2023 inspection. We promptly took action on these products and submitted a timely and comprehensive response to the warning letter describing our investigation and corrective actions, and we continue to cooperate with the FDA on this matter.”

Annual report 2026A · The company itself

“Noncompliance or concerns over noncompliance, including by suppliers, as a result of use of third party manufactures, or planned shifts in production sites, has in the past, and may in the future result in substantial modifications to our business practices and operations. These modifications can include suspension of our ability to import and distribute, refunds, or recalls, total or partial shutdown of production in one or more facilities while we or our suppliers remedy any actual or potential issues, the inability to obtain future pre-market approvals or marketing authorizations, and withdrawals or suspensions of current products from the market.”

Annual report 2026A · The company itself

“Verksamhetsgrenen Corporate Finance är beroende av att kreditmarknaden fungerar på ett effektivt sätt. Kreditmarknaden påverkar i sin tur marknaden för fastighetstransaktioner, som är Catellas huvudmarknad inom Corporate Finance.”

Annual report 2024A · The company itself

“Each of these proposals has been noticed for public comment, and in 2024, Rule 605 and the Tick Size/Access Fee Cap proposals were approved by the SEC. Rule 605 is expected to be implemented in August 2026 while the Tick Size/Access Fee Cap proposals are expected to be implemented in November 2026. Rule 605 may result in increased technology and compliance costs to Cboe. The Tick Size/Access Fee Cap rule is also likely to result in increased technology and compliance costs to Cboe, as well as potential adverse impact to Cboe’s trading volume and transaction fee revenue.”

Annual report 2025A · The company itself

“The legislative phase of the review is now complete and revised MiFIR rules and Directive 2024/790/EU on markets in financial instruments came into effect on March 28, 2024, with Member State transposition having been required by September 29, 2025. The final text includes, among other provisions, provision for a consolidated tape for the EU, a ban on payment for order flow (effective June 30, 2026), replacement of the double volume cap with a single volume cap of 7% for trades executed under certain trade waivers (operational as of October 2025), and changes to the transparency regime for equities.”

Annual report 2025A · The company itself

“As discussed above, the implementation of MDIR, the equity market structure rules and proposals, or potential changes to Rule 611 of Regulation NMS (the Order Protection Rule) could cause Cboe’s equities exchanges, BZX, BYX, EDGX, and EDGA, to require additional resources to comply with the new rules, and may have a material impact on our business, financial condition, and operating results, including if, for example, there are lower SIP plan revenues or we must reduce the fees or access fee caps we charge.”

Annual report 2025A · The company itself

“Further, following the SEC’s disapproval of our 2024 proposed rule change to adopt a rule providing that our order and execution management systems (“OEMS") that operate independently from our registered national securities exchanges are not “facilities” of those exchanges, we are seeking exemptive relief for our OEMSs from certain exchange regulations, such as rule filing requirements. Being required to continue to follow exchange regulations could reduce our OEMSs’ competitiveness, could result in a reduction of the value of OEMSs to us, and is likely to increase our compliance costs.”

Annual report 2025A · The company itself

“As European regulators determine how market data should be disaggregated and what is a reasonable commercial basis for providing market data, it could affect our ability to offer market data products in the same manner that we do today thereby causing an adverse effect on our European market data revenues. While MiFID II and MiFIR aim to encourage a commercial solution to a consolidated tape in Europe, should this fail to materialize, policy makers might be encouraged to implement a mandatory solution that could impact our ability to develop our own commercial offering. As discussed above, the E.C. published provisions for a consolidated tape for the EU, which is expected to be implemented in 2026. As proposed, these provisions may have a material impact on our business, financial condition, and operating results if, for example, we must reduce the fees we charge for market data.”

Annual report 2025A · The company itself

“Additionally, any vulnerability of third-party cloud service providers could expose our or our customers' confidential data, which could result in harm to our business reputation. •FINRA and OCC provide certain regulatory services and functions for our options, equities and futures exchanges, while we retain regulatory responsibilities for such services. If FINRA or OCC stopped providing services, or provided inadequate services, we may be subject to action by the SEC or CFTC, or may have limitations placed upon our markets.”

Annual report 2025A · The company itself

“•We rely on CATLLC, a subsidiary of FINRA, to provide services for the implementation of the CAT. If CATLLC or its third-party service providers stop providing services or provide inadequate services, we and the other SROs may not be able to recover costs related to the implementation of CAT, incur penalties for delays of implementation, incur related litigation and other expenses, or incur regulatory liability including enforcement action by the SEC or limitations placed upon our markets. In addition, if CATLLC is not able to collect fees again from Industry Members as a result of litigation or regulatory developments, the SROs may not be able to collect on the promissory notes related to the funding of the implementation and operation of the CAT and the SROs may continue to incur additional significant costs related to the historical, current, and future funding of the implementation and operation of the CAT.”

Annual report 2025A · The company itself

“Cboe Options, C2, BZX, BYX, EDGX, and EDGA are registered national securities exchanges and SROs, and, as such, are subject to comprehensive regulation by the SEC. Cboe Fixed Income is a registered broker-dealer also subject to comprehensive regulation by the SEC and a member of FINRA. CFE and Cboe Digital Exchange are each a DCM, Cboe SEF is a SEF, and Cboe Clear U.S. is a DCO, each registered with the CFTC and subject to comprehensive regulation by the CFTC.”

Annual report 2025A · The company itself

“Table of Contents Our European businesses are subject to regulatory oversight in the UK by the FCA and in the Netherlands by the DNB and the AFM, which, through the “passporting” regime, provides authorization to carry on business in other Member States of the EU and the EEA in accordance with the applicable EU legislation and regulation to which our European business is subject.”

Annual report 2025A · The company itself

“While we have entered into agreements under which FINRA, with respect to our options and equities exchanges provides certain regulatory services, and under which OCC, with respect to CFE provides certain financial surveillance and regulatory services, we retain ultimate responsibility for the regulation of our TPHs and members. We have begun to perform internally more of the regulatory services that FINRA used to handle.”

Annual report 2025A · The company itself

“Legislative or regulatory changes affecting our markets could have a material adverse effect on our business, financial condition, and operating results.”

Annual report 2025A · The company itself

“Each of these proposals has been noticed for public comment, and in 2024, Rule 605 and the Tick Size/Access Fee Cap proposals were approved by the SEC and await implementation. Rule 605 and Tick Size/Access Fee Cap rule may result in increased technology and compliance costs to Cboe. The Tick Size/Access Fee Cap rule is also likely to result in increased technology 38 Table of Contents and compliance costs to Cboe, as well as potential adverse impact to Cboe’s trading volume and transaction fee revenue.”

Annual report 2025A · The company itself

“The implementation of MiFID II and MiFIR in Europe at the beginning of 2018 has encouraged competition among market centers in Europe. MiFID II and MiFIR have introduced a number of new rules, including enhanced internal organizational and compliance monitoring requirements, which apply directly to European trading venues such as our MTF and RM. The impact of MiFID II and MiFIR is significant, and the increased competition among market centers could reduce trading fees, while increasing our costs of operating in Europe.”

Annual report 2025A · The company itself

“The legislative and regulatory environment in which the spot FX market operates is evolving and has undergone significant changes in the recent past, and there may be future regulatory changes in the spot FX industry. The FX Global Code was published in 2017, and re-affirmed in 2024, and sets forth standards of conduct agreed by market participants and central banks on a global basis to apply to the wholesale FX market, and the effect of its publication on conduct and future regulation continues to evolve.”

Annual report 2025A · The company itself

“In addition, U.S. and foreign legislatures and regulators could impose legislative or regulatory changes that could materially adversely impact the ability of our market participants to use our markets or participate in the securities industry at all. Any such changes could result in the loss of a significant number of market participants or a reduction in trading activity on our markets, either of which could have a material adverse effect on our business, financial condition, and operating results.”

Annual report 2025A · The company itself

“We maintain and continually seek to enhance and improve risk management, compliance and monitoring policies, procedures and programs that are reasonably designed to help with our compliance with applicable laws and rules and to prevent, detect, deter, monitor, and manage our risks, including enterprise risk, compliance, regulatory, and internal audit programs, but such policies, procedures and programs may not be fully effective in their operation. Further, we face the risk of intervention by regulatory authorities, including extensive examination and surveillance activity.”

Annual report 2025A · The company itself

“Changes in the tax laws and regulations affecting us, our offerings and our market participants could have a material adverse effect on our business. Legislation may be enacted or interpretative guidance issued, both domestically and internationally, that could result in transaction, sales, or value added taxes on our offerings or change the way that our market participants are taxed on the products they trade on our markets.”

Annual report 2025A · The company itself

“Changes in the regulatory environment and applicable laws and rules also may occur periodically, including in connection with changes in political party or administration at the state and federal levels.”

Annual report 2025A · The company itself

“For example, under state MCO statutes and insurance laws, our health plan subsidiaries, as well as companies within our Other segment, must comply with minimum statutory capital and other financial solvency requirements, such as deposit and surplus requirements.”

Annual report 2025A · The company itself

“States have adopted a number of laws and regulations that may affect our business and results of operations. These laws and regulations, in certain states, include: •premium taxes or similar assessments imposed on us; •stringent prompt payment laws requiring us to pay claims within a specified period of time; •mandated coverage of specific drugs or services; •state-specific medical loss ratios that may be more stringent than federal requirements; •disclosure requirements regarding provider fee schedules and coding procedures; and •programs to monitor and supervise the activities and financial solvency of provider groups.”

Annual report 2025A · The company itself

“The contracts generally are subject to termination for cause, an event of default or lack of funding, among other things.”

Annual report 2025A · The company itself

“Pertinent fraud, waste and abuse laws include the federal False Claims Act, which prohibits the known filing of a false claim or the known use of false statements to obtain payment from the federal government. Many states have their own statutes that closely resemble the federal False Claims Act.”

Annual report 2025A · The company itself

“Privacy Regulations We are subject to various federal, state and local laws and rules regarding the use, security and disclosure of protected health information, personal information and other categories of confidential or legally protected data that our businesses handle.”

Annual report 2025A · The company itself

“Table of Contents In addition, we process and maintain personal card data, particularly in connection with our Marketplace business. As a result, we must maintain compliance with the Payment Card Industry Data Security Standard, which is a multifaceted security standard intended to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information.”

Annual report 2025A · The company itself

“We are also subject to various reviews, audits and investigations, as well as self-reporting requirements, to verify our compliance with the terms of our contracts with various governmental agencies, as well as compliance with applicable laws and regulations. Any non-compliance with our government contracts or with applicable laws and regulations, adverse review, audit or investigation, could result in, among other things: cancellation of our contracts; refunding of amounts we have been paid pursuant to our contracts; imposition of fines, penalties and other sanctions on us; loss of our right to participate in various programs; increased difficulty in selling our products and services; loss or suspension of one or more of our licenses; lowered quality Star ratings; harm to our reputation; or required changes to the way we do business.”

Annual report 2025A · The company itself

“Our business is extensively regulated by the states in which we operate and by the federal government. Changes in political party, or administrations at the state or federal level may change the attitude or public commentary towards healthcare programs and result in changes to the existing legislative or regulatory environment, changes in the application of existing laws and regulations, or changes to funding available for healthcare programs.”

Annual report 2025A · The company itself

“Table of Contents In addition, CMS regulations will require beneficiaries dually enrolled in Medicare and in a Medicaid managed care plan to receive integrated care through the Medicaid company's Medicare Advantage D-SNPs beginning in 2030, with certain restrictions beginning in 2027, which may restrict our product offerings in some geographic service areas.”

Annual report 2025A · The company itself

“If we fail to comply with the extensive federal and state fraud, waste and abuse laws, our business, reputation, results of operations, financial condition and cash flows could be materially and adversely affected. We, along with other companies involved in public healthcare programs, have been, and from time to time are, the subject of federal and state fraud, waste and abuse investigations. The regulations and contractual requirements applicable to participants in these public sector programs are complex and subject to change. Violations of fraud, waste and abuse laws applicable to us could result in civil monetary penalties, criminal fines and imprisonment and/or exclusion from participation in Medicaid, Medicare, and other federal healthcare programs and federally funded state health programs.”

Annual report 2025A · The company itself

“Tax laws might change in ways that adversely affect our tax positions, effective tax rate and cash flow. For example, on November 14, 2025, CMS issued guidance to implement the OBBBA's requirement that states can no longer impose higher tax rates on Medicaid MCOs than commercial insurance by the end of the fiscal year ending in 2026. If the states increase the tax rates applicable to our Marketplace line of business during 2026, we cannot offset those increases by increasing premiums, as our Marketplace rates were approved and determined in 2025, which could have a material impact on the profitability of our Marketplace products, results of operations, financial condition and cash flows.”

Annual report 2025A · The company itself

“Table of Contents The Company's contracts with states and CMS may require it to maintain a minimum medical loss ratio (MLR) or may require it to share cost-savings in excess of certain levels. In certain circumstances, including commercial plans, its plans may be required to return premium to the state or policyholders in the event costs are below established levels.”

Annual report 2025A · The company itself

“In October 2017, the Trump Administration issued an executive order that immediately ceased payments of CSRs to issuers, and beginning in 2018, premium rates for Health Insurance Marketplace were set without factoring in the cost sharing subsidy payments from the federal government. In 2024, the Company reached an agreement with the federal government to retroactively compensate the Company for the difference between its actual CSR experience and its pricing assumptions for 2018 through 2020.”

Annual report 2025A · The company itself

“Additionally, if the FDA or a comparable foreign regulatory authority does not approve of our facilities for the manufacture of a client product, observes significant deficiencies or violations at its facilities or withdraws such approval in the future, our clients may choose to identify alternative manufacturing facilities and/or relationships, which could significantly impact our CDMO capacity and capabilities and results of operations therefrom and could have a negative impact on our reputation and financial results.”

Annual report 2025A · The company itself

“Changes in government regulation or in practices relating to the pharmaceutical or biotechnology industries, including potential healthcare reform, could decrease the need for the services we provide. Governmental agencies throughout the world strictly regulate the drug development process. Our business involves helping our customers navigate these regulatory processes.”

Annual report 2025A · The company itself

“Although we believe we are currently in compliance in all material respects with applicable national, regional and local laws, as well as other accepted guidance used by oversight bodies (including the USDA, the standards set by the International Air Transport Association, the Convention on International Trade in Endangered Species of Wild Fauna and Flora, USFWS, The Centers for Disease Control, the Department of Transportation, the Department of State, the office of Laboratory Animal Welfare of NIH, the Drug Enforcement Agency, as well as numerous other oversight agencies in the jurisdictions in which we operate), failure to comply could subject us to denial of the right to conduct business, fines, criminal penalties and other enforcement actions.”

Annual report 2025A · The company itself

“Where applicable, our clients expect us to timely deliver their non-clinical data compliant with the FDA’s SEND (Standardization for Exchange of Nonclinical Data) standards.”

Annual report 2025A · The company itself

“Regulation As a participant in the securities, banking and financial services industries, Schwab is subject to extensive regulation under both federal and state laws by governmental agencies, supervisory authorities, and self-regulatory organizations (SROs). We are also subject to oversight by regulatory bodies in other countries in which we operate. These regulations affect our business operations and impose capital, client protection, and market conduct requirements.”

Annual report 2025A · The company itself

“The Federal Reserve has the authority to limit an FHC’s ability to conduct otherwise permissible FHC Activities if the FHC or any of its depository institution subsidiaries ceases to meet the applicable eligibility requirements, including requirements that the FHC and each of its depository institution subsidiaries maintain their status as “well-capitalized” and “well-managed.” If the Federal Reserve finds that an FHC fails to meet these requirements, the FHC and its subsidiaries may not commence any new FHC Activity, either de novo or through an acquisition, without prior Federal Reserve approval. The Federal Reserve may also impose any additional limitations or conditions on the conduct or activities of the FHC or any of its subsidiaries as it deems appropriate.”

Annual report 2025A · The company itself

“This regulatory framework is designed to protect depositors and consumers, the safety and soundness of depository institutions and their holding companies, and the stability of the banking system as a whole. This framework affects the activities and investments of CSC and its subsidiaries and gives the regulatory authorities broad discretion in connection with their supervisory, examination and enforcement activities, and policies.”

Annual report 2025A · The company itself

“Capital requirements for Category III banking organizations include the generally applicable risk-based capital and Tier 1 leverage ratio requirements (the “standardized approach” framework), the minimum 3.0% supplementary leverage ratio, the stress capital buffer (CSC), the capital conservation buffer (banking subsidiaries), and the countercyclical capital buffer, which is currently 0%. As a large savings and loan holding company, CSC is subject to the stress capital buffer requirement, which applies to risk-based capital ratios (Common Equity Tier 1 Capital, Tier 1 Capital, and Total Capital).”

Annual report 2025A · The company itself

“Liquidity Coverage Ratio (LCR) rule is designed to promote resiliency of the banking sector by requiring that certain large U.S. banking organizations (Covered Companies) maintain a liquidity risk profile which ensures that they have sufficient High Quality Liquid Assets (HQLA), such as central bank reserves, certain government securities, and eligible corporate debt securities that can be converted easily and quickly to cash, to survive a significant stress event lasting 30 days. The LCR rule requires Covered Companies, including Schwab, to maintain an amount of HQLA that are unencumbered and controlled by the Covered Company’s liquidity management function sufficient to meet a designated percentage of their total stressed net cash outflows over a prospective 30 calendar-day period, as calculated in accordance with the LCR rule. Schwab is subject to the LCR and public disclosure requirement on a consolidated basis.”

Annual report 2025A · The company itself

“Consumer Financial Protection The CFPB has broad rulemaking, supervisory and enforcement authority for a wide range of federal consumer protection laws relating to financial products. The CFPB has examination and primary enforcement authority over depository institutions with $10 billion or more in consolidated total assets.”

Annual report 2025A · The company itself

“The principal purpose of regulating these entities is the protection of clients and securities markets. The regulations cover all aspects of the securities business, including, among other things, sales and trading practices, publication of research, margin lending, uses and safekeeping of clients’ funds and securities, capital adequacy, recordkeeping and reporting, fee arrangements, order flow revenue from securities exchanges and market makers, disclosure to clients, fiduciary duties, and the conduct of directors, officers, and employees. The structure and regulation of the securities markets have a significant impact on the Company’s business and operations, including its sources of net revenues.”

Annual report 2025A · The company itself

“Events affecting the financial services industry may also result in potentially adverse changes to laws or regulations governing banks and savings and loan holding companies or result in the imposition of restrictions through supervisory or enforcement activities, including higher capital or liquidity requirements or increased FDIC premiums and special assessments, which could have a material impact on our business. Following the failure of several U.S. banks in 2023, the U.S. federal banking agencies proposed rules that would significantly impact our regulatory capital requirements, including requiring us to include AOCI in regulatory capital, as well as rules that would require minimum levels of eligible long-term debt at CSC and our banking subsidiaries.”

Annual report 2025A · The company itself

“The regulatory landscape for cryptocurrencies is evolving and uncertain, and changes in laws, regulations, or regulatory interpretations could prohibit or limit our ability to offer these products, increase compliance costs, or expose us to increased regulatory scrutiny.”

Annual report 2025A · The company itself

“In July 2023, the U.S. federal banking agencies issued a notice of proposed rulemaking with amendments to the regulatory capital rules. Among other things, the proposed rules would require us to include AOCI in regulatory capital and to calculate our risk-weighted assets using a revised risk-based approach, a component of which is based on operational risk, phased in over a three-year transition period.”

Annual report 2025A · The company itself

“The year-over-year changes in expenses were primarily attributable to higher compensation and benefits and higher professional services expense, due largely to growth in the business and volume-related costs, including higher incentive compensation driven by the Company’s financial performance, partially offset by lower regulatory fees and assessments due to lower FDIC assessments.”

Annual report 2025A · The company itself

“Effective May 14, 2025, the SEC decreased the fee rate applicable to most securities transactions to zero from the rate in effect since May 22, 2024. This change resulted in lower industry fees in 2025 compared to 2024.”

Annual report 2025A · The company itself

“Compliance Risk Schwab faces compliance risk which is the potential exposure to legal or regulatory sanctions, fines or penalties, financial loss, or damage to reputation resulting from the failure to comply with laws, regulations, rules, or other regulatory requirements. Among other things, compliance risks relate to the suitability of client investments, consumer protection, conflicts of interest, disclosure obligations and performance expectations for products and services, supervision of employees, the retention of required records, and the adequacy of our controls.”

Annual report 2025A · The company itself

“Conduct risk arises from inappropriate, unethical, or unlawful behavior of the Company, its employees or third parties acting on the Company’s behalf that may result in detriment to the Company’s clients, financial markets, the Company, and/or the Company’s employees.”

Annual report 2025A · The company itself

“Planned Acquisition of Forge On November 6, 2025, Schwab announced that it had entered into a definitive agreement to acquire Forge, operator of a leading private market platform and trading marketplace, in a transaction valued at approximately $660 million.”

Annual report 2025A · The company itself

“Under Bermuda law prior to 2025, Chubb Limited and its Bermuda subsidiaries were not required to pay any taxes on income or capital gains. However, on December 27, 2023, the Government of Bermuda enacted the Corporate Income Tax Act of 2023 which established a 15 percent income tax on net taxable income of Bermuda entities effective January 1, 2025.”

Annual report 2025A · The company itself

“In addition, we may encounter the risk that Chubb may not be able to renew outstanding borrowings with a new term or with an existing counterparty due to market conditions including a decrease in demand as well as more restrictive terms from banks due to increased regulatory and capital constraints.”

Annual report 2025A · The company itself

“The ACA subjects individual and small group policy rate increases above an identified threshold to review by the United States Department of Health and Human Services ("HHS"), and our U.S. Healthcare medical plans are subject to minimum MLR requirements.”

Annual report 2025A · The company itself

“Federal and state regulatory agencies may restrict or prevent entirely our ability to implement changes in premium rates or collect certain administrative fees.”

Annual report 2025A · The company itself

“We expect federal and state governments to continue to enact legislative and regulatory reforms that will or could materially impact various aspects of the health services system, including pharmacy benefits manager, drug pricing or insurance market reforms. These reforms could result in material changes to the way we conduct our business and could impact the market for our products.”

Annual report 2025A · The company itself

“Existing or future laws, regulations, actions by governmental or regulatory authorities, or judgments could force us to change how we conduct our business; affect the products and services we offer and where we offer them; restrict revenue and enrollment growth; increase our costs, including medical, operating, health care technology and administrative costs; increase our liability; and require enhancements to our compliance infrastructure and internal controls environment. For example, we are required to obtain and maintain approvals from state boards of pharmacy, departments of insurance, and other federal and state regulatory agencies to, among other things, market many of our products, expand into additional geographic or product markets, increase prices for certain regulated products, and consummate some of our acquisitions and dispositions.”

Annual report 2025A · The company itself

“Financial Strength We believe that our financial strength and strong capital and surplus position, reflected in our insurer financial strength ratings, are clear, competitive advantages in the segments of the insurance marketplace that we serve. This strength supports the consistent, predictable performance that our policyholders, agents, associates and shareholders have always expected and received, helping us withstand significant challenges.”

Annual report 2025A · The company itself

“Citizens Financial Group, Inc. | 28 Risks Related to Regulations Governing Our Industry As a financial holding company and a bank holding company, we are subject to regulation that could have a material adverse effect on our business and results of operations. As a FHC and a BHC, we are subject to regulation, supervision, and examination by the FRB. In addition, CBNA is subject to regulation, supervision, and examination by the OCC.”

Annual report 2025A · The company itself

“Although we have historically declared cash dividends on our common stock, we are not required to do so and may reduce or eliminate our common stock dividend in the future, which could adversely affect the market price of our common stock. Also, as a BHC, our ability to repurchase shares and declare and pay dividends is dependent on certain federal regulatory considerations, including the rules of the FRB regarding capital adequacy and dividends.”

Annual report 2025A · The company itself

“Our principal non-market risks include credit, operational, regulatory, reputational, liquidity, and strategic risks.”

Annual report 2025A · The company itself

“Compliance Risk Financial institutions are subject to many laws, rules, and regulations at both the federal and state levels. These broad-based laws, rules, and regulations include, but are not limited to, expectations relating to anti-money laundering, lending limits, client privacy, fair lending, prohibitions against unfair, deceptive, or abusive acts or practices, protections for military members as they enter active duty, and community reinvestment.”

Annual report 2025A · The company itself

“Additional new laws or regulations or changes in enforcement practices applicable to our businesses or those of our clients could be imposed in the U.S. or other jurisdictions, which could change, or require us to change, our business practices or the structure of our business, including its current governance, risk oversight or regulatory structure, or impose significant costs on us by, for example, requiring more of our funds to be set aside for the guaranty fund or to meet other compliance requirements. This could adversely affect our ability to compete effectively with other institutions that are not affected in the same way or impact our clients' overall trading volume and demand for our market data and other services.”

Annual report 2025A · The company itself

“The regulatory environment related to information security, privacy, data collection, data usage and use of artificial intelligence is increasingly rigorous and complex, and any failure to comply may carry significant penalties and reputational damage.”

Annual report 2025A · The company itself

“As a financial services provider, we are subject to significant litigation risk and regulatory liability and penalties. Many aspects of our business present substantial litigation risks.”

Annual report 2025A · The company itself

“These risks include, among others, potential liability from disputes over terms of a trade, the claim that a system failure or delay caused monetary losses to a customer, that we entered into an unauthorized transaction, that we provided materially false or misleading statements in connection with a transaction or that we failed to effectively fulfill our regulatory oversight responsibilities.”

Annual report 2025A · The company itself

“System failure or degradation could lead our customers to file formal complaints with industry regulatory organizations, to file lawsuits against us or to cease doing business with us or could lead our regulators to initiate inquiries or proceedings for failure to comply with applicable laws and regulations.”

Annual report 2025A · The company itself

“Due to its holding company structure, CMS Energy depends on dividends from its subsidiaries to meet its debt service and other payment obligations.”

Annual report 2025A · The company itself

“CMS Energy and Consumers are subject to rate regulation. Consumers’ electric and gas retail rates are set by the MPSC and cannot be changed without regulatory authorization.”

Annual report 2025A · The company itself

“CMS Energy and certain of its subsidiaries, including Consumers, are subject to, or affected by, extensive utility regulation and state and federal legislation and regulation, including through application of policies and rules of numerous state and federal agencies and governmental entities. If it were determined that CMS Energy or Consumers failed to comply with applicable laws and regulations or with applicable tariff provisions, they could become subject to fines, penalties, refund or disgorgement orders, or disallowed costs, or be required to implement additional compliance, cleanup, or remediation programs, the cost of which could be material.”

Annual report 2025A · The company itself

“Demand in this segment is driven by our clients’ need to modernize legacy technology environments, strengthen operational resilience and adopt cloud, data and AI capabilities to meet evolving customer expectations and regulatory requirements. Our clients are expanding enterprise AI adoption to enhance customer experience, improve risk and fraud management, accelerate underwriting and lending and modernize payments. These initiatives require core platform modernization, greater use of advanced analytics and responsible AI frameworks to ensure transparency, security and compliance.”

Annual report 2025A · The company itself

“We provide services to clients and have operations in many parts of the world and in a wide variety of different industries, subjecting us to numerous, evolving, and sometimes conflicting, standards, laws and regulations on matters as diverse as trade controls and sanctions, immigration (including temporary work authorizations or work permits), content requirements, trade restrictions, tariffs, taxation, antitrust laws, anti-money laundering and anti-corruption laws (including the FCPA and the U.K. Bribery Act), the environment, including climate change regulation and reporting requirements, government affairs, internal and disclosure control obligations, data security, privacy and data protection, intellectual property, employment and labor relations, human rights and AI.”

Annual report 2025A · The company itself

“For example, we are required to comply with increasingly complex and changing data security and privacy laws and regulations in the many jurisdictions in which we operate that regulate the collection, storage, use, disclosure, transfer and security of personal data, including U.S. federal and state laws (such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and the Health Insurance Portability and Accountability Act), and non-U.S. laws, such as the India Digital Personal Data Protection Act, 2023, the U.K. General Data Protection Regulation (“GDPR”) and the E.U. GDPR.”

Annual report 2025A · The company itself

“Government Regulation We are subject to a variety of laws and regulations in the United States and abroad that involve matters central to our business operations and future business plans. Many of these laws and regulations continue to evolve through legislative and regulatory action and judicial interpretation, and may be modified, interpreted, and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another.”

Annual report 2025A · The company itself

“These agencies, as well as certain other governmental bodies, including state attorneys general, have broad consumer protection mandates and discretion in enforcing consumer protection laws, including matters related to unfair or deceptive, and, in the case of the CFPB, abusive acts or practices (“UDAAPs”), and they promulgate, interpret, and enforce rules and regulations that affect our business. The CFPB has enforcement authority to prevent an entity that offers or provides consumer financial services or products in the United States from committing or engaging in UDAAPs or violating other federal consumer financial laws, including the ability to engage in joint investigations with other agencies, issue subpoenas and civil investigative demands, conduct hearings and adjudication proceedings, commence a civil action, grant relief (e.g., limit activities or functions; rescission of contracts), and refer matters for criminal proceedings. Market disruptions have led to certain attempts by consumer protection focused agencies, including the CFPB, to directly regulate the crypto industry.”

Annual report 2025A · The company itself

“Anti-money laundering and counter-terrorist financing We are subject to various anti-money laundering and counter-terrorist financing laws, including the Bank Secrecy Act (the “BSA”) in the United States, and similar laws and regulations abroad. In the United States, as a money services business registered with the Financial Crimes Enforcement Network (“FinCEN”), we are required under the BSA to among other things, develop, implement, and maintain a risk-based anti-money laundering program, provide an anti-money laundering-related training program, report suspicious activities and transactions to FinCEN, comply with certain reporting and recordkeeping requirements, and collect and maintain information about our customers.”

Annual report 2025A · The company itself

“Interchange fees Interchange fees associated with four-party payments systems are being reviewed or challenged in various jurisdictions. For example, in the E.U., the Multilateral Interchange Fee Regulation caps interchange fees for credit and debit card payments and provides for business rules to be complied with by any company dealing with card transactions, including us.”

Annual report 2025A · The company itself

“Furthermore, the bylaws and agreements between clearing house participants, payment networks, and credit and debit card issuers impose specific responsibilities and liabilities for issuers of debit and credit cards and the brands that partner with such issuers. We, as well as the banks that issue our Coinbase Card (debit) and our Coinbase One Credit Card (credit), are required to comply with the appropriate National Automated Clearing House Association (“NACHA”), bylaws, operating rules, and agreements, as well as card network rules and guidelines, each as applicable. Additional new products and services that we offer may also impose additional obligations on us to comply with NACHA and card network obligations related to preventing fraud, money laundering, and IT security breaches.”

Annual report 2025A · The company itself

“We are subject to an extensive, highly-evolving and uncertain regulatory landscape and any adverse changes to, or our failure to comply with, any laws and regulations could adversely affect our brand, reputation, business, operating results, and financial condition. Our business is subject to extensive laws, rules, regulations, policies, orders, determinations, directives, treaties, and legal and regulatory interpretations and guidance in the markets in which we operate, including those governing financial services and banking, federal government contractors, trust companies, securities, derivative transactions and markets, broker-dealers and alternative trading systems (“ATS”), commodities, credit, crypto asset custody, exchange, and transfer, cross-border and domestic money and crypto asset transmission, commercial lending, usury, foreign currency exchange, privacy, data governance, data protection, cybersecurity, fraud detection, payment services (including payment processing and settlement services), consumer protection, escheatment, antitrust and competition, bankruptcy, tax, anti-bribery, economic and trade sanctions, anti-money laundering, and counter-terrorist financing.”

Annual report 2025A · The company itself

“Governmental and regulatory bodies, including in the United States, may introduce new policies, laws, and regulations relating to crypto assets and the onchain economy generally, and crypto asset platforms in particular. Other companies’ failures of risk management and other control functions could contribute to stricter oversight of crypto asset platforms and the onchain economy. Furthermore, new interpretations of existing laws and regulations may be issued by such bodies or the judiciary, which may adversely impact the development of the onchain economy as a whole and our legal and regulatory status in particular by changing how we operate our business, how our products and services are regulated, and what products or services we and our competitors can offer, requiring changes to our compliance and risk mitigation measures, imposing new licensing requirements, or imposing a total ban on certain crypto 29 Table of Contents asset transactions, as has occurred in certain jurisdictions in the past.”

Annual report 2025A · The company itself

“As another example, the extension of anti-money laundering requirements to certain crypto-related activities by the European Union’s Fifth Money Laundering Directive has increased the regulatory compliance burden for our business in Europe and, as a result of the fragmented approach to the implementation of its provisions, resulted in distinct and divergent national licensing and registration regimes for us in different E.U. member states. Additionally, MiCA introduces a comprehensive authorization and compliance regime for crypto asset service providers and a disclosure regime for the issuers of certain crypto assets, which will impact our operations in the European Union, including through localization requirements, due to the obligations associated with our MiCA license (obtained in June 2025).”

Annual report 2025A · The company itself

“In July 2025, the United States enacted the Guiding and Establishing National Innovation for U.S. Stablecoins Act (the “GENIUS Act”), which establishes a federal regulatory framework for “payment stablecoins” and their issuers and custodians. As a distributor and ecosystem partner of stablecoins, Coinbase may directly and indirectly be subject to these requirements.”

Annual report 2025A · The company itself

“Due to our business activities, we are subject to ongoing examinations, oversight, and reviews and currently are, and expect in the future, to be subject to investigations and inquiries, by U.S. federal and state regulators and foreign financial service regulators, many of which have broad discretion to audit and examine our business. We are periodically subject to audits and examinations by these regulatory authorities. As a result of findings from these audits and examinations, regulators have required, are requiring, and may in the future require us to take certain actions, including amending, updating, or revising our compliance measures from time to time, limiting the kinds of customers that we provide services to, changing, terminating, or delaying our licenses and the introduction of our existing or new product and services, and undertaking further external audit or being subject to further regulatory scrutiny, including investigations and inquiries.”

Annual report 2025A · The company itself

“Historically, a major source of competition has been from companies, in particular those located outside the United States, who at times are and may in the future be subject to significantly less stringent regulatory and compliance requirements in their local jurisdictions. Their business models rely on being unregulated or only regulated in a small number of lower compliance jurisdictions, whilst also offering their products in highly regulated jurisdictions, including the United States, without necessarily complying with the relevant regulatory requirements in such jurisdictions. Given the uneven enforcement by United States and foreign regulators, many of these competitors have been able to operate from offshore while offering large numbers of products and services to consumers, including in the United States, Europe, and other highly regulated jurisdictions, without complying with the relevant licensing and other requirements in these jurisdictions, and historically without penalty.”

Annual report 2025A · The company itself

“As we continue to expand and localize our international activities, our obligations to comply with the laws, rules, regulations, and policies of a variety of jurisdictions will increase and we may be subject to inquiries, investigations, and enforcement actions by U.S. and non-U.S. regulators and governmental authorities, including those related to sanctions, export control, and anti-money laundering. As we expand and localize our international activities, we have become increasingly obligated to comply with the laws, rules, regulations, policies, and legal interpretations of both the jurisdictions in which we operate and those into which we offer services on a cross-border basis.”

Annual report 2025A · The company itself

“In addition, we are required to comply with laws and regulations related to economic sanctions and export controls enforced by the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) and the U.S. Department of Commerce’s Bureau of Industry and Security, and U.S. anti-money laundering and counter-terrorist financing laws and regulations, enforced by FinCEN and certain state financial services regulators.”

Annual report 2025A · The company itself

“Regulators worldwide frequently study each other’s approaches to the regulation of our industry. Consequently, developments in any jurisdiction may influence other jurisdictions. New developments in one jurisdiction may be extended to additional services and other jurisdictions.”

Annual report 2025A · The company itself

“A particular crypto asset, product or service’s status as a “security” in any relevant jurisdiction is subject to a high degree of uncertainty and if we are unable to properly characterize a crypto asset or product offering, we may be subject to regulatory scrutiny, inquiries, investigations, fines, and other penalties, which could adversely affect our business, operating results, and financial condition. The SEC and its staff have taken evolving positions as to whether a range of crypto assets, products and services fall within the definition of a “security” under the U.S. federal securities laws.”

Annual report 2025A · The company itself

“The SEC has also brought enforcement actions and entered into settlements with numerous industry participants alleging that certain digital assets are securities. In 2025, the SEC dismissed many of those enforcement actions.”

Annual report 2025A · The company itself

“In January 2025, the SEC launched a crypto task force dedicated to developing a comprehensive and clear regulatory framework for crypto assets. While newly formed, its goal is to clarify federal securities laws for crypto, recommend practical policies, foster innovation, and protect investors. Furthermore, on November 12, 2025, SEC Chairman Atkins delivered an address at the Federal Reserve Bank of Philadelphia, in which he highlighted the view that most crypto assets are not securities, and that the SEC would coordinate with the CFTC on a token taxonomy that includes “digital commodities.””

Annual report 2025A · The company itself

“Several foreign jurisdictions have taken a broad-based approach to classifying crypto assets, products and services as “securities,” while other foreign jurisdictions have adopted a narrower approach. As a result, certain crypto assets, products or services may be deemed to be a “security” under the laws of some jurisdictions but not others.”

Annual report 2025A · The company itself

“Table of Contents Further, if Bitcoin, Ethereum, stablecoins or any other supported crypto asset is deemed to be a security under any U.S. federal, state, or foreign jurisdiction, or in a proceeding in a court of law or otherwise, it may have adverse consequences for such supported crypto asset. For instance, all transactions in such supported crypto asset would have to be registered with the SEC or other foreign authority, or conducted in accordance with an exemption from registration, which could severely limit its liquidity, usability and transactability.”

Annual report 2025A · The company itself

“We may face difficulty establishing or maintaining such relationships due to instability in the global banking system, increasing regulatory uncertainty and scrutiny, or our partners’ policies and some prior partners have terminated their relationship with us or have limited access to services. The loss of these partners or the imposition of operational restrictions by these partners and the inability for us to utilize other redundant financial institutions may result in a disruption of business activity as well as regulatory risks.”

Annual report 2025A · The company itself

“We provide secured loans to our customers, which exposes us to credit risks and may cause us to incur financial or reputational harm. We provide commercial loans to qualified customers secured by their fiat or crypto asset holdings, including USDC, on our platform, which exposes us to the risk of our borrowers’ inability to repay such loans.”

Annual report 2025A · The company itself

“If we are unable to successfully integrate Deribit or comply with evolving U.S. and international crypto and derivatives regulations applicable to our expanded operations and products, we could be required to modify or discontinue certain offerings, face limitations on our ability to onboard or serve customers in key markets, incur substantial compliance and remediation costs, or be subject to penalties and other enforcement actions, any of which could adversely affect our business, operating results, and financial condition.”

Annual report 2025A · The company itself

“Our platform may be exploited to facilitate illegal activity such as fraud, money laundering, gambling, tax evasion, sanctions evasion, and scams. We or our partners may be specifically targeted by individuals seeking to conduct fraudulent or otherwise illicit transfers, and it may be difficult or impossible for us to detect and avoid such transactions in certain circumstances. The use of our platform for illegal or improper purposes could subject us to claims, individual and class action lawsuits, and government and regulatory investigations, prosecutions, enforcement actions, inquiries, or requests that could result in liability and reputational harm for us.”

Annual report 2025A · The company itself

“Moreover, certain activities that may be legal in one jurisdiction may be illegal in another jurisdiction, and certain activities that are at one time legal may in the future be deemed illegal in the same jurisdiction. As a result, there is significant uncertainty and cost associated with detecting and monitoring transactions for compliance with local laws.”

Annual report 2025A · The company itself

“Our ability to comply with applicable complex and evolving laws, regulations, and rules is largely dependent on the establishment, maintenance, and scaling of our compliance, internal audit, and reporting systems to continuously keep pace with our customer activity and transaction volume, as well as our ability to attract and retain qualified compliance and other risk management personnel. While we have devoted significant resources to develop policies and procedures to identify, monitor, and manage our risks, and expect to continue to do so in the future, we cannot assure you that our policies and procedures are and will always be effective or that we have been and will always be successful in monitoring or evaluating the risks to which we are or may be exposed in all market environments or against all types of risks, including unidentified or unanticipated risks.”

Annual report 2025A · The company itself

“If we fail to comply with these, or do not adequately remediate certain findings, regulators could take a variety of actions that could impair our ability to conduct our business, including, but not limited to, delaying, denying, withdrawing, or conditioning approval of certain products and services. In addition, regulators have broad enforcement powers to censure, fine, issue cease and desist orders, prohibit us from engaging in some of our business activities, or revoke our licenses.”

Annual report 2025A · The company itself

“The failure of several prominent crypto trading venues and lending platforms in 2022 resulted in a loss of confidence in the broader industry, adverse reputational impact to crypto asset platforms, increased negative publicity surrounding crypto more broadly, heightened scrutiny by regulators and lawmakers and a call for increased regulations of crypto assets and crypto asset platforms.”

Annual report 2025A · The company itself

“Future developments regarding the treatment of crypto assets for U.S. and foreign tax purposes could adversely affect our business, operating results, and financial condition. Due to the nature of crypto assets and the absence of comprehensive legal and tax guidance with respect to crypto asset products and transactions, many significant aspects of the U.S. and foreign tax treatment of transactions involving crypto assets, such as the purchase and sale of crypto assets on our platform, as well as the provision of blockchain rewards and other crypto asset incentives and rewards products, are uncertain, and it is unclear whether, when and what guidance may be issued in the future on the treatment of crypto asset transactions for U.S. and foreign tax purposes.”

Annual report 2025A · The company itself

“There continues to be uncertainty with respect to the timing, character, and amount of income inclusions for various crypto asset transactions including, but not limited to lending and borrowing crypto assets, staking, and other crypto asset incentives and products that we offer. Although we believe our treatment of crypto asset transactions for federal income tax purposes is consistent with existing positions from the IRS and/or existing U.S. federal income tax principles, because of the advances in crypto asset innovations and the increasing variety and complexity of crypto asset transactions and products, it is possible the IRS and various U.S. states may disagree with our treatment of certain crypto asset offerings for U.S. tax purposes, which could adversely affect our customers and the vitality of our business.”

Annual report 2025A · The company itself

“Our Consolidated Balance Sheets may not contain sufficient amounts or types of regulatory capital to meet the changing requirements of our various regulators worldwide, which could adversely affect our business, operating results, and financial condition. We are required to possess sufficient financial soundness and strength to adequately support our regulated subsidiaries.”

Annual report 2025A · The company itself

“As a financial institution licensed to, among other things, engage in money transmission in the United States, to conduct virtual currency business activity in New York, Dubai and Bermuda, and issue electronic money in the United Kingdom and the European Union, we are subject to strict rules governing 62 Table of Contents how we manage and hold customer fiat currency, stablecoins, and crypto assets. We maintain complex treasury operations to manage and move customer fiat currency, stablecoins, and crypto assets across our platforms and to comply with regulatory requirements.”

Annual report 2025A · The company itself

“Many of the crypto assets and other products, such as event contracts, in which we facilitate trading are subject to regulatory authority by the CFTC. Any fraudulent or manipulative activity in a crypto asset or other regulated product, including event contracts, occurring on our platform could subject us to increased regulatory scrutiny, regulatory enforcement, and litigation.”

Annual report 2025A · The company itself

“As a result, the CFTC has general enforcement authority to police against manipulation and fraud in at least some spot crypto asset markets. From time to time, manipulation, fraud, and other forms of improper trading by market participants have resulted in, and may in the future result in, CFTC investigations, inquiries, enforcement action, and similar actions by other regulators, government agencies, and civil litigation.”

Annual report 2025A · The company itself

“Furthermore, the CTFC has regulatory authority over certain product offerings, including event contracts, which are regulated as “swaps” under the CEA. This classification subjects us to the CFTC’s supervisory and enforcement oversight, including supervisory requirements to prevent manipulation, fraud and other forms of improper trading in these markets.”

Annual report 2025A · The company itself

“Certain transactions in crypto assets may constitute “retail commodity transactions” subject to regulation by the CFTC as futures contracts. If crypto asset transactions we facilitate are deemed to be such retail commodity transactions, we would be subject to additional regulatory requirements, licenses and approvals, and potentially face regulatory enforcement, civil liability, and significant increased compliance and operational costs.”

Annual report 2025A · The company itself

“Table of Contents Particular crypto assets or transactions therein, or other contracts or products we offer, could be deemed “commodity interests” (e.g., futures, options, swaps) or security-based swaps subject to regulation by the CFTC or SEC, respectively. If a crypto asset that we facilitate trading in is deemed a commodity interest or a security-based swap, we would be subject to additional regulatory requirements, registrations and approvals, and potentially face regulatory enforcement, civil liability, and significant increased compliance and operational costs.”

Annual report 2025A · The company itself

“Furthermore, the CFTC and the SEC have jointly adopted regulations defining “security-based swaps,” which include swaps based on single securities and narrow-based indices of securities. If a crypto asset is deemed to be a security, certain transactions referencing that crypto asset could constitute a security-based swap.”

Annual report 2025A · The company itself

“Similarly, new rules for reporting crypto assets under the global “common reporting standard” (CRS) and the “crypto-asset reporting framework” (CARF) have been implemented on our operations, creating new obligations and a need to continue investing in new onboarding and reporting infrastructure. Such rules have been adopted by numerous member and observer states of the “Organization for Economic Cooperation and Development” and by the European Commission on behalf of the member states of the European Union.”

Annual report 2025A · The company itself

“The most well-known of such laws, the GDPR, imposes stringent privacy and personal data protection requirements and could increase the risk of non-compliance and the costs of providing our products and services in a compliant manner. A breach of the GDPR could result in regulatory investigations, reputational damage, fines and sanctions, orders to cease or change our processing of our data, enforcement notices, or assessment notices (for a compulsory audit).”

Annual report 2025A · The company itself

“Table of Contents We may also be directly or indirectly liable to the payment networks for rule violations. Payment networks set and interpret their network operating rules and have alleged from time to time that various aspects of our business model violate these operating rules.”

Annual report 2025A · The company itself

“In addition, the IRS has yet to issue guidance on a number of important issues regarding the tax treatment of cryptocurrency and the products we provide to our customers and from which we derive our income. In the absence of such guidance, we will take positions with respect to any such unsettled issues. There is no assurance that the IRS or a court will agree with the positions taken by us, in which case tax penalties and interest may be imposed that could adversely affect our business, cash flows or financial performance.”

Annual report 2025A · The company itself

“Therefore, we monitor these areas closely and invest significant resources in our legal, compliance, product, and engineering teams to ensure our business practices evolve to help us comply with the current laws, regulations, and legal standards to which we are subject, as well as to plan and prepare for changes in interpretations thereof, as well as additional laws, regulations, and legal standards that are introduced in the future.”

Annual report 2025A · The company itself

“We have policies and procedures to analyze whether each crypto asset that we seek to facilitate trading on Coinbase Spot Market, as well as our products and services, could be deemed to be a “security” under applicable laws. Our policies and procedures do not constitute a legal standard, but rather represent our company-developed model, which we use to make a risk-based assessment regarding the likelihood that a particular crypto asset, product or service could be deemed a “security” under applicable laws. Table of Contents Because Coinbase Spot Market, Coinbase Prime and Coinbase app are not registered or licensed with the SEC or foreign authorities as a broker-dealer, national securities exchange, or ATS (or foreign equivalents), we only permit trading of those crypto assets, and offer products and services, for which we determine there are reasonably strong arguments to conclude that the crypto asset, product or service is not a security.”

Annual report 2025A · The company itself

“We intend to continue to make investments in our business, which investments may require us to secure additional funds. Additional financing may not be available on terms favorable to us, if at all, including due to general macroeconomic conditions, crypto market conditions and any disruptions in the crypto market, instability in the global banking system, increasing regulatory uncertainty and scrutiny or other unforeseen factors.”

Annual report 2025A · The company itself

“Additionally, our event contract products, which allow customers to trade on the outcome of future events, are subject to complex and evolving legal and regulatory frameworks and interpretation. Event contracts, whether offered by us or others, have drawn scrutiny from federal and state regulators and resulted in litigation that we are party to as well as litigation against other companies that offer event contracts. Regulators and authorities in various jurisdictions may assert that these offerings constitute gambling, sports betting, or other regulated activities under state or local laws, rather than federally regulated financial instruments.”

Annual report 2025A · The company itself

“We also offer various staking, rewards, and lending products, all of which are subject to significant regulatory uncertainty, and could implicate a variety of laws and regulations worldwide. For example, there is regulatory uncertainty regarding the status of our staking, lending, rewards, and other yield-generating activities under the U.S. federal and state securities laws.”

Annual report 2025A · The company itself

“At the same time, public healthcare budgets came under strain, and reimbursement reforms added new uncertainty and complexity in the US market.”

Annual report 2025A · The company itself

“Kerecis continued volatility related to the expected changes to skin substitutes coverage and payment in the outpatient setting as of January 1, 2026 1) c.”

Annual report 2025A · The company itself

“Our chronic business areas are characterised by solid reimbursement (more than 90% of sales covered by reimbursement), risk of healthcare reforms, and a stable competitive environment.”

Annual report 2025A · The company itself

“In the US, the recent opening of Medicare reimbursement creates a multi-year opportunity to expand access, as all Medicare-covered patients become eligible for transanal irrigation.”

Annual report 2025A · The company itself

“Sales to hospital systems are not directly reimbursement driven, as hospitals pay for Biologics products from diagnoses related payments from insurance companies. In the out-patient segment Biologics enjoys wide product specific reimbursement coverage from public and private insurers, with future growth being dependent on continued coverage.”

Annual report 2025A · The company itself

“HyperlinkHy perlinkHyper linkHyperlink Hyperlink Other matters Proposed update to DMEPOS Competitive Bidding Program announced by CMS On June 30, 2025, the Centers for Medicare and Medicaid Services (CMS) in the US announced a proposed rule 1) , which, among other, included an update on the Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) Competitive Bidding Program (CBP). The commenting period ended August 29, 2025 and we expect an update to be published in late 2025, and for any potential changes to take effect at the earliest in 2028 based on internal assessment.”

Annual report 2025A · The company itself

“Expected changes to skin substitutes coverage and payment in the US out-patient setting as of January 1, 2026 As of January 1, 2026 we expect two new policies to be implemented in the skin substitutes outpatient setting; the Local Coverage Determination (LCD) 2) policy and the Calendar Year 2026 Medicare Physician Fee Schedule 3) . Around 20% of Kerecis total revenue comes from the out-patient setting and is covered by Medicare. Kerecis currently has two product brands, MariGen® and Shield®, affected by CMS payment and coverage policies, with a current average price for the outpatient setting of $110/cm .”

Annual report 2025A · The company itself

“On October 31, 2025 the CMS announced a finale rule on the Calendar Year 2026 Medicare Physician Fee Schedule, where the Average Selling Price (ASP) pricing model for the physicians private office in the outpatient setting is replaced by a fixed payment of $127.28/cm for all products effective January 1, 2026.”

Annual report 2025A · The company itself

“Pricing and reimbursement A large part of Coloplast’s products is sold in markets that are subsidised and eligible for reimbursement from healthcare authorities. As a result, prices are influenced by the economic and political developments in national and regional markets, budgetary constraints of governments, healthcare reforms, bargaining power of wholesalers and distributors, as well as the ability to convince buyers of the economic value of its products based on clinical evidence, costs, and patient outcomes. • Lower reimbursements and increasing price pressure due to healthcare and price reforms. • Lack of or inadequate clinical evidence to support reimbursement levels. • Claw back or other repayment schemes introduced by healthcare authorities retroactively. • Biologics is not getting the local coverage determination (LCD) reimbursement coverage.”

Annual report 2025A · The company itself

“MDR certification of product portfolio within Voice & Respiratory Care in newly acquired businesses The European Medical Device Regulation (EU MDR) ensures medical devices sold in Europe are safe and effective, requiring Coloplast to meet specific requirements before marketing. This necessitates increased documentation and reporting to demonstrate compliance.”

Annual report 2025A · The company itself

“In adverse events related to product health and safety, we engage directly with authorities and affected consumers or end-users, following legislation and formal processes.”

Annual report 2025A · The company itself

“Other policies supporting Coloplast’s business conduct Global Anti-Bribery, Anti-Corruption and Anti-Money Laundering Policy The global policy ensures Coloplast’s business practices are compliant with anti-bribery, anticorruption and anti-money laundering laws, as well as Coloplast policies and guidance on how to identify and combat anti-bribery, anti-corruption, and anti-money laundering risks. It applies to all directors, officers, managers, employees and contract workers employed within the Coloplast Group as well as third parties acting on behalf of Coloplast, whether directly or indirectly.”

Annual report 2025A · The company itself

“In the United States in particular, the Communications Act of 1934, as amended (the “Communications Act”), and Federal Communications Commission (“FCC”) regulations and policies affect significant aspects of our communications businesses. Beyond the more significant regulations summarized below, legislators and regulators at all levels of government frequently consider changing, and sometimes do change, existing statutes, rules or regulations, or interpretations of existing statutes, rules or regulations, or prescribe new ones, any of which may significantly affect our businesses and ability to effectively compete. Applying existing laws in novel ways to new technologies, including streaming services and artificial intelligence (“AI”), may also affect our business.”

Annual report 2025A · The company itself

“These legislators and regulators, along with some state attorneys general and foreign governmental authorities, have been active in conducting inquiries and reviews regarding our services. State legislative and regulatory initiatives can create a patchwork of different and/or conflicting state requirements, such as with respect to privacy and Open Internet/net neutrality regulations, that can affect our businesses and ability to effectively compete.”

Annual report 2025A · The company itself

“In 2024, the FCC reclassified broadband internet access services as a “telecommunications service” subject to traditional common carriage regulation under Title II of the Communications Act. However, a federal appellate court in January 2025 overturned that reclassification, ruling that broadband internet access service is an “information service” under Title I of the Communications Act and that the FCC does not have authority to subject broadband services to utility-style regulations such as rate regulation and market entry and exit requirements under Title II. As a Title I “information service,” broadband is only subject to light-touch regulation such as broadband disclosure requirements, and deployment, subscription and pricing reporting requirements.”

Annual report 2025A · The company itself

“States and localities have in the past enacted, and may in the future periodically consider, new broadband-related regulations, including those regarding government-owned broadband networks, net neutrality and broadband affordability, which could create a patchwork of, and potentially inconsistent, federal, state and local regulatory regimes.”

Annual report 2025A · The company itself

“These laws and regulations can constrain our ability to compete, particularly against DTC streaming service providers, which are not subject to these same requirements. Federal, state and local franchising rules and regulations may require us to provide adequate channel capacity, facilities and financial support for public, educational and governmental access programming; comply with certain renewal procedures for our franchise agreements; pay franchise fees; and comply with customer service, accessibility, and certain other requirements.”

Annual report 2025A · The company itself

“In addition, the FCC and other federal agencies can impact the programming networks that we carry, as well as how we price, package, bill and market our video services. FCC regulations also require cable operators to carry programming transmitted by certain local broadcast television stations (“must-carry” requirement) or to negotiate a “retransmission consent” agreement with certain other stations that will frequently involve payments from cable operators to the station; govern program access by preventing cable networks affiliated with cable operators from favoring affiliated cable operators over competing multichannel video providers; grant licenses to broadcast television stations for 8-year cycles, which may not be renewed on favorable terms, or at all; limit local and national broadcast television ownership, as well as foreign ownership in a broadcast television station; and regulate children’s programming.”

Annual report 2025A · The company itself

“We have been involved in disputes at the FCC in some of these areas and may be involved in new disputes in the future, including potential disputes related to content moderation and free speech.”

Annual report 2025A · The company itself

“Wireless We offer a wireless service primarily using our MVNO rights to provide the service over Verizon’s wireless network to customers, and beginning in 2026, over T-Mobile’s wireless network to business customers. MVNOs are subject to many of the same FCC regulations as facilities-based wireless carriers, such as E911 services and local number portability, as well as certain state or local regulations. The FCC or other regulatory authorities may adopt new or different regulations for MVNOs and/or mobile broadband providers in the future, which could adversely affect our wireless service offering or our business generally.”

Annual report 2025A · The company itself

“The FCC has adopted a number of regulations for providers of nontraditional voice services such as ours, including regulations relating to privacy of customer proprietary network information, local number portability duties and benefits, disability access, E911, law enforcement assistance, outage reporting, Universal Service Fund contribution obligations, rural call completion, customer equipment back-up power, robocall mitigation, service discontinuance and certain regulatory filing requirements. State regulatory commissions and legislatures in other jurisdictions may continue to consider imposing regulatory requirements on our voice services as long as the regulatory classification of VoIP remains unsettled at the federal level.”

Annual report 2025A · The company itself

“Further, if the FCC reallocates spectrum that our businesses currently use to provide services, we could be required to transition our operations to different frequencies in order to accommodate the reallocation of spectrum for 5G, which could disrupt our services and impose additional costs.”

Annual report 2025A · The company itself

“International Communications-Related and Other Regulations Certain of our international businesses are subject to telecommunications and media-specific regulation, including those related to broadband and voice services and television networks, in Europe, Latin America, and other international jurisdictions, and all of our international businesses are subject to regulation under generally applicable laws, such as competition, consumer protection, data protection, and taxation in the jurisdictions where they operate. Our international businesses are currently, and may be in the future, subject to proceedings or investigations from regulatory and antitrust authorities in the jurisdictions in which those businesses operate.”

Annual report 2025A · The company itself

“Modifications to existing laws, a weakening of these protections or their enforcement or a failure of existing laws, in the United States or internationally, to adapt to new technologies could have an adverse effect on our ability to license and sell our programming.”

Annual report 2025A · The company itself

“The cable compulsory copyright license and the royalties we pay are subject to audits and possible regulatory and legislative changes that could impact the royalty fees we pay and our ability to retransmit broadcast signals over cable systems. In addition, the landscape for music licensing is constantly changing, and music fees we pay are subject to new fee demands and negotiations. We cannot predict how changes to the compulsory copyright license and music licensing will impact the fees that we pay.”

Annual report 2025A · The company itself

“Privacy and Data Protection Regulation Our businesses are subject to laws and regulations that impose various restrictions and obligations related to privacy and the processing of individuals’ personal information. In the United States, federal privacy laws and regulations, such as those found within the Communications Act or the Video Privacy Protection Act, restrict companies’ collection, use, disclosure and retention of personal information. The proliferation of laws at the state level has expanded consumers’ rights to include individual rights of access, deletion, portability, correction, the right to appeal, and the individual’s right to “opt in” to collection and use of certain types of “sensitive” personal information. Internationally, we are subject to the European Union’s General Data Protection Regulation and the United Kingdom’s Data Protection Act of 2018, as well as many other similar laws that apply to our businesses, which broadly regulate the processing of personal data collected from individuals in the European Union and United Kingdom, respectively.”

Annual report 2025A · The company itself

“Some of our businesses are also subject to the FTC’s general oversight of consumer privacy protections through its enforcement authority over unfair and deceptive acts or practices, as well as through its enforcement authority under the Children’s Online Privacy Protection Act. The FTC has sought to expand its authority in this area through various rulemakings related to general privacy, targeted advertising and children’s privacy. There has been an increased focus on children’s privacy at both the state and federal levels within the United States, as well as internationally.”

Annual report 2025A · The company itself

“In addition, many international data protection laws, some federal laws, and all 50 U.S. states have security breach notification requirements that obligate businesses to provide notice to consumers and government agencies if certain information has been accessed or exfiltrated by an unauthorized party; some of these laws also require documented information security programs.”

Annual report 2025A · The company itself

“State and Local Taxes Some U.S. states and localities have imposed or are considering imposing, through both legislative and administrative channels, new or additional taxes or fees on, or limiting or eliminating incentives or credits earned or monetized by, our businesses, or imposing adverse methodologies by which taxes, fees, incentives or credits are computed, earned or monetized. These include combined reporting or other changes to general business taxes, central assessments for property tax, and taxes and fees on the businesses operated or services provided by our businesses, most notably new taxes or fees on digital advertising or other digital commerce.”

Annual report 2025A · The company itself

“In some situations, DBS providers and other competitors (such as DTC streaming service providers) that deliver their services over a broadband connection do not face the same state and local tax and fee burdens. Congress has also considered, and may consider again, proposals to bar or limit states from imposing taxes on these DBS providers or other competitors (such as DTC streaming service providers) that are equivalent to the taxes or fees that we pay.”

Annual report 2025A · The company itself

“Other Regulations U.S. states and localities, and various regulatory authorities, actively regulate other aspects of our businesses, including our Studios and Theme Parks businesses, accessibility to our video and voice services and broadcast television programming for people with disabilities, customer service standards, inside wiring, cable equipment, pole attachments, universal service fees, regulatory fees, public safety, telemarketing, leased access, indecency, loudness of commercial advertisements, advertising, political broadcasting, sponsorship identification, Emergency Alert System, equal employment opportunity and other employment-related practices, environmental-related matters, our equipment supply chain, and technical standards relating to the operation of cable systems and television stations. In addition, our international businesses are subject to various similar regulations, including those that cover television broadcasting, programming, and advertising. We are occasionally subject to enforcement actions and investigations at the FCC and other federal, state, and local agencies, as well as foreign governments and regulatory authorities, which can result in fines, sanctions and/or ongoing compliance plans and government oversight.”

Annual report 2025A · The company itself

“We offer broadband and wireline voice services in the United Kingdom and Italy using third-party networks. In many cases, the fee for us to access these networks is on regulated terms.”

Annual report 2025A · The company itself

“The FCC and Congress have previously considered proposals that would require companies that own multiple cable networks to make each of their networks available individually when negotiating distribution agreements with MVPDs and potentially with DTC streaming service providers. We currently offer our cable networks on a packaged basis (in “tiers”) and, in various cases, individually.”

Annual report 2025A · The company itself

“The Utilities have rate plans approved by state utility regulators that limit the rates they can charge their customers. The rates are generally designed for, but do not guarantee, the recovery of the Utilities’ cost of providing service (including a return on equity).”

Annual report 2025A · The company itself

“The Utilities’ rate plans typically require action by regulators at their expiration dates, which may include approval of new plans with different provisions.”

Annual report 2025A · The company itself

“The wholesale markets vary from region to region with distinct rules, practices, and procedures. Changes in these market rules, problems with rule implementation, or failure of any of these markets could adversely affect our business with little notice.”

Annual report 2025A · The company itself

“The imposition of price caps, the issuance of orders extending the operation of generation resources slated for retirement, the imposition of requirements that new large load secure supply from new generation resources or agree to be interrupted, policies allowing utility-owned generation in restructured states, and policies favoring new resources at the expense of existing resources may lead to a market design that results in the premature retirement of existing resources, which would negatively affect our portfolio of assets as well as the market as a whole. For example, PJM is considering market rule changes as part of its stakeholder process, and the Trump administration, in conjunction with Governors of PJM states, have proposed a framework to govern new load connection and the generation that can serve that load.”

Annual report 2025A · The company itself

“We could also be affected by state laws, regulations or initiatives to subsidize existing or new generation.”

Annual report 2025A · The company itself

“FERC’s requirements for market-based rate authority could pose a risk that we may no longer satisfy FERC’s tests for market-based rates. A loss of market-based rate authority would mean that we would sell power at cost-based rates.”

Annual report 2025A · The company itself

“Table of Contents Our results of operations and financial condition are significantly affected by our sales and purchases of commodities at market-based rates, as opposed to cost-based or other similarly regulated rates. Federal and state regulatory and legislative action designed to limit market-based rates through capacity market mitigation, energy and capacity pricing restrictions, new generation mandates, or other means, may negatively impact our results of operations.”

Annual report 2025A · The company itself

“Additionally, Federal Power Act Section 202(c) authorizes the issuance of emergency orders requiring power plants to operate or to mandate temporary electricity connections to prevent grid failure during emergencies such as severe weather, fuel shortages, or sudden demand spikes. The exercise of such authority could have an adverse impact on our results of operations if we are required to operate units when it is not economical.”

Annual report 2025A · The company itself

“Email and Text Marketing Laws and Regulations We use email marketing and text-messaging to reach out to current or potential customers and therefore are subject to various statutes, regulations and rulings, including the Telephone Consumer Protection Act (TCPA), the Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM Act) and related Federal Communication Commission (FCC) orders. Several states have enacted additional, more restrictive and punitive laws regulating telemarketing and commercial email. Foreign legislation exists as well, including Canada’s Anti-Spam Legislation and the European laws that have been enacted pursuant to European Union Directive 2002/58/EC and its amendments.”

Annual report 2025A · The company itself

“Unfair or Deceptive Business Practices All persons engaged in commerce, including, but not limited to, us and our bank sponsors and customers, are subject to regulatory enforcement by the FTC, under Section 5 of the Federal Trade Commission Act, and state attorneys general, under various consumer-protection statutes, prohibiting unfair or deceptive acts or practices, and certain products also are subject to the jurisdiction of the Consumer Financial Protection Bureau (CFPB) regarding the prohibition of unfair, deceptive, or abusive acts and practices.”

Annual report 2025A · The company itself

“We are subject to several laws and related regulations governing the provision and administration of credit. The Truth in Lending Act (TILA) was enacted as a consumer protection measure to increase consumer awareness of the cost of credit and to protect consumers from unauthorized charges or billing errors and is implemented by the CFPB’s Regulation Z.”

Annual report 2025A · The company itself

“Anti-Money Laundering, Counter Terrorist and Sanctions Regulations The Currency and Foreign Transactions Reporting Act, which is also known as the Bank Secrecy Act (BSA) and which has been amended by the USA PATRIOT Act of 2001, contains a variety of provisions aimed at fighting terrorism and money laundering. Among other things, the BSA and related regulations issued by FinCEN require financial-services providers to establish AML programs, to prohibit the financing of terrorism, to report suspicious activity and to maintain a number of related records.”

Annual report 2025A · The company itself

“The Durbin Amendment to the Dodd-Frank Act provided that interchange fees that a card issuer or payment network receives or charges for debit transactions must be “reasonable and proportional” to the cost incurred by the card issuer in authorizing, clearing and settling the transaction. Payment network fees may not be used directly or indirectly to compensate card issuers in circumvention of the interchange transaction fee restrictions.”

Annual report 2025A · The company itself

“Payment Card Industry Rules In connection with certain services we provide for payment cards bearing the Mastercard brand and to those acting as merchants accepting those cards, we must comply with the bylaws, regulations and requirements that are promulgated by Mastercard and other applicable payment-card organizations, including the Payment Card Industry Data Security Standard (PCI DSS), the Mastercard Site Data Protection Program (SDP) and other applicable data-security program requirements. A breach of such payment card network rules could subject us to a variety of fines or penalties that may be levied by the payment networks for certain acts or omissions. The payment networks routinely update and modify their requirements.”

Annual report 2025A · The company itself

“Furthermore, regulators and Congress have passed, and continue to consider, new legislation and regulations that change the electronic payments industry’s pricing, charges and other practices related to its customers. Any restrictions on our ability to price our products and services, including caps on late fees and finance charges, network fee changes or requirements to modify billing, disclosure or dispute practices, could materially and adversely affect our revenue.”

Annual report 2025A · The company itself

“In addition, Mastercard routinely updates and modifies its membership requirements. Changes in such requirements may make it significantly more expensive for us to provide these services, or may require product or process changes within compressed timelines.”

Annual report 2025A · The company itself

“In addition, the regulatory landscape for stablecoins and blockchain-based payments remains unsettled. Changes in, or inconsistent application of, laws and regulations relating to stablecoins could impose new licensing obligations, operational controls, reporting and disclosure obligations or other burdens.”

Annual report 2025A · The company itself

“Many of these laws and regulations are evolving, unclear and inconsistent across various jurisdictions, and ensuring compliance with them is difficult and costly. With increasing frequency, federal and state regulators are holding businesses like ours to higher standards of training, monitoring and compliance, including monitoring for possible violations of laws by our customers and people who do business with our customers while using our products.”

Annual report 2025A · The company itself

“With respect to its bank counterparties, the cross-border solution may be subject to additional regulatory requirements from time to time associated with trading non-centrally cleared OTC derivatives pursuant to the Uncleared Margin Rules (UMR). We will need to monitor and manage carefully the initial and variation margin requirements under the UMR, as and when they apply to portions of the cross-border solution.”

Annual report 2025A · The company itself

“Governmental bodies in the U.S. and abroad have adopted, or are considering the adoption of, laws and regulations granting consumer rights to, restricting the transfer of and requiring safeguarding of, personal information. For example, in the U.S., all financial institutions must undertake certain steps to help protect the privacy and security of consumer financial information.”

Annual report 2025A · The company itself

“The FTC Order requires us, among other things, to comply with certain advertising, contracting, record maintenance and reporting requirements for the U.S. fuel card business. Material failures to comply with the obligations under the FTC Order may subject us to enforcement proceedings, which could result in significant fines, penalties or liabilities that may impact our financial performance.”

Annual report 2025A · The company itself

“Increased regulation and compliance requirements are impacting these businesses and our bank relationships by making it more costly for us to provide our solutions or by making it more cumbersome for businesses to do business with us.”

Annual report 2025A · The company itself

“Our business is subject to regulation by various federal, state, local and foreign governmental agencies, including agencies responsible for monitoring and enforcing data privacy and security laws and regulations, employment and labor laws, workplace safety, product safety, environmental laws, consumer protection laws, anti-bribery laws, import and export controls, federal securities laws and tax laws and regulations. In certain jurisdictions, these regulatory requirements may be more stringent than in the United States. Increased scrutiny may also lead to new laws and regulations, or new applications of existing laws and regulations, that target topics such as AI, critical infrastructure software resiliency, digital sovereignty requirements and concentration risk.”

Annual report 2026A · The company itself

“The federal, state and local laws, regulations and rules and the international laws and regulations governing the Company’s businesses, the contracts they enter into, and interpretations of those laws, regulations and rules continue to change and expand, grow more complex and become more restrictive each year. The application of these complex legal and regulatory requirements to the detailed operation of the Company’s businesses creates areas of uncertainty.”

Annual report 2025A · The company itself

“Laws and Regulations Related to Multiple Segments of the Company’s Business Laws Related to Reimbursement by Government Programs - The Company is subject to various federal and state laws concerning its submission of claims and other information to Medicare, Medicaid and other federal and state government-sponsored health care programs. Potential sanctions for violating these laws include recoupment or reduction of government reimbursement amounts, civil penalties, treble damages, and exclusion from participation in government health care programs.”

Annual report 2025A · The company itself

“The ACA - The ACA significantly increased federal and state oversight of health plans. Among other requirements, it specifies minimum medical loss ratios (“MLRs”) for Commercial and Medicare Insured products, specifies features required to be included in commercial benefit designs, limits commercial individual and small group rating and pricing practices, encourages additional competition (including potential incentives for new participants to enter the marketplace), and includes regulations and processes that could delay or limit the Company’s ability to appropriately increase its health plan premium rates.”

Annual report 2025A · The company itself

“Medicare Regulation - The Company’s Medicare Advantage, Medicare stand-alone Part D PDP and other Medicare products are highly regulated by CMS. The regulations and contractual requirements applicable to the Company and other private participants in Medicare programs are complex, expensive to comply with and subject to change.”

Annual report 2025A · The company itself

“Additionally, there is growing interest among policymakers in re-evaluating how benchmarks are constructed in Medicare Advantage compared to Medicare Fee-For-Service programs. Policymakers could pursue various strategies including, among other things, re-evaluating benchmark construction, risk adjustment methodology and alignment in quality measures.”

Annual report 2025A · The company itself

“Medicaid Regulation - The Company is exposed to changes in government policy with respect to and/or regulation of the various Medicaid and dual eligible plan programs in which the Company participates, including changes in the amounts payable to the Company under those programs.”

Annual report 2025A · The company itself

“Minimum MLR requirements and similar actions further limit the level of margin the Company can earn in its Insured Medicaid products while leaving the Company exposed to medical costs that are higher than those reflected in its pricing.”

Annual report 2025A · The company itself

“The “One Big Beautiful Bill Act” also known as the “Working Families Tax Cut Act” of 2025 makes changes to Medicaid eligibility rules and financing, which will lead to reduced eligibility for Medicaid beneficiaries and reduced state funding, which will in turn impact Medicaid benefits and payment rates.”

Annual report 2025A · The company itself

“The Company’s Medicaid products, dual eligible products and CHIP contracts also are subject to complex federal and state regulations and oversight by state Medicaid agencies regarding the services provided to Medicaid enrollees, payment for those services, network requirements (including mandatory inclusion of specified high-cost providers), and other aspects of these programs, and by external review organizations which audit Medicaid plans on behalf of state Medicaid agencies. The laws, regulations and contractual requirements applicable to the Company and other participants in Medicaid and dual eligible programs, including requirements that the Company submit encounter data to the applicable state agency, are extensive, complex and subject to change. The Company has invested significant resources to comply with these standards, and its Medicaid and dual eligible program compliance efforts will continue to require significant resources.”

Annual report 2025A · The company itself

“CMS and/or state Medicaid agencies may fine the Company, withhold payments to the Company, seek premium and other refunds, terminate the Company’s existing contracts, elect not to award the Company new contracts or not to renew the Company’s existing contracts, prohibit the Company from continuing to market and/or enroll members in or refuse to automatically assign members to one or more of the Company’s Medicaid or dual eligible products, exclude the Company from participating in one or more Medicaid or dual eligible programs and/or institute other sanctions and/or civil monetary penalties against the Company if it fails to comply with CMS or state regulations or contractual requirements.”

Annual report 2025A · The company itself

“Medicare and Medicaid Audits - CMS regularly audits the Company’s performance to determine its compliance with CMS’ regulations and its contracts with CMS and to assess the quality of services it provides to Medicare Advantage and PDP beneficiaries. For example, CMS conducts risk adjustment data validation (“RADV”) audits of a subset of Medicare Advantage contracts for each contract year. Since 2011, CMS has selected certain of the Company’s Medicare Advantage contracts for various years for RADV audit, and the number of RADV audits continues to increase. The OIG also is auditing the Company’s risk adjustment data and that of other companies, and the Company expects CMS and the OIG to continue auditing risk adjustment data.”

Annual report 2025A · The company itself

“In May 2025, CMS announced it would audit every Medicare Advantage contract each payment year, with an expedited plan to complete audits for payment years 2018 through 2024 by early 2026.”

Annual report 2025A · The company itself

“Medicare Star Ratings - A portion of each Medicare Advantage plan’s reimbursement is tied to the plan’s “star ratings.” The star rating system considers a variety of measures adopted by CMS, including quality of preventative services, chronic illness management, compliance and overall customer satisfaction.”

Annual report 2025A · The company itself

“CMS continues to revise its star ratings system to make it harder to achieve 4 or more stars. There can be no assurances that the Company will be successful in maintaining or improving its star ratings in future years. Accordingly, the Company’s Medicare Advantage plans may not continue to be or become eligible for full level quality bonuses, which could adversely affect the benefits such plans can offer, reduce membership and/or reduce profit margins.”

Annual report 2025A · The company itself

“The 2027 Medicare Advantage rates, if finalized as proposed, will result in an expected average increase in revenue for the Medicare Advantage industry of 2.54%, which includes a risk score trend increase of 2.45%. Without including the risk score trend increase, the advance 2027 rates will result in an expected average increase in revenue for the Medicare Advantage industry of 0.09%, though the rates may vary widely depending on the provider group and patient demographics.”

Annual report 2025A · The company itself

“The Company faces a challenge from the impact of the increasing cost of medical care (including prescription medications), changes to methodologies for determining payments and CMS local and national coverage decisions that require the Company to pay for services and supplies that are not factored into the Company’s bids. The federal government may seek to impose restrictions on the configuration of pharmacy or other provider networks for Medicare Advantage and/or PDP plans, or otherwise restrict the ability of these plans to alter benefits, negotiate prices or establish other terms to improve affordability or maintain viability of products.”

Annual report 2025A · The company itself

“A reduction in Covered Entities’ participation in contract pharmacy arrangements, a reduction in the use of the Company’s administrative services by Covered Entities or a reduction in drug manufacturers’ participation in the program could result from enforcement actions, rule changes or otherwise and could materially and adversely affect the Company.”

Annual report 2025A · The company itself

“District Court of Maine issued a preliminary injunction halting the implementation of the 340B Rebate Model Pilot Program (the “Pilot”). The court held that the Pilot is likely arbitrary and capricious under the Administrative Procedure Act because the Pilot’s potential impact on 340B hospitals was not adequately considered; the decision has been appealed to the First Circuit Court of Appeals.”

Annual report 2025A · The company itself

“Anti-Remuneration Laws - Federal law prohibits, among other things, an entity from knowingly and willfully offering, paying, soliciting or receiving, subject to certain exceptions and “safe harbors,” any remuneration to induce the referral of individuals or the purchase, lease or order of items or services for which payment may be made under Medicare, Medicaid or certain other federal and state health care programs. A number of states have similar laws, some of which are not limited to services paid for with government funds. Sanctions for violating these federal and state anti-remuneration laws may include imprisonment, criminal and civil fines, and exclusion from participation in Medicare, Medicaid and other federal and state government-sponsored health care programs.”

Annual report 2025A · The company itself

“Numerous lawsuits have been filed throughout the U.S against pharmaceutical manufacturers, retail pharmacies and/or PBMs under various federal and state antitrust and unfair competition laws challenging, among other things: (i) brand name drug pricing and rebate practices of pharmaceutical manufacturers, (ii) the maintenance of retail or specialty pharmacy networks by PBMs, and (iii) various other business practices of PBMs and retail pharmacies.”

Annual report 2025A · The company itself

“The federal Health Insurance Portability and Accountability Act of 1996, as it has been amended from time to time, and the regulations issued thereunder (collectively, “HIPAA”), impose extensive requirements on the way in which health plans, providers, health care clearinghouses and their business associates use, disclose and safeguard protected health information (“PHI”). Criminal penalties and civil sanctions may be imposed for failing to comply with HIPAA’s privacy and security standards.”

Annual report 2025A · The company itself

“In addition to HIPAA, state laws apply to the extent they are more protective of individual privacy than is HIPAA, including laws that place stricter controls on the release of information relating to specific diseases or conditions, reproductive health records and requirements to notify members of unauthorized release or use of or access to PHI.”

Annual report 2025A · The company itself

“There is also a continuing trend of states enacting more comprehensive privacy laws and regulations addressing consumer rights to data access, deletion, protection or transparency, such as the California Consumer Privacy Act (“CCPA”). States also are starting to issue regulations and proposed regulations specifically related to cybersecurity, such as the regulations issued by the New York Department of Financial Services, as well as regulating use of artificial intelligence technologies. Complying with conflicting cybersecurity regulations, which may differ from state to state, requires significant resources.”

Annual report 2025A · The company itself

“Most states also have similar consumer protection laws and a growing number of states regulate subscription programs.”

Annual report 2025A · The company itself

“Transparency Laws - The Transparency in Coverage Rule requires health insurers to disclose negotiated prices of drugs, medical services, supplies and other covered items. The rule also requires group health plans and health insurance issuers in the individual and group markets to disclose cost-sharing information upon request, to a participant, beneficiary, or enrollee and require plans and issuers to publicly disclose in-network provider rates, historical out-of-network allowed amounts and the associated billed charges, and negotiated rates and historical net prices for prescription drugs.”

Annual report 2025A · The company itself

“Telemarketing and Other Outbound Contacts - Certain federal and state laws, such as the Telephone Consumer Protection Act and the Telemarketing Sales Rule, give the FTC, the Federal Communications Commission and state Attorneys General the ability to regulate, and bring enforcement actions relating to, telemarketing practices and certain automated outbound contacts, such as phone calls, texts or emails. Under certain circumstances, these laws provide consumers with a private right of action. Violations of these laws could result in substantial statutory penalties and other sanctions.”

Annual report 2025A · The company itself

“Pharmacy and Professional Licensure and Regulation - The Company is subject to a variety of intersecting federal and state statutes and regulations that govern the wholesale distribution of drugs; operation of retail, specialty, infusion and mail order pharmacies; licensure of facilities and professionals, including pharmacists, technicians, nurses and other health care professionals; registration of facilities with the U.S. Drug Enforcement Administration (the “DEA”) and analogous state agencies that regulate controlled substances; packaging, storing, shipping and tracking of pharmaceuticals; repackaging of drug products; labeling, medication guides and other consumer disclosures; interactions with prescribers and health care professionals; compounding of prescription medications; dispensing of controlled and non-controlled substances; counseling of patients; transfers of prescriptions; advertisement of prescription products and pharmacy services; security; inventory control; recordkeeping; reporting to Boards of Pharmacy, the U.S. Food and Drug Administration (the “FDA”), the U.S. Consumer Product Safety Commission, the DEA and related state agencies; and other elements of pharmacy practice.”

Annual report 2025A · The company itself

“Telehealth Laws - States generally require providers providing professional health care services, whether in person or via telehealth, to a patient residing within the state to be licensed in that state. States have established a variety of licensing and other regulatory requirements around the provision of telehealth services. These requirements vary from state to state.”

Annual report 2025A · The company itself

“State Insurance, HMO and Insurance Holding Company Regulation - A number of states regulate affiliated groups of insurers and HMOs, such as the Company under holding company statutes. These laws may, among other things, require prior regulatory approval of dividends and material intercompany transfers of assets and transactions between the regulated companies and their affiliates, including their parent holding companies.”

Annual report 2025A · The company itself

“Changes to state insurance, HMO and/or insurance holding company laws or regulations or changes to the interpretation of those laws or regulations, including due to regulators’ increasing concerns regarding insurance company and/or HMO solvency due, among other things, to past and expected payor insolvencies, could negatively affect the Company’s businesses in various ways, including through increases in solvency fund assessments, requirements that the Company hold greater levels of capital and/or delays in approving dividends from regulated subsidiaries.”

Annual report 2025A · The company itself

“The states of domicile of the Company’s regulated subsidiaries have statutory risk-based capital (“RBC”) requirements for health and other insurance companies and HMOs based on the National Association of Insurance Commissioners’ (the “NAIC”) Risk-Based Capital for Insurers Model Act (the “RBC Model Act”). These RBC requirements are intended to assess the capital adequacy of life and health insurers and HMOs, taking into account the risk characteristics of a company’s investments and products. The RBC Model Act sets forth the formula for calculating RBC requirements, which are designed to take into account asset risks, insurance risks, interest rate risks and other relevant risks with respect to an individual company’s business.”

Annual report 2025A · The company itself

“Government Agreements and Mandates - From time to time, the Company and/or its various affiliates are subject to certain consent decrees, settlement and other agreements, corrective action plans and corporate integrity agreements or heightened scrutiny with various federal, state and local authorities relating to such matters as privacy practices, controlled substances, PDPs, expired products, environmental and safety matters, marketing and advertising practices, PBM and other pharmacy operations and various other business practices. Certain of these agreements contain ongoing reporting, monitoring and/or other compliance requirements for the Company.”

Annual report 2025A · The company itself

“Environmental and Safety Regulation - The Company’s businesses are subject to various federal, state and local laws, regulations and other requirements pertaining to protection of the environment, public health and employee safety, including, 25 for example, regulations governing the management of hazardous substances, the cleaning up of contaminated sites, and the maintenance of safe working conditions in the Company’s retail locations, distribution centers and other facilities.”

Annual report 2025A · The company itself

“ERISA Regulation - The Employee Retirement Income Security Act of 1974 (“ERISA”) provides for comprehensive federal regulation of certain employee pension and benefit plans, including private employer and union sponsored health plans and certain other plans that contract with us to provide PBM services. In general, the Company assists plan sponsors in the administration of their health benefit plans, including the prescription drug benefit portion of those plans, in accordance with the plan designs adopted by the plan sponsors.”

Annual report 2025A · The company itself

“In addition to its fiduciary provisions, ERISA imposes civil and criminal liability on service providers to health plans and certain other persons if certain forms of illegal remuneration are made or received.”

Annual report 2025A · The company itself

“Under those interpretations, together with DOL regulations, the Company may have ERISA fiduciary duties with respect to medical members, PBM members and/or certain general account assets held under contracts that are not guaranteed benefit policies. As a result, certain transactions related to those general account assets are subject to conflict of interest and other restrictions, and the Company must provide certain disclosures to policyholders annually. The Company must comply with these restrictions or face substantial penalties.”

Annual report 2025A · The company itself

“Contract Audits - The Company is subject to audits of many of its contracts, including its PBM client contracts, its PBM rebate contracts, its PBM network contracts, its contracts relating to Medicare Advantage and/or Medicare Part D, the agreements the Company’s pharmacies enter into with other payors, its Medicaid contracts and its customer contracts. Because some of the Company’s contracts are with state or federal governments or with entities contracted with state or federal agencies, audits of these contracts are often regulated by the federal or state agencies responsible for administering federal or state benefits programs, including those which operate Medicaid fee for service plans, Managed Medicaid plans, Medicare Part D plans or Medicare Advantage organizations.”

Annual report 2025A · The company itself

“In addition to other requirements, such as the Transparency in Coverage Rule note above, OPM regulations require that community-rated FEHB plans meet a FEHB program-specific minimum MLR by plan code and market. Managing to these rules is complicated by the simultaneous application of the minimum MLR standards and associated premium rebate requirements of the ACA.”

Annual report 2025A · The company itself

“State laws regulate the practice of medicine, the practice of pharmacy, the practice of nursing and certain other clinical activities. Clinicians engaged in a professional practice in connection with the provision of clinical services must satisfy applicable state licensing requirements and must act within their scope of practice.”

Annual report 2025A · The company itself

“International Regulation - The Company’s international operations are subject to different, and sometimes more stringent, legal and regulatory requirements, which vary widely by jurisdiction, including anti-corruption laws; economic sanctions laws; various privacy, insurance, tax, tariff and trade laws and regulations; corporate governance, privacy, data protection (including the European Union’s (“EU’s”) General Data Protection Regulation which began to apply across the EU during 2018), data mining, data transfer, labor and employment, intellectual property, consumer protection and investment laws and regulations; discriminatory licensing procedures; compulsory cessions of reinsurance; required localization of records and funds; higher premium and income taxes; limitations on dividends and repatriation of capital; and requirements for local participation in an insurer’s ownership.”

Annual report 2025A · The company itself

“Commercial Product Pricing and Underwriting Restrictions - Pricing and underwriting regulation by states limits the Company’s underwriting and rating practices and those of other health insurers, particularly for small employer groups, and varies by state. In general, these limitations apply to certain customer segments and limit the Company’s ability to set prices for new or renewing groups, or both, based on specific characteristics of the group or the group’s prior claim experience. In some states, these laws and regulations restrict the Company’s ability to price for the risk it assumes and/or reflect reasonable costs in the Company’s pricing.”

Annual report 2025A · The company itself

“The ACA expanded the premium rate review process by, among other things, requiring the Company’s Commercial Insured rates to be reviewed for “reasonableness” at either the state or the federal level. HHS established a federal premium rate review process that generally applies to proposed premium rate increases equal to or exceeding a federally (or lower state) specified threshold. HHS’s rate review process imposes additional public disclosure requirements as well as additional review on filings requesting premium rate increases equal to or exceeding this “reasonableness” threshold.”

Annual report 2025A · The company itself

“In addition, from time to time the Company may request increases in its premium rates in its Commercial Health Care Benefits business in order to adequately price for projected medical cost trends, required expansions of coverage and rating limits, and significant assessments, fees and taxes imposed by the federal and state governments, including as a result of the ACA.”

Annual report 2025A · The company itself

“Federal and State Reporting - The Company is subject to extensive financial and business reporting requirements, including penalties for inaccuracies and/or omissions, at both the federal and state level. The Company’s ability to comply with certain of these requirements depends on receipt of information from third parties that may not be readily available or reliably provided in all instances. The Company is and will continue to be required to modify its information systems, dedicate significant resources and incur significant expenses to comply with these requirements.”

Annual report 2025A · The company itself

“Product Design and Administration and Sales Practices - State and/or federal regulatory scrutiny of health care benefit product design and administration and marketing and advertising practices, including the filing of insurance policy forms, the adequacy of provider networks, the accuracy of provider directories, and the adequacy of disclosure regarding products and their administration, is increasing as are the penalties being imposed for inappropriate practices. Medicare, Medicaid and dual eligible products and products offering more limited benefits in particular continue to attract increased regulatory scrutiny.”

Annual report 2025A · The company itself

“Pharmacy Network Access Legislation - Medicare Part D and a majority of states now have some form of legislation affecting the Company’s (and its health plans’ and its health plan clients’) ability to limit access to a pharmacy provider network or remove pharmacy network providers. For example, certain “any willing provider” legislation may require the Company or its clients to admit a nonparticipating pharmacy if such pharmacy is willing and able to meet the plan’s price and other applicable terms and conditions for network participation. These laws could negatively affect the services and economic benefits achievable through a limited pharmacy provider network.”

Annual report 2025A · The company itself

“Also, a majority of states have some form of legislation affecting the Company’s ability (and the Company’s and its client health plans’ ability) to conduct audits of network pharmacies regarding claims submitted to the Company for payment. These laws could negatively affect the Company’s ability to recover overpayments of claims submitted by network pharmacies that the Company identifies through pharmacy audits.”

Annual report 2025A · The company itself

“Finally, several states have passed legislation that limits the ability of PBMs and health insurers to provide special benefit structures for use with affiliated pharmacies, which could result in reduced savings to clients and consumers. One state has passed and others are considering legislation prohibiting licensure of pharmacies affiliated with a PBM.”

Annual report 2025A · The company itself

“Pharmacy Pricing Legislation - Multiple states have passed legislation regulating the Company’s ability to manage pricing practices, including mandated pharmacy reimbursement rates and the collection of transmission fees. A number of states have also established MACs for generic prescription drugs.”

Annual report 2025A · The company itself

“Some states now require the PBM to reimburse a pharmacy’s actual acquisition cost. These laws could negatively affect the Company’s ability to establish MAC prices for generic drugs.”

Annual report 2025A · The company itself

“Additionally, some states have passed legislation that would restrict certain types of retroactive reconciliation or recoupment from pharmacies in the network or create a reimbursement benchmark mandate, such as the national average drug acquisition cost and/or the wholesale acquisition cost (“WAC”), plus a set dispensing fee, for pharmacies in the network.”

Annual report 2025A · The company itself

“•Minimum MLR rebate requirements limit the level of margin we can earn in our Insured Health Care Benefits products while leaving us exposed to higher than expected medical costs. Challenges to our minimum MLR rebate methodology and/or reports could adversely affect our operating results. •Our operating results may be adversely affected by changes in laws and policies governing employers and by union organizing activity.”

Annual report 2025A · The company itself

“CMS has proposed requiring that health plans offering certain dual eligible programs must also offer Medicaid programs, which has resulted in the Company refraining from bidding in certain jurisdictions and could further impact the Company’s ability to obtain or retain membership in its dual eligible programs. •In our Health Care Benefits segment, our customers have considerable flexibility in moving between us and our competitors.”

Annual report 2025A · The company itself

“•Our Health Care Benefits segment’s operating results and competitiveness is heavily impacted, in the case of Medicaid programs, by the sufficiency of the rates the states determine are actuarially sound based on experience from previous years. Such rate levels may not be representative of actual experience, and insufficient rates will negatively impact our revenues and operating results. •From time to time we request increases in our premium rates in our Commercial Health Care Benefits business in order to adequately price for projected medical cost trends, required expansions of coverage and rating limits, and significant assessments, fees and taxes imposed by federal and state governments, including as a result of the ACA.”

Annual report 2025A · The company itself

“•If laws or regulations are promulgated that limit the number of PBMs available in a particular business or geography, competition in those businesses and geographies could be amplified and could adversely affect our revenues and operating results. •The PBM industry has been experiencing price compression as a result of competitive pressures and increased client demands for lower prices; pricing guarantees; increased revenue sharing, including sharing in a larger portion of payments, including rebates and fees, to PBMs and group purchasing organizations received from drug manufacturers; enhanced 36 service offerings and/or higher service levels.”

Annual report 2025A · The company itself

“Marketplace dynamics and regulatory changes also have adversely affected our ability to offer plan sponsors pricing that includes the use of retail “differential” or “spread,” which could adversely affect our future profitability, and we expect these trends to continue.”

Annual report 2025A · The company itself

“The reserves we hold for expected claims in our Insured Health Care Benefits products are based on estimates that involve an extensive degree of judgment and are inherently variable. Any reserve, including a premium deficiency reserve, may be insufficient. If actual claims exceed our estimates, our operating results could be materially adversely affected, and our ability to take timely corrective actions to limit future costs may be limited.”

Annual report 2025A · The company itself

“Our businesses are subject to extensive regulation and oversight by state, federal and international governmental authorities. The laws and regulations governing our operations and interpretations of those laws and regulations are increasing in number and complexity, change frequently and can be inconsistent or conflict with one another.”

Annual report 2025A · The company itself

“Our Health Care Benefits products are highly regulated, particularly those that serve Medicare, Medicaid, dual eligible, dual eligible special needs and small group Commercial customers and members. The laws and regulations governing participation 43 in Medicare Advantage (including dual eligible special needs plans), Medicare Part D, Medicaid, and Managed Medicaid plans are complex, are subject to interpretation and can expose us to penalties for non-compliance.”

Annual report 2025A · The company itself

“CMS and the OIG also are auditing the risk adjustment-related data of certain of our Medicare Advantage plans. We are also receiving an increasing number of audits related to our PBM network reconciliation processes, and audits related to our use of prior authorization, which could result in reputational risks and changes to policies that may limit our use of prior authorization.”

Annual report 2025A · The company itself

“•“Star ratings” from CMS for our Medicare Advantage plans will continue to have a significant effect on our plans’ operating results. Only Medicare Advantage plans with a star rating of 4 or higher (out of 5) are eligible for a quality bonus in their basic premium rates.”

Annual report 2025A · The company itself

“CMS continues to change its rating system to make achieving and maintaining a four or higher star rating more difficult, including annual updates to performance measures.”

Annual report 2025A · The company itself

“The Company may be subject to, among other penalties, significant fines, sanctions, corrective actions, and enrollment freezes depending on the findings of these audits and reviews. The Company’s ongoing performance and compliance with program requirements can impact our ability to expand and retain Medicaid business.”

Annual report 2025A · The company itself

“We may not be able to obtain adequate premium rate increases in our Insured Health Care Benefits products, which would have an adverse effect on our revenues, MBRs and operating results and could magnify the adverse impact of increases in health care and other benefit costs and of ACA assessments, fees and taxes. Premium rates for our Insured Health Care Benefits products often must be filed with state insurance regulators and are subject to their approval, which creates risk for us in the current political and regulatory environment.”

Annual report 2025A · The company itself

“We anticipate continued regulatory and legislative action to increase regulation of premium rates in our Insured Health Care Benefits products. We may not be able to obtain rates that are actuarially justified or that are sufficient to make our policies 48 profitable in one or more product lines or geographies.”

Annual report 2025A · The company itself

“In addition, there have been several investigations regarding the marketing practices of brokers and agents selling health care and other insurance products and the payments they receive from carriers offering Medicare Advantage, Medicare Part D and Medicare Supplemental Insurance products. These investigations have resulted in enforcement actions against companies in our industry and brokers and agents marketing and selling those companies’ products.”

Annual report 2025A · The company itself

“Risks Related to the Operation of our Business Our business is subject to a complex set of governmental laws, regulations and other requirements and any failure to adhere to those requirements, or any changes in those requirements or in federal or state legislation or regulations, could have a material adverse effect on our business, and operations, and in some circumstances, could materially harm our reputation. We operate in a complex regulatory environment with an extensive and evolving set of federal, state and local governmental laws, regulations and other requirements, including executive orders, that apply to us and shape the competitive environment in which we operate.”

Annual report 2025A · The company itself

“We operate in a highly regulated industry, including, among other things, through our participation in government-sponsored healthcare programs and as a government contractor. As a result, we are, and may in the future be, subject to investigations and audits by governmental agencies, private civil qui tam complaints filed by relators and other lawsuits, demands, claims, legal proceedings and/or other actions alleging our failure to comply with a rule, regulation, law or practice of medicine. We are, and may be in the future, subject to audits from the government concerning the billing for our patient.”

Annual report 2025A · The company itself

“The availability and affordability of commercial insurance may also be impacted by rulemaking and legislative efforts at both the federal and state level regarding the use of charitable premium assistance for ESRD patients. For example, if implemented in its proposed form, certain provisions of California bill (AB 290), including the amount of reimbursement paid to certain providers for services provided to patients with commercial insurance who receive charitable premium assistance (reimbursement cap), could have negative consequences on the ability of patients to afford commercial coverage, which may in turn adversely impact our business, results of operations, financial condition and cash flows.”

Annual report 2025A · The company itself

“Certain payors have been attempting to design and implement plans that restrict or limit coverage for treatment needed by ESRD patients in the commercial market. Among other things, these restrictive plan designs seek to limit the duration and/or the breadth of ESRD benefits, limit in-network providers, set arbitrary provider reimbursement rates, or otherwise restrict access to care, all of which may result in a decrease in the number of patients covered by commercial insurance or the reimbursement rate for ESRD services.”

Annual report 2025A · The company itself

“Privacy and information security laws are complex, and if we fail to comply with applicable laws, regulations and standards, including with respect to third-party service providers that utilize sensitive personally identifiable information on our behalf, it could have a material adverse effect on our business, results of operations, financial condition and cash flows and could materially harm our reputation. We must comply with numerous federal and state laws and regulations in both the U.S. and the foreign jurisdictions in which we operate governing the collection, dissemination, access, use, security and privacy of PII. In the U.S., these laws include, without limitation, the Health Insurance Portability and Accountability Act of 1996 and its implementing privacy, security, and related regulations, as amended by the federal Health Information Technology for Economic and Clinical Health Act (HITECH) (collectively referred to as "HIPAA").”

Annual report 2025A · The company itself

“Både i Norden och Storbritannien är trenden att politiken begränsar användningen av bemanningspersonal i vården. Olika typer av hyrstopp av läkare och sjuksköterskor har införts, särskilt kraftfullt i Sverige.”

Annual report 2024A · The company itself

“For example, all businesses that process payments are required to issue a Form 1099-K for all sellers who receive more than $20,000 and have over 200 transactions; however, circumstances exist in which businesses are required to withhold and issue a Form 1099-K to sellers for their first transaction.”

Annual report 2025A · The company itself

“We are subject to reporting requirements in various jurisdictions, including in the United States, European Union, the United Kingdom and China, and more jurisdictions continue to enact similar requirements. Tax collection and/or reporting responsibilities and the additional costs associated with compliance with complex sales and use tax collection, remittance and audit requirements, could create additional burdens for buyers and sellers on our Marketplace platforms.”

Annual report 2025A · The company itself

“Digital Services Act (the “DSA”) took effect for all online platforms in February 2024. The DSA imposes legal obligations on online marketplaces operating in Europe, requiring them to verify and ensure the accuracy and disclosure of required information, as well as the safety and authenticity of products posted by third-party merchants. The DSA also enforces new content moderation obligations, notice obligations, advertising restrictions and other requirements on digital platforms that created additional operational burdens and compliance costs for us.”

Annual report 2025A · The company itself

“Additionally, in late 2023, the United Kingdom’s Online Safety Act (the “OSA”) became law and in 2024, the United Kingdom’s Digital Markets, Competition and Consumers Act (the “DMCCA”) became law. The OSA created requirements around monitoring and handling harmful content and required us to expend resources to comply with the new regulations.”

Annual report 2025A · The company itself

“Payments and other financial services are governed by complex and continuously evolving laws and regulations that vary across the geographies where we operate. For example, we must comply with licensing and registration requirements, audit, capital maintenance, funds handling and segregation, consumer disclosure, data processing, authentication and other reporting requirements in numerous jurisdictions.”

Annual report 2025A · The company itself

“Our payments system is susceptible to illegal uses, including money laundering, terrorist financing, fraud and payments to sanctioned parties. If our compliance program and internal controls to limit such illegal activity are 20 Table of Contents ineffective, government authorities could bring legal action against us or otherwise suspend our ability to offer payments or financial services in one or more markets, which would materially harm our business.”

Annual report 2025A · The company itself

“We are subject to significant state and federal regulation across many aspects of our business, including, but not limited to, licensing, premiums, marketing activities, provider contracting, access and payment standards, and corporate governance and financial reporting matters, as described in greater detail in Part I, Item 1, “Business - Regulation” in this Annual Report on Form 10-K.”

Annual report 2025A · The company itself

“We expect state legislatures will continue to focus on healthcare delivery and financing issues, including actions to reduce or limit increases to premium payments, provider billing protections, access to care and other reforms of state health insurance markets.”

Annual report 2025A · The company itself

“Additionally, state legislative actions and litigation could impact ERISA pre-emption. Further, Congress has considered, and may consider in the future, various forms of managed care reform legislation which, if adopted, could fundamentally alter the treatment of coverage decisions under ERISA, including limiting ERISA’s preemptive effect on state laws, and could increase our costs, expose us to expanded liability, permit greater state regulation of our operations, or require us to revise the ways in which we conduct business.”

Annual report 2025A · The company itself

“We are required to obtain and maintain insurance licenses and other regulatory approvals to market certain of our products and services, to increase prices for certain regulated products and services and to consummate some of our acquisitions and dispositions.”

Annual report 2025A · The company itself

“In addition, changes in government regulations, policies or funding that apply to government-sponsored programs such as Medicare and Medicaid including, among other things, reimbursement levels, quality-based bonus payment determinations, eligibility and redetermination requirements, taxes or assessments for our programs, such as premium taxes on health insurance, benefit coverage requirements, rate-setting methodologies, audit and oversight practices, and additional governmental participation, have adversely affected, and could in the future adversely affect, our business, cash flows, financial condition, and results of operations.”

Annual report 2025A · The company itself

“We have experienced past assessments under state or federal insolvency or guaranty association laws applicable to insurance companies, HMOs and other payers, and may experience assessments in the future if, for example, premiums established by other companies for their health insurance products, including certain long-term care products, are inadequate to cover their costs. Any such assessment could expose us to the risk of paying a portion of an impaired or insolvent insurance company’s claims through state guaranty associations. We are not currently able to estimate our potential financial obligations, losses or the availability of offsets associated with future guaranty association assessments; however, any significant increase in guaranty association assessments could have an adverse effect on our business, cash flows, financial condition, and results of operations.”

Annual report 2025A · The company itself

“Certain of our subsidiaries operate internationally and are subject to regulation in the jurisdictions in which they are organized or conduct business related to, among other things, local and cross border taxation, intellectual property, investment, currency rate differentials, management control, labor, anti-fraud, anti-corruption and privacy and data protection, which vary by jurisdiction. In addition, we are subject to U.S. laws that regulate the conduct and activities of U.S.-based businesses operating abroad, such as the Foreign Corrupt Practices Act. Violations of these laws and regulations could result in fines, criminal sanctions against us, our officers or associates, restrictions or outright prohibitions on the conduct of our business and significant reputational harm and could adversely affect our ability to market our products and services, which may have an adverse effect on our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“We provide pharmacy services and are responsible to regulators, our members and customers for the delivery of those pharmacy services that we contract to provide. Our pharmacy services business is subject to the risks inherent in the dispensing, packaging, fulfillment and distribution of pharmaceuticals and other healthcare products, including exposure to liabilities and reputational harm related to clinical quality, patient safety, infusion center operations, and other risks inherent in these activities, and other operational errors by us or our pharmacy services suppliers. Any failure by us or one of our pharmacy services suppliers to adhere to the laws and regulations applicable to the dispensing of pharmaceuticals could subject our pharmacy services business to civil and criminal penalties.”

Annual report 2025A · The company itself

“Federal and state legislatures and regulators also regularly consider new laws and regulations as well as changes to existing requirements that could adversely affect current industry practices and our business. These new and changing laws and regulations include or could include changes to compensation, prohibitions or limitations on spread pricing contracting, requirements regarding rebates and/or fees, additional data reporting to plan sponsors and public sources, restrictions on the development and use of formularies and other utilization management tools, the use of average wholesale prices or other pricing benchmarks, pricing for -33- specialty pharmaceuticals, limited access to networks, prohibitions on pharmacy steering and pharmacy network reimbursement methodologies, and reporting requirements, as well as greater state regulation of pharmacy benefit managers, their ownership of pharmacy services and state involvement in the self-insured and Medicare Part D markets, which are typically preempted by federal law.”

Annual report 2025A · The company itself

“Further, various government agencies have conducted and continue to conduct investigations and studies into certain pharmacy services practices, which have resulted and may in the future result in pharmacy benefit managers agreeing to civil penalties, including the payment of money and entry into corporate integrity agreements, or could adversely impact the pharmacy services business model.”

Annual report 2025A · The company itself

“Recently, California enacted legislation that significantly regulates pharmacy benefit managers and pharmacy pricing practices. The law imposes requirements related to price transparency, restrictions on spread pricing, rebate pass-through obligations, licensing, and fiduciary duties.”

Annual report 2025A · The company itself

“In addition, legislative reforms such as the regulation issued by HHS related to rebates and the -35- 2021 Appropriations Act, which requires reporting of plan spending, the cost of plan pharmacy benefits, enrollee premiums and any manufacturer rebates received by the plan or issuer, may adversely affect our competitive position, cash flows, financial condition and results of operations.”

Annual report 2025A · The company itself

“Our relationship with our brokers and independent agents could be adversely impacted by changes in our business practices to address legislative changes, including potential reductions in commissions and consulting fees paid to agents and brokers.”

Annual report 2025A · The company itself

“As a holding company, we are dependent on dividends and administrative expense reimbursements from our subsidiaries. Among other restrictions, state insurance and HMO laws restrict the ability of most of our regulated subsidiaries to pay dividends. In some states, we have made special undertakings that may further limit the ability of our regulated subsidiaries to pay dividends.”

Annual report 2025A · The company itself

“The telecommunications industry is also subject to heavy regulation.”

Annual report 2025A · The company itself

“Changes in tax authorities’ interpretations of tax laws may lead to an increase in the tax burden for corporations.”

Annual report 2025A · The company itself

“In addition, regulatory changes that reduce the lending ability of the Group’s customers and/or impact customer behavior may have a negative effect on the demand for the Group’s services and products.”

Annual report 2025A · The company itself

“Changes to the regulatory framework may require the Group to adapt its service offering or strategy. These changes can include an introduction of potential governmental credit registers. Any actions in breach of regulations concerning operations subject to a license may lead to changing of the Group’s operations, imposing additional conditions to the license or cancellation of the license. The above may also lead to higher costs, force the Group to stop providing some products or services, or prevent or delay development of its operations, or the Group may end up in legal proceedings or become subject to legal claims.”

Annual report 2025A · The company itself

“Enento Group operates in a regulated business and changes in the applicable regulation may impact on revenue and profit. Such regulation may concern, but are not limited to data protection, freedom of speech, credit information and lending related legislation. Any governmental plans to change credit information register related regulations or potential introduction of governmental credit information registers beyond the current regulations may change the competitive landscape and/or otherwise impact the Group’s business, revenue and profit.”

Annual report 2025A · The company itself

“Future outlook and guidance Macroeconomic and geopolitical uncertainties are expected to persist into 2026. The Swedish regulatory environment, especially recent and upcoming changes affecting loan brokers, continue to present risks for Enento.”

Annual report 2025A · The company itself

“Rate, Cost-recovery, and Other Regulation State and Local Rate Regulation and Fuel-Cost Recovery The rates that the Utility operating companies charge for their services significantly influence Entergy’s financial position, results of operations, and liquidity. These companies are regulated, and the rates charged to their customers are determined in regulatory proceedings. Governmental agencies, including the APSC, the LPSC, the MPSC, the City Council, and the PUCT, are primarily responsible for approval of the rates charged to customers.”

Annual report 2025A · The company itself

“The Utility operating companies are regulated on a cost-of-service and rate of return basis and are subject to statutes and regulatory commission rules and procedures. The rates that the Utility operating companies and System Energy charge reflect their capital expenditures, operations and maintenance costs, allowed rates of return, financing costs, and related costs of service.”

Annual report 2025A · The company itself

“Changes to state or federal legislation or regulation affecting electric generation, electric transmission, distribution, and related activities could adversely affect Entergy and the Utility operating companies’ financial position, results of operations, or cash flows and their utility businesses. If legislative and regulatory structures evolve in a manner that erodes the Utility operating companies’ exclusive rights to serve their regulated customers, such as through “retail open access” or otherwise, they could lose customers and sales and their results of operations, financial position, or cash flows could be materially affected.”

Annual report 2025A · The company itself

“The Utility operating companies are subject to economic risks associated with participation in the MISO markets and the allocation of transmission upgrade costs. The operation of the Utility operating companies’ transmission system pursuant to the MISO RTO tariff and their participation in the MISO RTO’s wholesale markets may be adversely affected by regulatory or market design changes, as well as liability under, or any future inability to comply with, existing or future regulations or requirements.”

Annual report 2025A · The company itself

“The MISO tariff provisions governing the rights and obligations associated with the resource adequacy construct provided under the MISO tariff are subject to change and have recently undergone significant changes, some of which are the subject of pending litigation and/or appeals. Due to their magnitude and, with respect to the changes already made, the speed with which they have been implemented, these changes carry risk, including compliance risk, and may result in material additional costs being passed through to the Utility operating companies’ customers in retail rates, including but not limited to additional capacity costs incurred in the annual MISO Planning Resource Auction, and these risks may be exacerbated by significant new load additions, including large-scale projects to serve data centers, whether by the Utility operating companies or by other MISO load-serving entities.”

Annual report 2025A · The company itself

“The occurrence of one or more adverse events or contingencies, including an adverse decision or a delay in regulatory recovery of fuel or purchased power costs or storm restoration costs, an acceleration of payments or decreased credit lines, less cash flow from operations than expected, changes in regulation, governmental policy (including tax and trade policy, such as increased tariffs, and new laws or regulations relating to data centers or other large loads) or governmental programs (including tax incentives or tax credits, loans, grants, guarantees, and other subsidies), or other unknown or unforeseen events, could cause the financing needs of Entergy and its subsidiaries to increase.”

Annual report 2025A · The company itself

“Entergy’s business is subject to extensive and mandatory reliability standards. Such standards, which are established by the NERC, the SERC, and other regional enforcement entities, are approved by the FERC and frequently are reviewed, amended, and supplemented.”

Annual report 2025A · The company itself

“We may also face increased litigation risks arising from climate-related disclosures required by regulations.”

Annual report unknown yearA · The company itself

“Accordingly, authorizations needed for our or the MVP Joint Venture's projects, including any expansion of MVP Mainline, MVP Southgate, MVP Boost or other extensions, may not be granted or, if granted, such authorizations may include burdensome or expensive conditions or may later be stayed or revoked or vacated, as was repeatedly the case with the construction of MVP Mainline. Significant delays in the regulatory approval process for projects, as well as stays and losses of critical authorizations and permits, should they be experienced, have the potential to significantly increase costs, delay targeted in-service dates and/or affect operations for projects (among other adverse effects), as has happened with MVP Mainline and the originally certificated MVP Southgate project, and could occur in the future in the case of authorizations required for our or the MVP Joint Venture's current or future projects, including in respect of developing expansions or extensions, such as expansion of MVP Mainline, MVP Southgate and MVP Boost.”

Annual report unknown yearA · The company itself

“Our and the MVP Joint Venture's natural gas gathering, transmission and storage services, as applicable, are subject to extensive regulation by federal, state and local regulatory authorities. Changes in or additional regulatory measures adopted by such authorities, and related litigation, could have a material adverse effect on our business, financial condition, results of operations, and cash flows.”

Annual report unknown yearA · The company itself

“Our and the MVP Joint Venture's interstate natural gas transmission and storage operations, as applicable, are regulated by the FERC under the NGA and the NGPA and the regulations, rules and policies promulgated under those and other statutes. Our and the MVP Joint Venture's FERC-regulated operations are pursuant to tariffs approved by the FERC that establish rates (other than market-based rate authority), cost recovery mechanisms and terms and conditions of service to our customers.”

Annual report unknown yearA · The company itself

“Table of Contents Pursuant to the NGA, existing interstate transmission and storage rates, terms and conditions of service, and contracts may be challenged by complaint and are subject to prospective change by the FERC. Additionally, rate increases, changes to terms and conditions of service and contracts proposed by a regulated interstate pipeline may be protested and such actions can be delayed and may ultimately be rejected by the FERC.”

Annual report unknown yearA · The company itself

“Any changes to the FERC's policies regarding the natural gas industry may have an impact on us, including the FERC's approach to pro-competitive policies as it considers matters such as interstate pipeline rates and rules and policies that may affect rights of access to natural gas transmission capacity and transmission and storage facilities. The FERC and Congress may continue to evaluate changes in the NGA or new or modified FERC regulations or policies that may impact our or the MVP Joint Venture's operations and affect our or the MVP Joint Venture's ability to construct new facilities and the timing and cost of such new facilities, as well as the rates charged to our or the MVP Joint Venture's customers and the services provided.”

Annual report unknown yearA · The company itself

“Our and the MVP Joint Venture's significant construction projects generally require review by multiple governmental agencies, including state and local agencies, whose cooperation is important in completing the regulatory process on schedule. Any agency's delay in the issuance of, or refusal to issue, authorizations or permits, issuance of such authorizations or permits with unanticipated conditions, or the loss of a previously-issued authorization or permit, for one or more of these projects may mean that we will not be able to pursue these projects or that they will be constructed in a manner or with capital requirements that we did not anticipate (as was the case with MVP Mainline).”

Annual report unknown yearA · The company itself

“Failure to comply with applicable provisions of the NGA, the NGPA, federal pipeline safety laws and certain other laws, as well as with the regulations, rules, orders, restrictions and conditions associated with these laws, could result in the imposition of administrative and criminal remedies and civil penalties. For example, the FERC is authorized to impose civil penalties of up to approximately $1.6 million (as of February 11, 2026 and adjusted periodically for inflation) per violation, per day for violations of the NGA, the NGPA or the rules, regulations, restrictions, conditions and orders promulgated under those statutes.”

Annual report unknown yearA · The company itself

“The cost and financial impact of compliance will vary and depend on factors such as the number and extent of maintenance determined to be necessary as a result of the application of our integrity management programs, and such costs and financial impact could have a material adverse effect on us. Further, our pipeline and storage integrity management programs depend in part on inspection tools and methodologies developed, maintained, enhanced and applied, and certain testing conducted, by certain third parties, many of which are widely utilized within the natural gas industry.”

Annual report unknown yearA · The company itself

“Regulations related to the protection of wildlife could adversely affect our ability to conduct drilling activities and pipeline construction in some of the areas where we operate. Our operations can be adversely affected by regulations designed to protect various wildlife, including threatened and endangered species and their critical habitat.”

Annual report unknown yearA · The company itself

“The CFPB, which was established under the Dodd-Frank Act and commenced operations in July 2011, has broad authority over our business. This includes authority to issue regulations under federal consumer financial protection laws, such as under the FCRA and other laws applicable to us and our financial customers.”

Annual report 2025A · The company itself

“In addition, we are subject to numerous federal and state laws relating to the privacy and security of nonpublic personal information and other sensitive information of our customers, employees and others. The improper access, disclosure, misuse or mishandling of such information could result in legal liability, regulatory action and reputational damage.”

Annual report 2025A · The company itself

“Our regulated companies are entitled to charge rates that are sufficient to recover prudently incurred costs and a reasonable return on investment on invested capital.”

Annual report 2025A · The company itself

“Regulatory decisions may require us to cancel, delay, or reduce planned investments or incur costs we cannot recover. Rates are subject to prudency reviews, refunds or disallowances and may not align with the timing of costs incurred.”

Annual report 2025A · The company itself

“Federal-Level Risks The FERC has jurisdiction over our transmission cost recovery and our allowed ROEs on transmission investments. If FERC changes its methodology on developing ROEs or eliminates certain transmission incentives, it could negatively impact our financial position, results of operations and cash flows.”

Annual report 2025A · The company itself

“The purchase price included the sales value related to a 40 percent level of federal ITCs, 10 percent of which is the energy community ITC adder included in the Inflation Reduction Act related to Revolution Wind. If the project does not meet the qualifications under federal tax law for the full value of the ITC or there are changes to tax law, it could have a material adverse effect on our financial position, results of operations, and cash flows.”

Annual report 2025A · The company itself

“Changes to the tax laws, with or without retroactive application, could adversely affect our investors or us in ways we cannot predict. New legislation, Treasury Regulations, administrative interpretations or court decisions could significantly and negatively affect our ability to qualify as a REIT, the U.S. federal income tax consequences of such qualification, or the U.S. federal income tax consequences of an investment in us.”

Annual report 2025A · The company itself

“INCOME TAXES: We have elected to be treated as a REIT under Sections 856 through 860 of the Internal Revenue Code. In order to maintain our qualification as a REIT, among other requirements, we are required to distribute annually at least 90% of our REIT taxable income to our stockholders and meet certain tests regarding the nature of our income and assets.”

Annual report 2025A · The company itself

“Our failure to comply with applicable laws and regulations, or to protect such data, could result in enforcement action against us, including fines, imprisonment of company officials and public censure, claims for damages by end-customers and other affected individuals, damage to our reputation and loss of goodwill (both in relation to existing end-customers and prospective end-customers), any of which could have a material adverse effect on our operations, financial performance, and business.”

Annual report 2025A · The company itself

“Table of Contents Sales and Marketing Our customers include a wide variety of large enterprise businesses, public sector institutions, governments, and service providers, including many among Fortune 1000 and Business Week Global 1000 companies. Our customers include businesses in technology, telecommunications, financial services, transportation, education, manufacturing, healthcare, and government.”

Annual report 2025A · The company itself

“Table of Contents GOVERNMENTAL REGULATION We are subject to a number of U.S. federal, state, local and foreign laws and regulations that involve matters central to our business. Laws and governmental regulation affect how our business is conducted and, in some cases, subject us to the possibility of government supervision or enforcement and future lawsuits arising from our products and services.”

Annual report 2025A · The company itself

“The California Consumer Privacy Act of 2018 (“CCPA”) gives California residents certain privacy rights in the collection and disclosure of their personal information and requires businesses to make certain disclosures and take certain other acts in furtherance of those rights. Additionally, effective January 1, 2023, the California Privacy Rights Act (the “CPRA”) revised and significantly expanded the scope of the CCPA.”

Annual report 2025A · The company itself

“The Gramm-Leach-Bliley Act ("GLBA") regulates, among other things, the receipt, use, disclosure, and security of non-public personal information of consumers held by “financial institutions” and applies indirectly to companies that provide services to financial institutions. As a provider of services to financial institutions, portions of our business are subject to obligations to comply with certain GLBA provisions, including limitations on the use or disclosure of the underlying data and rules relating to the technological, physical and administrative safeguarding of non-public personal information.”

Annual report 2025A · The company itself

“The Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) prohibits unfair, deceptive, or abusive acts or practices (“UDAAP”) with respect to the offering of consumer financial products and services and provides the Consumer Financial Protection Bureau (the “CFPB”) with authority to enforce those provisions as well as certain enumerated federal consumer financial laws. In certain circumstances, the CFPB also has examination and supervision powers with respect to service providers who provide a material service to a covered financial institution offering consumer financial products and services.”

Annual report 2025A · The company itself

“Further, the CFPB has authority to issue rules designating non-depository “larger participants” in certain markets for consumer financial services and products for purposes of the CFPB’s supervisory authority under the Dodd-Frank Act, which the CFPB has done for several markets including the consumer reporting market. Such designated “larger participants” are subject to reporting and on-site compliance examinations by the CFPB, which may result in increased compliance costs and potentially greater enforcement risks based on these supervisory activities.”

Annual report 2025A · The company itself

“Fair Credit Reporting Act (the “FCRA”) applies to consumer reporting agencies, as well as data furnishers, and users of consumer reports such as banks and other companies, many of which are our customers. The FCRA provisions govern the accuracy, fairness and privacy of information in the files of consumer reporting agencies that engage in the practice of assembling or evaluating information relating to consumers for certain specified purposes.”

Annual report 2025A · The company itself

“The FCRA limits the type of information that may be reported by consumer reporting agencies, limits the distribution and use of consumer reports, establishes consumer rights to access and dispute their own credit files, includes provisions designed to prevent identity theft and assist fraud victims, requires consumer reporting agencies to make a free annual credit report available to consumers and imposes many other requirements on consumer reporting agencies, data furnishers and users of consumer report information. These requirements can affect the manner and extent to which our customers use our products and services.”

Annual report 2025A · The company itself

“Additional laws and regulations in the U.S. and abroad that may affect our business and our current and prospective customers’ activities include, but are not limited to, those in the following significant regulatory areas: •Laws and regulations that limit the use of credit scoring models (e.g., state “mortgage trigger” or “inquiries” laws, state insurance restrictions on the use of credit-based insurance scores, and the E.U.”

Annual report 2025A · The company itself

“Consumer Credit Directive). •Fair lending laws (e.g., the Equal Credit Opportunity Act and Regulation B, and the Fair Housing Act) and laws and regulations that may impose requirements relating to algorithmic fairness or accountability. •Laws and regulations related to data and cybersecurity, such as the Cybersecurity Act of 2015; the U.S.”

Annual report 2025A · The company itself

“If other credit score models are approved for use with mortgages delivered to Fannie Mae and Freddie Mac, or the FICO Score is not approved for continued use with those mortgages, it could have a material adverse effect on our revenues, results of operations and stock price. Other changes implemented by FHFA, Fannie Mae or Freddie Mac could also affect the demand for FICO Scores and thus could have similar adverse effects on our business, including, for example, the change announced by the FHFA Director in July 2025 permitting mortgage originators to choose the credit score they submit with mortgages delivered to Fannie Mae and Freddie Mac or a potential future change permitting mortgage originators to underwrite loans using credit scores from fewer than three national consumer reporting agencies.”

Annual report 2025A · The company itself

“Our subsidiary that conducts our broker-dealer business in the U.S. is registered as a broker-dealer with the SEC, is a member of FINRA, and is registered as a broker-dealer in numerous states. Our broker-dealer is subject to regulation and oversight by the SEC.”

Annual report 2025A · The company itself

“Because the Company is a technology service provider to U.S. financial institutions, it is subject to regular oversight and examination by the FBA, each agency of which is a member of the FFIEC, an interagency body of federal banking regulators. The FBA have broad discretion in the implementation, interpretation and enforcement of banking and consumer protection laws and use the FFIEC's uniform principles, standards and report forms in their review of bank service providers like FIS.”

Annual report 2025A · The company itself

“As such, we are obligated to comply with regulations, including, but not limited to, the FCRA, the Federal Fair Debt Collection Practices Act and applicable privacy requirements, and we are subject to examination and oversight by the CFPB.”

Annual report 2025A · The company itself

“Portions of FIS' European operations are in scope for regulatory oversight by European Supervisory Agencies (ESAs) as defined by DORA. FIS' designation as a Critical Third-Party Provider under DORA subjects us to additional and new regulatory oversight processes in the E.U.”

Annual report 2025A · The company itself

“Moreover, the legislative and regulatory landscape continues to evolve, and we expect that it may cover alternative payment types, including digital and crypto currencies. The regulatory environment for crypto assets, stablecoins, and digital currencies is rapidly evolving, with increased oversight from U.S. agencies such as the SEC, CFTC, and FinCEN, as well as global counterparts. Recent developments, including the European Union’s Markets in Crypto-Assets (MiCA) regulation, U.S. legislation such as the GENIUS Act, and other legislative initiatives, signal a trend toward increased oversight, more robust compliance obligations, and a move toward harmonized global standards.”

Annual report 2025A · The company itself

“For example, under DORA, our E.U. financial entity clients require us, as a designated Critical Third-Party Provider of information and communication technology services, to contract with and manage our relationships with such clients (and, where applicable, our relationships with other critical third-party technology vendors in our supply chain) in accordance with the requirements of DORA. Failure to support our clients in achieving compliance with DORA and similar global regulatory regimes may cause us to lose revenue, clients, and/or result in damage to our reputation, and may also attract scrutiny from regulators.”

Annual report 2025A · The company itself

“Constantly evolving global privacy, data protection, cybersecurity, cyber resilience, and AI laws and regulations require the Company to adopt new business practices, update contractual provisions in existing and new contracts, and constantly update our global Privacy and Data Protection Program and our global Information Security Program, which may require transitional and incremental expenses and may impact our future operating results. The Company is subject to numerous global privacy, data protection, cybersecurity, cyber resilience, and AI laws and regulations, which are continuing to change in ways that impose increasingly complex and costly compliance obligations on us and that have had, and are expected to continue to have, a significant impact on our operations.”

Annual report 2025A · The company itself

“Longstanding international tax laws that determine each country’s jurisdictional tax rights in cross-border international trade continue to evolve as a result of the base erosion and profit shifting reporting requirements and the introduction of the global minimum tax recommended by the Organisation for Economic Co-operation and Development (“OECD”). For example, the OECD Pillar Two framework introduces a global minimum corporate tax rate of 15% for companies with global revenues above certain thresholds. While it is uncertain whether the U.S. will enact legislation to adopt Pillar Two, certain jurisdictions in which we operate have adopted, and other jurisdictions are in the process of introducing, legislation to implement Pillar Two.”

Annual report 2025A · The company itself

“Additionally, in August 2022, the previous U.S. President signed into law the IRA, which revised U.S. tax law by, among other things, including a new corporate alternative minimum tax (the “CAMT”) of 15% on certain large corporations, imposing a 1% excise tax on stock buybacks, and providing various incentives, including the introduction of the advanced manufacturing production credit under Section 45X of the IRC.”

Annual report 2025A · The company itself

“Our ability to capitalize on investment opportunities available to our distribution business depends, in part, on any future distribution rate cases or other filings seeking cost recovery for distribution system enhancements in the states where our Electric Companies operate, including maintaining the affordability of the rates charged to customers. Any denial of, or delay in, the approval of any future distribution or transmission rate requests could restrict us from fully recovering our cost of service, may impose risks on the distribution and transmission operations, and could have a material adverse effect on our regulatory strategy, results of operations and financial condition.”

Annual report 2025A · The company itself

“The retail rates for each of the Electric Companies are set by each of its respective regulatory agency for utilities in the state in which it operates - in Maryland by the MDPSC, in New Jersey by the NJBPU, in Ohio by the PUCO, in Pennsylvania by the 11 PPUC, in West Virginia by the WVPSC and in New York by the NYPSC – through traditional, cost-based regulated utility ratemaking. As a result, any of the Electric Companies may not be permitted to recover its costs and, even if it is able to do so, there may be a significant delay between the time it incurs such costs and the time it is allowed to recover them.”

Annual report 2025A · The company itself

“FirstEnergy can provide no assurance that any base rate request filed by any of the Electric Companies will be granted in whole or in part. Any denial of, or delay in, any base rate request could restrict the applicable utility from fully recovering its costs of service, may impose risks on its operations, and may negatively impact such Electric Company’s results of operations, cash flows and financial condition.”

Annual report 2025A · The company itself

“FERC policy currently permits recovery of prudently incurred costs associated with cost-of-service-based wholesale power rates and the expansion and updating of transmission infrastructure within its jurisdiction. FERC’s policies on recovery of transmission costs continue to evolve, evidenced by ongoing proceedings to determine an appropriate ROE methodology to determine transmission ROEs, to determine whether FERC’s existing policies on transmission rate incentives should be revised, and to determine whether certain classes of network transmission upgrade costs can be recovered in transmission rates and whether such costs will be direct charged to the connecting customer. If FERC were to adopt a different policy regarding recovery of transmission costs or if there is any resulting delay in cost recovery, our strategy of investing in transmission could be adversely affected.”

Annual report 2025A · The company itself

“Secretary of Energy, is also considering whether to develop regulations intended to speed interconnection of AI data centers and “hybrid” data center/electric generation facilities (collectively, “large loads”) to the transmission system. Final regulations, if any, from FERC are expected in the second quarter of 2026. To the extent the new regulations promulgated by FERC do not permit transmission utilities to fully recover costs associated with transmission network upgrades required to serve new large loads, our strategy of investing in transmission could be adversely affected.”

Annual report 2025A · The company itself

“Our investments in transmission and distribution infrastructure modernization, reliability improvements, environmental compliance and storm hardening may increase customer bills over time and the resulting higher electric bills, when combined with the external pressures discussed above, may place pressure on residential customers’ affordability, particularly in portions of our service territory with lower median household income or high energy burdens and/or amongst those customers who have already seen significant retail bill increases. State and federal regulators may also adopt or modify policies intended to mitigate customer bill impacts – including disallowance or delayed recovery of certain capital investments or operating expenses, mandated bill assistance programs, changes to rate design, or restrictions on rate increases.”

Annual report 2025A · The company itself

“Regulatory agencies may also require utilities to offset portions of rising costs related to grid modernization, resilience investments, environmental compliance, or rapidly evolving market conditions if they determine that such costs would unduly affect customer affordability. Any such actions could limit or delay our ability to recover costs or investments, earn a fair and equitable return, or maintain expected cash flows and could have an adverse effect on our businesses, financial condition, results of operations and cash flows.”

Annual report 2025A · The company itself

“If we were found not to be in compliance with one or more of the mandatory reliability standards, we and/or our subsidiaries could be subject to sanctions, including substantial monetary penalties. For example, FERC has the authority under the FPA to impose penalties up to and including $1.5 million per day, subject thereafter to annual adjustments for inflation, for failure to comply with these mandatory reliability standards.”

Annual report 2025A · The company itself

“In addition, PJM may direct our transmission-owning affiliates to build new transmission facilities to meet PJM's reliability requirements or to provide new or expanded transmission service under the PJM Tariff. We may be allocated a portion of the cost of transmission facilities built by others due to changes in RTO transmission rate design. We may be required to expand our transmission system according to decisions made by an RTO rather than our own internal planning processes.”

Annual report 2025A · The company itself

“While FirstEnergy continues to believe, more likely than not, it will be subject to corporate AMT, additional IRS guidance or revised U.S. Treasury regulations, which are expected to be issued in the future, as well as potential tax legislation or presidential executive orders could provide certain adjustments to regulated utilities in calculating corporate AMT, which may reduce or otherwise significantly change FirstEnergy’s AMT estimates or its conclusions as to whether it is an AMT payer.”

Annual report 2025A · The company itself

“On August 13, 2025, the NJBPU issued an Order to Show Cause reviewing JCP&L’s 2024 Annual System Performance Report, which includes information regarding JCP&L’s systems level of electric service reliability performance during the prior calendar year. Failure to attain NJBPU’s minimum reliability levels may subject JCP&L to a penalty.”

Annual report 2025A · The company itself

“JCP&L requested that the NJBPU provide guidance either affirming the current project schedule or, alternatively, authorizing JCP&L to modify the schedule. On June 9, 2025, responses to JCP&L’s motion were filed with the NJBPU, including a cross-motion by the New Jersey Division of Rate Counsel to reopen the offshore wind transmission proceeding, which JCP&L opposed.”

Annual report 2025A · The company itself

“Government Regulation Our operations, and the products and services that we offer, are subject to various U.S. federal, state and local regulations, as well as regulations outside the U.S. We are also subject to non-government-issued rules and requirements, such as those promulgated by various payment networks.”

Annual report 2025A · The company itself

“In the U.S., we are subject to the Dodd-Frank Wall Street Reform and Consumer Protection Act, which, among other things, and in conjunction with the Federal Reserve Board’s Regulation II, caps debit interchange rates for certain debit and prepaid card issuers; prohibits card issuers and payment networks from restricting the ability of merchants to direct the routing of debit card transactions; requires all debit card issuers in the U.S. to participate in at least two unaffiliated debit payment card networks; prohibits payment card networks from restricting debit and prepaid card issuers from contracting with other payment card networks; and generally prohibits network exclusivity arrangements for debit card and prepaid card issuers. These regulations impact our card processing and debit network businesses.”

Annual report 2025A · The company itself

“Privacy and Cybersecurity Regulations. We provide services that involve the collection and processing of significant amounts of personal, financial, and other sensitive data which subject our offerings to various federal, state, local and foreign privacy and cybersecurity laws and regulations, as well as association and network privacy and cybersecurity rules, which govern, among other things, the collection, processing, storage, deletion, use and disclosure of personal information.”

Annual report 2025A · The company itself

“In the European Union (“E.U.”) and the U.K., we are subject to the General Data Protection Regulation (“GDPR”), which imposes a comprehensive approach to personal data protection and includes penalties for non-compliance of up to the greater of 20 million Euro (or 17.5 million British Pound) or four percent of a company’s consolidated global revenue.”

Annual report 2025A · The company itself

“Some of these data protection laws, including in the E.U., Argentina, Uruguay, Brazil, India, United Arab Emirates and China, impose requirements regarding data rights and security and either prohibit the international transfer of personal data or restrict such transfers absent lawfully recognized transfer mechanisms.”

Annual report 2025A · The company itself

“Stablecoin Regulations. In 2025, the U.S. enacted the Guiding and Establishing National Innovation for U.S. Stablecoins Act (“GENIUS Act”), which provides a regulatory framework for payment stablecoins, and will become effective on the earlier of January 18, 2027, or 120 days after the issuance of final regulations implementing the GENIUS Act.”

Annual report 2025A · The company itself

“Among the new services we intend to offer is custody for stablecoin reserves held under the GENIUS Act and other stablecoin regulations to help financial institutions retain funds associated with FIUSD stablecoin issuance. Our stablecoin offering has only recently been enabled by regulation. We have made certain assumptions about future stablecoin regulation, but there is no certainty about the favorability of the final regulatory environment.”

Annual report 2025A · The company itself

“If we or third parties with whom we partner or contract fail to comply with applicable laws and regulations, we could be subject to liability and our business could be harmed. Our businesses are subject to state, federal, and foreign laws and regulations, including payment, cybersecurity, consumer protection, money transmission, data privacy, artificial intelligence, anti-money laundering, anti-bribery, economic and trade sanctions, payment institution, electronic money licensing, credit reporting and debt collection laws and regulations.”

Annual report 2025A · The company itself

“The volume and complexity of the regulations that impact our business, directly or indirectly, will continue to increase our cost of doing business. If we or third parties with whom we partner or contract fail to comply with applicable laws and regulations, we could be exposed to litigation or regulatory proceedings, our client relationships and reputation could be harmed, our ability to obtain new clients could be inhibited, we could be required to change the manner in which we conduct our business or suspend or terminate certain services, and we could incur significant fines, penalties, or losses, all of which could have a material adverse impact on our business, results of operations and financial condition.”

Annual report 2025A · The company itself

“In order to provide our transaction processing services, several of our subsidiaries are registered with Visa and Mastercard and other networks as members or service providers for member institutions. A number of our subsidiaries outside the U.S. are direct members or associate members of Visa and Mastercard for purposes of conducting merchant acquiring, and various subsidiaries are also processor level members of numerous debit and electronic benefits transaction networks.”

Annual report 2025A · The company itself

“Since the enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act, a number of substantial regulations affecting the supervision and operation of the financial services industry within the U.S. have been adopted, including those that establish the Consumer Financial Protection Bureau (“CFPB”). The CFPB has issued regulations and guidance under U.S. consumer financial protection laws that apply to, and conducts direct examinations of, “supervised banks and nonbanks” as well as “supervised service providers” like us.”

Annual report 2025A · The company itself

“Additional regulation, examination or oversight of our business could require us to modify the manner in which we contract with or provide products and services to our clients; directly or indirectly limit how much we can charge for our services; require us to invest additional time and resources to comply with such oversight and regulations, including in respect of audits, investigations or enforcement actions related to us or third parties; or limit our ability to update our existing products and services, or require us to develop new ones. If this oversight or regulation negatively impacts the business, operations or financial condition of our clients, our business and results of operations could be materially and adversely affected because, among other matters, our clients could have less capacity to purchase products and services from us, could decide to avoid or abandon certain lines of business, or could seek to pass on increased costs to us by negotiating price reductions.”

Annual report 2025A · The company itself

“Failure to comply with state and federal antitrust requirements could adversely affect our business. Through our merchant alliances, we hold an ownership interest in and have commercial relationships with competing merchant acquiring businesses while serving as an electronic processor for those businesses.”

Annual report 2025A · The company itself

“The Company is subject to complex laws, regulations, rules, industry standards and contractual obligations related to privacy and personal data protection, which are evolving, inconsistent and potentially costly. We are subject to U.S. federal and state laws and regulations, as well as those of other countries, relating to the collection, use, disclosure and security of personal information. The number and complexity of these laws and regulations continues to increase.”

Annual report 2026A · The company itself

“As we continue to address our legal and regulatory requirements or focus on meeting new or expanded requirements, we may need to expend a substantial amount of additional time, costs and resources. Regulatory reforms may continue to add further complexity to our business and operations and could require us to alter our investment management services and related activities, which could be costly, impede our growth and adversely impact our AUM, revenues and income. Such reforms could significantly increase our reporting, disclosure and compliance obligations.”

Annual report 2025A · The company itself

“DOL Reforms. The DOL’s 2024 amended fiduciary rule broadening the definition of who is considered an “investment advice fiduciary” to a retirement investor, and adding significant restrictions and requirements for the use of prohibited transaction exemptions typically relied upon by investment firms such as ours, remains subject to applicable legal challenges. Under the new rule, a financial services provider that provides one-time advice to a retirement investor may become subject to the Employee Retirement Income Security Act (ERISA) fiduciary standard.”

Annual report 2025A · The company itself

“The Organization for Economic Co-operation and Development, an intergovernmental organization, has focused on addressing the tax challenges of the digitalization of the economy, which may further impact multinational businesses by allocating a greater share of taxing rights to countries where consumers are located regardless of the current physical presence of a business, and by implementing a global minimum tax. We will continue to monitor developments regarding such matters and any significant impacts on our effective tax rate.”

Annual report 2025A · The company itself

“In addition, Canada, the U.K., the Netherlands and the EU have adopted regimes that ban, or may limit, the payment of commissions and other inducements to intermediaries in relation to certain sales to retail customers in those jurisdictions, and similar regimes are under consideration in several other jurisdictions.”

Annual report 2025A · The company itself

“We may be adversely affected as a result of new or revised legislation or regulations or by changes in the interpretation of existing laws and regulations, in the U.S. and other jurisdictions. The laws and regulations applicable to our business generally involve restrictions and requirements in connection with a variety of technical, specialized, and expanding matters and concerns.”

Annual report 2025A · The company itself

“The EU’s GDPR strengthened and unified data protection rules for individuals within the EU and addresses export of personal data outside the EU. The failure to comply properly with GDPR rules on a timely basis and to maintain ongoing compliance with such rules may subject us to enforcement proceedings and significant fines and costs.”

Annual report 2025A · The company itself

“As with all investment management companies, our activities are highly regulated in almost all countries in which we conduct business. Failure to comply with the applicable laws, rules, regulations, codes, directives, notices or guidelines in any of our jurisdictions could result in regulatory enforcement, civil liability, criminal liability and/or the imposition of a range of sanctions or orders against us, including, as applicable, monetary damages, injunctions, disgorgements, fines, penalties, cease and desist orders, censures, reprimands, and the revocation, cancellation, suspension or restriction of licenses, registration status or approvals held by us or our business in a jurisdiction or market, any of which could adversely affect our reputation and operations.”

Annual report 2025A · The company itself

“We operate in a highly regulated industry and have received and routinely receive and respond to regulatory and governmental requests for documents or other information, subpoenas, examinations and, in some instances, investigations in connection with our business activities. For example, as noted in the “Legal Proceedings” section in Note 15 - Commitments and Contingencies, our subsidiary, Western Asset Management Company (“WAM”) remains the subject of parallel investigations by the SEC and the DOJ.”

Annual report 2025A · The company itself

“•Third parties have claimed and additional third parties in the future may claim that we infringe their proprietary rights. •Some of our products contain “open source” software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business. •Our substantial indebtedness and related debt obligations could limit our financial and operating flexibility and increase our vulnerability to adverse business and economic conditions. •Our Amended Credit Agreement imposes operating and financial restrictions on us. •The failure of financial institutions or transactional counterparties could adversely affect our current and projected business operations and our financial condition and results of operations. •We rely on a variety of funding sources to support our business model.”

Annual report 2026A · The company itself

“Table of Contents •We collect, use, disclose, store or otherwise process personal information and other sensitive data, which is subject to stringent and changing state and federal laws and regulations. •Our inability to successfully recover from a disaster or other business continuity event could impair our ability to deliver our products and services, which could harm our business. •We are dependent upon Broadcom for certain engineering and threat response services, which are critical to many of our products and business. •Our solutions are complex and operate in a wide variety of environments, systems and configurations, which could result in failures of our solutions to function as designed.”

Annual report 2026A · The company itself

“RISKS RELATED TO LEGAL AND COMPLIANCE Our solutions are highly regulated, which could impede our ability to market and provide our solutions, increase regulatory scrutiny or adversely affect our business, financial position, results of operations and cash flows. Our solutions are subject to a high degree of regulation, including a wide variety of international and U.S. federal, state, and local laws and regulations, such as the Fair Credit Reporting Act, the GLBA, the Consumer Financial Protection Act, the Federal Trade Commission Act (the FTC Act), and comparable state laws that are patterned after the FTC Act, the U.S.”

Annual report 2026A · The company itself

“We provide, facilitate or market consumer financial products and services, and in certain cases act as a service provider to regulated financial institutions. Therefore, we are subject to the supervisory, regulatory and enforcement authority of federal and state agencies, including the Consumer Financial Protection Bureau (CFPB), the FTC, state banking and consumer finance regulators and state attorneys general. These authorities may exercise authority with respect to our services, or the marketing and servicing of those services, through the oversight of our financial institution partners and suppliers, or by otherwise exercising their supervisory, regulatory or enforcement authority over consumer financial products and services.”

Annual report 2026A · The company itself

“U.S. federal regulators, state attorneys general or other state enforcement authorities and other governmental agencies have in the past and may in the future take formal or informal actions against us, which and could cause reputational and financial harm to our business, financial condition, results of operations and cash flows. These formal and informal actions may involve inquiries, subpoenas, exams, pending investigations, enforcement matters and litigation by state and federal regulators, cease and desist orders, fines, civil penalties, criminal penalties or other disciplinary action or force us to adopt new compliance programs or policies, remove personnel including senior executives, provide remediation or refunds to customers, or undertake other changes to our business operations, such as limits or prohibitions of our ability to offer certain products and services, or suspension or revocation of one or more of our licenses. Any weaknesses in our compliance management system may also subject us to penalties or enforcement action by the CFPB or state regulators.”

Annual report 2026A · The company itself

“In particular, the regulatory landscape regarding earned wage access products (including our Instacash product) is uncertain and evolving given rapid growth in the use of such products in recent years. State and federal regulators have in the past and may in the future launch inquiries, reviews or similar investigations or issue new, or change or interpret, regulations or rules relating to earned wage access products, which could result in additional compliance requirements and other risks relating to our current and past business activities as described herein, including with respect to whether such products constitute extensions of credit, fee disclosures, tipping practices, or other consumer protection considerations. These developments may not only result in additional compliance requirements but may also be cited by private plaintiffs or plaintiffs’ attorneys as a basis for litigation, including putative class actions, alleging violations of federal or state consumer protection, lending, or unfair or deceptive acts or practices laws.”

Annual report 2026A · The company itself

“Certain states and localities have adopted laws regulating and requiring licensing, registration, notice filing or other approval by parties that engage in certain activity regarding consumer financial services products such as loans and earned wage access services, life insurance and mortgage transactions, as well as brokering, facilitating and assisting such transactions in certain circumstances, and we currently hold certain state or local licenses.”

Annual report 2026A · The company itself

“The Organisation for Economic Co-operation and Development (“OECD”) has proposed certain tax reforms, which, among other things, (1) shift taxing rights to the jurisdiction of the consumer (“Pillar One”) and (2) establish a global minimum tax rate of 15% for multinational companies (“Pillar Two”).”

Annual report 2026A · The company itself

“Table of Contents •Consumer and Enterprise marketplace: The acquisition of MoneyLion further expanded our go-to-market reach through a consumer and enterprise marketplace, which is branded Engine by Gen. Consumers can access a broad range of personalized and actionable offers for both financial and non-financial products and services.”

Annual report 2026A · The company itself

“Government contractors operate in a highly regulated environment and are subject to audit by the U.S. government. Numerous U.S. government agencies routinely audit and review government contractors. These agencies review a contractor’s performance under its contracts and compliance with applicable laws, regulations and standards.”

Annual report 2025A · The company itself

“Genmab is subject to extensive legislative, regulatory, and other requirements during preclinical and clinical development, commercialization, and post-marketing approval, including healthcare, marketing/labeling/promotion, fraud and abuse, competition/antitrust laws, and regulations, as well as transparency, privacy, and data protection and other requirements. • • • • Responsible and ethical marketing Potential Negative Impact Without responsible, ethical marketing, patients and healthcare professionals could receive incomplete or misleading information about Genmab’s therapies. This could undermine trust in our science, contributing to improper medicine use, and negatively affect patient well-being. It can also distort treatment decisions and harm the integrity of the broader healthcare ecosystem. • • • • Personal safety and information of consumers and/or end user Consumers and End-Users - Personal safety and information of consumers and/or end user Patient voice Actual Positive Impact Genmab incorporates patient and caregiver perspectives across the full product lifecycle, ensuring our innovations address the realities of serious illness.”

Annual report 2025A · The company itself

“Det er krav til konsesjon for å få drive forsikring, og en rekke regulatoriske krav som må etterleves.”

Annual report 2024A · The company itself

“Derfor blir vi påvirket av at forsikring er strengt regulert, med krav til kapitaldekning og ivaretakelse av kundenes behov.”

Annual report 2024A · The company itself

“A ratings downgrade or other negative action by a rating agency could materially affect our business, financial condition, and results of operations. Various rating agencies review the financial performance and condition of insurers, including our insurance subsidiaries, and publish their financial strength ratings as indicators of an insurer’s ability to fulfill its contractual obligations. These ratings are important to maintaining public confidence in our insurance products.”

Annual report 2025A · The company itself

“Our businesses are heavily regulated and changes in regulation or regulatory scrutiny may have a material adverse impact on our business, financial condition or results of operation. Insurance companies, including our insurance subsidiaries, are subject to extensive supervision and regulation in the states in which they conduct business. The primary purpose of this supervision and regulation is the protection of policyholders, not investors.”

Annual report 2025A · The company itself

“Any future regulatory changes that restrict the use of off-shore captive reinsurers might require Globe Life to obtain third-party financing, which could cause an increase in financing costs.”

Annual report 2025A · The company itself

“The financial strength of our major insurance subsidiaries is rated by Standard & Poor’s and A. M. Best. The following table presents these ratings for our five largest insurance subsidiaries at December 31, 2025.”

Annual report 2025A · The company itself

“An additional source of Parent Company liquidity is a credit facility with a group of lenders. The facility was amended on March 29, 2024, resulting in an increased capacity of $250 million. The facility allows for unsecured borrowings and stand-by letters of credit up to $1 billion, which could be increased up to $1.25 billion.”

Annual report 2025A · The company itself

“The Organization for Economic Co-operation and Development (OECD) has and continues to release guidance and certain countries have enacted legislation, with widespread implementation of the Pillar Two framework expected in the near future. The Pillar Two framework and associated laws, rules, regulations and guidance across jurisdictions have not yet been fully adopted, implemented or released. We are unable to predict when and how additional rules will be enacted in additional countries, and it is possible that such legislation, when implemented, could have a material effect on our liability for taxes.”

Annual report 2025A · The company itself

“In addition, we may be subject to audits of our income, sales and other transaction taxes by federal and state and foreign tax authorities. Outcomes from these audits could have an adverse effect on our operating results and financial condition.”

Annual report 2025A · The company itself

“ICANN is a multi-stakeholder, private sector, not-for-profit corporation formed in 1998 for the express purposes of overseeing a number of internet related tasks, including managing the DNS allocation of IP addresses, accreditation of domain name registrars and registries and the definition and coordination of policy development for these functions. We are accredited by ICANN as a domain name registrar and thus our ability to offer domain name registration products is subject to our ongoing relationship with, and accreditation by, ICANN. Further, our gTLD registry business is based on contracts with ICANN, per TLD, and therefore, is subject to existing requirements and any changes or modifications to those requirements.”

Annual report 2025A · The company itself

“If any of these events occur, they could create instability in the domain name registration system and may make it difficult for us to continue to offer existing products and introduce new products, or serve customers in certain international markets. These events could also disrupt or suspend portions of our domain name registration product and subject us to additional restrictions on how the registrar and registry products businesses are conducted, which would result in reduced revenue.”

Annual report 2025A · The company itself

“In addition to the above, courts and regulators in certain jurisdictions have adopted, and may continue to adopt, broad or evolving interpretations of the obligations of domain name registrars and registries. Such interpretations may include, among other things, disclosure of registrant information, restrictions on the availability or promotion of certain domain names, limitations on privacy or proxy services, requirements to implement intellectual property protection or anti-fraud measures (including Know Your Customer requirements), and compliance with local court orders or enforcement requests, including in cross-border contexts. Compliance with such interpretations, or with inconsistent or conflicting legal requirements across jurisdictions, may increase our costs, require operational changes, limit certain product offerings or expose us to increased litigation, regulatory scrutiny, fines, penalties or enforcement actions, including restrictions on our ability to operate or offer services in certain markets.”

Annual report 2025A · The company itself

“ICANN introduced a new gTLD program, Next Round, which is expected to open in the second quarter of 2026 upon completion of certain policy implementation work. Our competitive position depends in part on our ability to gain access to and meaningfully participate in new TLDs opportunities, including the Next Round. A significant portion of our business relies on our ability to sell domain name registrations to our customers, and any limitations on our access to newly created TLDs, whether as a registrar, a registry operator or a provider of backend registry and other related services, could adversely impact our ability to sell domain name registrations 43 Table of Contents to customers, and, in turn, could adversely impact our business.”

Annual report 2025A · The company itself

“If these fees increase, it would have a significant impact upon our operating results. Each registry typically imposes a fee in association with the registration of a domain name. For example, VeriSign, the registry for .com and .net, has a current annual list prices of $10.26 and $11.66 for .com and .net registrations, respectively, and ICANN charges $0.20 for most domain names registered in the gTLDs within its purview.”

Annual report 2025A · The company itself

“In addition, aspects of the DSA, OSA and other new, existing and emerging laws concerning content moderation and transparency, including at the state and federal levels in the U.S., remain unclear or subject to evolving regulatory guidance and interpretation, and we may be required to modify our policies and practices further in an effort to comply with them. Moreover, regulatory regimes are becoming increasingly fragmented and may diverge or conflict across jurisdictions, making cross-border compliance more complex.”

Annual report 2025A · The company itself

“Several U.S. federal statutes may apply to us with respect to various activities of our customers, including the Anti-Cybersquatting Consumer Protection Act (ACPA), which provides recourse for trademark owners against cybersquatters, the Digital Millennium Copyright Act (DMCA), which provides recourse for owners of copyrighted material who believe their rights under U.S. copyright law have been infringed on the internet, and the Communications Decency Act (CDA), which addresses blocking and screening of content on the internet. Although these and other similar laws, rules and regulations provide limited protections from liability for providers like us, those protections may not be interpreted in a way that applies to us, may be amended or removed in the future, or may not provide us with complete protection from applicable claims.”

Annual report 2025A · The company itself

“Furthermore, there have been, and continue to be, various Congressional and executive efforts to remove or restrict the scope of the protections available under Section 230 of the CDA, which could narrow, condition or repeal existing statutory liability protections which, if successful could decrease our current protections from liability for third-party content and increase our litigation costs. For example, the Stop Enabling Sex Traffickers Act and the Allow States and Victims to Fight Online Sex Trafficking Act may limit the immunity previously available to us under the CDA, which could subject us to investigations or penalties if our customers' activities are deemed illegal or inappropriate. Furthermore, the DSA, could negatively impact the scope of the limited immunity provided by the E-Commerce Directive in the E.U.”

Annual report 2025A · The company itself

“Our payments-related operations, including GoDaddy Payments, are subject to various laws, regulations, and restrictions. Our failure to comply with such rules, regulations, and restrictions regarding our payments-related operations or properly manage the risks inherent to such operations could materially harm our business.”

Annual report 2025A · The company itself

“The E.U. has adopted rules to implement the Basel III Revisions through amendments to the CRR and the CRD, referred to as CRR III and CRD VI. The amendments include the FRTB rules, revised rules for credit risk capital, a new standardized approach for operational risk and credit valuation adjustment (CVA) risk capital and a floor on internally modeled capital requirements at 72.5% of those required under the standardized approach, commonly known as the “output floor,” which began to be phased in from 2025 and will be fully phased in by 2030. Substantial parts of these rules became effective in January 2025, though certain provisions applied beginning in July 2024.”

Annual report 2025A · The company itself

“In January 2026, the PRA issued final rules with an effective date of January 1, 2027, implementing Basel III Revisions, including new rules covering the FRTB, credit risk, counterparty credit risk, CVA risk, operational risk and securitization for the U.K. The implementation of the internal model approach for market risk (FRTB-IMA) is deferred to January 1, 2028.”

Annual report 2025A · The company itself

“We are required by the FRB and the FDIC to submit a periodic plan for our rapid and orderly resolution in the event of material financial distress or failure (resolution plan). If these regulators jointly determine that an institution has failed to remediate identified deficiencies in its resolution plan or that its resolution plan, after any permitted resubmission, is not credible or would not facilitate an orderly resolution under the U.S. Bankruptcy Code, they may jointly impose more stringent capital, leverage or liquidity requirements or restrictions on growth, activities or operations, or may jointly order the institution to divest assets or operations, in order to facilitate orderly resolution in the event of failure.”

Annual report 2025A · The company itself

“Bank Recovery and Resolution Directive (BRRD), as amended by the BRRD II, establishes a framework for the recovery and resolution of financial institutions in the E.U., such as GSBE. The BRRD provides national supervisory authorities with tools and powers to pre-emptively address potential financial crises in order to promote financial stability and minimize taxpayers’ exposure to losses. The BRRD requires E.U. member states to grant certain resolution powers to national and, where relevant, E.U. resolution authorities, including the power to impose a temporary stay, and to recapitalize a failing entity by writing down its unsecured debt or converting its unsecured debt into equity.”

Annual report 2025A · The company itself

“In addition, certain FHCs, including us, are permitted to engage in certain commodities activities in the U.S. that may otherwise be impermissible for BHCs, so long as the assets held pursuant to these activities do not equal 5% or more of their consolidated assets. The FRB, however, has the authority to limit an FHC’s ability to conduct activities that would otherwise be permissible, and will likely do so if the FHC does not satisfactorily meet certain requirements of the FRB. For example, if an FHC or any of its U.S. depository institution subsidiaries ceases to maintain its status as well-capitalized or well-managed, the FRB may impose corrective capital and/or managerial requirements, as well as additional limitations or conditions.”

Annual report 2025A · The company itself

“As a German credit institution, GSBE is subject to Volcker Rule-type prohibitions under German banking law and regulations because its financial assets exceed certain thresholds. Prohibited activities include (i) proprietary trading, (ii) high-frequency trading at a German trading venue, and (iii) lending and guarantee businesses with German hedge funds, German funds of hedge funds or any non-German substantially leveraged alternative investment funds, unless an exclusion or an exemption applies.”

Annual report 2025A · The company itself

“The SEC requires lenders of securities to provide the material terms of securities lending transactions to FINRA and for FINRA to make certain terms publicly available. Reporting under this requirement will begin in September 2026.”

Annual report 2025A · The company itself

“The SEC has adopted a rule, effective December 2025, to revise and expand reporting and disclosure requirements relating to execution quality.”

Annual report 2025A · The company itself

“The SEC requires that SEC-registered clearing agencies set up policies and procedures that would, among other things, require many market participants to clear cash and repurchase transactions involving U.S. Treasury securities through such a clearing agency by December 2026 for cash transactions and by June 2027 for repurchase transactions.”

Annual report 2025A · The company itself

“In the E.U. and the U.K., the Markets in Financial Instruments Directives (MiFID II) and the Markets in Financial Instruments Regulations (MiFIR) (as amended from time to time, including the proposed amendments to MiFID II and MiFIR), have established trading venue categories for the purposes of discharging the obligation to trade OTC derivatives on a trading platform, established enhanced pre- and post-trade transparency covering a wide range of financial instruments, placed volume caps on non-transparent liquidity trading for equities trading venues, limited the use of broker-dealer equities crossing networks and created a regime for systematic internalizers in certain financial instruments (which are investment firms that execute transactions outside a trading venue). Additional control requirements apply to algorithmic trading, high frequency trading and direct electronic access.”

Annual report 2025A · The company itself

“Our affiliates registered as swap dealers are subject to the margin rules issued by the CFTC (in the case of our non-bank swap dealers) and the FRB (in the case of GS Bank USA and GSBE). Inter-affiliate transactions under the CFTC and FRB margin rules are generally exempt from initial margin requirements.”

Annual report 2025A · The company itself

“Consumer Regulation Our U.S. consumer-oriented activities are subject to supervision and regulation by the CFPB with respect to federal consumer protection laws, including laws relating to fair lending and the prohibition of unfair, deceptive or abusive acts or practices in connection with the offer, sale or provision of consumer financial products and services. Our consumer-oriented activities are also subject to various state and local consumer protection laws, rules and regulations, which, among other things, impose obligations relating to marketing, origination, servicing and collections activities in our consumer businesses.”

Annual report 2025A · The company itself

“Bank Secrecy Act, as amended (BSA), including by the USA PATRIOT Act of 2001 and the Anti-Money Laundering Act of 2020 (AMLA), contains anti-money laundering and financial transparency laws and authorizes or mandates the promulgation of various regulations applicable to financial institutions, including standards for verifying client identification at account opening, and obligations to monitor client transactions and report suspicious activities. Through these and other provisions, the BSA seeks, among other things, to promote the identification of parties that may be involved in terrorism, money laundering or other suspicious activities.”

Annual report 2025A · The company itself

“In 2024, FinCEN and the SEC proposed a rule that would require certain investment advisers to implement reasonable procedures to identify and verify the identities of their customers. In 2024, FinCEN proposed to amend the anti-money laundering/countering the financing of terrorism (AML/CFT) program requirements for all financial institutions subject to the BSA that have AML/CFT program obligations, including us. The proposal would, among other things, require a financial institution’s risk assessment process to identify, evaluate and document the financial institution’s money laundering, terrorist financing and other illicit activity risks, and update such risk assessments on a periodic basis.”

Annual report 2025A · The company itself

“Privacy and Cybersecurity Regulation Our businesses are subject to numerous laws and regulations relating to the privacy of information regarding clients, employees and others. These include, but are not limited to, the GLB Act, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CCPA), the E.U.’s General Data Protection Regulation (GDPR), the U.K.’s Data Protection Act 2018 and U.K. GDPR, the Swiss Federal Data Protection Act, the Japanese Personal Information Protection Act, the Personal Information Protection Law of the People’s Republic of China, the Australian Privacy Act 1988, and India’s Digital Personal Data Protection Act.”

Annual report 2025A · The company itself

“The CFPB has adopted a rule regarding personal financial data rights that requires financial institutions that offer consumer deposit accounts and issue credit cards, such as GS Bank USA, to provide consumers electronic access to at least 24 months of transaction data and certain account information and are prohibited from imposing any fees or charges for maintaining or providing access to such data. The rule also imposes data accuracy, retention and other obligations, and data use limitations and other obligations on entities obtaining access to such personal financial data, such as GS&Co.”

Annual report 2025A · The company itself

“In recent years, certain states have enacted, or are considering enacting, “fair access” statutes that generally prohibit financial institutions from denying or canceling services on the basis of factors, such as political opinions, religious beliefs, “social credit scores,” or any factor that is not quantitative, impartial, and risk-based. In addition, at the federal level, fair access legislation has been proposed and federal regulatory agencies have taken actions to address “debanking,” which generally refers to restricting access to financial services on the basis of a customer’s political or religious beliefs or affiliations.”

Annual report 2025A · The company itself

“As a participant in the financial services industry and a globally systemically important financial institution, we are subject to extensive regulation in jurisdictions around the world. We face the risk of significant intervention by law enforcement, regulatory and taxing authorities, as well as private litigation, in all jurisdictions in which we conduct our businesses. In many cases, our activities have been and may continue to be subject to overlapping and divergent regulation in different jurisdictions. Among other things, as a result of law enforcement authorities, regulators or private parties challenging our compliance with existing laws and regulations, we or our employees have been, and could be, fined, criminally charged or sanctioned; prohibited from engaging in some of our business activities; subjected to limitations or conditions on our business activities, including higher capital requirements; or subjected to new or substantially higher taxes or other governmental charges in connection with the conduct of our businesses or with respect to our employees.”

Annual report 2025A · The company itself

“If there are new laws or regulations or changes in the interpretation or enforcement of existing laws or regulations applicable to our businesses or those of our clients, including capital, liquidity, leverage, long-term debt, total loss-absorbing capacity and margin requirements, restrictions on leveraged lending or other business practices, reporting requirements, requirements relating to recovery and resolution planning, tax burdens and compensation restrictions, that are imposed on a limited subset of financial institutions (whether based on size, method of funding, activities, geography or other criteria), compliance with these new laws or regulations, or changes in the enforcement of existing laws or regulations, could adversely affect our ability to compete effectively with other institutions that are not affected in the same way.”

Annual report 2025A · The company itself

“In addition, regulation imposed on financial institutions or market participants generally, such as taxes on stock transfers, share repurchases and other financial transactions, could adversely impact levels of market activity more broadly, and thus impact our businesses. Changes to laws or regulations, such as tax laws, could also have a disproportionate impact on us, based on the way those laws or regulations are applied to financial services and financial firms or due to our corporate structure or where or how we provide these services.”

Annual report 2025A · The company itself

“We may become subject to higher and more stringent capital and other regulatory requirements as a result of the implementation of the Basel Committee’s finalization of the post-crisis regulatory capital reforms, as well as future Basel Committee standards.”

Annual report 2025A · The company itself

“As described in “Business — Regulation — Banking Supervision and Regulation — Risk-Based Capital Ratios” in Part I, Item 1 of this Form 10-K, the SCB has replaced the capital conservation buffer under the Standardized Capital Rules and in the past has resulted in and may in the future result in higher and more volatile Standardized capital ratio requirements. Failure to comply with these requirements could limit our ability to, among other things, repurchase shares, pay dividends and make certain discretionary compensation payments.”

Annual report 2025A · The company itself

“Additionally, as a G‑SIB, we are subject to the G‑SIB surcharge. Our G‑SIB surcharge is updated annually based on financial data from the prior year. Expansion of our businesses, growth in our balance sheet and increased reliance on short-term wholesale funding have resulted in increases and in the future may result in further increases in our G‑SIB surcharge and a corresponding increase in our capital requirements.”

Annual report 2025A · The company itself

“We are also subject to laws and regulations, such as the GDPR and the California Consumer Privacy Act, relating to the privacy of the information of clients, employees or others, and any failure to comply with these laws and regulations could expose us to liability and/or reputational damage. As new privacy-related laws and regulations are implemented, the time and resources needed for us to comply with such laws and regulations, as well as our potential liability for non-compliance and reporting obligations in the case of data breaches, may significantly increase.”

Annual report 2025A · The company itself

“In addition, our businesses are increasingly subject to laws and regulations relating to surveillance, encryption and data on-shoring in the jurisdictions in which we operate. Compliance with these laws and regulations may require us to change our policies, procedures and technology for information security, which could, among other things, make us more vulnerable to cyber attacks and other misappropriation, corruption, unavailability or loss of information or technology.”

Annual report 2025A · The company itself

“Our consumer-oriented deposit-taking and credit card businesses subject us to numerous additional regulations in the jurisdictions in which these businesses operate. Not only are these regulations extensive, but they involve types of regulations and supervision, as well as regulatory compliance risks, that have not historically applied to us. The level of regulatory scrutiny and the scope of regulations affecting financial interactions with consumers is often much greater than that associated with doing business with institutions and high-net-worth individuals. Complying with these regulations is time-consuming, costly and presents new and increased risks.”

Annual report 2025A · The company itself

“Increasingly, regulators and courts have sought to hold financial institutions liable for the misconduct of their clients where they have determined that the financial institution should have detected that the client was engaged in wrongdoing, even though the financial institution had no direct knowledge of the activities engaged in by its client. Regulators and courts have also increasingly found liability as a “control person” for activities of entities in which financial institutions or funds controlled by financial institutions have an investment, but which they do not actively manage. In addition, regulators and courts continue to seek to establish “fiduciary” obligations to counterparties to which no such duty had been thought to exist.”

Annual report 2025A · The company itself

“Penalties and fines sought by regulatory authorities have increased substantially over time.”

Annual report 2025A · The company itself

“Significant settlements by large financial institutions, including, in some cases, us, with governmental entities have become common. The trend of large settlements with governmental entities may adversely affect the outcomes for other financial institutions, including, in some cases, us, in similar actions, especially where governmental officials have announced that the large settlements will be used as the basis or a template for other settlements. The uncertain regulatory enforcement environment makes it difficult to estimate probable losses, which can lead to substantial disparities between legal reserves and subsequent actual settlements or penalties.”

Annual report 2025A · The company itself

“Claims of collusion or anti-competitive conduct have become more common. Financial institutions (including us) have been subject to civil cases and investigatory demands relating to alleged bid-rigging, group boycotts or other anti-competitive practices. Antitrust laws generally provide for joint and several liability and treble damages.”

Annual report 2025A · The company itself

“In many countries, the laws and regulations applicable to the securities and financial services industries and many of the transactions in which we are involved are uncertain and evolving, and it may be difficult for us to determine the exact requirements of local laws in every market. We have been, in some cases, subject to divergent and conflicting laws and regulations across markets, and we are increasingly subject to the risk that the jurisdictions in which we operate have implemented or may implement laws and regulations that directly conflict with those of another jurisdiction. Any determination by local regulators that we have not acted in compliance with the application of local laws in a particular market or our failure to develop effective working relationships with local regulators could have a significant and negative effect not only on our businesses in that market, but also on our reputation generally.”

Annual report 2025A · The company itself

“While business and other practices throughout the world differ, our principal entities are subject in their operations worldwide to rules and regulations relating to corrupt and illegal payments, hiring practices and money laundering, as well as laws relating to doing business with certain individuals, groups and countries, such as the FCPA, the BSA and the U.K. Bribery Act. While we have invested and continue to invest significant resources in training and in compliance monitoring, the geographical diversity of our operations, employees, clients and consumers, as well as the vendors and other third parties that we deal with, greatly increases the risk that we may be found in violation of such rules or regulations and such violations have in the past subjected and could in the future subject us to significant penalties or adversely affect our reputation.”

Annual report 2025A · The company itself

“In addition, certain jurisdictions, including the U.K. and the E.U., have implemented resolution regimes to provide resolution authorities with the ability to recapitalize a failing entity by writing down its unsecured debt or converting its unsecured debt into equity. Such “bail-in” powers are intended to enable the recapitalization of a failing institution by allocating losses to its shareholders and unsecured debtholders.”

Annual report 2025A · The company itself

“These activities subject us and/or the entities in which we invest to extensive and evolving federal, state and local energy, environmental, antitrust and other governmental laws and regulations worldwide, including environmental laws and regulations relating to, among others, air quality, water quality, waste management, transportation of hazardous substances, natural resources, site remediation and health and safety.”

Annual report 2025A · The company itself

“There may be substantial costs in complying with current or future laws and regulations relating to our commodities-related activities and investments, which could increase our operating costs and adversely affect the profitability of certain of our investments and activities. Compliance with these laws and regulations requires significant commitments of capital toward environmental and operational monitoring, development of appropriate operational and supervisory procedures and processes, payment of emission fees and carbon or other taxes, and application for, and holding of, permits and licenses.”

Annual report 2025A · The company itself

“Governments and regulators have adopted regulations, imposed taxes, adopted compensation restrictions or otherwise put forward various proposals that have impacted or may impact our ability to conduct certain of our businesses in a cost-effective manner or at all in certain or all jurisdictions, including proposals relating to restrictions on the type of activities in which financial institutions are permitted to engage. These or other similar rules, many of which do not apply to all our U.S. or non-U.S. competitors, could impact our ability to compete effectively.”

Annual report 2025A · The company itself

“The adoption and evolution of such new technologies may also increase our compliance and regulatory costs.”

Annual report 2025A · The company itself

“Factors that affect our ability to attract and retain such employees include the level and composition of our compensation and benefits, our reputation as a successful business with a culture of fairly hiring, training and promoting qualified employees and government policies, including immigration policy. As a significant portion of the compensation that we pay to our employees is in the form of year-end discretionary compensation, a significant portion of which is in the form of deferred equity-related awards, declines in our profitability, or in the outlook for our future profitability, as well as regulatory limitations on compensation levels and terms, can negatively impact our ability to hire and retain highly qualified employees.”

Annual report 2025A · The company itself

“In our consumer-oriented activities, we have faced and continue to face compliance, legal and regulatory risk, increased reputational risk and increased operational risk due to, among other things, higher transaction volumes and significantly increased retention and transmission of consumer and client information. We are also subject to additional legal requirements, including with respect to suitability and consumer protection (for example, Regulation Best Interest, fair lending laws and regulations and privacy laws and regulations).”

Annual report 2025A · The company itself

“Effective January 1, 2026, our G-SIB surcharge (Method 2) increased from 3.0% to 3.5%, resulting in an external long-term debt to RWAs requirement of 9.5%.”

Annual report 2025A · The company itself

“Regulatory and Other Matters Regulatory Matters Our businesses are subject to extensive regulation and supervision worldwide. Regulations have been adopted or are being considered by regulators and policy makers worldwide.”

Annual report 2025A · The company itself

“Effective January 1, 2026, the firm’s G-SIB surcharge (Method 2) increased from 3.0% to 3.5%, which increased the firm’s total risk-based capital requirements for each of the Standardized and Advanced capital ratios by 0.5%.”

Annual report 2025A · The company itself

“GS Bank USA GS Bank USA is the firm’s primary U.S. bank subsidiary. GS Bank USA is a New York State-chartered bank and a member of the Federal Reserve System, is supervised and regulated by the FRB, the FDIC, the New York State Department of Financial Services (NYDFS) and the Consumer Financial Protection Bureau (CFPB), and is subject to regulatory capital requirements that are calculated under the Capital Framework.”

Annual report 2025A · The company itself

“On October 22, 2020, the firm announced that it reached settlements of governmental and regulatory investigations relating to 1MDB with the DOJ, the SEC, the FRB, the NYDFS, the Financial Conduct Authority, the Prudential Regulation Authority, the Singapore Attorney General’s Chambers, the Singapore Commercial Affairs Department, the Monetary Authority of Singapore and the Hong Kong Securities and Futures Commission. Group Inc. entered into a three-year deferred prosecution agreement with the DOJ, in which a charge against the firm, one count of conspiracy to violate the FCPA, was filed and was later dismissed on May 6, 2024 in accordance with the agreement.”

Annual report 2025A · The company itself

“Federal and State Securities and Financial Regulation Laws The Company sells and distributes its mutual funds and ETFs through a broker dealer subsidiary, and is subject to regulation promulgated and enforced by the Financial Industry Regulatory Authority, the SEC and/or, in some instances, state securities administrators. Other subsidiaries operate as investment advisers registered with the SEC under the Investment Advisers’ Act of 1940, as amended, and are registered as investment advisers under certain state laws, as applicable.”

Annual report 2025A · The company itself

“Countries in which our international insurance subsidiaries are incorporated or deemed commercially domiciled are subject to minimum capital requirements as defined by the applicable regulatory regime, including a phased program of changes to the prudential and solvency regime in the U.K. following the U.K.'s departure from the European Union.”

Annual report 2025A · The company itself

“We are subject to extensive laws, regulations and executive orders that are complex, subject to change and often conflict in their approach or intended outcomes. Compliance with these laws, regulations and executive orders can increase cost, affect our strategy, and constrain our ability to adequately price our products.”

Annual report 2025A · The company itself

“As an insurer, insurance affordability and availability trends are under scrutiny by federal and state lawmakers and state insurance regulators with new laws and regulations potentially impacting exposure mix, growth, and reinsurance strategies. For example, regulators could impose new disclosure requirements regarding underwriting or investment in certain industry sectors or take other actions such as implementing a temporary moratorium on cancellation of policies within catastrophe prone areas.”

Annual report 2025A · The company itself

“Like any major insurance company, litigation is a routine part of The Hartford’s business - both in defending and indemnifying our insureds and in litigating insurance coverage and benefits disputes. The Hartford accounts for such activity by establishing unpaid loss and loss adjustment expense reserves.”

Annual report 2025A · The company itself

“Among other factors, rating agencies consider the level of statutory capital and surplus of our U.S. insurance subsidiaries as well as the level of U.S. GAAP capital held by the Company in determining the Company’s financial strength and credit ratings.”

Annual report 2025A · The company itself

“Certain states may direct managed care plans to pass through supplemental payments to designated providers, independent of services rendered, to ensure consistent funding of providers that serve large numbers of low-income patients. In an effort to more closely tie funds to delivery and outcomes, CMS is limiting these “pass-through payments” that are paid by states under managed Medicaid plan contracts and will generally prohibit such payments by July 2027.”

Annual report 2025A · The company itself

“States are increasingly using SDP arrangements, and some states have converted supplemental payment programs to SDP arrangements, diverting previously available funding. SDP arrangements can be limited to a specific subset of providers, and providers that do not satisfy applicable criteria may be ineligible for payments. If a state is unable to obtain future CMS approvals of these programs, our revenues could be negatively impacted.”

Annual report 2025A · The company itself

“For example, the FBA directs HHS to revise regulations governing SDP arrangements by tying caps on total payment rates paid by Medicaid managed care organizations for specified services, including hospital services, to Medicare payment rates instead of average commercial rates. Several states in which we operate currently tie caps on total payment rates paid by managed care organizations to average commercial rates. Under the revised regulations, rates will generally be capped at 100% of the total published Medicare payment rate in Medicaid expansion states, including states with waiver-based expansions, and at 110% of the total published Medicare payment rate in non-expansion states.”

Annual report 2025A · The company itself

“Beginning with the rating period on or after January 1, 2028, grandfathered SDP arrangements will be reduced by 10 percentage points annually until they reach the allowable payment limits. Certain states in which we operate have submitted applications to CMS for approval where the grandfathered payments we receive could be impacted and, in some instances, increased. Some states have received preliminary grandfathering determinations with application approvals, but we are unable to predict the timing or extent of any additional approvals by CMS and the resulting recognition of the 14 related revenues.”

Annual report 2025A · The company itself

“In addition, CMS issued a final rule in May 2024 that revised SDP arrangement requirements, including removing regulatory barriers to help states use SDP arrangements to implement value-based purchasing payment arrangements and include non-network providers in SDP arrangements. Further, the rule requires states to ensure each provider receiving an SDP attest by January 1, 2028, that they do not participate in any arrangement that holds taxpayers harmless for the cost of a tax.”

Annual report 2025A · The company itself

“For example, CMS published a final rule in August 2023 that has been the subject of litigation and that will affect the treatment of patient days paid under demonstrations authorized under Section 1115 of the Social Security Act (including through demonstration-authorized uncompensated and undercompensated care pools) in the Medicaid fraction of the DSH payment formula. Implementation of the 2023 final rule is expected to result in lower DSH payments for hospitals.”

Annual report 2025A · The company itself

“Separately, lawsuits filed in April 2025 allege that the Medicare DSH calculation inappropriately reduces hospital reimbursement by counting only fee-for-service Medicare patients who received Supplemental Security Income (“SSI”) cash assistance during the inpatient stay, excluding beneficiaries covered under Medicare Advantage and other Medicare and SSI categories. The plaintiffs argue this policy resembles rulemaking previously vacated by the U.S. Supreme Court.”

Annual report 2025A · The company itself

“Medicare-approved ACOs that achieve quality performance standards while lowering growth in expenditures are eligible to share in a portion of the amounts saved by the Medicare program. Conversely, under some MSSP payment tracks, ACOs may be required to pay shared losses if expenditures exceed an established benchmark. Failure to meet quality performance 15 standards may result in an ACO’s termination from the MSSP.”

Annual report 2025A · The company itself

“Model reviews and new model designs may require that all alternative payment models involve downside risk and that a growing proportion of Medicare and Medicaid beneficiaries are in global downside risk arrangements, among other requirements.”

Annual report 2025A · The company itself

“Several private third-party payers are increasingly employing alternative payment models, which may increasingly shift financial risk to providers.”

Annual report 2025A · The company itself

“Managed care contracts are typically negotiated for terms between one and three years. While we generally have received contracted annual increases to payment rates from managed care payers, there can be no assurance that we will continue to receive increases in the future. Price transparency initiatives may impact our relationships with payers and ability to obtain or maintain favorable contract terms.”

Annual report 2025A · The company itself

“The No Surprises Act requires providers to provide uninsured and self-pay patients, in advance of the scheduled date for the item or service or upon request of the individual, a good faith estimate of the expected charges for furnishing scheduled items or services, including billing and diagnostic codes. HHS is delaying enforcement with regard to good faith estimates to uninsured individuals that do not include expected charges for co-providers or co-facilities until the agency issues additional regulations. If the actual charges to the uninsured or self-pay patient exceed the good faith estimate by an amount deemed to be substantial by regulation (which is currently $400), the patient can invoke a patient-provider dispute resolution process to challenge the higher amount.”

Annual report 2025A · The company itself

“Managed care plans attempt to direct and coordinate members’ use of health care services and obtain discounts from providers’ established gross charges. Similarly, employers and traditional health insurers continue to attempt to contain costs through negotiations with providers for managed care programs and discounts from established gross charges.”

Annual report 2025A · The company itself

“Health plans increasingly utilize narrow networks that restrict the number of participating providers or tiered networks that impose significantly higher cost sharing obligations on patients who obtain services from providers in a disfavored tier.”

Annual report 2025A · The company itself

“In those states that do not require state approval or that set relatively high levels of expenditures before they become reviewable by state authorities, competition in the form of new services, facilities and capital spending is more prevalent.”

Annual report 2025A · The company itself

“Regulation and Other Factors Licensure, Certification and Accreditation Health care facility construction and operation are subject to numerous federal, state and local regulations relating to the adequacy of medical care, equipment, personnel, operating policies and procedures, maintenance of adequate records, fire prevention, rate-setting, building codes and environmental protection. Facilities are subject to periodic inspection by governmental and other authorities to assure continued compliance with the various standards necessary for licensing, certification, and accreditation.”

Annual report 2025A · The company itself

“The requirements for licensure, certification and accreditation are subject to change, and, in order to remain qualified, it may become necessary for us to make changes in our facilities, equipment, personnel and services.”

Annual report 2025A · The company itself

“Certificates of Need In some states where we operate hospitals and other health care providers, the construction or expansion of health care facilities, the transfer or change of ownership of existing facilities, capital expenditures and the addition of new beds or services may be subject to review by and prior approval of, or notifications to, state regulatory agencies under a CON program. Such laws generally require the reviewing state agency to determine the public need for additional or expanded health care facilities and services or other change.”

Annual report 2025A · The company itself

“If a hospital or other provider fails to substantially comply with the numerous conditions of participation in the Medicare and Medicaid programs or performs certain prohibited acts, the provider’s participation in the federal health care programs may be terminated, or civil and/or criminal penalties may be imposed. Civil monetary penalties are adjusted annually based on updates to the consumer price index.”

Annual report 2025A · The company itself

“Anti-kickback Statute A section of the Social Security Act known as the “Anti-kickback Statute” prohibits providers and others from directly or indirectly soliciting, receiving, offering or paying any remuneration with the intent of generating referrals or orders for services or items covered by a federal health care program. Courts have interpreted this statute broadly and held that there is a violation of the Anti-kickback Statute if just one purpose of the remuneration is to generate referrals, even if there are other lawful purposes. Furthermore, knowledge of the law or the intent to violate the law is not required. Violations of the Anti-kickback Statute may be punished by criminal fines per violation, imprisonment, substantial civil monetary penalties per violation that are subject to annual adjustment based on updates to the consumer price index and damages of up to three times the total amount of the remuneration and/or exclusion from participation in federal health care programs, including Medicare and Medicaid.”

Annual report 2025A · The company itself

“While we endeavor to comply with the applicable safe harbors, certain of our current arrangements, including joint ventures and financial relationships with physicians and other referral sources and persons and entities to which we refer patients, do not qualify for safe harbor protection.”

Annual report 2025A · The company itself

“Although we believe our arrangements with physicians and other referral sources and referral recipients have been structured to comply with current law and available interpretations, there can be no assurance regulatory authorities enforcing these laws will determine these financial arrangements comply with the Anti-kickback Statute or other applicable laws. An adverse determination could subject us to liabilities under the Social Security Act and other laws, including criminal penalties, civil monetary penalties and exclusion from participation in Medicare, Medicaid or other federal health care programs.”

Annual report 2025A · The company itself

“The Stark Law prohibits physicians from referring Medicare and Medicaid patients to entities with which they or any of their immediate family members have a financial relationship, if these entities provide certain “designated health services” reimbursable by Medicare or Medicaid unless an exception applies. The Stark Law also prohibits entities that provide designated health services reimbursable by Medicare and Medicaid from billing the Medicare and Medicaid programs for any items or services that result from a prohibited referral and requires the entities to refund amounts received for items or services provided pursuant to the prohibited referral on a timely basis. “Designated health services” include inpatient and outpatient hospital services, clinical laboratory services, radiology and certain other imaging services, radiation therapy services and home health services.”

Annual report 2025A · The company itself

“Unlike safe harbors under the Anti-kickback Statute with which compliance is voluntary, a financial relationship must comply with every requirement of a Stark Law exception or the arrangement is in violation of the Stark Law.”

Annual report 2025A · The company itself

“Violations of the HIPAA privacy and security regulations may result in criminal penalties and in substantial civil penalties per violation. These civil penalties are updated annually based on updates to the consumer price index.”

Annual report 2025A · The company itself

“For example, federal regulations require hospitals to publish a list of their 26 standard charges for all items and services, including gross charges, discounted cash prices and payer-specific and de-identified minimum and maximum negotiated charges, in a machine-readable, publicly accessible online file. The current presidential administration has signaled its commitment to advancing price transparency initiatives, including through an executive order issued in February 2025 and a final rule issued in November 2025 that update the requirements for data elements in the machine-readable file, among other changes. Hospitals are also required to publish a consumer-friendly list of standard charges for certain “shoppable” services (i.e., services that can be scheduled by a patient in advance) and associated ancillary services or, alternatively, maintain an online price estimator tool.”

Annual report 2025A · The company itself

“In addition, the No Surprises Act imposes various requirements on providers and health plans intended to prevent “surprise” medical bills, and several states have implemented similar laws intended to protect consumers. The No Surprises Act prohibits providers from charging patients an amount beyond the in-network cost sharing amount for items and services rendered by out-of-network providers (i.e., prohibits balance billing), subject to limited exceptions.”

Annual report 2025A · The company itself

“Hospitals may face conflicting interpretations by courts and federal and state law enforcement agencies regarding EMTALA’s requirements in relation to state laws that limit access to abortion or other reproductive health services. For example, 25 in May 2025, CMS rescinded EMTALA guidance issued to hospitals under the prior presidential administration regarding the preemption of state laws restricting abortion.”

Annual report 2025A · The company itself

“For example, the FBA includes significant health care policy reforms that are expected to result in Medicaid spending reductions and changes in administration of state Medicaid programs. Among other changes, the law limits eligibility for Medicaid by imposing work or community engagement requirements for adults under age 65 in Medicaid expansion states, including states with waiver-based expansions, subject to limited exceptions. The law also makes significant changes to Medicaid financing mechanisms, including restrictions intended to reduce the federal matching funds received by state Medicaid programs, with greater restrictions in states that have expanded Medicaid.”

Annual report 2025A · The company itself

“Generally, value-based care aims to hold providers accountable for delivering efficient, effective care, tying provider reimbursement to patient outcomes or related measures. Value-based care arrangements vary in the method for determining payments and the level of risk assumed, among other factors.”

Annual report 2025A · The company itself

“Furthermore, reductions in Medicaid spending and cuts to Medicaid provider rates, the expiration of health insurance subsidies under the Patient Protection and Affordable Care Act, along with the Health Care and Education Reconciliation Act of 2010 (collectively, the “Affordable Care Act”), other potential changes to federal reimbursement policies, and other potential policy initiatives focused on medical care, including site-neutral payments and changes to reimbursement for certain outpatient services, could reduce patient volumes, increase uncompensated care, and put downward pressure on reimbursement rates for hospitals and outpatient medical facilities, which could have an adverse effect on our tenants’, operators’, and borrowers’ liquidity, financial condition, or results of operations.”

Annual report 2025A · The company itself

“Adverse changes in our credit ratings could impair our ability to obtain additional debt and equity financing on favorable terms. Our credit ratings affect the amount and type of capital, as well as the terms of any financing we may obtain.”

Annual report 2025A · The company itself

“Hoist Finance finansiering baseras huvudsakligen på inlåning från allmänheten via sparkonton, vilket möjliggörs av vår status som reglerat kreditmarknadsbolag under Finansinspektionens tillsyn. Detta är en stabil, kostnadseffektiv och flexibel finansieringskälla, som vi kan styra i realtid.”

Annual report 2024A · The company itself

“Som kreditmarknadsbolag står Hoist Finance under Finansinspektionens tillsyn och lyder under svensk banklagstiftning. Då Sverige är ett EU-land innebär detta även att Hoist Finance lyder under direktiv och förordningar på EU-nivå.”

Annual report 2024A · The company itself

“This concentration of revenues subjects these businesses to reductions in Medicare 27 reimbursement rates or changes in the rules governing the Medicare program, including changes to CMS’s risk adjustment model that may apply to our primary care business through its contracts with third-party payors. It is reasonably possible that such changes in reimbursement rates or changes to the Medicare programs in which our primary care and home health business participate may have a material adverse effect on our results of operations, financial position, or cash flows. •We are subject to various other governmental audits and investigations.”

Annual report 2025A · The company itself

“Anti-Kickback, Physician Self-Referral, and Other Fraud and Abuse Laws We are subject to various federal and state healthcare fraud and abuse laws including the federal False Claims Act (the “False Claims Act”), the federal anti-kickback statute (the “Anti-Kickback Statute”), the federal “Stark Law,” and related state laws. Potential sanctions for violating these laws include recoupment or reduction of government reimbursement amounts, civil penalties, treble damages, and exclusion from participating in the Medicare and Medicaid programs or other government healthcare programs.”

Annual report 2025A · The company itself

“State Regulation of our Products and Services Laws in each of the states in which we operate our HMOs, PPOs and other health insurance-related services regulate our operations including: capital adequacy and other licensing requirements, policy language describing benefits, mandated benefits and processes, entry, withdrawal or re-entry into a state or market, rate increases, delivery systems, utilization review procedures, quality assurance, complaint systems, enrollment requirements, claim payments, marketing, and advertising. The HMO, PPO, and other health insurance-related products we offer are sold under licenses issued by the applicable insurance regulators.”

Annual report 2025A · The company itself

“Certain of our healthcare services businesses require a Certificate of Need, or CON, to operate in certain states. These states restrict the entry of new providers or services and the expansion of existing providers or services in their state through a CON process, which is periodically evaluated and updated as required by applicable state law. To the extent that we require a CON or other similar approvals to expand our operations, our expansion could be adversely affected by our inability to obtain the necessary approval.”

Annual report 2025A · The company itself

“Our pharmacy solutions business also subjects us to extensive federal, state, and local regulation. The practice of pharmacy is generally regulated at the state level by state boards of pharmacy. Many of the states where we deliver pharmaceuticals, including controlled substances, have laws and regulations that require out-of-state mail-order pharmacies to register with that state’s board of pharmacy.”

Annual report 2025A · The company itself

“Huntington’s acquisition of Cadence results in Huntington’s total consolidated assets exceeding $250 billion at closing and is expected to cause Huntington’s total average consolidated assets to exceed $250 billion in the fourth quarter of 2026, causing Huntington and the Bank to become subject to the standards applicable to Category III banking organizations, following a transition period.”

Annual report 2025A · The company itself

“The final notice amended the LFI Rating System by considering a firm with no more than one deficient-1 rating to be “well managed.” Firms that do not meet this standard, as well as firms with a deficient-2 rating for any component, would not be deemed “well managed” and would face limitations on certain acquisitions and new activities.”

Annual report 2025A · The company itself

“Enhanced Prudential Standards BHCs with consolidated assets of more than $100 billion, such as Huntington, are currently subject to certain enhanced prudential standards. As a result, Huntington is subject to more stringent standards, including liquidity and capital requirements, leverage limits, stress testing, resolution planning, and risk management standards, than those applicable to institutions with less than $100 billion in total consolidated assets.”

Annual report 2025A · The company itself

“Once Huntington exceeds $250 billion in total average consolidated assets, including following consummating the acquisition of Cadence, and not exceed certain risk-based thresholds, Huntington and the Bank will each qualify as a Category III banking organization and become subject to additional enhanced prudential standards, such as limitations on Huntington’s aggregate net credit exposures to any single, unaffiliated company (referred to as SCCL).”

Annual report 2025A · The company itself

“As a Category IV banking organization, Huntington is subject to internal liquidity stress tests and standards. When Huntington becomes a Category III banking organization, Huntington will continue to be subject to internal liquidity stress tests and standards to which Category IV banking organizations are subject, but the frequency of its liquidity stress tests will change from a quarterly basis to a monthly basis.”

Annual report 2025A · The company itself

“Long-term Debt Requirements In August 2023, the U.S. banking agencies issued a proposed rule that would require certain large banking organizations such as Huntington to comply with long-term debt requirements and “clean holding company requirements” similar to those that currently only apply to U.S. global systemically important banking organizations. This proposal would also impose a long-term debt requirement on certain categories of insured depository institutions that are not consolidated subsidiaries of U.S. global systematically important banking organizations, including insured depository institutions with $100 billion or more in total assets, such as the Bank. If adopted, this proposal would require Huntington and the Bank to each maintain a minimum outstanding eligible long-term debt amount of no less than the greater of (i) 6% of total risk-weighted assets, (ii) 2.5% of total leverage exposure (if subject to the supplementary leverage ratio), or (iii) 3.5% of average total consolidated assets.”

Annual report 2025A · The company itself

“Capital Planning and Stress Testing Huntington is required to develop, maintain, and submit to the Federal Reserve a capital plan every year, which is subject to supervisory review in connection with the Federal Reserve’s CCAR process. Huntington is required to include within its capital plan an assessment of the expected uses and sources of capital and a description of all planned capital actions over a nine-quarter planning horizon, a detailed description of the process for assessing capital adequacy, its capital policy, and a discussion of any expected changes to its business plan that are likely to have a material impact on its capital adequacy. Under the stress buffer requirements, the CCAR process is used to determine a BHC’s SCB requirement.”

Annual report 2025A · The company itself

“The Federal Reserve expects BHCs subject to CCAR, such as Huntington, to have sufficient capital to withstand a highly adverse operating environment and to be able to continue operations, maintain ready access to funding, meet obligations to creditors and counterparties, and serve as credit intermediaries. In addition, the Federal Reserve evaluates the planned capital actions of these BHCs, including planned capital distributions such as dividend payments or stock repurchases. This involves a quantitative assessment of capital based on supervisory-run stress tests that assess the ability to maintain capital levels above certain minimum ratios, after taking into consideration all capital actions included in a BHC’s capital plan, under baseline and stressful conditions throughout the nine-quarter planning horizon.”

Annual report 2025A · The company itself

“Once Huntington exceeds $250 billion in total average consolidated assets, Huntington will be required to submit to the Federal Reserve and the FDIC every three years a 165(d) Resolution Plan for its orderly resolution in the event it faces material financial distress or failure, with submissions alternating between a full resolution plan and a targeted resolution plan.”

Annual report 2025A · The company itself

“Heightened Governance and Risk Management Standards The OCC has published guidelines to set expectations for the governance and risk management practices of national banks with total assets equal to or greater than $50 billion, including the Bank. The guidelines require covered institutions to establish and adhere to a written governance framework in order to manage and control their risk-taking activities.”

Annual report 2025A · The company itself

“Cybersecurity and data privacy are also areas of increasing state legislative focus. For example, under California state law, the CCPA broadly defines personal information and substantially increases the rights of California residents to understand how their personal information is collected, used, and otherwise processed by commercial businesses, such as affording them the right to access and request deletion of their information and to opt out of certain sharing and sales of personal information. The CCPA contemplates civil penalties of up to $2,500 for each violation and up to $7,500 for each intentional violation and includes a private right of action (permitting lawsuits to be brought by private individuals instead of the state Attorney General or other government actor for certain breaches).”

Annual report 2025A · The company itself

“We operate in a highly regulated industry, and the laws and regulations that govern our operations, corporate governance, executive compensation and financial accounting, or reporting, including changes in them, or our failure to comply with them, may adversely affect us and our business model. The banking industry is highly regulated.”

Annual report 2025A · The company itself

“We are subject to supervision, regulation, and examination by various federal and state regulators, including the Federal Reserve, OCC, SEC, CFPB, FDIC, FINRA, and various state regulatory agencies. The statutory and regulatory framework that governs us is generally intended to protect depositors and customers, the DIF, the U.S. banking and financial system, and financial markets as a whole - not to protect shareholders.”

Annual report 2025A · The company itself

“These laws and regulations, many of which are discussed in Item 1: Business - “Regulatory Matters,” among other matters, prescribe minimum capital requirements, impose limitations on our business activities (including foreclosure and collection practices), limit the dividend or distributions that we can pay, restrict the ability of institutions to guarantee our debt, and impose certain specific accounting requirements that may be more restrictive and may result in greater or earlier charges to earnings or reductions in our capital than GAAP. Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations often impose additional compliance costs.”

Annual report 2025A · The company itself

“Such regulation and supervision may increase our costs and limit our ability to pursue business opportunities. Further, our failure to comply with these laws and regulations, even if the failure was inadvertent or reflects a difference in interpretation, could subject us to restrictions on our business activities, fines, and other penalties, any of which could adversely affect our results of operations, capital base, and the price of our securities.”

Annual report 2025A · The company itself

“Under the supervision of the CFPB, our consumer and business banking products and services are subject to heightened regulatory oversight and scrutiny with respect to compliance with consumer laws and regulations. We may face a greater number or wider scope of investigations, enforcement actions, and litigation in the future related to consumer practices, thereby increasing costs associated with responding to or defending such actions.”

Annual report 2025A · The company itself

“Legislative and regulatory actions taken now or in the future that impact the financial industry may materially adversely affect us by increasing our costs, adding complexity in doing business, impeding the efficiency of our internal business processes, negatively impacting the recoverability of certain of our recorded assets, requiring us to increase our regulatory capital, limiting our ability to pursue business opportunities, and otherwise resulting in a material adverse impact on our financial condition, results of operation, liquidity, or stock price. Both the scope of the laws and regulations and the intensity of the supervision to which we are subject may increase in times of financial crisis, as well as a result of other factors such as technological and market changes.”

Annual report 2025A · The company itself

“The Trump administration has sought to implement a regulatory reform agenda that is significantly different than that of the Biden administration. There have been changes in rulemaking, supervision, examination, and enforcement priorities of the federal banking agencies.”

Annual report 2025A · The company itself

“For example, during 2023, the FDIC took control and was appointed receiver of Silicon Valley Bank, Signature Bank, and First Republic Bank, respectively. The failure of other banks and financial institutions and the measures taken by governments and regulators in response to these events, including increased regulatory scrutiny and heightened supervisory expectations, could adversely impact our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“There is also increased scrutiny of compliance with the rules enforced by the OFAC. If our policies, procedures, and systems are deemed deficient or the policies, procedures, and systems of the financial institutions that we have already acquired or may acquire in the future are deficient, we would be subject to liability, including fines and regulatory actions such as restrictions on our ability to pay dividends and the necessity to obtain regulatory approvals to proceed with certain planned business activities, including acquisition plans, which would negatively impact our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“Cybersecurity and data privacy are areas of heightened legislative and regulatory focus. As cybersecurity and data privacy risks for banking organizations and the broader financial system have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus.”

Annual report 2025A · The company itself

“We share, use, collect, disclose and otherwise process personal information of our customers and counterparties, including, but not limited to, personal financial information. The sharing, use, collection, disclosure, and other processing of this type of information is governed by increasingly stringent and evolving legislation and regulations, the intent of which is to protect the privacy of personal information, including personal financial information.”

Annual report 2025A · The company itself

“We are also required to maintain minimum capital ratios and the Federal Reserve and OCC may determine that Huntington and/or the Bank, based on size, complexity, or risk profile, must maintain capital ratios above these minimums in order to operate in a safe and sound manner. In the event we are required to raise capital to maintain required minimum capital and leverage ratios or ratios above the required applicable minimums, we may be forced to do so when market conditions are undesirable or on terms that are less favorable to us than we would otherwise require.”

Annual report 2025A · The company itself

“We also face the risk of becoming subject to new or more stringent requirements in connection with the introduction of new regulations or modification of existing regulations, which could require us to hold more capital or liquidity or have other adverse effects on our businesses or profitability. For example, proposed changes to applicable capital and liquidity requirements, such as the Basel III Endgame Proposal and the long-term debt proposal, could result in increased expenses or cost of funding, which could negatively affect our financial results or our ability to pay dividends and engage in share repurchases.”

Annual report 2025A · The company itself

“The Anti-Money Laundering Act of 2020, enacted as part of the National Defense Authorization Act, requires the U.S. Treasury to issue National Anti-Money Laundering and Countering the Financing of Terrorism Priorities, and conduct studies and issue regulations that may, over the next few years, significantly alter some of the due diligence, recordkeeping, and reporting requirements that the Bank Secrecy Act imposes on banks. The Anti-Money Laundering Act of 2020 also contains provisions that promote increased information-sharing and use of technology and increases penalties for violations of the Bank Secrecy Act and includes whistleblower incentives, both of which could increase the prospect of regulatory enforcement.”

Annual report 2025A · The company itself

“Failure to comply with these sanctions could have serious legal and reputational consequences.”

Annual report 2025A · The company itself

“Further, the GLBA, and its regulations such as Regulation P and Regulation S-P, require financial institutions to disclose their data privacy policies and practices relating to sharing personal information and enables retail customers to opt out of our ability to share their personal information with unaffiliated third parties under certain circumstances. The GLBA and its regulations require financial institutions to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information.”

Annual report 2025A · The company itself

“In October 2023, the Federal Reserve released a notice of proposed rulemaking that would lower the maximum interchange fee that a large debit card issuer can receive on a debit card transaction. Under the proposal, the Federal Reserve would set the components of the maximum interchange fee to amounts lower than those in the currently applicable Regulation II.”

Annual report 2025A · The company itself

“Consumer Protection Regulation and Supervision We are subject to supervision and regulation by the CFPB with respect to federal consumer protection laws. We are also subject to certain state consumer protection laws, and under the Dodd-Frank Act, state attorneys general and other state officials are empowered to enforce certain federal consumer protection laws and regulations. State authorities have increased their focus on and enforcement of consumer protection rules.”

Annual report 2025A · The company itself

“In May 2025, President Trump signed a Congressional Review Act resolution that overturned the CFPB’s December 2024 final rule, which would have taken effect October 1, 2025 and imposed certain requirements on overdraft fees, similar to those that apply to credit cards, unless the financial institution limited the amount of overdraft fees to the higher of the amount of costs and losses to provide overdraft services or $5.00.”

Annual report 2025A · The company itself

“Community Reinvestment Act The CRA is intended to encourage banks to help meet the credit needs of their service areas, including low- and moderate-income neighborhoods, consistent with safe and soundness practices. The relevant federal bank regulatory agency, the OCC in the Bank’s case, examines each bank and assigns it a public CRA rating. A bank’s record of fair lending compliance is part of the resulting CRA examination report.”

Annual report 2025A · The company itself

“Federal Anti-Kickback and Self-Referral Laws. The federal healthcare Anti-Kickback Statute prohibits the knowing and willful offer, payment, solicitation, or receipt of any form of remuneration, directly or indirectly, in return for, or to induce: •the referral of an individual to any person or entity for the furnishing or arranging for the furnishing of items or services that are reimbursable under Medicare, Medicaid, or any other federal healthcare program; or •the purchase, lease, order of, or recommendation of the purchase, lease, or order of any item or service that is reimbursable under Medicare, Medicaid, or any other federal healthcare program.”

Annual report 2025A · The company itself

“The federal Anti-Kickback Statute has been interpreted to apply to arrangements between drug and medical device manufacturers and suppliers on one hand and prescribers, patients, purchasers, and formulary managers on the other. In addition, claims resulting from a violation of the federal Anti-Kickback Statute constitute false or fraudulent claims for purposes of the federal civil False Claims Act discussed below.”

Annual report 2025A · The company itself

“Although there are a number of statutory exemptions and regulatory safe harbors protecting certain common business practices from prosecution and administrative sanctions, the exemptions and safe harbors are drawn narrowly, and practices that involve remuneration that may be perceived as inducing the prescription, purchase, or recommendation of Omnipod products may be subject to scrutiny under the law. For example, we may provide the initial training to users necessary for appropriate use of our product either through our own diabetes educators or by contracting with outside diabetes educators that have completed a Certified Pod Trainer course. We compensate outside diabetes educators for their services at contracted rates deemed to be consistent with the market.”

Annual report 2025A · The company itself

“Table of Contents Federal law also includes a provision commonly known as the “Stark Law,” which prohibits a physician from referring Medicare or Medicaid patients to an entity for the furnishing of certain “designated health services,” in which the physician has an ownership or investment interest or with which the physician has entered into a compensation arrangement. Violation of the Stark Law could result in denial of payment, disgorgement of reimbursements received for items and services referred by a physician with a noncompliant arrangement, civil damages and penalties, and exclusion from Medicare, Medicaid, or other governmental programs.”

Annual report 2025A · The company itself

“Federal Civil False Claims Act. The federal civil False Claims Act imposes penalties against any person or entity who, among other things, knowingly presents, or causes to be presented, a false or fraudulent claim for payment of government funds, or knowingly makes, uses, or causes to be made or used a false record or statement material to a false or fraudulent claim.”

Annual report 2025A · The company itself

“Civil Monetary Penalties Law. We are subject to the federal Civil Monetary Penalties Law, which prohibits, among other things, the offering or transferring of remuneration to a Medicare or Medicaid beneficiary that the person knows or should know is likely to influence the beneficiary’s selection of a particular supplier of Medicare or Medicaid payable items or services.”

Annual report 2025A · The company itself

“Federal Healthcare Fraud Statutes. We are also subject to federal healthcare fraud statutes that, among other things, impose criminal and civil liability for executing a scheme to defraud any healthcare benefit program, including non-governmental programs, and prohibit knowingly and willfully falsifying, concealing, or covering up a material fact, making any materially false or fraudulent statement or representation, or making or using any false writing or document with knowledge that it contains a materially false or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items, or services.”

Annual report 2025A · The company itself

“Privacy Laws. Many states have enacted various privacy laws of general applicability over the past several years. For example, the California Consumer Privacy Act (“CCPA”) and California Privacy Rights Act (“CPRA”) are consumer privacy laws that provide certain privacy rights and consumer protection for residents of the state of California. These consumer rights include the right to know what personal information is collected, the right to know whether the data is sold or disclosed and to whom, the right to request a company to the delete personal information collected, the right to opt-out of the sale of personal information, and the right to non-discrimination in terms of price or service when a consumer exercises a privacy right.”

Annual report 2025A · The company itself

“Physician Payments Sunshine Act. The Physician Payments Sunshine Act, implemented as the Open Payments program, requires manufacturers of drugs and devices for which payment is available under Medicare, Medicaid, or the Children’s Health Insurance Program (with certain exceptions) to report annually to the Centers for Medicare & Medicaid Services (“CMS”) information related to direct or indirect payments and other transfers of value provided to physicians and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members.”

Annual report 2025A · The company itself

“We and our contract manufacturer are required to comply with the FDA’s QSR, which is a complex regulatory framework that covers the procedures and documentation of the design, testing, production, control, quality assurance, sterilization, labeling, packaging, storage, shipping, and servicing of our devices.”

Annual report 2025A · The company itself

“Our promotional materials and training methods must comply with FDA and other applicable laws and regulations, including the prohibition of the promotion of unapproved, or off-label, use.”

Annual report 2025A · The company itself

“Risks Related to Laws, Regulations and Litigation • Our future efforts to sell shares or raise additional capital may be delayed or prohibited by regulations. • Regulatory and legal uncertainties could harm our business. • We are subject to risks relating to litigation and potential securities laws liability. • Heightened regulatory and legislative requirements and changes in the U.S. and globally have increased our compliance, regulatory and other risks and costs. • There are emerging legal and regulatory risks related to prediction markets that could harm our business. • We may incur additional tax expense or become subject to additional tax liabilities.”

Annual report 2025A · The company itself

“We are required to interpret and implement extensive and frequently changing regulatory and legislative requirements in the U.S. and other jurisdictions in which we do business resulting in substantial compliance, regulatory and other risks and costs, including the cost of hiring additional personnel.”

Annual report 2025A · The company itself

“Rules regarding data privacy worldwide are continuously evolving and developing, increasing in complexity and, as a result, interpretation and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. New laws, amendments to or reinterpretations of existing laws, regulations, standards, and other obligations, if applicable, might require us to incur additional costs and change how we use, collect, store, transfer or otherwise process certain types of personal data, to implement new processes to comply with those applicable laws and our customers’ exercise of their rights thereunder.”

Annual report 2025A · The company itself

“Our key areas of focus on these evolving efforts are: •Increased Bank Capital Requirements. The Board of Governors of the Federal Reserve, or the Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation proposed to implement various Basel Committee standards which would increase U.S. bank capital requirements (Basel III Endgame). The Basel III Endgame would apply credit valuation adjustment risk capital requirements to bank-affiliated clearing members' exposures to their clearing clients.”

Annual report 2025A · The company itself

“Both proposals would increase capital requirements for client clearing activities, which could increase costs for clearing services, decrease clearing members' clearing capacity, and result in a reduction of cleared volumes at our clearing houses. The Basel III Endgame proposal could also discourage participation in mortgage lending and servicing, resulting in a reduction of mortgage volumes at ICE Mortgage Technology, negatively impact U.S. capital markets, end users' ability to hedge and raise financing through public markets and degrade liquidity.”

Annual report 2025A · The company itself

“In October 2025, the EU Commission adopted a Delegated Act for the Active Account Requirement, or AAR, under the European Market Infrastructure Regulation, or EMIR, known as EMIR 3.0. The AAR mandates EU market participants to establish accounts for euro-denominated short-term interest rate derivatives at an EU central counterparty and clear a certain number of trades in an EU account. In 2025, ICE Clear Netherlands was authorized to clear euro-denominated short-term interest rate derivatives traded at ICE Futures Europe and thus allows market participants in scope for the AAR to satisfy their obligations.”

Annual report 2025A · The company itself

“•Policy intervention to address high energy prices. Various legislative proposals in the EU have been adopted to address high energy prices and impact ICE Endex, the primary European exchange for the benchmark European gas contract, and ICE Clear Europe, which clears ICE Endex contracts. These policy interventions include a temporary price cap on certain Dutch Title Transfer Facility, or TTF, derivatives traded on ICE Endex, which expired on January 31, 2025.”

Annual report 2025A · The company itself

“Many jurisdictions have adopted or are proposing or considering proposals to regulate environmental, social or governance, or ESG, data providers, as well as ESG ratings. In December 2024, the EU Regulation on ESG Ratings Providers was published in the Official Journal of the EU. The regulation introduces a regulatory regime for ESG rating providers operating in the EU and will take effect in July 2026.”

Annual report 2025A · The company itself

“In December 2025, the European Parliament and Council agreed to postpone the effective date of the EU Deforestation Regulation, or EUDR, for large companies to December 30, 2026, and to June 30, 2027, for small entities. EUDR requires that certain commodities (including cocoa and coffee) and their products be from deforestation-free land and meet other requirements before they can be placed or made available on the EU market, or exported from it. The EUDR requirements may decelerate the physical trade of cocoa and coffee, impact the usability of EU coffee and cocoa physical inventories, and reduce trading volumes on ICE Futures Europe of the Robusta Coffee Contract and London Cocoa Contract and on ICE Futures U.S. of the Coffee C Contract (Arabica).”

Annual report 2025A · The company itself

“In December 2025, the European Commission published a proposal to centralize supervision of certain financial entities under ESMA. If enacted, the proposal could change the supervisory structure for ICE Endex and ICE Clear Netherlands. •Bank of England CCP Reforms.”

Annual report 2025A · The company itself

“In July 2025, the BOE published a consultation on the U.K.'s regulatory framework for CCPs which included proposals to increase CCP default fund contributions and to increase governance and operational requirements. Many of the proposed changes exceed those required by other global CCP regulatory regimes and, if enacted as drafted, could increase the cost of operating a CCP and affect the competitive position of U.K. CCPs.”

Annual report 2025A · The company itself

“Benchmark Regulation. In December 2025, HM Treasury launched a consultation proposing to repeal and replace the U.K. BMR with a new framework that narrows regulatory oversight to only those benchmarks and administrators that could pose systemic risks to U.K. markets.”

Annual report 2025A · The company itself

“The adoption of new laws or regulations, changes in governmental policies or changes in regulations or enforcement practices applicable to our businesses or those of our clients could adversely affect our ability to compete effectively with other institutions that are not affected in the same way or impact our clients’ overall trading volume through our exchanges and clearing houses and demand for our market data and connectivity offerings, mortgage technology and other services.”

Annual report 2025A · The company itself

“Changes to existing laws, regulations or policies, or the adoption of new laws, regulations or policies that affect the residential mortgage industry could reduce residential mortgage volume or otherwise limit the ability of users and participants of our mortgage technology services to operate their businesses, resulting in decreased usage of our solutions.”

Annual report 2025A · The company itself

“Markets in Financial Instruments Directive II, or U.K. MiFID II, and EU Markets in Financial Instruments Directive II, or EU MiFID II, the U.K BMR and the EU BMR, including each such regulation as incorporated into U.K. law, have significantly altered and propose to further alter the regulatory framework within which we operate and may adversely affect our competitive position and profitability. These regulatory developments could also cause us to change our business practices, restructure our businesses or move certain of our businesses and employees.”

Annual report 2025A · The company itself

“ICE Clear Credit has been designated as a systemically important financial market utility by the FSOC and, as a result, is subject to additional oversight by the CFTC. Compliance with these requirements has resulted in, and will continue to result in, additional operating costs.”

Annual report 2025A · The company itself

“In 2016, the SEC approved a plan to establish a market-wide consolidated audit trail, or the CAT, to improve regulators’ ability to monitor trading activity. In addition to increased risk in connection with our regulatory obligations, the implementation of the CAT has resulted in, and in the future could continue to result in significant additional expenditures, which may not be reimbursed, especially in light of a court challenge to the CAT funding model in the United States Court of Appeals for the Eleventh Circuit and follow-on cases.”

Annual report 2025A · The company itself

“Legislative proposals in the EU and elsewhere are contemplating new or expanded requirements for data service providers such as conflict of interest and transparency rules, regulation of prices and fees and imposition of market access rules for third-country providers. These requirements may increase our regulatory burden and impact our ability to provide certain data related services in relevant jurisdictions.”

Annual report 2025A · The company itself

“For example, there have been discussions in various jurisdictions around financial transaction or digital service tax frameworks as well as global 30 minimum corporate income tax rates. Changes to tax frameworks in jurisdictions where we operate significant business, for example, the U.S., the U.K. and the EU have increased costs in the past, and may in the future increase costs to us or to our market participants and discourage participation in the markets we operate.”

Annual report 2025A · The company itself

“For example, our acquisitions of Ellie Mae, Inc., or Ellie Mae, in 2020 and Black Knight in 2023 expose us to increased regulatory scrutiny from U.S. regulatory bodies that regulate the U.S. residential mortgage industry, including the FFIEC and its member agencies, and the CFPB, among others.”

Annual report 2025A · The company itself

“In addition, our acquisition of ICE Digital Trust, which is a New York limited purpose trust company, subjects us to additional regulation and oversight by the NYDFS, including requirements to comply with additional cybersecurity, anti-money laundering, capital adequacy and digital asset safekeeping requirements. Compliance with any such regulatory requirements increases our regulatory burden and gives rise to costs and expenses that may be material.”

Annual report 2025A · The company itself

“Regulatory developments or court rulings could reduce the amount of revenue that we obtain from exchange market data and connectivity fees related to our U.S. equity and options exchanges, and from mortgage data related to our mortgage technology businesses. With respect to our U.S. equities and equity options exchanges, our ability to assess fees for market data products and certain connectivity fees are subject to review by the SEC.”

Annual report 2025A · The company itself

“If new constraints are placed on our ability to charge for market data, mortgage data or market access in the U.S., it could have a negative impact on our revenues.”

Annual report 2025A · The company itself

“Separately, our European exchanges are currently authorized to sell trade information on a non-discriminatory basis at a reasonable cost. This regulatory position could be modified or interpreted by the European Commission or future European court decisions in a manner that could have an adverse effect on our European market data revenues.”

Annual report 2025A · The company itself

“In January 2025, the European Commission adopted a new equivalence decision that allows continued access by EU firms to clear trades at U.K. central counterparties until June 30, 2028. Subsequently, in March 2025, ESMA extended the tiering determination and temporary recognition decisions for ICE Clear Europe until June 30, 2028, which allows continued access for EU firms to clear trades at ICE Clear Europe.”

Annual report 2025A · The company itself

“In the absence of an extension of the temporary equivalence or permanent equivalence of U.K. CCPs by the European Commission, EU persons would be restricted in accessing clearing services at ICE Clear Europe, which could impact clearing revenues, and could also cause us to change our business practices, restructure our businesses or move certain of our businesses and employees.”

Annual report 2025A · The company itself

“•ICE Clear Credit and ICE Clear U.S. are regulated by the CFTC as DCOs. DCOs are subject to extensive regulation by the CFTC under the CEA.”

Annual report 2025A · The company itself

“Our compliance and risk management methods, as well as our fulfillment of our regulatory obligations, may not be effective, which could lead to enforcement actions by our regulators or other legal proceedings. Our ability to comply with existing and future rules, regulations and laws largely depends on our establishment and maintenance of compliance, audit and reporting systems that can quickly adapt and respond, as well as our ability to attract and retain qualified compliance and other risk management personnel.”

Annual report 2025A · The company itself

“Archipelago Securities, LLC is subject to oversight by the SEC and FINRA and is a full clearing member of the National Securities Clearing Corporation and Options Clearing Corporation, or OCC. •Our U.S.-based execution-oriented fixed income markets are operated by our SEC-registered broker-dealers, ICE Bonds Securities Corporation, or ICE Bonds, which operates two SEC registered ATSs, ICE BondPoint, and ICE TMC. ICE Bonds is subject to oversight by the SEC and is a member of FINRA and the Municipal Securities Rulemaking Board, or MSRB.”

Annual report 2025A · The company itself

“Regulation of our Mortgage Business We have a mortgage technology business, ICE Mortgage Technology, that provides software, data, and electronic data processing to financial institutions and other stakeholders throughout the U.S. residential mortgage industry. ICE Mortgage Technology is subject to supervision and examination by the Federal Financial Institutions Examination Council, or FFIEC, and its member agencies because ICE Mortgage Technology is a third-party technology service provider to financial institutions directly regulated by the FFIEC's member agencies.”

Annual report 2025A · The company itself

“We are subject to the U.S. Foreign Corrupt Practices Act (“FCPA”) and similar anti-bribery and anti-corruption laws in other jurisdictions, which generally prohibit companies and their intermediaries from making improper payments to foreign officials to obtain or retain business or secure other commercial advantages.”

Annual report 2025A · The company itself

“Additionally, challenges to, or investigation into, our practices could cause adverse publicity and be costly to respond to and, thus, could harm our business, financial condition, or results of operations.”

Annual report 2025A · The company itself

“We are subject to inspection and marketing surveillance by the FDA to determine our compliance with regulatory requirements. If the FDA finds that we have failed to comply, it can institute a wide variety of enforcement actions, ranging from inspectional observations (as set forth on FDA Form-483) to a public Warning Letter to more severe civil and criminal sanctions, including the seizure of our products and equipment or ban on the import or export of our products.”

Annual report 2025A · The company itself

“This facility has an FDA Establishment Registration but has not been inspected by the FDA to date. If the FDA were to identify non-conformances in our product documentation or quality system compliance, it could hold indefinitely the importation of instruments at the border, which would deprive us of the ability to sell and supply the majority of our customers until the FDA requirements have been satisfied.”

Annual report 2025A · The company itself

“To demonstrate compliance with the general safety and performance requirements, we must undergo a conformity assessment procedure, which varies according to the type of medical device and its (risk) classification. A conformity assessment procedure generally requires the intervention of a notified body.”

Annual report 2025A · The company itself

“Clearance under Section 510(k) requires demonstration that a new device is substantially equivalent to another device with 510(k) clearance or grandfathered (“pre-amendment”) status and for which a PMA is not required. If we develop products in the future that are not considered to be substantially equivalent to a device with 510(k) clearance or grandfathered status, we may be required to obtain marketing authorization through the more burdensome PMA process or alternatively through the de novo classification process, which is a path to market for novel devices that are low to moderate risk and for which a predicate device is not available.”

Annual report 2025A · The company itself

“A PMA is typically a much more complex, lengthy, and burdensome application than a 510(k) and generally takes from one to three years, or even longer, from the time the application is submitted to the FDA. In the PMA process, the FDA must determine that a proposed device is safe and effective for its intended use based, in part, on extensive data, including, but not limited to, technical, preclinical, clinical study, manufacturing, and labeling data.”

Annual report 2025A · The company itself

“In addition, a PMA application or de novo classification requests generally require the performance of one or more clinical studies. In some cases, such studies may also be required to support a 510(k) application, and any requirements to conduct clinical studies beyond those we anticipate for our current or future products could add significantly to our costs and have a material adverse effect on our business.”

Annual report 2025A · The company itself

“Like other investment management companies, our activities are highly regulated in nearly every country in which we conduct business. The regulatory environment in which we operate frequently changes, and in recent years we have observed a significant increase in both regulatory changes and enforcement actions and proceedings brought by governmental agencies and self-regulatory authorities against financial services companies. Laws and regulations generally grant governmental agencies and industry self-regulatory authorities broad administrative discretion over our activities, including the power to require registrations or licenses, limit or restrict our business activities, conduct examinations, risk assessments, investigations and capital adequacy reviews and impose remedial programs to address perceived deficiencies.”

Annual report 2025A · The company itself

“Current and anticipated regulatory developments include requirements related to AI, cybersecurity, and digital operational resilience, as well as evolving ESG disclosure standards and cross-border data transfer restrictions. Global divergence in these regulations could create conflicting obligations and increase compliance complexity. These changes may require significant investment of management time and resources, impact product design and distribution, and materially increase compliance costs or capital requirements.”

Annual report 2025A · The company itself

“Table of Contents A substantial portion of the products and services we offer in the U.S. are regulated by the SEC, Financial Industry Regulatory Authority, Commodity Futures Trading Commission, National Futures Association, Department of Labor and Texas Department of Banking, in the U.K. are regulated by the Financial Conduct Authority and in Hong Kong, China, and Japan are regulated by the Securities and Futures Commission of Hong Kong, the China Securities Regulatory Commission, and the Financial Services Agency, respectively. Subsidiaries operating in the EU and the products and services they provide are mainly regulated by the Commission de Surveillance du Secteur Financier in Luxembourg and Central Bank of Ireland, and by the European Securities and Markets Authority. Such subsidiaries are also subject to various EU Directives, which generally are implemented by member state national legislation and by EU Regulations.”

Annual report 2025A · The company itself

“Regulatory developments and changes specific to our business will or may include, without limitation: •Regulations that place restrictions on certain outbound investments from the United States or by U.S. persons to companies operating in certain countries and/or industries perceived to be adverse to national security interests of the United States, such as the U.S. Department of Treasury’s Outbound Investment Security Program Rule that became effective in 2025, may impede our ability to provide certain products and/or make certain investments and add complexity to our compliance program with heightened regulatory requirements. •Regulations pertaining to privacy and the use, protection, transfer and management of personal data with respect to clients, employees and business partners.”

Annual report 2025A · The company itself

“Privacy laws, such as the European and U.K. General Data Protection Regulation, U.S. state privacy laws and financial sector regulations, India’s Digital Personal Data Protection Act, China’s Personal Information Protection Law and Bermuda's Personal Information Protection Act, have strengthened privacy requirements for organizations handling personal data, granted individuals more rights and control over the use of their personal data and greatly increased penalties for non-compliance. In addition, rules and legal requirements for international transfers of personal data from Europe and Asia create additional complexity and risk, particularly regarding integrated global cloud-based systems and business services employed by us.”

Annual report 2025A · The company itself

“•Regulations aimed at addressing concerns associated with open-end funds making investments in less liquid asset classes. Financial regulators in the U.S., U.K. and EU have periodically expressed concern that the daily redeemability features of these funds may create a “liquidity mismatch” with the assets in which they invest, and that this mismatch can give rise to investor dilution and systemic risk, especially in times of financial market stress. In the EU, recent amendments to the Undertakings for the Collective Investment in Transferable Securities (UCITS) and Alternative Investment Fund Managers directive frameworks introduce new rules regarding the use of certain liquidity management tools by UCITS funds and AIFs.”

Annual report 2025A · The company itself

“•The application of antitrust, change in bank control and similar competition laws and regulations to the asset management industry, including proposed amendments to these laws and regulations that could require large asset managers like us to, in certain circumstances, make acquisition notification filings or requests for approval with the U.S. Federal Trade Commission, Department of Justice and/or U.S. banking regulators before we acquire securities for the accounts of our clients, and the potential for antitrust regulators to promulgate regulations limiting common ownership of competitive companies by a single fund or by affiliated funds in a single fund complex. Developments in these laws and regulations and their application to our business could impede our ability to provide certain products or limit the AUM of certain investment strategies that we provide.”

Annual report 2025A · The company itself

“We cannot predict the full impact of legal and regulatory changes, changes in the interpretation of existing laws and regulations or possible enforcement actions or proceedings on our business. Such matters have imposed, and are likely to continue to impose, new compliance costs and/or capital requirements or impact us in other ways that could have a material adverse impact on our AUM, revenues, net income or liquidity. Moreover, certain legal or regulatory changes could require us to modify our strategies, businesses, product portfolios or operations, and we may incur other new costs or impacts, including the investment of significant management time and resources, to satisfy new regulatory requirements or to compete in a changed regulatory environment.”

Annual report 2025A · The company itself

“Höga krav på certifiering och regelefterlevnad Produkter som säljs till försvarsorganisationer och blåljusverksamhet måste uppfylla strikta standarder och höga krav. Det innebär att de genomgår omfattande certifieringsprocesser för att säkerställa att de lever upp till kundernas krav på säkerhet och prestanda.”

Annual report 2024A · The company itself

“Broker Licensure We own internal brokerages to serve the states in which we operate and utilize in-market leasing experience specialists to drive an end-to-end resident experience that achieves our occupancy, revenue, and retention goals while facilitating enjoyment of a worry-free leasing lifestyle. Our internal brokerages are subject to numerous federal, state, and local laws and regulations that govern the licensure of real estate agents and brokers and affiliate brokers and set forth standards for, and prohibitions on, the conduct of real estate brokers. Such standards and prohibitions include, among others, those relating to fiduciary and agency duties, administration of trust funds, collection of commissions, and advertising and consumer disclosures, as well as compliance with federal, state, and local laws and programs for providing housing to low-income families.”

Annual report 2025A · The company itself

“Laws and Regulations Regarding Privacy and Data Protection We are subject to a variety of laws and regulations that involve matters such as privacy, data protection, content, consumer protection, and other matters. These regulations include laws requiring holders of personal data to maintain safeguards and to take certain actions in response to a data breach.”

Annual report 2025A · The company itself

“For example, the California Consumer Privacy Act of 2018 (“CCPA”), which came into effect on January 1, 2020, as amended by the California Privacy 19 Rights Act (“CPRA”), which became effective on January 1, 2023, governs the collection, use, disclosure, and security of information about California residents. It also requires us to, among other things, provide certain disclosures to California residents, promptly respond to certain consumer requests related to their data, and contractually impose certain obligations on vendors.”

Annual report 2025A · The company itself

“Other states in the United States have either passed, proposed, or are considering similar laws and regulations to the CCPA and CPRA (such as the Nevada Privacy of Information Collected on the Internet from Consumers Act, which became effective on October 1, 2021, the Colorado Privacy Act and the Utah Consumer Privacy Act, which both became effective in 2023, and the Texas Data Privacy and Security Act, which became effective on July 1, 2024) which could impose similarly significant operational and legal obligations, potential liabilities and costs.”

Annual report 2025A · The company itself

“Our ability to sell our properties may also be limited by our need to avoid the 100% prohibited transactions tax that is imposed on gain recognized by a REIT from the sale of property characterized as dealer property. For example, we may be required to hold our properties for a minimum period of time and comply with certain other requirements in the Internal Revenue Code of 1986, as amended (the “Code”), or dispose of our properties through a taxable REIT subsidiary (“TRS”), in which case we will incur corporate level tax on any net gains from such dispositions.”

Annual report 2025A · The company itself

“Our industry is under increasing political and regulatory scrutiny, resulting in governmental inquiries relating to the conduct of our business. These actions or inquiries may be costly to comply with, result in negative publicity and reputational damage, require significant management time and attention, and subject us to expenses and remedies that may harm our business, including fines or demands or orders that we modify or cease existing business practices.”

Annual report 2025A · The company itself

“Various continuously evolving and new federal and state privacy and data security laws, such as the California Consumer Privacy Act, further expanded by the California Privacy Rights Act, Nevada Privacy Law, the Colorado Privacy Act, the Utah Consumer Privacy Act, and the Texas Data Privacy and Security Act, or other legal and regulatory standards create data privacy rights for users, including more ability to control how their data is shared with third parties. These laws and regulations, as well as any associated inquiries or investigations or any other government actions, may be costly to comply with, require significant management time and attention, and subject us to remedies that may harm our business, including fines and other sanctions resulting from any related breaches of data privacy regulations or demands or orders that we modify or cease existing business practices.”

Annual report 2025A · The company itself

“To qualify as a REIT, we must continually satisfy tests concerning, among other things, our sources of income, the nature and diversification of our assets, the amounts we distribute to our stockholders, and the ownership of our stock. For instance, at the end of each calendar quarter, at least 75% of the value of our assets must consist of cash, cash items, government securities, and qualified REIT real estate assets.”

Annual report 2025A · The company itself

“The Code generally requires that a REIT annually distribute at least 90% of its REIT taxable income, determined without regard to the deduction for dividends paid and excluding any net capital gain, and imposes tax on any REIT taxable income retained by a REIT, including capital gains.”

Annual report 2025A · The company itself

“In particular, restrictions on, or withdrawal of, participation by agency or government-sponsored enterprises in transactions secured by our homes, or in securitizations backed by such assets, could limit our refinancing alternatives at or near maturities, require us to use more expensive or less flexible sources of capital, or necessitate asset sales on unfavorable terms.”

Annual report 2025A · The company itself

“Legal and Regulatory JPMorganChase’s businesses are highly regulated and are significantly affected by applicable law and supervisory expectations. JPMorganChase must comply with applicable law in all of the jurisdictions around the world where it does business. Like other financial services firms, JPMorganChase is subject to extensive supervision and regulation that significantly affects the way that it conducts its business and structures its operations.”

Annual report 2025A · The company itself

“JPMorganChase has in the past and could in the future be required to modify its business and operations in response to changes in applicable law, regulatory decisions or supervisory expectations, such as: •limiting the products and services that it offers •increasing the prices that it charges for products and services, which could reduce the demand for them •reducing the liquidity that it provides through market-making activities •paying higher taxes or other governmental charges •absorbing losses arising from fraudulent transactions perpetrated against its clients and customers •disposing of certain assets, and doing so at disadvantageous times or prices •forgoing business opportunities that it might otherwise pursue, or •otherwise restricting its business activities. These types of changes could increase JPMorganChase’s costs or reduce its revenues.”

Annual report 2025A · The company itself

“Differences in the supervision and regulation of financial services firms could require JPMorganChase to modify its operations and incur higher operational and compliance costs. Various factors could influence the scope of applicable law and supervision for a firm that provides financial services, such as the size of the firm, the businesses in which it engages and its jurisdiction of organization. For example: •larger firms such as JPMorganChase often face more stringent supervision and regulation •certain competitors, such as financial technology companies, may not be subject to banking regulation, or may be subject to less stringent oversight, or •the regulatory and supervisory framework in a particular jurisdiction may favor locally-based firms.”

Annual report 2025A · The company itself

“A highly-regulated financial services firm such as JPMorganChase can be vulnerable to competition from firms that are less regulated or unregulated. In addition, differences in regulatory implementation between the U.S. and other countries could adversely affect JPMorganChase’s businesses. For example, a national financial services regulator may impose requirements 10 that are stricter than a global standard, which could create competitive disadvantages for those firms, such as JPMorganChase, that are subject to the enhanced regulations.”

Annual report 2025A · The company itself

“JPMorganChase faces significant legal risks from civil and governmental proceedings, including litigation, investigations and enforcement actions. JPMorganChase is named as a defendant or is otherwise involved in many civil and governmental legal proceedings, including class actions, derivative actions and other litigation or disputes with third parties, as well as investigations and enforcement actions by U.S. and non-U.S. governmental authorities, including criminal proceedings. Actions currently pending against JPMorganChase could result in judgments, settlements or penalties adverse to JPMorganChase, and any such resolution of legal proceedings could materially and adversely affect JPMorganChase’s business, financial condition or results of operations, or cause serious reputational harm.”

Annual report 2025A · The company itself

“JPMorganChase has in the past incurred significant penalties and experienced collateral consequences and other repercussions in connection with resolving investigations and enforcement actions by governmental authorities, and it could face similar investigations, actions and resolutions in the future. JPMorganChase typically incurs higher operational and compliance costs when addressing the requirements of such resolutions, including devoting substantial resources to remediation. In connection with resolving specific investigations or enforcement actions, certain governmental authorities have required JPMorganChase and other financial institutions to admit wrongdoing with respect to the activities that gave rise to the resolution.”

Annual report 2025A · The company itself

“JPMorganChase’s businesses and results of operations could be adversely affected by actions or initiatives by governmental authorities or officials that: •seek to discourage financial institutions from doing business with companies engaged in certain industries, or conversely, to penalize financial institutions that elect not to do business with such companies, or •mandate specific business practices for companies operating in the relevant jurisdiction. Governmental policies may differ or conflict across jurisdictions, which could lead to negative consequences for JPMorganChase regardless of the course of action that it takes or elects not to take, including: •prohibitions or restrictions on doing business within a particular jurisdiction, or with governmental entities in a jurisdiction •the threat of enforcement actions, including under antitrust or other anti-competition laws, and •reputational harm.”

Annual report 2025A · The company itself

“In addition, greater government scrutiny of practices related to the handling of personal information has in some cases resulted in, and could in the future lead to, the adoption of applicable law in the U.S. and elsewhere that is stricter and could result in JPMorganChase incurring higher compliance costs or constraining its ability to offer certain products and services to customers.”

Annual report 2025A · The company itself

“A significant inadequacy in disclosure or financial reporting controls could negatively affect JPMorganChase’s business, operations and reputation. JPMorganChase is subject to complex global financial reporting obligations that require continuous enhancements to disclosures in its financial statements and regulatory reports. JPMorganChase’s disclosure and financial reporting controls may not always be effective, and a material weakness or significant deficiency in internal control over financial reporting could occur.”

Annual report 2025A · The company itself

“Part I Competition in the financial services industry could lead to negative effects on JPMorganChase’s results of operations. JPMorganChase operates in a highly competitive environment in which it must constantly adapt to changes in financial regulation, technological advances and economic conditions. JPMorganChase expects that competition in the financial services industry will remain intense, with new competitors in the financial services industry continuing to emerge.”

Annual report 2025A · The company itself

“In addition, advocacy by non-banking competitors for exemptions from regulatory requirements could significantly disadvantage traditional financial institutions.”

Annual report 2025A · The company itself

“Comprehensive reform of the legislative and regulatory environment for financial services companies remains ongoing.”

Annual report 2025A · The company itself

“The Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”) raised the asset threshold above which the Federal Reserve is required to apply enhanced prudential standards to BHCs with at least $250 billion in total consolidated assets and gave the Federal Reserve the authority to apply enhanced prudential standards to BHCs with at least $100 billion in assets but less than $250 billion in assets (like KeyCorp) if it determines that the application of the enhanced prudential standards is appropriate to prevent or mitigate risks to financial stability or to promote the safety and soundness of the BHC or BHCs, taking into consideration the BHC’s or BHCs’ capital structure, riskiness, complexity, financial activities, size, and other relevant factors.”

Annual report 2025A · The company itself

“Further, the Federal Reserve has detailed the processes that BHCs should maintain to ensure they hold adequate capital under severely adverse conditions and have ready access to funding before engaging in any capital activities. The severity and other features of these processes, which take the form of stress tests and other measures, may evolve from year to year and are used by the Federal Reserve to, among other things, evaluate our management of capital and the adequacy of our regulatory capital and to determine the stress capital buffer that we must maintain above our minimum regulatory capital requirements.”

Annual report 2025A · The company itself

“To facilitate our wholesale funding and other business activities, we maintain credit ratings with three major credit rating agencies, and their assessments of our capital and liquidity are prominent determinants of our credit ratings. Additionally, from time to time, the agencies revise their bank rating methodologies and may increase their expectations of the amount and/or type of capital and liquidity we hold in order to maintain our investment grade credit ratings.”

Annual report 2025A · The company itself

“From time to time, federal banking regulators tailor the extent to which various categories of large banks are subject to certain capital, liquidity and other regulations. For instance, Category IV banks with assets between $100 billion and $250 billion, including Key, are not currently subject to certain capital and liquidity standards required of larger banks.”

Annual report 2025A · The company itself

“The FDIC may impose a special assessment on IDIs to recover the loss to the failed bank resulting from the use of the systemic risk exception to protect uninsured depositors. A special assessment could increase our noninterest expense for that quarter, as was the case during the fourth quarter of 2023 and first quarter of 2024.”

Annual report 2025A · The company itself

“Regulators can implement measures designed to strengthen capital and liquidity standards and restore confidence in the banking system applicable to Key including those discussed in “Regulatory capital requirements” under the heading “Supervision and Regulation” in Item 1 of this report. These regulatory rules could have a material effect on our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“Changes in FHLB lending policies or the haircuts they apply to our pledged collateral could adversely affect our liquidity and profitability.”

Annual report 2025A · The company itself

“Further, regulatory guidance adopted by federal banking regulators related to how banks select, contract with, evaluate, engage with, and manage their third parties, including such third parties’ use of subcontractors and 35 Table of contents downstream service providers, impacts whether and how we work with such parties, as well as the cost of managing such relationships.”

Annual report 2025A · The company itself

“Changes to existing statutes and regulations, and taxes (including industry-specific taxes and surcharges), or their interpretation or implementation, could affect us in substantial and unpredictable ways, particularly with those laws and regulations that serve to protect customers. Such changes may subject us to additional costs, adversely impact our income, and increase our litigation risk should we fail to appropriately comply and may also impact consumer behavior, limit the types of financial services and products we may offer, affect the investments we make, and change the manner in which we operate.”

Annual report 2025A · The company itself

“In addition, changes to laws and regulations may impact our customers by requiring them to adjust their operations or practices or impair their ability to pay fees or outstanding loans or afford new products, which could negatively impact demand for our products and services.”

Annual report 2025A · The company itself

“A number of states have also recently enacted consumer privacy laws that impose compliance obligations with respect to personal information or issued guidance regarding the same, such as the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (known as the “CCPA”), and the New York Department of Financial Services Cybersecurity Regulations.”

Annual report 2025A · The company itself

“On October 18, 2022, the FDIC adopted a final rule, applicable to all IDIs (including KeyBank), to increase the initial base deposit insurance assessment rate schedules uniformly by two basis points consistent with the Amended Restoration Plan approved by the FDIC on June 21, 2022. The FDIC indicated that it was taking this action in order to restore the DIF reserve ratio to the required statutory minimum of 1.35% by the statutory deadline of September 30, 2028. Under the final rule, the increase in rates began with the first quarterly assessment period of 2023 and will remain in effect unless and until the reserve ratio meets or exceeds 2% in order to support growth in the DIF in progressing toward the FDIC’s long-term goal of a 2% reserve ratio.”

Annual report 2025A · The company itself

“Table of contents On November 16, 2023, the FDIC issued a final rule to impose a special assessment on IDIs (including KeyBank) to recover the loss to the DIF resulting from the use of the systemic risk exception to protect the uninsured depositors of SVB and Signature. Under the final rule, the FDIC would collect a special assessment from IDIs at an annual rate of approximately 13.4 basis points (or 3.36 basis points per quarter) over eight quarterly assessment periods, starting with the first quarterly assessment period of 2024 (i.e., January 1, 2024 through March 31, 2024) with an invoice payment date of June 28, 2024.”

Annual report 2025A · The company itself

“Changes in applicable regulatory and legal requirements, including changes in their enforcement, could materially and adversely affect our business and our financial condition and results of operations.”

Annual report 2025A · The company itself

“Regulation as a Broker-Dealer KKR Capital Markets, LLC, one of our subsidiaries, is registered as a broker-dealer with the SEC under the Exchange Act and in 53 U.S. states and territories, and is a member of FINRA.”

Annual report 2025A · The company itself

“We are a global financial institution, and our business is subject to complex, extensive and evolving laws and regulations in the jurisdictions in which we operate around the world. Our asset management and capital markets businesses are generally governed by securities laws and regulations applicable to investment advisers, broker-dealers, and other financial services firms, including extensive regulatory requirements relating to registration, fiduciary obligations, disclosure, reporting, recordkeeping, supervision and compliance. In addition, our insurance business is subject to complex laws and extensive regulations applicable to insurance companies as well as regulations applicable to investment advisers, broker-dealers, and other financial services firms, including requirements relating to licensing, capital adequacy, investments, governance, policy terms, reporting and compliance.”

Annual report 2025A · The company itself

“Adverse regulatory actions may result in significant sanctions, liabilities, operational restrictions, litigation, reputational harm and other material and adverse impacts to our business. Our compliance with securities and insurance laws and regulations, as well as other laws and regulations applicable to our business, is subject to frequent examinations, inquiries and investigations by U.S. federal and state, as well as non-U.S., governmental agencies and regulatory authorities (including self-regulatory organizations) in the jurisdictions in which we operate.”

Annual report 2025A · The company itself

“For example, in Europe, we are an AIFM registered with the Central Bank of Ireland under the AIFMD, and in the United Kingdom, we are regulated by the FCA under the FSMA.”

Annual report 2025A · The company itself

“In addition, in Asia, we are a financial instruments business operator under the Financial Instruments and Exchange Act of Japan and a licensed asset manager and broker-dealer with the Securities and Futures Commission in Hong Kong, and we conduct fund management activities under license from the Monetary Authority of Singapore.”

Annual report 2025A · The company itself

“Any suspension, revocation, limitation, conditioning, or failure to obtain or renew licenses, registrations, authorizations, exemptions, or approvals applicable to any of our businesses, in the United States or in any other country in which we operate around the world, could restrict or prohibit our ability to conduct our business, require restructuring of business lines, limit products we offer, impede fundraising, restrict transaction activity, or otherwise materially adversely affect our business.”

Annual report 2025A · The company itself

“Our business operates within regulatory frameworks globally that distinguish among different types of financial activities, products, organizational structure, and other factors. These regulatory frameworks, including the scope, availability, and interpretation of exemptions, exclusions, and tailored regulatory requirements, are subject to change. If the regulatory framework applicable to our business were to change, we could become subject to additional or more comprehensive regulation in any one or more jurisdictions in which we operate, which may cause material and adverse impacts to our business.”

Annual report 2025A · The company itself

“For example, our private credit strategies and insurance-adjacent lending activities operate largely outside the traditional banking system and are subject to a complex and developing set of regulatory regimes, including securities, insurance, derivatives, banking, and financial stability laws. Although these activities are conducted through entities that are not regulated as banks, they have increasingly attracted regulatory attention due to their scale, growth, use of leverage, liquidity characteristics, interconnectedness with regulated financial institutions and potential relevance to broader financial markets. Regulatory authorities may adopt new or revised laws, regulations, guidance, or supervisory approaches applicable to these activities.”

Annual report 2025A · The company itself

“Moreover, given the scale and scope of our business and financial activities, regulators may evaluate our business and risk profile on a consolidated or group-wide basis rather than solely by reference to individual regulated entities. In the United States, the Financial Stability Oversight Council has authority to designate certain non-bank financial companies as systemically important financial institutions, which could subject a designated entity to enhanced supervision and regulation. Similarly, in the European Union and the United Kingdom, groups that engage in both insurance and investment activities may be subject to supplementary group-wide supervision under the Financial Conglomerates Directive and its UK equivalent.”

Annual report 2025A · The company itself

“If regulatory exemptions or exclusions on which we rely become unavailable, we may become subject to additional restrictive and costly regulatory requirements, regulatory action or liability. We regularly rely on exemptions, exclusions and other regulatory accommodations under U.S. and non-U.S. laws and regulations in conducting our asset management, capital markets and insurance businesses. The unavailability of these exemptions or exclusions for any reason, including changes in law, changes in regulatory interpretation, disqualifying events involving us, our affiliates, or associated persons, or changes in our business activities or organizational structure, may subject us or our investment vehicles to additional restrictive and costly regulatory compliance requirements, regulatory action or third-party claims, or other otherwise materially and adversely affect our business.”

Annual report 2025A · The company itself

“For example, in raising new funds or other investment vehicles in the United States, we typically rely on private placement exemptions from registration under the Securities Act, including Rule 506 of Regulation D. If we, our investment vehicles or any of the covered persons associated with our investment vehicles were to become subject to a disqualifying event, which includes a variety of criminal, regulatory and civil matters, one or more of our investment vehicles could lose the ability to raise capital in a Rule 506 private offering, which could materially impair our ability to raise capital for existing and new investment vehicles. The occurrence of a disqualifying event would also materially and adversely affect our ability to raise or syndicate capital for our transactions and for third parties and otherwise materially and adversely affect our ability to conduct our capital markets business, which depends on our ability to participate in unregistered securities offerings.”

Annual report 2025A · The company itself

“Distribution of financial products to individual investors subjects us to heightened regulatory, litigation, and reputational risks, which may materially adversely affect our business. As part of our growth strategy, we have distributed and expect to continue distributing certain of our investment and insurance products to individual investors.”

Annual report 2025A · The company itself

“For example, in the United States, the public offering and sale of securities to individual investors is subject to the antifraud and other investor protection provisions of the Securities Act of 1933, the Securities Exchange Act of 1934, and, where applicable, the Investment Company Act, which may subject issuers and their affiliates and control persons to heightened regulatory scrutiny and to claims by private plaintiffs alleging that such products were inappropriately marketed, inadequately disclosed, or otherwise offered or sold in violation of applicable securities laws.”

Annual report 2025A · The company itself

“In addition, various non-U.S. laws and regulations also govern the sale of financial products to individual investors, including, for example, Directive 2014/65/EU (MiFID II), Directive 2011/61/EU (AIFMD), and Regulation 2015/760/EU (ELTIF Regulation) which govern the sale of financial products to individual investors in the European Economic Area (the “EEA”). These EEA directives and regulations contain requirements for, among other things, marketing, investor suitability assessments, and conflicts of interest management, and certain of these requirements also apply to distributors, placement agents and other intermediaries that distribute our products to individual investors.”

Annual report 2025A · The company itself

“The distribution of our products to individual investors often occurs through third-party channels that we do not control. Although we conduct due diligence and establish onboarding and contractual arrangements with such distributors, we may not be able to effectively monitor or control how our products are marketed, recommended, or sold. As a result, we may be exposed to regulatory inquiries, enforcement actions, litigation, or reputational harm arising from allegations that our products were sold to investors for whom they were unsuitable or inadequately disclosed, even where such conduct was undertaken by third parties.”

Annual report 2025A · The company itself

“Regulations impacting the insurance industry and insurance companies owned by alternative asset managers may adversely affect our business. The NAIC and task forces and working groups appointed by it as well as individual U.S. state insurance regulators continue to consider various initiatives to change and modernize the solvency framework applicable to regulated insurance companies. These initiatives include enhancing the ability of state insurance regulators to effectively monitor the solvency and risks faced by an insurer within a larger group and when engaging in reinsurance transactions with other insurers.”

Annual report 2025A · The company itself

“As part of their efforts to address potential risks stemming from an insurance company’s relationship with alternative asset managers that may impact the insurance company’s risk profile, regulators have increased their scrutiny of certain structured investments held by insurance companies, the appropriateness of investment ratings and potential conflicts of interest (including affiliated investments), and potential misalignment of incentives. This growing scrutiny may increase the risk of regulatory actions against our insurance business and could result in new or amended regulations that limit our ability as an investment adviser, or make it more burdensome or costly, to enter into or amend existing investment management agreements with insurance companies and thereby grow our insurance strategy.”

Annual report 2025A · The company itself

“We often pursue complex investment opportunities, which may often involve substantial business, regulatory or legal complexities. Our tolerance for complexity presents significant risks, as such transactions can be more difficult, expensive and time consuming to finance and execute, and it can be more difficult to manage or realize value from these types of investments.”

Annual report 2025A · The company itself

“There is U.S. federal income tax risk associated with reinsurance transactions, intercompany transactions and distributions between U.S. companies and their non-U.S. affiliates, including from the Base Erosion and Anti-Abuse Tax (the “BEAT”) on certain U.S. companies that make deductible payments to related non-U.S. companies. While we have taken steps to mitigate the BEAT, there can be no assurance that these steps will be successful.”

Annual report 2025A · The company itself

“U.S. tax law changes could affect the products our insurance subsidiaries sell. Many such products benefit from taxfavored statuses under current U.S. federal and state income tax regimes.”

Annual report 2025A · The company itself

“Our insurance and reinsurance subsidiaries are highly regulated by, among others, insurance regulators in the United States and Bermuda, and changes in regulations affecting our insurance business may reduce Global Atlantic’s profitability and limit its growth.”

Annual report 2025A · The company itself

“The laws and regulations of the jurisdictions in which our insurance and reinsurance subsidiaries are domiciled or may be deemed commercially domiciled may require these companies to, among other things, maintain minimum levels of statutory capital, surplus and liquidity, meet solvency standards, submit to periodic examinations of their financial condition, restrict payments of dividends and distributions of capital, restrict our ability, in certain cases, to write insurance and reinsurance policies, make certain types of investments and distribute funds, and restrict the type and concentration of investments that can be made. For example, due to regulatory restrictions on the payment of dividends, our U.S. insurance subsidiaries may not declare a dividend in 2025 to the corporate parent companies of our insurance business without prior domiciliary state regulatory approval.”

Annual report 2025A · The company itself

“In addition, our U.S. insurers are required to be members of state guaranty associations. Guaranty associations subject insurers to assessments to pay policyholders in the event of another insurer’s insolvency. We cannot predict the amount, nature or timing of any future guaranty assessments.”

Annual report 2025A · The company itself

“Furthermore, as Global Atlantic seeks to expand its business outside of the U.S., it may become increasingly exposed to other applicable regulatory regimes in other jurisdictions, which may be extensive, complex and varied. As a result, any future overseas expansion of Global Atlantic’s business would subject us to additional regulatory risk, potential litigation, and increased compliance costs, and creates potential for additional liabilities and penalties.”

Annual report 2025A · The company itself

“In recent years, state insurance regulators have undertaken a review of the state-based insurance regulatory framework in the United States to bolster their ability to address concerns stemming from the increasing usage of offshore reinsurance transactions and expanding allocations to affiliated assets and alternative assets. In addition, some state legislatures have considered or enacted laws that alter, and in many cases increase, state authority to regulate insurance holding companies and insurance and reinsurance companies. Regulatory changes have the ability to impact other areas of Global Atlantic’s business as well, including access to liquidity or ability to write certain products.”

Annual report 2025A · The company itself

“Regulators also continue to propose or adopt sometimes conflicting or overlapping fiduciary rules, best interest standards and other similar laws and regulations applicable to the sale of retirement and life insurance products, which would generally require advisers providing investment recommendations to act in the client’s best interest or put the client’s interest ahead of their own interest. These new and proposed regulations may fundamentally adversely impact the way in which our insurance products are marketed and offered by its distribution partners.”

Annual report 2025A · The company itself

“Changes to SAP, the EBS Framework or capital models may be complex, require significant resources to implement and have an impact on our controls, which may be significant. Failure to implement or take appropriate or effective management actions in response to such changes may have a material adverse impact on us.”

Annual report 2025A · The company itself

“If our insurance business fails to mitigate the reserve strain associated with statutory accounting rules, it may result in a material adverse impact on our insurance subsidiaries’ capital positions or require increasing prices or reducing sales of certain insurance products. The application of certain statutory accounting rules for term life insurance policies with long-term premium guarantees and universal life policies with secondary guarantees requires Global Atlantic to maintain reserves at a level that exceeds what our insurance subsidiaries’ actuarial assumptions for the applicable business would otherwise require.”

Annual report 2025A · The company itself

“It is unclear what additional actions and regulatory changes will result from the continued scrutiny of captive reinsurers and reform efforts by the NAIC and other regulatory bodies. The NAIC is evaluating changes to accounting rules regarding surplus notes with linked assets, a structure used in certain captive reserve financing transactions. Further changes in such statutory accounting rules will likely make it difficult for Global Atlantic to establish new captive financing arrangements on a basis consistent with its current captives.”

Annual report 2025A · The company itself

“Certain of the reserve financing facilities Global Atlantic has put in place will mature prior to the run-off of the liabilities they support. As a result, Global Atlantic may be unable to implement actions to mitigate the strain of having redundant reserves or to maintain collateral support for its captives or existing third-party reinsurance arrangements to which one of our captive reinsurance subsidiaries is a party. If Global Atlantic is unable to continue to implement those actions or maintain existing collateral support, it may be required to increase statutory reserves, incur higher operating costs or tax costs, and the competitiveness, capital and financial position and results of operations of our insurance business may be materially and adversely affected.”

Annual report 2025A · The company itself

“We are party to agreements providing for various financial services and transactions that contain an element of risk in the event that the counterparties are unable to meet the terms of such agreements. In these agreements, we depend on these counterparties to make payment or otherwise perform.”

Annual report 2025A · The company itself

“In the United States, our Global Atlantic's insurance companies are subject to risk based capital ("RBC") standards and other minimum capital and surplus requirements imposed by state laws. The RBC formula is intended to measure the adequacy of the insurance company’s statutory surplus in relation to the risks inherent in its business.”

Annual report 2025A · The company itself

“Since 2022, as previously disclosed, KKR has been subject to investigations by the Antitrust Division of the DOJ (the “DOJ”) related to the accuracy and completeness of certain filings made by KKR pursuant to the premerger notification requirements under the Hart‐Scott‐Rodino Act of 1976 (“HSR”) for certain transactions in 2021 and 2022. On January 14, 2025, the DOJ filed a civil antitrust complaint (the “DOJ Complaint”) in the U.S. District Court for the Southern District of New York against KKR and various KKR-sponsored investment entities (the “KKR Defendants”) alleging violations of the HSR Act.”

Annual report 2025A · The company itself

“Reimbursement and Market Dynamics Affecting the Clinical Laboratory Business Government and commercial payers in the U.S. continue to implement measures to control healthcare costs and utilization, resulting in ongoing reimbursement pressure and increased administrative complexity for the clinical laboratory industry. The Company believes that pressure to reduce government and commercial reimbursement for clinical laboratory services is likely to continue.”

Annual report 2025A · The company itself

“Reimbursement from commercial payers for diagnostic testing may increasingly shift away from traditional, fee-for-service models to alternatives, including value-based, bundled pay-for-performance, and other risk-sharing payment models. The growth of the managed care sector and consolidation of MCOs present various challenges and opportunities to Dx and other clinical laboratories.”

Annual report 2025A · The company itself

“In addition to reductions in test reimbursement, the Company could also experience potential declines in test volumes due to increased controls over the utilization of laboratory services by Medicare, Medicaid, and third-party payers. MCOs are implementing, directly or through third parties, various ways to more closely monitor and reduce the volume and expense of laboratory testing. This includes utilization management efforts, such as requiring prior authorization from the MCO before certain tests can be performed.”

Annual report 2025A · The company itself

“To the extent that the U.S. government's OCI laws, regulations, and rules or interpretations thereof limit our ability to successfully compete for new contracts or task orders with the U.S. government, either because of OCI issues arising from our business, or because companies with which we are affiliated, or with which we otherwise conduct business, create OCI interest issues for us, our financial metrics and results of operations could be materially and adversely affected.”

Annual report 2026A · The company itself

“These agencies review a contractor’s performance on government contracts, cost structure, indirect rates and pricing practices, compliance with applicable contracting and procurement laws, regulations, terms, and standards, and the adequacy of our systems and processes in meeting government requirements. They also review the adequacy of the contractor’s compliance with government standards for its business systems, including a contractor’s accounting system, earned value management system, estimating system, materials management and accounting system, property management system, and purchasing system.”

Annual report 2026A · The company itself

“A finding of material weakness in our business system audits or other reviews can result in the suspension of payments or lower billing rates to our U.S. government customers until the material weakness is corrected and the DCMA accepts our remediations.”

Annual report 2026A · The company itself

“Our receipt of adverse audit findings or the failure to obtain an “approved” determination of our various business systems from the responsible U.S. government agency could significantly and adversely affect our business, including our ability to bid on new contracts and our competitive position in the bidding process.”

Annual report 2026A · The company itself

“A determination of noncompliance could also result in the U.S. government imposing penalties and sanctions against us, including reductions of the value of contracts, contract modifications reflecting less favorable terms or termination, withholding of payments, the loss of export/import privileges, administrative or civil judgments and liabilities, criminal judgments or convictions, liabilities and consent or other voluntary decrees or agreements, other sanctions, the assessment of penalties, fines or compensatory, treble or other damages or non-monetary relief or actions, suspension or debarment, suspension of payments and increased government scrutiny that could negatively impact our reputation, delay or adversely affect our ability to invoice and receive timely payment on contracts, perform contracts or compete for contracts with the U.S. government.”

Annual report 2026A · The company itself

“We are routinely subject to governmental investigations relating to compliance with various laws and regulations with respect to our role as a contractor to federal, state and local government customers and in connection with performing services in countries outside the United States. If a review or investigation identifies improper or unlawful activities, we may be subject to disgorgement of profits, fines, damages, litigation, civil or criminal penalties, exclusion from sales channels or sales opportunities, injunctions, or administrative sanctions, including the termination of contracts, the triggering of price reduction clauses, suspension of payments, suspension or debarment from doing business with governmental agencies or other consequences.”

Annual report 2026A · The company itself

“We are subject to numerous state, federal and international laws and directives and regulations in the U.S. and abroad that involve matters central to our business, including but not limited to, data privacy and security, employment and labor relations, immigration, taxation, anti-corruption, anti-bribery, import-export controls, trade restrictions, internal and disclosure control obligations, securities regulation and anti-competition restrictions.”

Annual report 2026A · The company itself

“BUSINESS AND OPERATIONAL RISKS Misconduct of employees, subcontractors, agents, suppliers, business partners or joint ventures and others working on our behalf could cause us to lose existing contracts or customers and adversely affect our ability to obtain new contracts and could have a material adverse impact on our business, reputation and future results. Misconduct encompasses a wide range of improper activities that could pose risks to our business.”

Annual report 2026A · The company itself

“Since Lifecare prioritizes commercialization in Europe, the device must comply with the EU Medical Device Regulation (MDR). Regulatory bodies require clinical evidence demonstrating that Sencell provides accurate glucose monitoring, reliability, and long-term safety.”

Annual report 2024A · The company itself

“Governmental Regulation: The FERC regulates Boardwalk Pipelines’ interstate natural gas transmission operating subsidiaries under the Natural Gas Act of 1938 (“NGA”) and the Natural Gas Policy Act of 1978 (“NGPA”). The FERC regulates, among other things, the rates and charges for the transportation and storage of natural gas in interstate commerce and the construction, extension, enlargement or abandonment of facilities under its jurisdiction.”

Annual report 2025A · The company itself

“CNA is subject to capital adequacy requirements and, if it is unable to maintain or raise sufficient capital to meet these requirements, regulatory agencies may restrict or prohibit CNA from operating its business. Insurance companies such as CNA are subject to capital adequacy standards set by regulators to help identify companies that merit further regulatory attention. In the U.S., these standards apply specified risk factors to various asset, premium and reserve components of CNA’s legal entity statutory basis of accounting financial statements.”

Annual report 2025A · The company itself

“CNA’s insurance subsidiaries, upon whom CNA depends for dividends in order to fund its corporate obligations, are limited by insurance regulators in their ability to pay dividends. CNA is a holding company and is dependent upon dividends, loans and other sources of cash from its subsidiaries in order to meet its obligations. Ordinary dividend payments or dividends that do not require prior approval by the insurance subsidiaries’ domiciliary insurance regulator are generally limited to amounts determined by formulas that vary by jurisdiction.”

Annual report 2025A · The company itself

“Among the adverse effects in the event of such downgrades would be the inability to obtain a material volume of business from certain major insurance brokers, the inability to sell a material volume of CNA’s insurance products to certain markets and the required collateralization of certain future payment obligations or reserves. Further, if one or more of CNA’s corporate debt ratings were downgraded, CNA may find it more difficult to access the capital markets and may incur higher borrowing costs.”

Annual report 2025A · The company itself

“Regulatory powers also extend to premium rate regulations which require that rates not be excessive, inadequate or unfairly discriminatory. State jurisdictions ensure compliance with such regulations through market conduct exams, which may result in losses to the extent non-compliance is ascertained, either as a result of failure to document transactions properly, failure to comply with internal guidelines or otherwise.”

Annual report 2025A · The company itself

“Risks Related to Us and Our Subsidiary, Boardwalk Pipelines Boardwalk Pipelines’ natural gas transportation and storage operations and ethane transportation services are subject to extensive regulation by the FERC, including rules and regulations related to the rates it can charge for its services and its ability to construct or abandon facilities. Boardwalk Pipelines may not be able to recover the full cost of operating its pipelines or storage operations, including earning a reasonable return.”

Annual report 2025A · The company itself

“Boardwalk Pipelines’ natural gas transportation and storage operations are subject to extensive regulation by the FERC, including with respect to the types, rates and terms of services Boardwalk Pipelines may offer to its customers, construction of new facilities, creation, modification or abandonment of services or facilities and recordkeeping and relationships with affiliated companies. An adverse FERC action in any of these areas could affect Boardwalk Pipelines’ ability to compete for business, construct new facilities, offer new services or recover the full cost of operating its pipelines or storage operations, including earning a reasonable return.”

Annual report 2025A · The company itself

“The FERC regulates the rates Boardwalk Pipelines can charge for its natural gas transportation and storage and interstate ethane transportation operations. For cost-based services, the FERC establishes both the maximum and minimum rates Boardwalk Pipelines can charge. The basic elements that the FERC considers are the costs of providing service, the volumes of gas being transported, the rate design, the allocation of costs between services, the capital structure and the rate of return a pipeline is permitted to earn.”

Annual report 2025A · The company itself

“Boardwalk Pipelines may not be able to recover its costs, including certain costs associated with pipeline integrity, through existing or future rates.”

Annual report 2025A · The company itself

“The FERC and/or Boardwalk Pipelines’ customers could challenge the maximum applicable rates that any of its regulated pipelines can charge in accordance with Section 5 of the NGA. The adoption of potential legislation that would amend Section 5 of the NGA to add refund provisions could increase the likelihood of such a challenge. If such a challenge is successful for any of Boardwalk Pipelines’ pipelines or if its rates are found not to be just and reasonable, then the revenues associated with transportation and storage services the pipeline provides pursuant to cost-of-service rates could materially decrease in the future, which would adversely affect, perhaps substantially, the revenues on that pipeline going forward.”

Annual report 2025A · The company itself

“The FERC has authority to impose civil penalties for violations of the NGA and NGPA, and the implementing regulations thereunder, up to a maximum amount that is adjusted annually for inflation, which for 2026 is approximately $1.5 million per day per violation. Should Boardwalk Pipelines fail to comply with applicable statutes, rules, regulations and orders administered by the FERC, it could be subject to substantial penalties and fines, in addition to reputational damage.”

Annual report 2025A · The company itself

“These laws and regulations may restrict or impact Boardwalk Pipelines’ business activities, including requiring the acquisition or renewal of permits or other approvals to conduct regulated activities, restricting the manner in which Boardwalk Pipelines handles or disposes of wastes, imposing remedial obligations to remove or mitigate contamination resulting from a spill or other release, requiring capital expenditures to comply with pollution control requirements and imposing safety and health criteria addressing worker protection. Failure to comply with these laws and regulations may trigger a variety of administrative, civil and criminal enforcement measures, including the assessment of monetary penalties, the imposition of remedial requirements, the incurrence of capital expenditures, the occurrence of delays, denials or cancellations in the permitting or performance or expansion of projects and the issuance of orders enjoining future operations in a particular area.”

Annual report 2025A · The company itself

“Legislative and regulatory initiatives relating to new or more stringent pipeline safety requirements or substantial changes to existing integrity management programs or withdrawal of regulatory waivers could subject Boardwalk Pipelines to increased capital and operating costs and operational delays.”

Annual report 2025A · The company itself

“State regulations may impose more stringent requirements than those found under federal law that affect Boardwalk Pipelines’ intrastate operations. Compliance with these rules over time generally has resulted in an overall increase in maintenance costs.”

Annual report 2025A · The company itself

“The imposition of new or more stringent pipeline safety rules applicable to natural gas or NGLs pipelines, or any issuance or reinterpretation of guidance from PHMSA or any state agencies, could cause Boardwalk Pipelines to install new or modified safety controls, pursue additional capital projects, forgo growth projects or conduct maintenance programs on an accelerated basis, any or all of which could result in Boardwalk Pipelines incurring increased capital and operating costs, experiencing operational delays and suffering potential adverse impacts to its operations, ability to grow its business or ability to reliably serve its customers.”

Annual report 2025A · The company itself

“Boardwalk Pipelines has entered into certain firm transportation contracts with shippers that utilize the design capacity of certain of its pipeline assets, based upon the authority Boardwalk Pipelines received from PHMSA to operate those pipelines at higher than normal operating pressures of up to 0.80 of the pipeline’s SMYS under issued permits with specific conditions. PHMSA retains discretion to withdraw or modify this authority. If PHMSA were to withdraw or materially modify such authority, it could affect Boardwalk Pipelines’ ability to transport all of its contracted quantities of natural gas on these pipeline assets and it could incur significant additional costs to reinstate this authority or to develop alternate ways to meet its contractual obligations.”

Annual report 2025A · The company itself

“TSA has issued a series of security directives applicable to pipeline owners and operators, which require the implementation of a variety of cybersecurity measures and reporting. Other regulators, such as PHMSA and the SEC, have also established requirements for reporting certain cybersecurity incidents.”

Annual report 2025A · The company itself

“Negative impacts from a compromised reputation or changes in public opinion (including with respect to the production, transportation and use of hydrocarbons generally) could include increased regulatory oversight, delays in obtaining, or challenges to, regulatory approvals with respect to growth projects, blockades, project cancellations, difficulty securing financing at reasonable terms, revenue loss or a reduction in customer base.”

Annual report 2025A · The company itself

“Risks Relating to Compliance and the Regulatory Environment The Company is subject to extensive government regulation and supervision and this regulatory environment can be and has been significantly impacted by financial regulatory reform initiatives. The Company is subject to extensive federal and state regulation and supervision.”

Annual report 2025A · The company itself

“The Company’s liquidity position and ability to fund and operate the business could be materially adversely affected by a variety of conditions and factors, including financial and credit market disruptions and volatility or a lack of market or customer confidence in financial markets in general, which may result in a loss of customer deposits or outflows of cash or collateral and/or ability to access capital markets on favorable terms. Negative news about the Company or the financial services industry generally may reduce market or customer confidence in the Company, which could in turn materially adversely affect the Company’s liquidity position and ability to raise funding.”

Annual report 2025A · The company itself

“Various regulations have been adopted to impose more stringent liquidity requirements for large financial institutions, including the Company. These regulations address, among other matters, liquidity stress testing and minimum liquidity requirements.”

Annual report 2025A · The company itself

“In addition, laws, regulations, and the expectations of federal and state banking regulators, investors and other stakeholders regarding appropriate climate-related risk management, practices and disclosures are continuously evolving and may require financial institutions including the Company, to adhere to new or heightened requirements and expectations regarding the disclosure and management of their climate-related risks and related lending, investment, operations and advisory activities.”

Annual report 2025A · The company itself

“Our activities are subject to extensive regulation under the laws of the U.S. and its various states, the United Kingdom, the European Union and its member states, Australia and the other jurisdictions in which we operate.”

Annual report 2025A · The company itself

“The U.S. and foreign laws and regulations that apply to our operations are complex and may change rapidly, and our efforts to comply and keep up with them require significant resources. In some cases, these laws and regulations may decrease the need for our services, increase our costs, negatively impact our revenues or impose operational limitations on our business, including on the products and services we may offer or on the amount or type of compensation we may collect.”

Annual report 2025A · The company itself

“At the international level, we are subject to an increasing number of comprehensive privacy laws including, for example, those passed in Indonesia, the Kingdom of Saudi Arabia, India and Australia. Many of these laws, which are modeled after the GDPR, have greatly increased the jurisdictional reach of privacy laws and added a broad array of requirements for handling personal data, such as the public disclosure of data breaches, data protection impact assessments, data portability and the appointment of data protection officers in some cases.”

Annual report 2025A · The company itself

“Given the breadth and depth of changes in data protection obligations, including classifying data and committing to a range of administrative, technical and physical controls to protect data and enable data transfers across borders, our compliance with such laws will continue to require time, resources and review of the technology and systems we use. Despite a proliferation of regulatory guidance papers, there remains uncertainty in key areas related to these laws, and that uncertainty could result in potential liability for our failure to meet our obligations, including the possibility of significant fines some of which can amount to 4% or more of our global revenue.”

Annual report 2025A · The company itself

“Some of the global laws enacted in recent years, including those in China and the Kingdom of Saudi Arabia, also include data localization elements that will require that certain personal data stay within their borders. These requirements are complex and our efforts to comply with them require significant resources, and we cannot guarantee we are or will be in full compliance with such laws at all times.”

Annual report 2025A · The company itself

“At the U.S. federal level, we are subject to various privacy laws and regulations, including those promulgated under the authority of the U.S. Federal Trade Commission, which has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including with respect to data privacy and cybersecurity.”

Annual report 2025A · The company itself

“At the U.S. state level, we are subject to laws and regulations related to privacy, such as the CCPA, which introduced concepts such as transparency and rights like access and deletion, that have been enacted by over twenty states with more such laws expected to pass in future years. These laws establish a privacy 16 framework for covered businesses, including various obligations imposed on them related to the personal information they collect and use, and offer various rights for their state residents. Some of these laws provide a private right of action for violations and in some cases damages may be significant.”

Annual report 2025A · The company itself

“Many of these laws diverge from the CCPA and create their own set of rules, and this proliferation of inconsistent state level privacy laws will add operational complexity and increased risk of noncompliance or violations which could trigger enforcement action or litigation.”

Annual report 2025A · The company itself

“In addition to data protection and data privacy laws, foreign countries and U.S. states are enacting cybersecurity laws and regulations. For example, in November 2025, the final amendments made by the New York State Department of Financial Services (NYDFS) to its previous cybersecurity regulations came into effect, which imposed obligations on companies such as Marsh, including for example, requiring companies to provide evidence of how they are implementing their data retention, data governance and data classifications policies and procedures.”

Annual report 2025A · The company itself

“A number of states have also adopted laws covering data collected by insurance licensees that include security and breach notification requirements. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may divert resources from other initiatives and projects and could restrict the way services involving data are offered, all of which may adversely affect our results of operations.”

Annual report 2025A · The company itself

“Many statutory requirements, both in the U.S. and abroad, include obligations for companies to notify individuals of security breaches involving certain personal information, which could result from breaches experienced by us or our vendors. For example, laws in all 50 U.S. states generally require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a breach.”

Annual report 2025A · The company itself

“Many of these laws and rules also include strict notification requirements for organizations related to confirmed or suspected breaches. This narrow notification window is often too short to fully validate the facts, and there is an increased risk of reporting a false alarm or immaterial breach, which may lead to reputational damage despite there not being an actual data breach.”

Annual report 2025A · The company itself

“We post public privacy notices and other documentation regarding our collection, use, disclosure, cross-border transfer, retention, and other processing of personal information. Although we endeavor to comply with our published notices and other documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees, contractors, service providers, vendors or other third parties with whom we do business fail to comply with our published notices and documentation. Such failures could carry similar consequences or subject us to potential enforcement actions or investigations if they are found to be deceptive, unfair or misrepresentative of our actual practices.”

Annual report 2025A · The company itself

“Furthermore, U.S. and global regulators continue to focus their enforcement actions and investigations on website-related practices, including the proper use of "cookies", pixels and other online trackers, as well as the use of online session recording tools. As we use such tools in our website environment, we are at risk of being impacted by such activity, including fines and cease and desist orders.”

Annual report 2025A · The company itself

“Privacy or AI-related legal or regulatory violations, including unauthorized use disclosure or transfer of sensitive, personal or confidential client or Company data, whether through systems failure, employee negligence, fraud or misappropriation, by the Company, our vendors or other parties with whom we do business (if they fail to meet the standards we impose) could damage our reputation and subject us to significant litigation, monetary damages, regulatory enforcement actions, fines and criminal prosecution in one or more jurisdictions where we operate.”

Annual report 2025A · The company itself

“Given the complexity of operationalizing the various privacy, data security, data protection and AI laws and regulations mentioned above, the complexity of proposed compliance frameworks and the continued lack of certainty on how to implement their requirements, we and our clients are at risk of enforcement actions taken by applicable regulators or authorities around the world or litigation from third parties, including consumer advocacy groups acting on behalf of data subjects. Additionally, due to the ongoing fast pace of legislative and regulatory activity, we may not be able to respond quickly or effectively to new legislative, regulatory and other developments.”

Annual report 2025A · The company itself

“These changes may also impair our ability to offer our existing or planned products and services and increase our cost of doing business in various countries.”

Annual report 2025A · The company itself

“Moreover, if we acquire a business operating in regions or industries subject to heightened regulatory scrutiny, we may face significant costs or risks in bringing their operations into compliance with applicable laws and our internal policies.”

Annual report 2025A · The company itself

“Adverse legal developments and future regulations concerning how intermediaries are compensated by insurers or clients, as well as allegations of anti-competitive behavior or conflicts of interest, could have a material adverse effect on our business, results of operations and financial condition. The ways in which insurance intermediaries are compensated receive scrutiny from regulators in part because of the potential for anti-competitive behavior and conflicts of interest.”

Annual report 2025A · The company itself

“The healthcare industry, inclusive of health insurance, is regulated by federal, state and local governments in the U.S., and by regulators and governments in other countries where we do business. The laws and rules governing the healthcare industry and interpretations of those laws and rules are subject to frequent and often unpredictable change. For example, legislation or regulatory action that has the impact of disincentivizing U.S. companies from offering employer-sponsored health insurance could ultimately reduce the revenue we receive when consulting on and broking these policies on behalf of our corporate clients.”

Annual report 2025A · The company itself

“Legislation seeking to regulate pharmacy benefit management services introduced or enacted at the federal or state level could impact the compensation structure and how much we are paid where we advise clients on prescription drug coverage.”

Annual report 2025A · The company itself

“Our strategic expansion of our products and services has also created the need for us to obtain new types and increasing numbers of regulatory licenses, resulting in increased supervision and additional compliance burdens distinct from those imposed on our payment network activities. For example, certain of our subsidiaries maintain money transfer licenses that typically impose supervisory and examination requirements, as well as capital, safeguarding, risk management and other business obligations.”

Annual report 2025A · The company itself

“We are subject to increasingly complex, fragmented, overlapping and/or divergent laws and regulations related to privacy and data protection, data use and governance, AI and information security (including with respect to cybersecurity and cyber-risk) in the jurisdictions in which we do business. New or updated laws and regulations have led, and may continue to lead, to similar, stricter or at times conflicting requirements, creating an uncertain regulatory environment.”

Annual report 2025A · The company itself

“Government Regulation As a technology company in the global payments industry, we are subject to government regulation that impacts key aspects of our business. In particular, we are subject to the laws and regulations that affect the payments industry in the many countries in which our products and services are used.”

Annual report 2025A · The company itself

“Central banks and similar regulatory bodies have increasingly established or further expanded their authority over certain aspects of payments systems such as ours, including obligations or restrictions with respect to the types of products and services that we may offer, the countries in which our products and services may be used, the way we structure and operate our business and the types of consumers and merchants who can obtain or accept our products or services. Similarly, jurisdictions that regulate a particular product may consider extending their jurisdiction to other products.”

Annual report 2025A · The company itself

“Key 2025 Developments •In July 2025, the EU introduced its revised systemic importance regulation, covering companies such as ours that have been designated as systemically important. The revision introduces a framework for cyber resilience and detailed rules for managing outsourcing risks.”

Annual report 2025A · The company itself

“•In November 2025, the Central Bank of Brazil established a new regulation for all Payment Scheme Operators (PSOs) in Brazil (including Mastercard and Visa), enhancing governance, risk management and transparency standards across the payments ecosystem. The new regulation reinforces the PSOs’ accountability for the financial and settlement integrity of payments to merchants (including in cases of default, operational failure or insolvency of any of their scheme participants) and, in particular, requires payment networks to extend their settlement guarantees to previously non-guaranteed transactions (such as merchant installment transactions).”

Annual report 2025A · The company itself

“For example, some jurisdictions have implemented or are otherwise considering requirements to collect, store and/or process data within their borders, as well as prohibitions on the transfer of and access to data abroad, leading to technological and operational implications. Other jurisdictions have adopted or are otherwise considering adopting sector-specific regulations for the payments industry and other industries in which we participate, including forced data sharing requirements or additional verification requirements.”

Annual report 2025A · The company itself

“Other Regulation Regulations that directly or indirectly apply to Mastercard as a result of our participation in the global payments industry may materially and adversely affect our overall business and results of operations. We are subject to regulations that affect the payments industry in the many jurisdictions in which our products and services are used.”

Annual report 2025A · The company itself

“Examples include: •Anti-Money Laundering, Countering the Financing of Terrorism, Economic Sanctions and Anti-Corruption. We are subject to AML and CFT laws and regulations globally.”

Annual report 2025A · The company itself

“Certain regulations or legislation that do or could impact our issuers and acquirers (such as caps on issuer interest rates) may impact various aspects of our business. Additionally, strong authentication requirements within the EU’s Payment Services Directive in the EEA could increase the number of transactions consumers abandon if we are unable to secure a frictionless authentication experience under these standards. Such an increase could adversely impact our volumes or other operational metrics.”

Annual report 2025A · The company itself

“Increased regulatory focus on us has resulted and may continue to result in significant compliance and governance burdens or otherwise increase our costs. Similarly, increased regulatory focus on our customers and other stakeholders may cause them to reduce the volume of transactions processed through our systems, or may otherwise impact the competitiveness of our products.”

Annual report 2025A · The company itself

“Additionally, our compliance with new economic sanctions and related laws with respect to particular jurisdictions or customers could result in a loss of business, which could be significant. Moreover, while our risk-based compliance program obligates issuers and acquirers to comply with U.S., EU and local sanctions programs (among other obligations), the failure of those issuers and acquirers to identify potential non-compliance issues either during or after their customer onboarding processes could ultimately impact our compliance with economic sanctions and related laws.”

Annual report 2025A · The company itself

“•Regulation may disintermediate issuers by enabling third-party providers opportunities to route payment transactions toward their own forms of payment by offering account information or payment initiation services directly to our product users. Such regulation may also provide these processors with the opportunity to commoditize the data that are included in the transactions they are servicing. Disintermediation of our customers’ business could diminish demand for our products and services.”

Annual report 2025A · The company itself

“In addition, to the extent that we offer discounts or incentives under such agreements, we will need to further increase transaction volumes or the amount of services provided in order to benefit from such agreements and to increase revenue and profit, and we may not be successful in doing so, particularly in the current regulatory environment.”

Annual report 2025A · The company itself

“Moreover, regulatory or government requirements could continue to require us to host and deliver certain products and services on-soil in certain markets. As a result, we may need to alter our technology and delivery model, potentially resulting in additional expenses and/or other operational impacts.”

Annual report 2025A · The company itself

“Operating a real-time account-based payments network presents risks that could materially affect our business. U.K. regulators have designated Vocalink, our real-time account-based payments network platform, to be a “specified service provider” and regulators in other countries may in the future expand their regulatory oversight of real-time account-based payments systems in similar ways.”

Annual report 2025A · The company itself

“Our failure to effectively design and deliver these products and services could make our other offerings less desirable to these customers, or put us at a competitive disadvantage. In addition, if there is a delay in the implementation of our products or services (which could include compliance obligations, such as AML and CFT, and licensing requirements for applicable products and services), if our products or services do not perform as anticipated, or we are unable to otherwise adequately anticipate risks related to new types of customers, we could face additional regulatory scrutiny, fines, sanctions or other penalties, which could materially and adversely affect our overall business and results of operations, as well as negatively impact our brand and reputation.”

Annual report 2025A · The company itself

“Changes in governmental priorities or other political developments, including disruptions in governmental operations, could impact approved funding and result in scope changes or termination of the arrangements or contracts we or financial institutions enter into with respect to our products and services. •Our work with governments is heavily regulated, subjecting us to additional potential exposure under U.S. and international anti-corruption laws (including the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act), as well as compliance with various procurement and other laws, regulations, standards and contract terms.”

Annual report 2025A · The company itself

“Competition and Related Laws: Antitrust and competition laws (“competition laws”) in the U.S. and elsewhere prohibit types of conduct, practices, or arrangements deemed to be anti-competitive. Enforcement of competition laws in the healthcare industry remains a focus of the FTC and the U.S. Department of Justice.”

Annual report 2026A · The company itself

“Table of Contents Item 1A Index McKESSON CORPORATION We are subject to extensive, complex, challenging, and frequently changing healthcare, environmental, and other laws, and may experience increased costs to distribute controlled substances such as opioids.”

Annual report 2026A · The company itself

“As described under “Healthcare Program Regulation” in Item 1 of Part I above, our business is subject to a broad range of recent and ongoing reform efforts, and challenges to those efforts, that could affect healthcare program access and spending, pharmaceutical pricing and reimbursement, and distribution economics. These include: the IRA; the OBBBA; Executive Order 14297; CMS rulemaking on BFSFs and proposed rebate models; 340B program litigation and developments; and state drug pricing legislation.”

Annual report 2026A · The company itself

“For example, the European Union and other countries (including countries in which we operate) have committed to enacting changes to numerous long-standing tax principles impacting how large multinational enterprises are taxed. In particular, the Organization for Economic Co-operation and Development’s Pillar Two initiative introduces a 15% global minimum tax applied on a country-by-country basis which many jurisdictions have enacted or committed to enact.”

Annual report 2026A · The company itself

“Government Regulation” and “Item 1A - Risk Factors” in Part I of this Annual Report, our industry is highly regulated and is subject to risks and uncertainty caused by the volume and speed of changes to regulatory policies. Changes in regulatory posture and law may result in significant changes in healthcare policy, government funding of healthcare costs, and other laws affecting our operations, but the ultimate outcomes are difficult to predict.”

Annual report 2026A · The company itself

“However, due to the U.S. FDA’s manufacturing requirements and those of other regulatory authorities, we may not be able to quickly establish additional or replacement sources for certain components or materials if we experience a sudden or unexpected reduction or interruption in supply and are unable to develop alternative sources.”

Annual report 2026A · The company itself

“To varying degrees, each of these agencies requires us to comply with laws and regulations governing the development, testing, manufacturing, labeling, marketing and distribution of our products, including with respect to product safety and quality, marketing and promotional practices, reimbursement and healthcare fraud and abuse, data privacy, and competition and antitrust compliance.”

Annual report 2026A · The company itself

“Our failure to comply with laws and regulations relating to reimbursement of healthcare goods and services, or changes to such laws, coverage policies, and payment practices, may subject us to penalties and adversely impact demand, our reputation, business, results of operations, financial condition, and cash flows.”

Annual report 2026A · The company itself

“Coverage decisions, utilization management programs (e.g., prior authorization), and variability in payment policies may affect physician adoption, hospital purchasing decisions, procedure volumes, and patient access, even where reimbursement is available. Additionally, differences in coverage, payment rates, or site of service incentives across payors or geographies may result in uneven or delayed adoption of our devices, products, and therapies.”

Annual report 2026A · The company itself

“Our devices, products, and therapies are subject to regulation regarding quality and cost by HHS, including the Centers for Medicare & Medicaid Services (CMS), as well as comparable state and non-U.S. agencies responsible for reimbursement and regulation of health care goods and services, including laws and regulations related to fair competition, kickbacks, false claims, self-referrals and healthcare fraud. Many states have similar laws that apply to reimbursement by state Medicaid and other funded programs as well as in some cases to all payors.”

Annual report 2026A · The company itself

“We also are subject to risks relating to changes in government and private medical reimbursement programs and policies, and changes in legal and regulatory requirements in the U.S. and around the world. Implementation of further legislative or administrative reforms to these reimbursement systems, or adverse decisions relating to coverage of or reimbursement for our products by administrators of these systems, 18 Table of Contents could delay or reduce adoption, limit utilization, or otherwise have an impact on the acceptance of and demand for our products and the prices that our customers are willing to pay for them.”

Annual report 2026A · The company itself

“Most of our customers, and the healthcare providers to whom our customers supply medical devices, rely on third-party payors, including government programs and private health insurance plans, to reimburse some or all of the cost of the procedures in which medical devices are used. The continuing efforts of governmental authorities, insurance companies and other payors of healthcare costs to contain or reduce these costs could lead to patients being unable to obtain approval for coverage and payment from these third-party payors.”

Annual report 2026A · The company itself

“Additionally, government and private payors in the U.S. are increasingly using utilization management programs, particularly prior authorization, which creates administrative burden, reimbursement uncertainty for providers, and patient access delays, leakage, or barriers.”

Annual report 2026A · The company itself

“Government Regulation We are subject to a variety of laws and regulations in the United States and abroad that involve matters central to our business, many of which are still evolving and being tested in courts, and could be interpreted in ways that could harm our business. These laws and regulations involve matters including privacy, data use, data combination, data protection and personal information, the provision of our services to younger users, biometrics, encryption, rights of publicity, content, integrity, intellectual property, advertising, marketing, distribution, data security, data retention and deletion, data localization and storage, data disclosure, AI and machine learning, electronic contracts and other communications, competition, protection of minors, consumer protection, civil rights, accessibility, telecommunications, product liability, medical devices, e-commerce, taxation, economic or other trade controls including sanctions, export controls, anti-corruption and political law compliance, securities law compliance, and online payment services.”

Annual report 2025A · The company itself