Item 1C. CYBERSECURITY

Risk Management and Strategy

We are subject to cybersecurity incidents and information theft risks in our operations, which we seek to manage through

cybersecurity and information security programs, training and insurance coverage. To strengthen our security and cybersecurity

defenses, we maintain a defensive approach to cybersecurity and information security designed to defend our systems against

misuse, intrusions and cyberattacks and to protect the data we collect. We maintain continuous security monitoring and threat

detection capabilities, including centralized logging and alerting, intended to support the timely identification and triage of

cybersecurity events. Our processes to assess, identify and manage material risks from cybersecurity threats are strategically

integrated into our overall risk management framework, as evidenced by annual risk assessments and required trainings across

business lines and applications. Our information security program maintains procedures and controls for the systems,

applications and our data and data of our third-party providers. We also maintain processes intended to identify, assess and

prioritize vulnerability remediation, including regular scanning of our environment.

We have an established cybersecurity training program which is administered through online learning modules and is required

for all employees at least annually. Such trainings cover topics such as password protection, phishing, the protection of

confidential information and asset security, among others and educate employees on mechanisms in place to report

cybersecurity incidents or suspicions of cybersecurity incidents or threats. Further, we maintain a cybersecurity incident

response plan, which is managed by our Chief Information Security Officer (CISO) and is reviewed and tested annually. The

incident response process is overseen by a security operations and cybersecurity incident response team comprised of members

across the organization, including global management and IT operations and leverages an organizational-wide platform that

allows us to track, manage and resolve information security risks across the organization. We conduct periodic exercises,

including tabletop simulations, to evaluate readiness and drive continuous improvement.

Our information security program is designed to generally align with recommended practices in security standards issued by the

International Organization for Standardization (ISO), American Institute of Certified Public Accountants (AICPA, SSAE18),

National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security

Standard (PCI DSS) and other industry sources. Specifically, we strive to maintain ISO certifications (U.K.), SOC 1 and 2 Type

2 reports and PCI DSS reports on compliance to adhere to industry standard practices.

Our newly acquired businesses operate with independent cybersecurity programs and processes, which may vary in scope and

complexity compared to our overarching cybersecurity framework, until they are fully integrated into our unified system, and

during this integration period we seek to establish baseline security requirements and reporting expectations appropriate to the

risk profile of the acquired business.

As part of our overall risk mitigation strategy, we also maintain cybersecurity insurance coverage; however, such insurance may

not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other cybersecurity

incidents.

We have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have

materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial

condition. However, we have been the target of cyber-attacks and expect them to continue as cybersecurity threats have been

rapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from

cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that

we will not experience such an incident in the future. For more information on the risks from cybersecurity threats and incidents

that we face, refer to Part I, “Item 1A. Risk Factors.”

Use of Third Parties

To regularly assess whether our cybersecurity strategies and processes remain appropriate to prevent, investigate and address

cybersecurity-related issues, we engage with information security and forensics firms with specialized industry knowledge. Our

collaboration with these third parties includes the administration of third-party security questionnaires, risk assessments and

testing and consultation on security enhancements to attempt to mitigate threats. We also collaborate with third parties,

regulators and law enforcement, when appropriate, to resolve security incidents and assist in efforts to prevent unauthorized

access to our processing systems.

In order to oversee and identify risks from cybersecurity threats and incidents associated with our use of third-party service

providers, we maintain a risk management program designed to help protect against the misuse of information technology. In

addition to risk assessments and questionnaires obtained upon selection of a new service provider, we also perform annual

third-party risk assessments to ensure these service providers continue to meet contractual obligations for cybersecurity,

regulatory and industry requirements. We generally seek to include appropriate information security requirements in

agreements with certain third-party service providers, including, where appropriate based on risk, incident notification

obligations and rights to assess or validate the provider’s security controls.

Governance

Board of Directors Oversight

The Information Technology and Security Committee (ITSC) is responsible for providing oversight and leadership for our

information technology security and cybersecurity planning processes, policies and objectives. The ITSC is composed of board

members with both industry knowledge as well as expertise in technology and security, finance and risk management. The

primary purpose of the committee is to review, assess and make recommendations regarding the long-term strategy for global

information security and the evolution of our technology in a competitive environment. The ITSC receives cybersecurity

updates in connection with its regularly scheduled meetings and more frequent briefings as needed regarding significant

developments, including notable incidents and the status of key risk management initiatives.

To accomplish this purpose, the information technology and security committee has four primary responsibilities:

• to understand the security controls and assessments conducted on major card platforms and concur that such controls

are comparable to industry best practices and standards as appropriate;

• to assess technology modernization plans and processing platform strategies to validate proper investment in multi-

year initiatives that maintain effective and efficient use of Company resources;

• to review progress on significant IT projects against milestones and quality indicators and evaluate actions intended to

drive quality and timeliness; and

• to evaluate the prioritization of strategies for intellectual property protection.

Management's Role

The Board and the information technology and security committee directed the formation of a cross-functional cybersecurity

council and receive regular cybersecurity reports from the Company's Chief Information Officer (CIO) and the CISO, among

others. These reports include updates on our cybersecurity strategy and execution of its processes, including updates on

procedures to prepare for, prevent, detect, respond to and recover from (as applicable) cybersecurity incidents. Such updates

also include updates on our continued compliance with regulatory requirements. Our information security and risk management

program is periodically evaluated by third-party specialists, and the results of those reviews are reported to the Board.

Our CISO, who reports directly to our CIO, has served in various roles in information technology and information security for

over 20 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information

systems and business resiliency. He is a Certified Information Systems Security Professional and Certified Information Systems

Auditor.

Our CISO manages our information security and oversees our data security personnel and our incident response and business

continuity management programs to assess and manage the cybersecurity element of our risk management program, including

policies, cybersecurity training, security operations and engineering, cybersecurity threat detection and incident response. Our

CISO informs and updates the Board about any information security incidents that may pose a significant risk to us.