Item 1. BUSINESS

OVERVIEW

Equifax Inc. is a leading global provider of information solutions and human resources business process outsourcing services for businesses, governments and consumers. We have a large and diversified group of clients, including financial institutions, corporations, governments and individuals. Our services are based on comprehensive databases of consumer and business information derived from numerous sources including credit, financial assets, telecommunications and utility payments, employment, income, demographic and marketing data. We use advanced statistical techniques and proprietary software tools to analyze all available data, creating customized insights, decision-making solutions and processing services for our clients. We help consumers understand, manage and protect their personal information and make more informed financial decisions. We also provide information, technology and services to support debt collections and recovery management. Additionally, we are a leading provider of payroll-related and human resource management business process outsourcing services in the United States of America, or U.S.

We currently operate in four global regions: North America (U.S. and Canada), Asia Pacific (Australia and New Zealand), Europe (the United Kingdom, or U.K., Spain and Portugal) and Latin America (Argentina, Chile, Costa Rica, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay). We maintain support operations in the Republic of Ireland. We also offer Equifax branded credit services in Russia and India through joint ventures, have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and Dubai, and have an investment in a consumer and commercial credit information company in Brazil.

Equifax was originally incorporated under the laws of the State of Georgia in 1913, and its predecessor company dates back to 1899. As used herein, the terms Equifax, the Company, we, our and us refer to Equifax Inc., a Georgia corporation, and its consolidated subsidiaries as a combined entity, except where it is clear that the terms mean only Equifax Inc.

We are organized and report our business results in four operating segments, as follows:

•	U.S. Information Solutions (USIS) — provides consumer and commercial information solutions to businesses in the U.S. including online information, decisioning technology solutions, fraud and identity management services, portfolio management services, mortgage reporting and financial marketing services.

•	International —which includes our Asia Pacific, Europe, Canada and Latin America business units, provides products and services similar to those available in the USIS operating segment but with variations by geographic region. We also provide information, technology and services to support debt collections and recovery management.

•

Workforce Solutions — provides services enabling clients to verify income and employment (Verification Services) as well as to outsource and automate the performance of certain payroll-related and human resource management business processes, including unemployment cost management, tax credits and incentives and I-9 management services and services to allow employers to ensure compliance with the Affordable Care Act (Employer Services).

•	Global Consumer Solutions — provides products to consumers in the United States, Canada, and the U.K., enabling them to understand and monitor their credit and monitor and help protect their identity. We also sell consumer and credit information to resellers who combine our information with other information to provide direct to consumer monitoring, reports and scores.

2017 Cybersecurity Incident

Background. In fiscal 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of certain personally identifiable information of U.S., Canadian and U.K. consumers. Criminals exploited a U.S. website application vulnerability to gain unauthorized access to our network. Based on our forensic investigation, the unauthorized access of information occurred from mid-May through July 2017. The information accessed primarily includes names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. In addition, credit card numbers for approximately 209,000 U.S. and Canadian consumers, and certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers, were accessed. The investigation determined that personal information

of approximately 19,000 Canadian consumers was impacted and approximately 860,000 potentially affected U.K. consumers were contacted regarding access to personal information. The forensic investigation of the cybersecurity incident was, as previously disclosed, completed in the fourth quarter of fiscal 2017. No evidence was found that the Company's core consumer, employment and income, or commercial credit reporting databases were accessed.

The Company acted promptly to notify the approximately 145.5 million U.S. consumers whose personally identifiable information the Company had identified in 2017 as potentially accessed. As a result of an ongoing analysis of data stolen in the 2017 cybersecurity incident, the Company recently announced that it was able to identify approximately 2.4 million U.S. consumers whose name and partial driver’s license information were stolen, but who were not in the affected population of approximately 145.5 million consumers previously identified by the Company in 2017. The Company is in the process of notifying these additional consumers.

As a result of the 2017 cybersecurity incident, we are party to numerous lawsuits and governmental investigations. See Item 1A. Risk Factors and Item 3. Legal Proceedings for more information regarding these lawsuits and investigations. We continue to cooperate with law enforcement in connection with the criminal investigation into the actors responsible for the cybersecurity incident.

Regaining Trust. The Company has taken and continues to take extensive steps designed to prevent this type of incident from happening again and to earn back the trust of consumers, customers and regulators.

Upon discovery of the unauthorized access, we acted immediately to stop the intrusion and promptly engaged a leading, independent cybersecurity firm to conduct a comprehensive forensic investigation to determine the scope of the intrusion, including the specific data potentially impacted. We have continued to analyze the data impacted, including through the use of external data providers, to identify and inform consumers who may have been impacted by this incident.

Following the cybersecurity incident, we began undertaking significant steps to enhance our data security infrastructure. In connection with these efforts, we have incurred significant costs and expect to incur additional significant costs as we take further steps to prevent unauthorized access to our systems and the data we maintain. The actions we have taken are based on our investigation of the causes of the cybersecurity incident, but there will be additional changes needed to prevent a similar incident. We have also enhanced our disclosure controls and procedures and related protocols to specifically provide that cyber incidents are promptly escalated and investigated and reported to senior management, and where appropriate, to the Board of Directors. We also engaged an independent outside consulting firm to help us with both strategic remediation activities and to review our cybersecurity framework, our controls framework and our management and employees' roles and responsibilities.

In the third and fourth quarters of 2017, our Board made strategic changes to our executive leadership team and added an independent director to our Board with highly-relevant skills in data security. Our Board also formed a Special Committee to conduct an independent review of the cybersecurity incident, the Company’s response to it and all relevant policies and practices. The Special Committee's investigation was undertaken with the assistance of outside professionals engaged by the Special Committee.

The Company has also taken action to provide consumers with new tools to protect credit data. Immediately following the announcement of the breach, the Company devoted substantial resources to consumer notifications and launched and continuously enhanced multi-faceted consumer resources, including making its TrustedID Premier service, an identity theft protection and credit file monitoring product, available for free to all U.S. consumers for 12 months for those who signed up by January 31, 2018. Similarly, for consumers impacted by the cybersecurity incident in Canada and the U.K., we are providing free credit reports and scores, credit monitoring and identity theft protection for 12 months for those consumers who signed up by January 31, 2018. As part of our commitment to providing long-term resources and protections for consumers, in January 2018, the Company introduced Lock & AlertTM, a new service that allows U.S. consumers to quickly lock and unlock their Equifax credit report for free, for life. We believe this is a meaningful step toward fulfilling our commitment to give consumers the power to protect and control access to personal credit data.

OUR BUSINESS STRATEGY

Data is at the core of our value proposition and the protection and safeguarding of that information is paramount. Our strategic objective is to be the global leader in information solutions that creates unparalleled insights to solve customer challenges. Leveraging our extensive resources, we deliver differentiated decisions through a broad and diverse set of data assets, sophisticated analytics and proprietary decisioning technology. Our long-term corporate strategy is driven by the following imperatives:

•

Serve as a trusted steward and advocate for consumers and our customers. This includes protecting and safeguarding the information we have using advanced data security tools, techniques and processes in order to protect consumer specific information from fraudulent access. We also strive to continuously improve the consumer and customer experience in our consumer and commercial offerings, anticipating and executing on regulatory initiatives, while simultaneously delivering industry leading security for our services.

•	Deliver consistently strong profitable growth and shareholder returns. We seek to enhance shareholder value through disciplined execution of our strategic initiatives and by positioning ourselves as a premier and trusted provider of high value information solutions.

•

Develop unparalleled analytical insights leveraging Equifax unique data. We continue to invest in and acquire unique sources of credit and non-credit information to enhance the variety and quality of our services while increasing clients’ confidence in information-based business decisions. Areas of focus for investment in new sources of data include, among others, positive payment data, fraud and personal identification data, real estate data and new commercial business data. We also have developed unique capabilities to integrate customer and third-party data into our solution offerings to further enhance the decisioning solutions we develop for our customers.

We continue to invest in and develop new technology to enhance the security, functionality and cost-effectiveness of the services we offer and further differentiate our products from those offered by our competitors. In addition to custom products for large clients, we develop software as a service based, decisioning and data access technology platforms that are cost effective for clients of all sizes. We also develop predictive scores and analytics, some of which leverage multiple data assets, to help clients acquire new customers and manage their existing customer relationships. We develop a broad array of industry, risk management, cross-sell and account acquisition models to enhance the precision of our clients’ decisioning activities. We also develop custom and generic solutions that enable customers to effectively manage their debt collection and recovery portfolios.

•

Innovate for market leadership in key domains and verticals. We seek to increase our share of clients’ spend on information-related services through developing and introducing new products, pricing our services in accordance with the value they represent to our customers, increasing the range of current services utilized by our clients, and improving the quality and effectiveness of our sales organization and client support interactions with consumers. We are also helping clients address increased requirements to comply with emerging regulations and rules.

We believe there are many opportunities to expand into emerging markets both in the U.S. and internationally. In the U.S., we have increased and broadened resources in key markets, including financial, mortgage, auto, insurance, telecommunications, healthcare and government, and we are delivering services ranging from identity authentication to risk management. We continue to invest in growing our ventures in Russia and India and leveraging our newer product offerings across all of our geographical business units and periodically enter new country markets through acquisitions or start-up operations.

•	Invest in talent to drive our strategy and foster a culture of innovation. We attract top talent by continuing to expand and diversify our talent pipeline. We regularly undertake various talent initiatives to engage, develop, and retain our top talent.

MARKETS AND CLIENTS

Our products and services serve clients across a wide range of verticals, including financial services, mortgage, employers, consumer, commercial, telecommunications, retail, automotive, utilities, brokerage, healthcare and insurance industries, as well as state and federal governments. We also serve consumers directly. Our revenue stream is highly diversified with our largest client providing less than 3% of total revenue. The following table summarizes the various end-user markets we serve:

(1)	Predominantly sold to companies who serve the direct to consumer market and includes other small end user markets.

(2)	Other includes revenue from other miscellaneous end-user markets.

We market our products and services primarily through our own direct sales organization that is structured around sales teams that focus on client segments typically aligned by vertical markets and geography. Sales groups are based in our headquarters in Atlanta, Georgia, and field offices located in the U.S. and in the countries where we have operations. We also market our products and services through indirect channels, including alliance partners, joint ventures and other resellers. In addition, we sell through direct mail and the internet.

Our largest geographic market segments are the U.S.; Asia Pacific (Australia and New Zealand); Europe (the U.K., Spain and Portugal); Canada; and Latin America (Argentina, Chile, Costa Rica, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay). We maintain support operations in the Republic of Ireland. We also offer Equifax branded credit services in Russia and India through joint ventures, have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and Dubai, and have an investment in a consumer and commercial credit information company in Brazil. We also provide information, technology and services to support debt collections and recovery management in Asia Pacific, Europe, Canada and Latin America.

Revenue from international clients, including end users and resellers, amounted to 29% of our total revenue in 2017, 27% of our total revenue in 2016 and 23% of our total revenue in 2015.

PRODUCTS AND SERVICES

Our products and services help our clients make more informed decisions with higher levels of confidence by leveraging a broad array of data assets. Analytics are used to derive insights from the data that are most relevant for the client’s decisioning needs. The data and insights are then processed through proprietary software and transmitted to the client’s operating system to execute the decision.

The following chart summarizes the key products and services offered by each of the business units within our segments:

	USIS						International								Workforce Solutions
	Online Information Solutions		Financial Marketing Services		Mortgage Services		Europe		Asia Pacific		Latin America		Canada		Verification Services		Employer Services		Global Consumer Solutions
Online data	X				X		X		X		X		X		X				X
Portfolio management services	X		X		X		X		X		X		X		X
Analytical services	X		X		X		X		X		X		X		X		X		X
Technology services	X				X		X		X		X		X
Identity management and fraud	X						X		X		X		X		X				X
Marketing Services			X		X				X		X		X
Direct to consumer credit monitoring									X										X
Employment and income verification services									X						X
Business process outsourcing (BPO)									X						X		X
Debt collection software, services and analytics							X		X		X		X

Each of our operating segments is described more fully below. For the operating revenue, operating income and total assets for each segment see Note 13 of the Notes to the Consolidated Financial Statements in this report.

USIS

USIS provides consumer and commercial information solutions to businesses in the U.S. through three product and service lines, as follows:

Online Information Solutions. Online Information Solutions’ products are derived from multiple large and comprehensive databases of consumer and commercial information that we maintain about individual consumers and businesses, including credit history, current credit status, payment history and address information. Our clients utilize the information and analytical insights we provide to make decisions for a broad range of financial and business purposes, such as whether, and on what terms, to approve auto loans or credit card applications, and whether to allow a consumer or a business to open a new utility or telephone account. In addition, this information is used by our clients for cross selling additional products to existing customers, improving their underwriting and risk management decisions, and authenticating and verifying consumer and business identities. We also sell consumer and credit information to resellers who combine our information with other information to provide services to the financial, mortgage, fraud and identity management, and other end-user markets. Our software platforms and analytical capabilities can integrate all types of information, including third-party and client information, to enhance the insights and decisioning process to help further mitigate the risk of granting credit, predict the risk of bankruptcy, indicate the applicant’s risk potential for account delinquency, ensure the identity of the consumer, and reduce exposure to fraud. These risk management services enable our clients to monitor risks and opportunities and proactively manage their portfolios.

Online Information Solutions’ clients access products through a full range of electronic distribution mechanisms, including direct real-time access, which facilitates instant decisions. We also develop and host customized applications that enhance the decision-making process for our clients. These decisioning technology applications assist with a wide variety of decisioning activities, including determining pre-approved offers, cross-selling of various products, determining deposit amounts for telephone and utility companies, and verifying the identity of their customers. We have also compiled commercial databases regarding businesses in the U.S., which include loan, credit card, public records and leasing history data, trade accounts receivable performance, and Secretary of State and Securities and Exchange Commission registration information. We offer scoring and analytical services that provide additional information to help mitigate the credit risk assumed by our clients.

Mortgage Solutions. Our Mortgage Solutions products, offered in the U.S., consist of specialized credit reports that combine information from the three major consumer credit reporting agencies (Equifax, Experian Group and TransUnion) into a single “merged” credit report in an online format, commonly referred to as a tri-merge report. Mortgage lenders use these tri-merge reports in making their mortgage underwriting decisions. Additionally, we offer various “triggering” services designed to alert lenders to changes in a consumer’s credit status during the underwriting period and securitized portfolio risk assessment services for evaluating inherent portfolio risk.

Financial Marketing Services. Our Financial Marketing Services products utilize consumer and commercial financial information enabling our clients to more effectively manage their marketing efforts, including targeting and segmentation, to identify and acquire new clients for their products and services; to develop portfolio strategies to minimize risk and maximize

profitability; and to realize additional revenue from existing customers through more effective cross selling and upselling of additional products and services. These products utilize information derived from consumer and commercial information, including credit, income, asset, liquidity, net worth and spending activity, which also support many of our Online Information Solutions’ products. These data assets broaden the understanding of consumer and business financial potential and opportunity which can further drive high value decisioning and targeting solutions for our clients. We also provide account review services, which assist our clients in managing their existing customers and prescreen services that help our clients identify new opportunities with their customers. Clients for these products primarily include institutions in the banking, brokerage, retail, insurance and mortgage industries as well as companies primarily focused on digital and interactive marketing.

International

The International operating segment includes our Asia Pacific, Europe, Latin America and Canada business units. These business units offer products that are similar to those available in the USIS operating segment, although, in some jurisdictions, data sources tend to rely more heavily on government agencies than in the U.S. We also offer specialized services that help our customers better manage risk in their consumer portfolios. This operating segment’s products and services generate revenue in Argentina, Australia, Canada, Chile, Costa Rica, Ecuador, El Salvador, Honduras, Mexico, New Zealand, Paraguay, Peru, Portugal, Spain, the U.K. and Uruguay. We also maintain support operations in the Republic of Ireland, Chile and Costa Rica. We offer consumer credit services in Russia and India through investments in joint ventures, have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and Dubai, and have an investment in the second largest consumer and commercial credit information company in Brazil. We also provide information, technology and services to support debt collections and recovery management in Asia Pacific, Europe, Canada and Latin America.

Europe. Our European operation provides information solutions, marketing and personal solutions products. Information solutions and personal solutions products are generated from information that we maintain and include credit reporting and scoring, asset information, risk management, identity management and authentication services, fraud detection and modeling services. Most of these products are sold in the U.K. with a more limited set of information solutions products sold in Portugal and Spain. Our commercial products, such as business credit reporting and commercial risk management services, are available mostly in the U.K, with a more limited set of information solutions products sold in Portugal and Spain. Marketing products, which are similar to those offered in our Financial Marketing Services business unit, are primarily available in the U.K. and, to a lesser extent, in Spain. We also provide information, technology and services to support debt collections and recovery management.

Asia Pacific. Our Asia Pacific operation provides consumer and commercial information solutions products, marketing products and personal solutions products. We offer a full range of products, generated from credit records, including credit reporting and scoring, decisioning technology, risk management, identity management, authentication and fraud detection services. Our consumer and commercial products are the primary source of revenue in each of the countries in which we operate and include credit reporting, decisioning tools and risk management services. We also provide information, technology and services to support debt collections and recovery management. Additionally, we provide a variety of consumer and commercial marketing products generated from credit information databases, including business profile analysis, business prospect lists and database management. The countries in which we operate include Australia and New Zealand, as well as through joint ventures in Cambodia, Malaysia, Singapore and Dubai.

Latin America. Our Latin American operation provides consumer and commercial information solutions products, marketing products and personal solutions products. We offer a full range of products, generated from credit records that we maintain, including credit reporting and scoring, decisioning technology, risk management, identity management, authentication and fraud detection services. Our consumer products are the primary source of revenue in each of the countries in this region in which we operate. We also offer various commercial products, which include credit reporting, decisioning tools and risk management services, in the countries we serve. We also provide information, technology and services to support debt collections and recovery management. Additionally, we provide a variety of consumer and commercial marketing products generated from our credit information databases, including business profile analysis, business prospect lists and database management. The countries in this region in which we operate include Argentina, Chile, Costa Rica, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay.

Canada. Similar to Online Information Solutions, Mortgage Solutions and Financial Marketing Services business units, Canada offers products derived from the credit information that we maintain about individual consumers and businesses. We offer many products in Canada, including credit reporting and scoring, consumer and commercial marketing, risk management, fraud detection and modeling services, identity management and authentication services, together with certain of

our decisioning products that facilitate pre-approved offers of credit and automate a variety of credit decisions. We also provide information, technology and services to support debt collections and recovery management in Canada.

Workforce Solutions

Workforce Solutions operates in the U.S. through two business units:

Verification Services. Verification Services include employment and income verification services. Our online verification services enable direct third-party verifiers including various governmental agencies, mortgage originators, credit card and automotive lenders and pre-employment screeners to verify the employee’s employment status and income information. We also offer an offline research verification service, which expands employment verification to locate data outside our existing automated database.

Employer Services. These services are aimed at reducing the cost to the human resources function of businesses through a broad suite of services including assisting with employment tax matters designed to reduce the cost of unemployment claims through effective claims representation and management and efficient processing and to better manage the tax rate that employers are assessed for unemployment taxes; comprehensive services designed to research the availability of employment-related tax credits (e.g., the federal work opportunity and welfare to work tax credits and state tax credits), and to process the necessary filings and assist the client in obtaining the tax credit; W-2 management services (which include initial distribution, reissue and correction of W-2 forms); paperless pay services that enable employees to electronically receive pay statement information as well as review and change direct deposit account or W-4 information; integrated electronic time capture and reporting services; paperless new-hire services to bring new workers on board using electronic forms; I-9 management services designed to help clients electronically comply with the immigration laws that require employers to complete an I-9 form for each new hire; and onboarding services using online forms to complete the new hire process for employees of corporate and government agencies. In addition we provide software and services to employers to assist in compliance with the Affordable Care Act ("ACA") through partnerships with government agencies.

The Work Number. The Work Number is our key repository of employment and income data serving our verifier business and enabling employer human resource services. We rely on payroll data received from over 10,600 organizations to regularly update the database. The updates occur as employers transmit data electronically to Equifax from their payroll systems. Employers contract to provide this data for specified periods under the terms of contracts which range from one to five years. We use this data to provide automated employment and income verification services to third-party verifiers as well as enabling employer services such as unemployment claims, I-9 and eVerify transactions and employer tax credits opportunities.

The fees we charge for these services are generally on a per transaction basis. We have not experienced significant turnover in the employer contributors to the database because we generally do not charge them to add their employment data to the database and the verification service we offer relieves them of the administrative burden and expense of responding to third-party employment verification requests. The database is approaching 330 million current and historic employment records at December 31, 2017.

Global Consumer Solutions

Our Global Consumer Solutions ("GCS") products give consumers information to enable them to understand and monitor their credit and monitor and help protect their identity primarily through our Equifax Complete, ID Patrol, Credit Watch and Score Watch monitoring products. Consumers can obtain credit file information about them and Equifax or FICO credit scores. Equifax products also offer monitoring features for consumers who are concerned about identity theft and data breaches, including credit report monitoring from all three bureaus, internet and bank account monitoring, lost wallet support, and the ability to lock and unlock the Equifax credit file. Our products are available to consumers in the U.S., Canada, and the U.K. directly primarily over the internet and indirectly through relationships with business partners who distribute our products or provide these services to their employees or customers. We also sell consumer and credit information to resellers who combine our information with other information to provide direct to consumer monitoring, reports and scores. Due to the 2017 cybersecurity incident, we have ceased advertising for new business as it relates to our U.S. consumer direct business and have now provided free services as discussed below.

Free Consumer Services

As part of our response to the cybersecurity incident announced in September 2017, we began offering in the U.S. our TrustedID Premier service, an identity theft protection and credit file monitoring product, for free to all consumers who signed up through January 31, 2018. Additionally, in January 2018, the Company introduced in the U.S., Lock & AlertTM, a new

service that allows customers to quickly lock and unlock their Equifax credit report for free, for life. Equifax also will provide the ability for U.S. consumers to freeze and unfreeze their Equifax credit file for free through June 30, 2018. We provide U.S. consumers with a free annual credit report in accordance with the FACT Act. For consumers impacted by the cybersecurity incident in Canada and the U.K., we are providing free credit reports and scores, credit monitoring and identity theft protection for 12 months for those consumers who signed up by January 31, 2018.

Seasonality

We experience seasonality in certain of our revenue streams. Revenue generated by the online consumer information services component of our USIS operating segment is typically the lowest during the first quarter, when consumer lending activity is at a seasonal low. Revenue generated from the Employer Services business unit within the Workforce Solutions operating segment is generally higher in the first quarter due primarily to the provision of Form W-2 preparation services which occur in the first quarter each year. Revenue generated from our financial wealth asset products and data management services in our Financial Marketing Services business is generally higher in the fourth quarter each year due to the significant portion of our annual renewals and deliveries which occur in the fourth quarter of each year.

COMPETITION

The market for our products and services is highly competitive and is subject to constant change. Our competitors vary widely in size and in the nature of the products and services they offer. Sources of competition are numerous and include the following:

•

Competition for our consumer credit information solutions and personal solutions products varies by both application and industry, but generally includes two global consumer credit reporting companies, Experian and TransUnion, both of which offer a product suite similar to our credit information solutions. In the U.S., LifeLock is a national provider of personal identity theft protection service. Also, there are emerging competitors offering free credit scores including Credit Karma in the U.S. as well as CallCredit and ClearScore in the U.K. There are also a large number of competitors who offer competing products in specialized areas (such as fraud prevention, risk management and application processing and decisioning solutions) and software companies offering credit modeling services or analytical tools. Our differentiators include our unique data assets, decisioning technology and the features and functionality of our analytical capabilities. Our competitive strategy is to emphasize improved decision making and product quality while remaining competitive on price. Our marketing services products also compete with the foregoing companies and others who offer demographic information products, including Acxiom, Harte-Hanks and infoGROUP. We also compete with Fair Isaac Corporation with respect to certain of our analytical tools and solutions.

•	Competition for our commercial solutions products primarily includes Experian, Dun & Bradstreet and Cortera, and providers of these services in the international markets we serve.

•

Competition for our employment and income verification services includes large employers who serve their own needs through in-house systems to manage verification as well as regional online verification companies, such as Verify Jobs and First Advantage, who offer verification services along with other human resources ("HR") and tax services. Competition in the Verification Services market includes employers who manage verifications in-house, lenders who obtain verifications directly from employers, and online and offline verification companies, such as Verify Job System, Corporate Cost Control, Thomas & Thorngren and Employers Edge. Competition in the Employer Services market is diverse and includes in-house management of such services or the outsourcing of one or more of such services to HR consulting firms such as Mercer and Towers Watson, HR management services providers such as Oracle and Silk Road, payroll processors such as ADP and Ceridian, accounting firms such as PricewaterhouseCoopers and Ernst & Young, analytics companies such as Tableau and Visier and hundreds of smaller companies that provide one or multiple offerings that compete with our Employer Services business.

•

Competition for our debt collection and recovery management software, services and analytics is similar to the competition for our consumer credit information solutions. We believe that the breadth and depth of our data assets enable our clients to develop a more current and comprehensive view of consumers. In the category of platforms and analytics, we compete to some extent with entities that deploy collections platforms, account management systems or recovery solutions.

While we believe that none of our competitors offers the same mix of products and services as we do, certain competitors may have a larger share of particular geographic or product markets or operate in geographic areas where we do not currently have a presence.

We assess the principal competitive factors affecting our markets to include: our ability to protect information; product attributes such as quality, depth, coverage, adaptability, scalability, interoperability, functionality and ease of use; product price; technical performance; access to unique proprietary databases; availability in application service provider, or ASP, format; quickness of response, flexibility and client services and support; effectiveness of sales and marketing efforts; existing market penetration; and new product innovation.

TECHNOLOGY AND INTELLECTUAL PROPERTY

We generally seek protection under federal, state and foreign laws for strategic or financially important intellectual property developed in connection with our business. Certain intellectual property, where appropriate, is protected by registration under applicable trademark laws or by prosecution of patent applications. We own a number of patents registered in the U.S. and several in foreign countries. We also have certain registered trademarks, service marks, logos and internet domain names in the U.S. and in many foreign countries, the most important of which are “Equifax,” “Decision360,” “The Work Number” and variations thereof. These marks are used in connection with many of our product lines and services. We believe that, in the aggregate, the rights under our patents and trademarks are generally important to our operations and competitive position, but we do not regard any of our businesses as being dependent upon any single patent or group of patents or trademark. However, certain Company trademarks, which contribute to our identity and the recognition of our products and services, including but not limited to the “Equifax” trademark, are an integral part of our business, and their loss could have a significant negative impact on us. We also protect certain of our confidential intellectual property and technology in compliance with trade secret laws and through the use of nondisclosure agreements.

We license other companies to use certain data, software, and other technology and intellectual property rights we own or control, primarily as core components of our products and services, on terms that are consistent with customary industry standards and that are designed to protect our interest in our intellectual property. Other companies license us to use certain data, technology and other intellectual property rights they own or control. For example, we license credit-scoring algorithms and the right to sell credit scores derived from those algorithms from third parties for a fee. We do not hold any franchises or concessions that are material to our business or results of operations.

GOVERNMENTAL REGULATION

We are subject to a number of U.S. federal, state, local and foreign laws and regulations that involve matters central to our business. These laws and regulations may involve privacy, data protection, intellectual property, competition, consumer protection, anti-corruption, anti-bribery, anti-money laundering, employment, health, taxation or other subjects. In particular, we are subject to U.S. federal, state, local and foreign laws regarding the collection, protection, dissemination and use of non-public personal information we have in our possession. Failure to satisfy those legal and regulatory requirements, or the adoption of new laws or regulations, could have a significant negative impact on our results of operations, financial condition or liquidity.

U.S. federal, state, local and foreign laws and regulations are evolving and can be subject to significant change. In addition, the application and interpretation of these laws and regulations are often uncertain. These laws are enforced by federal, state and local regulatory agencies in the jurisdictions where we operate, and in some instances also through private civil litigation. There are also a number of legislative proposals pending before the U.S. Congress, various state legislative bodies, and foreign governments concerning consumer and data protection that could affect us.

Summary of U.S. Regulation Relating to Consumer and Data Protection

Our U.S. operations are subject to numerous laws and regulations governing the collection, protection and use of consumer credit and other information, and imposing sanctions for the misuse of such information or unauthorized access to data. Many of these provisions also affect our customers’ use of consumer credit or other data we furnish.

Examples of the most significant of these laws include, but are not limited to, the following:

Federal Laws and Regulation

•

FCRA - The Fair Credit Reporting Act (“FCRA”) regulates consumer reporting agencies, including us, as well as data furnishers and users of consumer reports such as banks and other companies. FCRA provisions govern the accuracy, fairness and privacy of information in the files of consumer reporting agencies (“CRAs”) that engage in the practice of assembling or evaluating certain information relating to consumers for certain specified purposes. The FCRA limits the type of information that may be reported by CRAs, limits the distribution and use of consumer reports and establishes consumer rights to access and dispute their credit files. CRAs are required to follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates and if a consumer disputes the accuracy of any information in the consumer’s file, to conduct a reasonable reinvestigation. CRAs are required to make available to consumers a free annual credit report. The FCRA imposes many other requirements on CRAs, data furnishers and users of consumer report information. Violation of the FCRA can result in civil and criminal penalties. The FCRA contains an attorney fee shifting provision to provide an incentive for consumers to bring individual or class action lawsuits against a CRA for violations of the FCRA. Regulatory enforcement of the FCRA is under the purview of the United States Federal Trade Commission (“FTC”), the Consumer Financial Protection Bureau (“CFPB”), and state attorneys general, acting alone or in concert with one another.

•

The Dodd-Frank Act - One of the purposes of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) is to protect consumers from abusive financial services practices. Title X of the Dodd-Frank Act created the CFPB. The Dodd-Frank Act provides the CFPB with examination and supervisory authority over CRAs, including us. The Dodd-Frank Act also prohibits unfair, deceptive or abusive acts or practices (“UDAAP”) with respect to consumer finance and provides the CFPB with authority to enforce those provisions. The CFPB may pursue administrative proceedings or litigation to enforce the laws and rules subject to its jurisdiction. In these proceedings the CFPB can obtain cease and desist orders, which can include orders for restitution to consumers or rescission of contracts, as well as other types of affirmative relief, and monetary penalties ranging from $5,000 per day for ordinary violations and up to $1 million per day for knowing violations. Also, the Dodd-Frank Act empowers state attorneys general and state regulators to bring civil actions in certain circumstances for the kind of cease and desist orders available to the CFPB (but not for civil penalties).

•

FTC Act - The Federal Trade Commission Act (“FTC Act”) prohibits unfair methods of competition and unfair or deceptive acts or practices. Under the FTC Act, the Federal Trade Commission's oversight includes the security measures we employ to safeguard the personal data of consumers and failure to safeguard data adequately may subject us to regulatory scrutiny or enforcement action. There is no private right of action under the FTC Act.

•

GLBA - The Financial Services Modernization Act of 1999, or Gramm-Leach-Bliley Act (“GLBA”) regulates, among other things, the use of non-public personal information of consumers that is held by financial institutions, including us. We are subject to various GLBA provisions, including rules relating to the use or disclosure of the underlying data and rules relating to the physical, administrative and technological protection of non-public personal financial information. Breach of the GLBA can result in civil and/or criminal liability and sanctions by regulatory authorities. Regulatory enforcement of the GLBA is under the purview of the FTC, the CFPB, the federal prudential banking regulators, the SEC and state attorneys general, acting alone or in concert with each other.

•

CROA - The Credit Repair Organizations Act (“CROA”) regulates companies that claim to be able to assist consumers in improving their credit standing. There have been efforts to apply the CROA to credit monitoring services offered by consumer reporting agencies and others. CROA allows for a private right of action. Consumers can sue to recover the greater of the amount paid or actual damages, punitive damages, costs, and attorney’s fees for violations of CROA.

State Laws and Regulation Relating to Consumer and Data Protection

•

A number of states have enacted requirements similar to the federal FCRA. Some of these state laws impose additional, or more stringent, requirements than the FCRA, especially in connection with the investigations and responses to reported inaccuracies in consumer reports. The FCRA preempts some of these state laws, but the scope of preemption continues to be defined by the courts. The state of Vermont is grandfathered under the original FCRA requirements and thus we are subject to additional requirements to comply with Vermont law.

•

Most states and the District of Columbia have passed laws that give consumers the right to place a security freeze on their credit reports to prevent others from opening new accounts or obtaining new credit in their name. These laws place differing requirements on credit reporting agencies with respect to how and when to respond to such credit file freeze requests and in the fees, if any, the agencies may charge for freeze-related actions.

•	A majority of states have adopted versions of data security breach laws that require notification of affected consumers and potentially regulators in the event of a breach of personal information. A subset of these laws and other state data security laws require data protection measures as well.

•

We are also subject to federal and state laws that are generally applicable to any U.S. business with national or international operations, such as antitrust laws, the Foreign Corrupt Practices Act, the Americans with Disabilities Act, state unfair or deceptive practices acts and various employment laws. We continuously monitor legislative and regulatory activities that involve credit reporting, data privacy, security and other relevant issues to identify issues in order to remain in compliance with all applicable laws and regulations.

Summary of International Regulation Relating to Consumer and Data Protection

We are subject to various data protection, privacy and consumer credit laws and regulations in the foreign countries where we operate. Examples of the most significant of these laws include, but are not limited to, the following:

•

In the U.K., we are subject to a regulatory framework which provides for primary regulation by the Financial Conduct Authority (the “FCA”). The FCA focuses on consumer protection and market regulation as well as prudential supervision of regulated financial institutions. The FCA has significant powers, including the power to regulate conduct related to the marketing of financial products, to specify minimum standards and to place requirements on products, impose unlimited fines, and to investigate organizations and individuals. In addition, the FCA is able to ban financial products for up to a year while considering an indefinite ban; it has the power to instruct firms to immediately retract or modify promotions which it finds to be misleading, and to publish such decisions. Our core credit reporting (“credit reference”) and debt collections services and recovery management businesses in the U.K. are subject to FCA supervision and we are required to have certain corporate and “approved person” authorizations from the FCA to carry on such businesses. The license application for our collection business (TDX Group or "TDX") was approved in 2016, and the license application for authorization in our capacity as a credit reference agency was approved in 2017. In addition to regulation by the FCA, we are also subject to regulation covering personal data and protection by the U.K. Information Commissioner’s Office. In the U.K., regulatory limitations affect our use of the Electoral Roll, one of our key data sources in that jurisdiction. Generally, the data underlying the products offered by our U.K. Information Services and Global Consumer Solutions product lines, excluding our Commercial Services products, are subject to these regulations.

•

In Europe, we are subject to the European Union (“EU”) Data Protection Regulation ("GDPR"), which will replace the comprehensive 1995 European Union Data Protection Directive. The GDPR maintains the prohibition on the transfer of personal information from the EU to other countries whose laws do not protect personal data to an “adequate” level of privacy or security. The GDPR establishes multiple new requirements that are generally stricter and more comprehensive than those of the U.S. and most other countries where Equifax operates. In Spain and Portugal, privacy laws also regulate all credit bureau and personal solutions activities. The GDPR, among other things, will tighten data protection requirements and make enforcement more rigorous, for example, by streamlining enforcement at a European level, introducing data breach notification requirements and substantially increasing penalties for non-compliance.

•

In Canada, federal and provincial laws govern how we collect, use or disclose personal information in the course of our commercial activities. Federally, the Personal Information Protection and Electronic Documents Act governs the collection, use and disclosure of personal information by organizations in the private sector. It sets out specific obligations with respect to accountability and identifying purposes, consent, collection, use, disclosure, retention, accuracy, safeguards, individual access and compliance. The federal and provincial privacy regulators have powers of investigation and intervention, and provisions of Canadian law regarding civil liability apply in the event of unlawful processing which is prejudicial to the persons concerned. Canada also has specific credit reporting legislation that is regulated at a provincial level. At present, each province has credit reporting legislation, with the exception of New Brunswick and the Territories (Northwest Territories, Yukon, and Nunavut). Generally speaking, the legislation regulates the contents of credit files, the length of time information can be included on a credit file and who can receive credit reports.

•

In Latin America, data protection and credit reporting laws and regulations vary considerably among Latin American countries. Some countries, such as El Salvador, Ecuador and Honduras, establish a constitutional right to privacy without general data protection standards or a data protection authority. These countries, however, have laws that govern the functioning of credit bureaus. In 2017, Ecuador passed a law relating to the collection of credit data and the operation of a credit bureau within the country, which, if implemented, would effectively prohibit us from operating as a credit bureau within Ecuador. The Ecuadorian Superintendent of Banks (ESB) is obligated to set up a public credit data registry within 270 days of January 1, 2018. The ESB may offer services through third parties via a bid process, which may allow continued operation by us within Ecuador, but this is not certain. Other countries, such as Argentina, Uruguay, Peru and Costa Rica, have enacted comprehensive data protection legislation similar to the EU GDPR. The EU recognizes Argentina and Uruguay as having adequate levels of protection for personal data transfers and processing. Peru also has a specific law for credit reporting. Paraguay and Chile have fewer comprehensive data protection laws in place, but do have rules regarding reporting periods, consent and data collection.

•

In Australia, we are subject to regulatory oversight by various agencies. The Office of the Australian Information Commissioner (OAIC) is the agency with direct responsibility for administering the Australian Privacy Principles (which relate to the collection, holding, use and disclosure of personal information) and Part IIIA of the Privacy Act 1988 (which regulates credit reporting). The OAIC can investigate a complaint, conduct its own investigations, resolve/make binding determinations and seek civil penalties. Our credit reporting business, Equifax Information Services and Solutions, is a member of an external dispute resolution scheme, the Credit and Investments Ombudsman, which has been approved by the OAIC to handle privacy and credit reporting complaints and make binding determinations. The OAIC can register codes of practice under the Privacy Act 1988, and has registered the Privacy (Credit Reporting) Code 2014. The Australian Competition and Consumer Commission (ACCC) is the agency responsible for enforcing the Competition and Consumer Act 2010 and related legislation concerning consumer protection and competition. The ACCC has the authority to use a range of actions to ensure compliance with the law, including investigative powers and the ability to seek penalties through litigation and other formal enforcement means. The Australian Retail Credit Association (ARCA) is a credit and credit reporting industry self-regulatory body, which administers principles and standards for the exchange of credit data between industry participants. Equifax Australasia Credit Ratings Pty Limited (Formerly named Corporate Scorecard Pty Limited, one of our Australian subsidiaries), holds an Australia Financial Services License (AFSL), which allows it to provide general advice to wholesale clients by issuing a credit rating, and has been approved by the Reserve Bank of New Zealand as a rating agency under section 86 of the Non-bank Deposit Takers Act 2013. The Australian Securities and Investments Commission (ASIC) regulates that business, and has authority to investigate, prosecute, ban individuals, and to seek civil penalties. In addition, in Australia, draft legislation has been released by the Federal Government, mandating the supply by large banks of comprehensive credit information to credit reporting bodies, including Equifax, and imposing certain disclosure, storage and reporting obligations on the credit reporting bodies. The draft legislation is yet to be finalized or enacted. Equifax will continue to engage with the Federal Government as it concludes its consultation process.

•

In New Zealand, the regulatory framework provides for primary regulation under the Office of the Privacy Commissioner (OPC). The OPC investigates complaints relating to the collection, use, holding and disclosure of personal information, both credit-related and non-credit related. The OPC can make a finding that there has been an interference with privacy but cannot impose civil penalties. In extreme cases where there has been an interference with privacy it can refer these cases to the Director of Human Rights, for determination in the Human Rights Review Tribunal. The OPC can issue practice codes under the Privacy Act 1993, and has issued and subsequently amended, the Credit Reporting Privacy Code 2004. A self-regulatory body, the Retail Credit Association of New Zealand (RCANZ) addresses reciprocity of data issues relating to comprehensive credit reporting, and data standards.

•

In India, various legislation including the Information Technology Act 2000 and Rules framed thereunder and the Credit Information Companies (Regulation) Act of 2005 and Rules and Regulations framed thereunder, establishes a federal data protection framework. Entities that collect and maintain personal data and/or credit information must ensure that it is complete, accurate and safeguarded, and must adopt certain privacy principles with respect to collecting, processing, preserving, sharing and using such data and/or credit information. The Indian parliament has passed legislation that would allow individuals to sue for damages in the case of a data breach, if the entity negligently failed to implement reasonable security practices and procedures to protect personal data and/or credit information. Our Indian joint venture is subject to regulation by the Reserve Bank of India, which is India’s central banking institution.

•	In Russia, credit reporting activities are governed by the Federal Law on Credit Histories No.218-fz, dated December 30, 2004. The law regulates the contents of credit files, who may submit data to a credit bureau and who can receive credit reports. Russia has also enacted a comprehensive data protection law that is similar to Europe's approach.

Tax Management Services

The Tax Management Services business within our Workforce Solutions segment is potentially impacted by changes in renewal or non-renewal of U.S. tax laws or interpretations, for example, those pertaining to work opportunity tax credits and unemployment compensation claims.

PERSONNEL

Equifax employed approximately 10,300 employees in 24 countries as of December 31, 2017. None of our U.S. employees are subject to a collective bargaining agreement and no work stoppages have been experienced. Pursuant to local laws, certain of our employees in Argentina and Spain are covered under government-mandated collective bargaining regulations that govern general salary and compensation matters, basic benefits and hours of work. In some of our non-U.S. subsidiaries, certain of our employees are represented by workers’ councils or statutory labor unions.

FORWARD-LOOKING STATEMENTS

This report contains information that may constitute “forward-looking statements.” Generally, the words “believe,” “expect,” “intend,” “estimate,” “anticipate,” “project,” “will” and similar expressions identify forward-looking statements, which generally are not historical in nature. All statements that address operating performance, events or developments that we expect or anticipate will occur in the future, including statements relating to future operating results and statements related to the cybersecurity incident reported in the third quarter of 2017 and the Tax Cuts and Jobs Act of 2017, are forward-looking statements. Management believes that these forward-looking statements are reasonable as and when made. However, forward-looking statements are subject to certain risks and uncertainties that could cause actual results to differ materially from our Company’s historical experience and our present expectations or projections, including without limitation our expectations regarding the Company’s outlook, long-term organic and inorganic growth, and customer acceptance of our business solutions referenced above under "Business” and below in Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operation — “Business Environment and Company Outlook.” These risks and uncertainties include, but are not limited to, those described below in Item 1A. Risk Factors, and elsewhere in this report and those described from time to time in our future reports filed with the United States Securities and Exchange Commission, or SEC. As a result of such risks and uncertainties, we urge you not to place undue reliance on any such forward-looking statements. Forward-looking statements speak only as of the date when made. We undertake no obligation to publicly update or revise any forward-looking statements, whether as a result of new information, future events or otherwise, except as required by law.

AVAILABLE INFORMATION

Detailed information about us is contained in our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, proxy statements and other reports, and amendments to those reports, that we file with, or furnish to, the SEC. These reports are available free of charge at our website, www.equifax.com, as soon as reasonably practicable after we electronically file such reports with or furnish such reports to the SEC. However, our website and any contents thereof should not be considered to be incorporated by reference into this document. We will furnish copies of such reports free of charge upon written request to Equifax Inc., Attn: Office of Corporate Secretary, P.O. Box 4081, Atlanta, Georgia, 30302.