Equifax (EFX) 10-K risk factor changes: FY2019 vs FY2018

[removed: Security] [added: Security] breaches [removed: like the 2017 cybersecurity incident] and other disruptions to our information technology infrastructure could compromise Company, consumer and customer information, interfere with our operations, cause us to incur significant costs for remediation and enhancement of our IT systems and expose us to legal liability, all of which could have a substantial negative impact on our business and [removed: reputation.][added: reputation.]

In the ordinary course of business, we collect, process, transmit and store sensitive data, including intellectual property, proprietary business information and personally identifiable information of [removed: consumers.][added: consumers, employees and strategic partners.]

[removed: In] [added: For example, in] 2017, we [removed: were the target of] [added: experienced] a cybersecurity [added: incident following a criminal] attack [added: on our systems] that involved the theft of [removed: certain] personally identifiable information of [removed: approximately 145.5 million U.S. consumers, approximately 19,000] [added: U.S.,] Canadian [removed: consumers] and [removed: approximately 860,000] U.K. consumers.

Any such access, disclosure or other loss of information could subject us to significant [removed: additional] litigation, regulatory fines, penalties, losses of customers or reputational damage, any of which could have a [removed: significant negative impact] [added: material adverse effect] on our cash flows, competitive position, financial condition or results of operations.

We cannot ensure that our insurance policies in the future will be adequate to cover losses from any future [removed: failures.][added: security breaches.]

In addition, other [removed: lawsuits, investigations] [added: lawsuits] and [removed: reports] [added: investigations] related to the 2017 cybersecurity incident [added: are still outstanding and additional lawsuits or investigations] may be filed, commenced or issued.

[removed: The] [added: The] 2017 cybersecurity incident and the adverse publicity that followed have had a negative impact on our reputation and our relationships with our customers, and we cannot assure that it will not have a long-term effect on our relationships with our customers, our revenue and our [removed: business.][added: business.]

Despite our progress made toward repairing our reputation and business relationships, if we [added: experience another cybersecurity incident or] are [added: otherwise] unable to demonstrate the security of our systems and the data we maintain and retain the trust of our customers, consumers and data suppliers, we could experience a substantial negative impact on our business.

[removed: Additionally, following the 2017 cybersecurity incident, certain of our International Organization for Standardization (“ISO”) certifications, which] [added: ISO certifications] specify requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented information security management [removed: system, were suspended.][added: system.]

[removed: These] [added: Industry and technical] certifications, [removed: including] [added: such as] the ISO [removed: 27001 certification,] [added: certifications,] are critical to our [removed: business,] [added: business] because certain of our current and potential customers and the contracts governing certain customer relationships, as well as certain of our data suppliers, require us to maintain them as a requirement of doing business.

[removed: If] [added: If] we fail to [added: achieve and] maintain [added: key industry] or [removed: regain these] [added: technical] certifications, [added: our] customers [added: and business partners] may stop doing business with us and we may not be able to win new business, which would negatively affect our [removed: revenue.][added: revenue.]

[removed: The] [added: The] failure to realize the anticipated benefits of our technology transformation strategy could adversely impact our business and financial [removed: results.][added: results.]

We expect our technology transformation strategy, including our transition to cloud-based technologies, will significantly increase our efficiency and productivity, the functionality of our products and services, as well as decrease the cost of our [added: overall] systems infrastructure, all of which we expect will drive growth and have a positive effect on our business, competitive position and results of operations.

This initiative is a major undertaking as we replace many of our previous [removed: operating systems with cloud-based systems.]

Moreover, we may experience issues [removed: of] [added: with] customer migration, as many of our customers may [added: not want to migrate or may] choose not to utilize our products and services during and after our transition to cloud-based technologies.

If we are unable to correctly respond to these issues, we may experience business disruptions, damage to our reputation, negative publicity, diminished customer [added: trust and] relationships and other adverse effects on our business.

[removed: Our] [added: Our] technology transformation strategy places a significant strain on our management, operational, financial and other limited [removed: resources.][added: resources.]

Additionally, as a result of our [added: cloud] migration efforts in connection with our technology transformation strategy, we may experience a loss of continuity, loss of accumulated knowledge or loss of efficiency during transitional periods.

[removed: Our] [added: Our] transition to cloud-based technologies could expose us to operational [removed: disruptions.][added: disruptions.]

As part of our technology transformation strategy, we are upgrading [added: a significant portion of] the information technology systems used to operate our business and replacing them with cloud-based solutions.

Upon implementation of the new cloud-based solutions, much of our information technology systems will consist of outsourced, cloud-based infrastructure, platform and software-as-a-service solutions not under our direct management or [added: control.]

[removed: The] [added: The] loss of access to credit, employment, financial and other data from external sources could harm our ability to provide our products and [removed: services.][added: services.]

If a substantial number of data sources or certain key data sources were to withdraw or be unable to provide their data, if we were to lose access to data due to government regulation, if we lose exclusive right to the use of data, or if the collection, disclosure or use of data becomes uneconomical, our ability to provide products and services to our clients could [removed: have a significant negative impact,] [added: be adversely affected,] which could result in decreased revenue, net income and earnings per share and reputational loss.

[removed: Negative] [added: Negative] changes in general economic conditions, including interest rates, unemployment rates, income, home prices, investment values and consumer confidence, could adversely affect [removed: us.][added: us.]

[removed: Our] [added: Our] markets are highly competitive and new product introductions and pricing strategies being offered by our competitors could decrease our sales and market share or require us to enhance our products and services or reduce our prices in a manner that reduces our operating [removed: margins.][added: margins.]

Changes in prices between competitors for this information and/or changes in the design or sale of tri-bureau versus single [added: or dual] bureau product offerings may affect our revenue or profitability.

[removed: Our] [added: Our] relationships with key long-term customers may be materially diminished or [removed: terminated.][added: terminated.]

[removed: If] [added: If] we do not introduce successful new products, services and analytical capabilities in a timely manner, or if the market does not adopt our new services, our competitiveness and operating results will [removed: suffer.][added: suffer.]

[removed: Our resources have to be committed to any new] products and services before knowing whether the market will adopt the new offerings.

In addition, our management is and will continue to be intensely focused on enhancing our security measures and [removed: responding to consumer and customer concerns relating to the 2017 cybersecurity incident] [added: our technology transformation] and may not be able to devote [removed: sufficient] [added: as much] time or resources to new product development, which could cause us to be less competitive as compared to our peers, lose out on new revenue opportunities and have an adverse effect on our growth and our business.

[removed: The] [added: The] demand for some of our products and services may be negatively impacted to the extent the availability of free or less expensive consumer information [removed: increases.][added: increases.]

[removed: Additionally, effective] [added: Effective] September 2018, federal law allows consumers to place freezes on their credit files at all credit bureaus including Equifax.

[removed: If] [added: If] our systems do not meet customer requirements for response time or high availability, or we experience system constraints or failures, or our customers do not modify and/or upgrade their systems to accept new releases of our products and services, our services to our customers could be delayed or interrupted, which could result in lost revenues or customers, lower [removed: margins,] [added: margins] or other harm to our business and [removed: reputation.][added: reputation.]

These systems and operations, and the personnel that support, service and operate these systems, could be exposed to interruption, damage or destruction from power loss, telecommunication failures, computer viruses, denial-of-service [added: or other cyber] attacks, employee or insider malfeasance, human error, fire, natural disasters, war, terrorist acts or civil unrest.

[removed: We] [added: We] and our customers are subject to various current laws and governmental regulations, and could be affected by new [added: and evolving consumer privacy and cybersecurity or other data-related] laws or regulations, [removed: including as a result of the 2017 cybersecurity incident,] compliance with which may cause us to incur significant expenses and change our business practices, and if we fail to maintain satisfactory compliance with certain [added: laws and] regulations, we could be subject to civil or criminal [removed: penalties.][added: penalties.]

We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy, [added: cybersecurity,] data and financial protection.

Examples of such new [added: and evolving] laws and regulations include recent amendments to the FCRA requiring the provision of free credit freezes to consumers, [removed: new] cybersecurity and other requirements promulgated by the New York Department of Financial [removed: Services and] [added: Services,] the [removed: passage] [added: taking effect] of the [added: CCPA on January 1, 2020, and] California [removed: Consumer Protection Act.][added: data broker registration requirements that took effect on January 31, 2020.]

There are a number of legislative proposals pending before the U.S. Congress, various state legislative bodies and foreign governments concerning [removed: data protection] [added: privacy or cybersecurity] that could affect [removed: us and the President of the United States could act by Executive Order.][added: us.]

In addition, a growing number of legislative and regulatory bodies have adopted consumer notification and other requirements in the event that [added: consumer information is accessed or acquired by unauthorized persons and additional regulations regarding the use, access, accuracy and security of such data are possible.]

We devote substantial compliance, legal and operational business resources to [removed: facilitate] [added: strive for] compliance with applicable regulations and requirements.

We are a global data, analytics and technology company.

We are in the process of transforming our applications and infrastructure technologies, transitioning to cloud-based technologies.

Because the techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently and often are not recognized until launched against a target, or even some time after, we may be unable to anticipate these techniques, implement adequate preventative measures or remediate any intrusion on a timely or effective basis even if our security measures are appropriate, reasonable, and/or in accordance with applicable legal requirements.

As part of a global settlement, we entered into agreements with various parties to settle the U.S. Consumer MDL Litigation and certain federal and state government investigations arising out of the 2017 cybersecurity incident.

If we are unable to comply with our obligations under these agreements, or if other lawsuits or investigations are filed or commenced, it could have a material adverse effect on our financial condition.

In July 2019, the Company entered into multiple agreements that resolve the U.S. consolidated consumer class action cases, captioned *In re: Equifax, Inc. Customer Data Security Breach Litigation, MDL No. 2800 (Consumer Cases)* (the “U.S. Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the Attorneys General of 48 states, the District of Columbia and Puerto Rico (the “MSAG Group”) and the NYDFS (collectively, the “Consumer Settlement”) relating to the 2017 cybersecurity incident.

On January 13, 2020, the U.S. District Court for the Northern District of Georgia (the “Court”) entered an order granting final approval of the settlement in connection with the U.S. Consumer MDL Litigation, from which several objectors have appealed.

Until the appeals are finally adjudicated or dismissed, we can provide no assurance that the U.S. Consumer MDL Litigation will be resolved as contemplated by the settlement agreement.

If the Court’s order approving the settlement agreement were reversed by an appellate court, there is a risk that we would not be able to settle the U.S. Consumer MDL Litigation on acceptable terms or at all, which could have a material adverse effect on our financial condition.

In addition to the monetary payments and consumer redress, we also agreed as part of the Consumer Settlement to implement certain business practice commitments related to consumer assistance and our information security program, including third party assessments of our program.

These business practice commitments are extensive and will require a significant amount of attention from management.

We can provide no assurance that we will be able to comply with these business practice commitments.

To the extent we were unable to comply or we are viewed as not being in compliance with these business practice commitments or other requirements of a relevant order, we could face an enforcement action or contempt proceeding that could potentially result in fines, penalties and new business practice commitments, which, depending on the amount and type, could have a material adverse effect on our financial condition.

The resolution of these additional matters may result in damages, costs, fines or penalties, which, depending on the amount, could be material to the Company’s consolidated financial condition, results of operations, or cash flows in future periods.

We are required by customers and business partners to obtain various industry or technical certifications, including from the International Organization for Standardization (“ISO”).

As a result of the 2017 cybersecurity incident, we lost certain key certifications which adversely affected our business.

We had to spend significant resources on remediation activities in order to obtain certain re-certifications.

If we fail to achieve or maintain key industry or technical certifications as a result of another cybersecurity incident or for other reasons, customers and business partners may stop doing business with us and we may not be able to win new business, which would negatively affect our revenue.

operating systems with cloud-based systems.

Our resources have to be committed to any new

We also use algorithms, artificial intelligence and machine learning in our business processes.

For example, already in 2020 several states have introduced varying comprehensive privacy laws modeled to some degree on the CCPA and/or the GDPR.

Compliance with multiple state laws containing varying requirements could be complicated and costly.

While in the EU the GDPR already includes certain provisions relating to the automated processing of personal data, there has also been discussion in the EU of new legislative proposals to regulate business use of artificial intelligence and machine learning technologies that if enacted could impose new legal requirements addressing among other issues, privacy, discrimination and human rights.

As of now, the specifics of such legislation are unclear.

However, legislation in this area could also be introduced in other countries.

The enactment of new laws and how they are interpreted could impact our business.

In particular, legislative activity in the privacy area may result in new laws that are applicable to us and that may hinder our business, for example, by restricting use or sharing of consumer data, including for marketing or advertising or limiting the use of, or otherwise regulating artificial intelligence and machine learning, including the use of algorithms and automated processing in ways that could materially affect our business, or which may lead to significant increases in the cost of compliance.

Any failure by us to comply with, or remedy any violations of, applicable

We are subject to risks and uncertainties associated with the U.K.’s withdrawal from the EU (referred to as “Brexit”), including implications for the free flow of labor and goods in the U.K. and the EU and other financial, legal, tax and trade implications.

In addition, we identified approximately 2.4 million U.S. consumers whose name and partial driver’s license information were stolen in the attack.

While the forensic analysis of the 2017 cybersecurity incident is complete, it is possible that further analysis will identify additional consumers affected or additional types of data accessed, which could result in additional notifications and negative publicity.

In addition, the 2017 cybersecurity incident may embolden individuals or groups to target our systems.

The government investigations and litigation resulting from the 2017 cybersecurity incident will continue to adversely impact our business and results of operations.

As a result of the 2017 cybersecurity incident, we are currently a party to a consolidated multi-district consumer class action lawsuit and a consolidated multi-district financial institution class action lawsuit, as well as a consolidated securities class action lawsuit, shareholder derivative litigation and other lawsuits and claims arising out of the 2017 cybersecurity incident seeking monetary damages or other relief.

A number of U.S. federal, state, local and foreign governmental officials and agencies, including Congressional committees, the FTC, the CFPB, the SEC, the U.S. Department of Justice and state attorneys general offices in the U.S., the FCA in the U.K. and the Office of the Privacy Commissioner in Canada, continue to investigate events related to the 2017 cybersecurity incident, including how it occurred, the consequences thereof and our response thereto.

While we believe it is beneficial to resolve the consolidated multi-district consumer class action and one or more of the government investigations in the U.S. through a global resolution, the complexity of achieving a multi-party resolution, especially involving multiple government agencies, makes this a difficult objective to achieve.

We may not have success in achieving a global resolution or even a resolution of any of these matters individually.

The claims and investigations have resulted in the incurrence of significant external and internal legal costs and expenses and reputational damage to our business and are expected to continue throughout 2019 and beyond.

The resolution of these matters may result in damages, costs, fines or penalties substantially in excess of our insurance coverage, which, depending on the amount, could have a material adverse effect on our liquidity or compliance with our credit agreements.

If such damages, costs, fines or penalties were great enough that we could not pay them through funds generated from operating activities and/or cause a default under our revolving credit facility, we may be forced to renegotiate or obtain a waiver under our revolving credit facility and/or seek additional debt or equity financing.

Such renegotiation or financing may not be available on acceptable terms, or at all.

In these circumstances, if we were unable to obtain sufficient financing, we may not be able to meet our obligations as they come due.

The outcome of such claims and investigations could also adversely affect or cause us to change how we operate our business.

Various governmental agencies investigating the 2017 cybersecurity incident are seeking to impose injunctive relief, consent decrees, and civil penalties, which could, among other things, impact our ability to collect and use consumer information, materially increase our data security costs, reduce available resources to invest in technology and innovation and/or otherwise require us to alter how we operate our business, and put us at a competitive disadvantage.

Any legislative or regulatory changes adopted in reaction to the 2017 cybersecurity incident or other companies’ data breaches could require us to make modifications to the operation of our business that could have an adverse effect and/or increase or accelerate our compliance costs.

Furthermore, these matters necessitate significant attention by management, which may divert the focus of management from the operation of our business resulting in an adverse impact on our results of operations.

Additionally, certain of our payment card industry certifications were suspended.

In 2018, significant focus was placed on remediation activities in order to obtain ISO and payment card industry re-certifications.

We have reacquired three independent ISO/IEC 27001:2013 certifications (representing our Corporate, U.K. and Canada environments) and two of our payment card industry certifications (U.K. and Canada).

In addition, we expect to obtain the

USIS and GCS payment card industry re-certification in 2019.

control.

For example, in 2018, our revenue was negatively impacted in the U.S. by the weak mortgage market; in Argentina by the substantial weakening of the economy and local currency; in Australia by weak real estate and mortgage markets and overall weakness in consumer credit markets.

Due to the 2017 cybersecurity incident and our provision of free services to consumers in connection therewith, we ceased the advertisement and sale of new products in our direct-to-consumer business from September 2017 through October 2018, which resulted in a significant decline in revenue in that business.

Furthermore, in late January 2018, we began offering a new credit lock service, Lock & Alert™, that is free for life and is aimed at empowering U.S. consumers to control access to their Equifax credit file directly and quickly from their smartphone or computer.

consumer information is accessed by unauthorized persons and additional regulations regarding the use, access, accuracy and security of such data are possible.

| | |

| --- | --- |

In 2018, a general weakening of foreign currencies in countries where we have operations against the U.S. dollar had a negative impact on our results as reported in U.S. dollars.

See “Segment Financial Results—International—Asia Pacific,” “—Europe,” “—Latin America,” and “—Canada” and “Effects of Inflation and Changes in Foreign Currency Exchange Rates” in the “Item 7.

Management’s Discussion and Analysis” in this Form 10-K.

Because of the geographic diversity of our operations, weaknesses in some currencies might be offset by strengths in others over time.

Changes to tax laws can have immediate impacts, either favorable or unfavorable, on our

Intellectual property rights and

The effects of any Brexit will depend on its terms.

A downgrade to our credit ratings would increase our cost of borrowing under our credit facility and adversely affect our ability to access the capital markets.

The Revolver replaced the Company’s previous $900 million unsecured revolving credit facility that was scheduled to mature in November 2020.

The cost of borrowing under the Revolver and our ability and the terms under which we may access the credit markets are affected by credit ratings assigned to our indebtedness by the major credit rating agencies.

These ratings are premised on our performance under assorted financial metrics, such as leverage and interest coverage ratios and other measures of financial strength, business and financial risk, industry conditions, transparency with rating agencies and timeliness of financial reporting.

[removed: BUSINESS OVERVIEW][added: BUSINESS OVERVIEW]

We also offer Equifax branded credit services in Russia [removed: and India] through [added: a] joint [removed: ventures,] [added: venture,] have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and the United Arab Emirates, [removed: and] have an investment in a consumer and commercial credit information company in [removed: Brazil.][added: Brazil and have an investment in an identity authentication company in Canada.]

[removed: 2017] [added: 2017] Cybersecurity [removed: Incident][added: Incident]

[added: Product Liability.] As a result of the 2017 cybersecurity incident, we offered TrustedID® Premier, a credit file monitoring and identity theft protection product, for free to all eligible U.S. consumers who signed up through January 31, 2018.

In [added: late] 2018, the Company extended the free credit monitoring services for an additional twelve months for eligible consumers impacted by the 2017 cybersecurity incident by providing them the opportunity to enroll in Experian® IDNotify™ at no cost.

[added: We recorded expenses, net of insurance recoveries, of $800.9 million in other current liabilities and selling,] general, and administrative expenses in [removed: the accompanying] [added: our] Consolidated [added: Balance Sheets and] Statements of [removed: Income] [added: (Loss) Income, respectively, as of and] for the twelve months ended December 31, [removed: 2018.][added: 2019,]

As a result of the 2017 cybersecurity incident, we [removed: are] [added: were] subject to a significant number of proceedings and investigations as described in [removed: Part I,] “Item 3.

While [removed: we believe] it is reasonably possible that [removed: we will incur] losses [removed: associated with such proceedings and investigations,] [added: exceeding the amount accrued may be incurred,] it is not possible at this time to estimate the [removed: amount of loss or range of] [added: additional] possible loss [added: in excess of the amount already accrued] that might result from adverse judgments, settlements, penalties or other resolution of the proceedings and investigations described in “Item 3.

Legal Proceedings” [added: in this Form 10-K] based on [added: a number of factors, such as] the various stages of these proceedings and investigations, [added: including matters on appeal,] that alleged damages have not been specified or are uncertain, the uncertainty as to the certification of a class or classes and the size of any certified class, as applicable, and the lack of resolution on significant factual and legal issues.

The [removed: Company believes that the] ultimate amount paid on these actions, claims and investigations [added: in excess of the amount already accrued] could be material to the Company’s consolidated financial condition, results of operations, or cash flows in future periods.

[added: Future Costs.] We are currently executing substantial initiatives in security and consumer support, and a company-wide transformation of our technology infrastructure, which we refer to as our technology transformation, and incurred substantial increased expenses and capital expenditures in [removed: 2018] [added: 2019] related to these initiatives.

We expect to [removed: again] [added: continue to] incur significant expenses and capital expenditures in [removed: 2019 and] 2020 related to these initiatives, [removed: although] at [added: similar] levels [removed: slightly below] [added: as] those incurred in [removed: 2018.][added: 2019.]

We incurred significant legal and professional services expenses related to the lawsuits, claims and government investigations to which we [removed: are] [added: were] a party in [removed: 2018,] [added: 2019,] and expect to continue to incur these expenses until [removed: these items] [added: all matters] are [added: fully] resolved.

[added: Insurance Coverage.] At the time of the 2017 cybersecurity incident, we had $125.0 million of cybersecurity insurance coverage, above a $7.5 million deductible, to limit our exposure to losses such as those related to this incident.

[removed: Segment] [added: Segment] and Geographic [removed: Information][added: Information]

[added: Segments.] The USIS segment, the largest of our four segments, consists of three service lines: Online Information [removed: Solutions;] [added: Solutions,] Mortgage [removed: Solutions;] [added: Solutions,] and Financial Marketing Services.

USIS also markets certain decisioning software [removed: services,] [added: services] which facilitate and automate a variety of consumer and commercial credit-oriented decisions.

Financial Marketing Services revenue is principally project and subscription based and is derived from our sales of batch credit and consumer wealth information such as those that assist clients in acquiring new customers, [removed: cross selling] [added: cross-selling] to existing customers and managing portfolio risk.

Employer Services [removed: revenues are] [added: revenue is] derived from our provision of certain human resources business process outsourcing services that include both transaction and subscription based product offerings.

Due to the 2017 cybersecurity [removed: incident] [added: incident,] we ceased [added: advertising our consumer business in the U.S. in September 2017.]

[added: Geographic Information.] We currently have operations in the following countries: Argentina, Australia, Canada, Chile, Costa Rica, Ecuador, El Salvador, Honduras, India, Mexico, New Zealand, Paraguay, Peru, Portugal, the Republic of Ireland, Spain, the U.K., Uruguay and the U.S. We also offer Equifax branded credit services in [removed: India and] Russia through [added: a] joint [removed: ventures, we] [added: venture,] have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, [removed: Singapore and the United Arab Emirates, and have an investment in a consumer and commercial credit information company in Brazil.]

Approximately [added: 73% and] 71% our revenue was generated in the U.S. during both of the twelve months ended December 31, [removed: 2018] [added: 2019] and [removed: 2017.][added: 2018, respectively.]

[added: Key Performance Indicators.] Management focuses on a variety of key indicators to monitor operating and financial performance.

Key performance indicators for the twelve months ended December 31, [removed: 2018, 2017] [added: 2019, 2018] and [removed: 2016,] [added: 2017,] include the following:

| | [removed: Key] [added: | | Key] Performance Indicators Twelve Months Ended December [removed: 31,] [added: 31,] | | | | | | | | | | | [added: | | | | | | | | | | | | | | | |]

| | [removed: 2018] | | [added: 2019] | | [removed: 2017] | | | | [removed: 2016] [added: 2018] | | | [added: | | | 2017 | | | | | | | | | | | | | | |]

| | [removed: (In] [added: | | *(In] millions, except per share [removed: data)] [added: data)*] | | | | | | | | | | | [added: | | | | | | | | | | | | | | | |]

| Operating revenue | [added: | | $ | 3,507.6 | | | | |] $ | 3,412.1 | | | [added: | |] $ | 3,362.2 | | | [removed: $] | [removed: 3,144.9] | | [added: | | | | | | | |]

| Operating revenue change | [added: | | 3 | | % | | | |] 1 | | % | | [added: | |] 7 | | % | | [removed: 18] | | [removed: %] | [added: | | | | | | | |]

| Operating [added: (loss)] income | [added: | | $ | (335.4) | | | | |] $ | 448.0 | | | [added: | |] $ | 831.7 | | | [removed: $] | [removed: 825.1] | | [added: | | | | | | | |]

| Operating margin | [added: | | (9.6) | | % | | | |] 13.1 | | % | | [added: | |] 24.7 | | % | | [removed: 26.2] | | [removed: %] | [added: | | | | | | | |]

| Net [added: (loss)] income attributable to Equifax | [added: | | $ | (398.8) | | | | |] $ | 299.8 | | | [added: | |] $ | 587.3 | | | [removed: $] | [removed: 488.8] | | [added: | | | | | | | |]

| Diluted earnings per share | [added: | | $ | (3.27) | | | | |] $ | 2.47 | | | [added: | |] $ | 4.83 | | | [removed: $] | [removed: 4.04] | | [added: | | | | | | | |]

| Cash provided by operating activities | [added: | | $ | 313.8 | | | | |] $ | 672.2 | | | [added: | |] $ | 816.0 | | | [removed: $] | [removed: 823.0] | | [added: | | | | | | | |]

| Capital expenditures* | [removed: $] | [removed: (368.1] | [removed: )] [added: $] | [added: (375.9)] | [added: | | | |] $ | [removed: (214.0] [added: (368.1)] | [removed: )] | | [added: | |] $ | [removed: (191.5] [added: (214.0)] | [removed: )] | [added: | | | | | | | | | | | |]

[removed: Business] [added: Business] Environment and Company [removed: Outlook][added: Outlook]

In the United States, we expect [removed: 2019] [added: 2020] economic activity, as measured by GDP, to be down from [removed: the levels seen in the second half of 2018.][added: 2019.]

We expect modest growth in consumer credit, excluding mortgage, over the course of [removed: 2019.][added: 2020.]

We anticipate [removed: 2019] [added: 2020] economic activity, as measured by GDP, in Canada to be slightly below [removed: the levels seen in the second half of 2018.][added: 2019.]

In the European markets we serve, the U.K., Spain and Portugal, we are expecting [removed: 2019] [added: 2020] economic activity, as measured by GDP, to be [removed: at] [added: down] or slightly below [removed: the levels in 2018.][added: 2019.]

On February 10, 2020, the U.S. Department of Justice announced that four members of the Chinese People’s Liberation Army were indicted on criminal charges for their involvement in the 2017 cybersecurity incident.

The remaining product liability balance at December 31, 2019 and 2018 was not material to the Consolidated Financial Statements.

Litigation, Claims and Government Investigations. As a result of the 2017 cybersecurity incident, we were subject to a significant number of proceedings and investigations as described in Part I, “Item 3.

We recorded expenses, net of insurance recoveries, of $800.9 million in other current liabilities and selling, general, and administrative expenses in our Consolidated Balance Sheets and Statements of (Loss) Income, respectively, as of and for the twelve months ended December 31, 2019, exclusive of our legal and professional services expenses.

The amount accrued represents our best estimate of the liability related to these matters.

The Company will continue to evaluate information as it becomes known and adjust accruals for new information and further developments in accordance with ASC 450-20-25.

However, we expect that the level of legal and professional service expenses related to these matters will be significantly lower in 2020 due to the settlement of all of the significant matters in the U.S.

We also maintained a directors and officers insurance policy of which we have recorded our estimated maximum recoveries as of December 31, 2019.

Singapore and the United Arab Emirates, have an investment in a consumer and commercial credit information company in Brazil and have an investment in an identity authentication company in Canada.

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

U.S. mortgage market inquiries are expected to be approximately flat in 2020 versus 2019, with strong growth in inquiries in the first half of 2020, offset by a decline in inquiries in the second half of 2020.

In Australia, we anticipate 2020 economic activity, as measured by GDP, to be up from 2019.

In Argentina, the market continued to weaken in 2019.

Additional uncertainty exists in Argentina due to the Argentinean political environment and in the U.K. due to the impact of Brexit in the U.K.

We recorded expenses, net of insurance recoveries, of $800.9 million in other current liabilities and selling, general, and administrative expenses in our Consolidated Balance Sheets and Statements of (Loss) Income, respectively, as of and for the twelve months ended December 31, 2019, exclusive of our legal and professional services expenses.

The amount accrued represents our best estimate of the liability related to these matters.

The Company will continue to evaluate information as it becomes known and adjust accruals for new information and further developments in accordance with ASC 450-20-25.

Legal Proceedings” in this Form 10-K based on a number of factors, such as the various stages of these proceedings and investigations, including matters on appeal, that alleged damages have not been

specified or are uncertain, the uncertainty as to the certification of a class or classes and the size of any certified class, as applicable, and the lack of resolution on significant factual and legal issues.

As such, as of any given date, we could have exposure to losses as to which no liability has been accrued or as to which the accrued liability is inadequate.

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

USIS growth was primarily driven by increases in core credit decisioning volumes and revenue from acquisitions.

International had local currency growth across Latin America and Canada.

Global Consumer Solutions revenue decreased primarily due to decreases in consumer direct revenue in the U.S. and the U.K.

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | | | | | | | | | | | | | | | | | | | | | | 2019 vs. 2018 | | | | | | | | | | | | | | | | | | 2018 vs. 2017 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

The increase is due to increased royalty and technology costs.

We also incurred increased incremental technology and data security costs of $20.3 million in

2019.

These increased technology and security costs predominantly reflect the investments we are making in our technology transformation, which include costs for enhanced data security.

The increase in 2019 is primarily due to losses, net of insurance recoveries, of $800.9 million associated with certain legal proceedings and government investigations related to the 2017 cybersecurity incident.

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | | | | Twelve Months Ended December 31, | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Change | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| Consolidated operating revenue | | | | | | $ | 3,507.6 | | | | | $ | 3,412.1 | | | | | $ | 3,362.2 | | | | | $ | 95.5 | | | | | 3 | | % | | | | $ | 49.9 | | | | | 1 | | % | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

Total company operating margin decreased in 2019 versus 2018, primarily due to losses, net of insurance recoveries, of $800.9 million associated with certain legal proceedings and government investigations related to the 2017 cybersecurity incident which are reflected in selling, general, and administrative expenses in our Consolidated Statements of (Loss) Income.

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

As a result of the 2017 cybersecurity incident, we are party to numerous lawsuits and governmental investigations.

See “Item 1A.

Risk Factors” and “Item 3.

Legal Proceedings” in this Form 10-K for more information regarding these lawsuits and investigations.

Product Liability.

Through December 31, 2017, we recorded $50.7 million of product costs in selling, general and administrative expenses in the accompanying Consolidated Statements of Income.

We recorded $20.4 million related to these services in selling,

Litigation, Claims and Government Investigations.

The Company will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable.

Future Costs.

In 2018, we incurred elevated costs for insurance, finance and compliance activities, and expect to incur costs at these levels again in 2019.

Insurance Coverage.

During the twelve months ended December 31, 2018 and 2017, the Company recorded insurance recoveries of $75.0 million and $50.0 million, respectively, and received payments of $110.0 million and $15.0 million, respectively, for reimbursable costs incurred to date.

Segments.

advertising our consumer business in the U.S. in September 2017.

As part of our response to the 2017 cybersecurity incident, we made our TrustedID® Premier service, an identity theft protection and credit file monitoring product, available for free to all U.S. consumers for twelve months for those who signed up by January 31, 2018.

In late 2018, the Company extended the free credit file monitoring services for impacted consumers in the U.S. using the free TrustedID Premier® service by providing them the opportunity to enroll in Experian® IDNotify™ at no cost for an additional twelve months.

Similarly, for impacted consumers in Canada and the U.K., we provided free credit reports and scores, credit monitoring and identity theft protection for twenty four months.

As part of our commitment to providing long-term resources and protections for consumers, in January 2018, the Company introduced Lock & Alert™, a mobile application enabled service that allows U.S. consumers to quickly lock and unlock their Equifax credit report for free, for life.

Geographic Information.

Key Performance Indicators.

| | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

U.S. Mortgage market originations are expected to be much weaker in the first half of 2019 and down for the full year of 2019 versus 2018.

In Australia, as measured by GDP, we anticipate 2019 economic activity to be below the levels seen in the second half of 2018 due to overall weakness in consumer credit markets.

In Argentina, the market weakened significantly in 2018.

The 2017 cybersecurity incident is expected to continue to negatively impact revenue, principally in our USIS and Global Consumer Solutions businesses.

We have incurred, in 2018, and will continue to incur, in 2019, legal, consulting and other costs related to the analysis and response to the 2017 cybersecurity incident.

While we believe it is reasonably possible that we will incur losses associated with these proceedings and investigations, it is not possible to estimate the amount of loss or range of possible loss that might result from adverse judgments, settlements, penalties or other resolution of the proceedings and investigations based on the various stages of these proceedings and investigations, that alleged damages have not been specified or are uncertain, the uncertainty as to the certification of a class or classes and the size of any certified class, as applicable, and the lack of resolution on significant factual and legal issues.

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

International had strong growth across all regions, which reflects broad based organic growth and the Veda acquisition.

USIS had an increase in revenue compared to 2016, reflecting growth in core credit decisioning, financial marketing services, mortgage and identity and fraud solutions.

Revenue in our USIS, Global Consumer Solutions and Workforce Solutions segments were negatively impacted by the 2017 cybersecurity incident.

Cost of Services.

The increase in cost of services, when compared to 2016, was due to the increase in production costs driven by higher revenues, as well as increases of $14.2 million in professional services related to the 2017 cybersecurity incident and in people costs.

Related to the 2017 cybersecurity incident, we incurred net costs of $19.0 million in 2018.

We incurred legal and investigative fees of $73.6 million, and decreased costs to fulfill and support the free credit monitoring service provided to eligible consumers of $20.4 million.

Additionally, we benefited from the recognition of insurance proceeds of $75.0 million to offset these costs in 2018, versus the $50.0 million of insurance proceeds recorded in 2017.

Selling, general and administrative expenses increased $91.0 million in 2017 as compared to 2016.

[removed: Foreign] [added: Foreign] Currency Exchange Rate [removed: Risk][added: Risk]

Foreign currency transaction gains and losses, which have historically been immaterial, are recorded on our Consolidated Statements of [added: (Loss)] Income.

For the year ended December 31, [removed: 2017,] [added: 2019,] a 10% weaker U.S. dollar against the currencies of all foreign countries in which we had operations during [removed: 2017] [added: 2019] would have increased our revenue by [removed: $54.7] [added: $54.8] million and our pre-tax operating profit by [removed: $18.6] [added: $10.2] million.

A 10% stronger U.S. dollar would have resulted in similar decreases to our revenue and pre-tax operating profit for [removed: 2018] [added: 2019] and [removed: 2017.][added: 2018.]

On average across our mix of international businesses, foreign currencies at December 31, [removed: 2018] [added: 2019] were weaker against the U.S. dollar than the average foreign exchange rates that prevailed across the full year [removed: 2018.][added: 2019.]

As a result, if foreign exchange rates were unchanged throughout [removed: 2019,] [added: 2020,] foreign exchange translation would reduce growth as reported in U.S. dollars.

As foreign exchange rates change daily, there can be no assurance that foreign exchange rates will remain constant throughout [removed: 2019,] [added: 2020,] and rates could go either higher or lower.

[removed: Interest] [added: Interest] Rate [removed: Risk][added: Risk]

Our exposure to market risk for changes in interest rates relates to our variable-rate commercial paper, Revolver, and Floating Rate [removed: Senior Note] [added: Notes] borrowings.

At December 31, [removed: 2018,] [added: 2019,] our weighted average cost of debt was 3.8% and weighted-average life of debt was [removed: 5.42] [added: 4.54] years.

At December 31, [removed: 2018, 89%] [added: 2019, 91%] of our debt was fixed rate, and the remaining [removed: 11%] [added: 9%] was variable rate.

A 100 basis point increase in the weighted-average interest rate on our variable-rate debt would have increased our [removed: 2018] [added: 2019] interest expense by $3.0 million.

[removed: Overview][added: Overview]

We provide information solutions [added: for businesses, governments] and [added: consumers, and we provide] human resources [removed: business-process] [added: business process] outsourcing services for [removed: businesses, governments and consumers.][added: employers.]

We have a large and diversified group of clients, including financial institutions, corporations, [removed: governments] [added: government agencies] and individuals.

Additionally, we are a leading provider of payroll-related and human resource management business process outsourcing services in the United States of America [removed: (U.S.).][added: (“U.S.”).]

We currently operate in four global regions: North America (U.S. and Canada), Asia Pacific (Australia, New Zealand and India), Europe (the United Kingdom [removed: (U.K.),] [added: (“U.K.”),] Spain and Portugal) and Latin America (Argentina, Chile, Costa Rica, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay).

We [removed: also] offer [removed: Equifax-branded] [added: consumer] credit services in Russia [removed: and India] through [added: an investment in a] joint [removed: ventures,] [added: venture,] have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and the United Arab Emirates, and have an investment in a consumer and commercial credit information company in Brazil.

[removed: | • | U.S.] [added: - U.S.] Information Solutions [removed: (USIS) —] [added: (“USIS”) *—*] provides consumer and commercial information solutions to businesses in the U.S. including online information, decisioning technology solutions, fraud and identity management services, analytical services, portfolio management services, mortgage reporting and marketing services. [removed: |]

[removed: | • | International —] [added: - International *—*] provides products and services similar to those available in the USIS operating segment but with variations by geographic region. [removed: We also provide information, technology and services to support debt collections and recovery management. This operating segment is comprised of our Canada, Europe, Latin America and Asia-Pacific business units. |]

[removed: | • |] [added: -] Workforce [removed: Solutions —] [added: Solutions *—*] provides services enabling customers to verify income and employment (Verification Services) of people in the U.S., as well as providing our [added: employer] customers [added: with] services [removed: to outsource] [added: that assist them in complying with] and [removed: automate the performance of] [added: automating] certain payroll-related and human resource management [removed: business processes,] [added: processes throughout the entire cycle of the employment relationship,] including unemployment [removed: claims] [added: cost] management, [added: employee onboarding,] tax credits and [removed: incentives and] [added: incentives,] I-9 [added: management] and [removed: W-2] [added: compliance, tax] form management services and [removed: services to allow employers to ensure compliance with the] Affordable Care Act [added: management services] (Employer Services). [removed: Workforce Solutions is in the process of establishing Verifications Services operations in Canada and Australia. |]

[removed: | • |] [added: -] Global Consumer [removed: Solutions —] [added: Solutions *—*] provides products to consumers in the U.S., Canada and the U.K., enabling them to understand and monitor their credit and monitor and help protect their identity. [removed: We also sell consumer credit information to resellers who combine our information with other information to provide direct-to-consumer monitoring, reports and scores. |]

[removed: 2017] [added: 2017] Cybersecurity [removed: Incident][added: Incident]

[removed: In March 2017, the U.S. Department of Homeland] Security distributed a notice concerning the software vulnerability.

[added: We undertook efforts to identify and remediate vulnerable] systems; however, the vulnerability in the website application that was exploited was not identified by our security processes.

The Company has taken actions to provide consumers with tools to protect [added: their] credit data.

[removed: Our] [added: Our] Business [removed: Strategy][added: Strategy]

[removed: | • | Lead our industry in data security. Building on the progress we made following the 2017 cybersecurity incident, we are focused on becoming a leader in our industry in the effectiveness of our data and technology security practices.] This [removed: includes building an Equifax culture that considers data and technology security, and more broadly risk management, as a primary requirement in all decisions. This] also includes the extensive use of advanced data and technology security tools, techniques, services and processes in order to enhance our ability to protect the information with which we are entrusted from fraudulent access. [removed: |]

[removed: | • | Transform our technology. We plan to rebuild our technology infrastructure, accelerate our migration to a public cloud environment, employ virtual private cloud deployment techniques, and rationalize and rebuild our application portfolio using cloud-focused services. This technology transformation is a significant enabler to our goal of leading our industry in data and technology security capability.] Our goal is to deliver market-leading capabilities to our customers in terms of speed of bringing new products and services to market; ease of customer and partner implementation and integration; ease of consumer access to and interaction with [removed: Equifax, our systems and data;] [added: Equifax;] system resiliency and uptime; and ultimately cost to serve. [removed: We are approximately one year into our multi-year technology transformation, which is already broadly impacting our internal and external information technology systems. |]

[removed: | • | Lead] [added: - Lead] in data and analytics, to develop unparalleled analytical insights leveraging Equifax’s unique [removed: data.] [added: data.] We use proprietary advanced analytical platforms, including capabilities in machine learning and advanced visualization tools, to leverage our unique data to develop leading analytical insights that enhance the precision of our customers’ decisioning activities. [removed: We strive to continue to advance these capabilities through ongoing data monetization activities, the acquisition of distinctive and differentiated assets, and continued advancement of capabilities in artificial intelligence and machine learning. As part of our technology transformation, we are investing to simplify our customers’ access to our leading analytical platforms, in order to speed the development of unique insights and the conversion of these insights into new products and services consumable by our customers through our delivery platforms. |]

[added: We also develop] predictive scores and analytics, some of which leverage multiple data assets, to help clients acquire new customers and manage their existing customer relationships.

[removed: | • | Improve] [added: - Improve] the consumer user [removed: experience.] [added: experience.] Equifax understands the importance of providing consumers with user-friendly capabilities to see, understand and question their consumer credit file and information. [removed: As part of our technology transformation, we are rebuilding our digital and call center technology infrastructure to provide an experience focused on making consumers’ interactions with Equifax as effective and efficient as possible. |]

[removed: | • | Foster] [added: - Foster] a culture of customer [removed: centricity.] [added: centricity.] We are focused on building a culture in which the customer is at the center of our decision [removed: processes,] [added: processes] and we exceed customer expectations by delivering solutions with speed, flexibility, stability and performance. [removed: Our focus on customer centricity will enable us to be more proactive in solving problems better and faster for customers while delivering enhanced operational readiness to provide a better customer experience. |]

[removed: | • | Deliver growth while enhancing profitability and shareholder returns.] We [removed: strive to accelerate innovation through expanded customer focus and collaboration. We] intend to leverage our unique data assets and capabilities, as well as customer expertise and [added: customer] data and technology assets, to help us jointly create high-value analytical products and services targeted at a broader range of customer needs. [removed: We seek to expand partnerships in order to further broaden the key customer domains and verticals that our products and services are able to serve. |]

We continue to invest, including through acquisitions and partnerships, to expand our addressable [removed: markets,] [added: markets] and the data and capabilities we offer to solve customer challenges ranging from identity authentication to risk management.

[removed: | • | Build] [added: - Build] a world-class Equifax team by investing in talent to drive our strategy and promote a culture of [removed: innovation.] [added: innovation.] We attract top talent by providing opportunities to grow and lead within our company. [removed: We regularly undertake talent initiatives to engage, develop and retain our top talent. |]

[removed: Markets] [added: Markets] and [removed: Clients][added: Clients]

Our products and services serve clients across a wide range of verticals, including financial services, mortgage, [added: state and federal government,] employers, consumer, commercial, telecommunications, retail, automotive, utilities, brokerage, healthcare and insurance [removed: industries, as well as state and federal governments.][added: industries.]

Our revenue [removed: stream is] [added: streams are] highly diversified with our largest client providing less than 3% of total revenue.

[removed: ][added: ]

[removed: | (1) | Predominantly] [added: (1)Predominantly] sold to companies who serve the direct-to-consumer market and includes other small end user markets. [removed: Mortgage and auto resellers are excluded from this category as they are included within their respective categories above. |]

[removed: | (2) | Other] [added: (2)Other] includes revenue from other miscellaneous end-user markets. [removed: |]

Sales groups are based in [added: field offices located throughout the U.S., including] our headquarters in Atlanta, Georgia, and [removed: field offices located] in the [removed: U.S. and in the] countries where we have operations.

[removed: Our largest geographic global regions are the U.S.; Asia Pacific (Australia, New Zealand and India); Europe (the U.K., Spain and Portugal); Canada;] [added: products] and [removed: Latin America (Argentina,] [added: services generate revenue in Argentina, Australia, Canada,] Chile, Costa Rica, Ecuador, El Salvador, Honduras, [added: India,] Mexico, [added: New Zealand,] Paraguay, [removed: Peru] [added: Peru, Portugal, Spain, the U.K.] and [removed: Uruguay).][added: Uruguay.]

We also offer Equifax branded credit services in Russia [removed: and India] through [added: a] joint [removed: ventures,] [added: venture,] have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and the United Arab Emirates, [removed: and] have an investment in a consumer and commercial credit information company in [removed: Brazil.][added: Brazil and have an investment in an identity authentication company in Canada.]

We also provide information, technology and services to support debt collections and recovery [removed: management in Asia Pacific, Europe, Canada and Latin America.][added: management.]

Revenue from international clients, including end users and resellers, amounted to [removed: 29%] [added: 27%] of our total revenue in [removed: 2018,] [added: 2019,] 29% of our total revenue in [removed: 2017] [added: 2018] and [removed: 27%] [added: 29%] of our total revenue in [removed: 2016.][added: 2017.]

[removed: Products] [added: Products] and [removed: Services][added: Services]

| | [removed: USIS] | | [added: USIS] | | | | [removed: International] | | | | | | | | [removed: Workforce Solutions] | | | | | | [added: | | | | | | | | | | | | Workforce Solutions | | | | | | | | | | | | | | | | | | International | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| | [removed: Online] [added: | | Online] Information [removed: Solutions] [added: Solutions] | | [removed: Financial] [added: | | | | Financial] Marketing [removed: Services] [added: Services] | | [removed: Mortgage Services] | | [removed: Europe] | | [removed: Asia Pacific] [added: Mortgage Services] | | [removed: Latin America] | | [removed: Canada] | | [removed: Verification Services] [added: Verification Services] | | [removed: Employer Services] | | [removed: Global] [added: | | Employer Services | | | | | | Europe | | | | | | Asia Pacific | | | | | | Latin America | | | | | | Canada | | | | | | Global] Consumer [removed: Solutions] [added: Solutions] | | [added: | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| Online data | [added: | |] X | | | | [added: | | | | | | | |] X | | [added: | | | |] X | | [added: | | | | | | | | | |] X | | [added: | | | |] X | | [added: | | | |] X | | [added: | | | |] X | | | | [added: | |] X | | [added: | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| Portfolio management services | [added: | |] X | | [added: | | | |] X | | [added: | | | |] X | | [added: | | | |] X | | [added: | | | | | | | | | |] X | | [added: | | | |] X | | [added: | | | |] X | | [added: | | | |] X | | | | | | [added: | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

Workforce Solutions has recently established Verifications Service operations in Canada and is working toward a similar operation in Australia.

This operating segment is comprised of our Canada, Europe, Latin America and Asia Pacific business units.

In March 2017, the U.S. Department of Homeland

On February 10, 2020, the U.S. Department of Justice announced that four members of the Chinese People’s Liberation Army were indicted on criminal charges for their involvement in the 2017 cybersecurity incident.

Since then, the Company has been focused on implementing significant improvements to its data security systems, technology platforms and risk management processes, in an effort to underpin its business strategy.

- Lead our industry in data security. We are focused on becoming a leader in our industry in the effectiveness of our data and technology security practices.

This includes building an Equifax culture that considers data and technology security, and more broadly risk management, as a primary requirement in all decisions.

- Transform our technology. We are rebuilding our technology infrastructure, accelerating our migration to a public cloud environment, employing virtual private cloud deployment techniques, and rationalizing and rebuilding our application portfolio using cloud-native services.

This technology transformation is a significant part of our goal of leading our industry in data and technology security capability.

We are undergoing a multi-year technology transformation which is already broadly impacting our internal and external information technology systems.

We strive to continue to advance these capabilities through ongoing data monetization activities, the acquisition of distinctive and differentiated assets, and continued advancement of capabilities in artificial intelligence and machine learning.

As part of our technology transformation, we are investing to simplify our customers’ access to our leading analytical platforms, in order to speed the development of unique insights and the conversion of these insights into new products and services consumable by our customers through our delivery platforms.

As part of our

technology transformation, we are rebuilding our digital and call center technology infrastructure to provide an experience focused on making consumers’ interactions with Equifax as effective and efficient as possible.

Our focus on customer centricity will enable us to be more proactive in solving problems better and faster for customers while delivering enhanced operational readiness to provide a better customer experience.

- Deliver growth while enhancing profitability and shareholder returns. We strive to accelerate innovation through expanded customer focus and collaboration.

We seek to expand partnerships in order to further broaden the key customer domains and verticals that our products and services are able to serve.

We regularly undertake talent initiatives to engage, develop and retain our top talent.

Mortgage and auto resellers are excluded from this category as they are included within their respective categories above.

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

We also offer various government direct data services, where we process tax forms on behalf of our customers with the applicable government agency.

Workforce Solutions has established an income and employment verification service in Canada, known as Verification Exchange.

This operating segment’s

We also sell consumer credit information to resellers who may combine our information with other information to provide direct-to-consumer monitoring, reports and scores.

- Competition for our credit information solutions and direct-to-consumer solutions products varies by both application and industry, but generally includes two global consumer credit reporting companies, Experian and TransUnion, both of which offer a product suite similar to our credit information solutions.

In the U.S., LifeLock is a national provider of personal identity theft protection service.

Also, there are competitors offering free credit scores including Credit Karma in the U.S., Canada and the U.K., ClearScore in the U.K., and Credit Simple and Credit Savvy in Australia.

There are also a large number of competitors who offer competing products in specialized areas (such as fraud prevention, risk management and application processing and decisioning solutions) and software companies offering credit modeling services or analytical tools.

Our differentiators include our unique data assets, decisioning technology and the features and functionality of our analytical capabilities.

We emphasize our improved decision making and product quality while remaining competitive on price.

Our marketing services products also compete with the foregoing companies and others who offer demographic information products, including Acxiom, Harte-Hanks and Infogroup.

We also compete with Fair Isaac Corporation with respect to certain of our analytical tools and solutions.

- Competition in the Verification Services market includes employers who manage verifications in-house, lenders who obtain verifications directly from employers, and other online and offline verification companies, such as CCC Verify, Thomas & Company and First Advantage.

- Competition for our debt collection and recovery management software, services and analytics is similar to the competition for our consumer credit information solutions.

We believe that the breadth and depth of our data assets enable our clients to develop a more current and comprehensive view of consumers.

- FCRA - The Fair Credit Reporting Act (“FCRA”) regulates consumer reporting agencies, including us, as well as data furnishers and users of consumer reports such as banks and other companies.

FCRA provisions govern the accuracy, fairness and privacy of information in the files of consumer reporting agencies (“CRAs”) that engage in the practice of assembling or evaluating certain information relating to consumers for certain specified purposes.

The FCRA limits the type of information that may be reported by CRAs, limits the distribution and use of consumer reports and establishes consumer rights to access, freeze and dispute information in their credit files.

| | |

| --- | --- |

We undertook efforts to identify and remediate vulnerable

This included making its TrustedID® Premier service, an identity theft protection and credit file monitoring product, available for free to all U.S. consumers for twelve months for those who signed up by January 31, 2018.

In late 2018, the Company extended the free credit file monitoring services for impacted consumers in the U.S. using the free TrustedID Premier® service by providing them the opportunity to enroll in Experian® IDNotify™ at no cost for an additional twelve months.

Similarly, for impacted consumers in Canada and the U.K., we provided free credit reports and scores, credit monitoring and identity theft protection for twenty four months.

As part of our commitment to providing long-term resources and protections for consumers, in January 2018, the Company introduced Lock & Alert™, a mobile application enabled service that allows U.S. consumers to quickly lock and unlock their Equifax credit report for free, for life.

As a result of the 2017 cybersecurity incident, we are party to numerous lawsuits and governmental investigations.

See “Item 1A.

Risk Factors” and “Item 3.

Legal Proceedings” in this Form 10-K for more information regarding these lawsuits and investigations.

We also develop

We maintain support operations in the Republic of Ireland, Chile, Costa Rica, and India.

| | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

Online Information Solutions.

Mortgage Solutions.

Financial Marketing Services.

risk and maximize profitability; and to realize additional revenue from existing customers through more effective cross selling of additional products and services.

This operating segment’s products and services generate revenue in Argentina, Australia, Canada, Chile, Costa Rica, Ecuador, El Salvador, Honduras, India, Mexico, New Zealand, Paraguay, Peru, Portugal, Spain, the U.K. and Uruguay.

We offer consumer credit services in Russia and India through investments in joint ventures, have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and the United Arab Emirates, and have an investment in a consumer and commercial credit information company in Brazil.

Europe.

Asia Pacific.

Latin America.

Canada.

automate a variety of credit decisions.

Verification Services.

Employer Services.

The Work Number®.

Due to the 2017 cybersecurity incident we ceased advertising our consumer business in the U.S. in September 2017.

We resumed limited advertising of our consumer business in the U.S. in the fourth quarter of 2018.

Free Consumer Services

As part of our response to the 2017 cybersecurity incident, we made our TrustedID® Premier service, an identity theft protection and credit file monitoring product, available for free to all U.S. consumers for twelve months for those who signed up by January 31, 2018.

In late 2018, the Company extended the free credit file and identity monitoring services for impacted

consumers in the U.S. using the free TrustedID® Premier service, by providing them the opportunity to enroll in Experian® IDNotify™ at no cost for an additional twelve months.

Similarly, for consumers impacted by the 2017 cybersecurity incident in Canada and the U.K., we provided free credit reports and scores, credit monitoring, and identity theft protection for twenty four months.

We provide U.S. consumers with an annual free credit report and the ability to freeze and unfreeze their Equifax credit report for free in accordance with the Fair Credit Reporting Act.

Additionally, in January 2018, the Company introduced Lock & Alert™, a mobile application enabled service that allows U.S. consumers to quickly lock and unlock their Equifax credit report for free, for life.

| • | Competition for our credit information solutions and direct-to-consumer solutions products varies by both application and industry, but generally includes two global consumer credit reporting companies, Experian and TransUnion, both of which offer a product suite similar to our credit information solutions. In the U.S., LifeLock is a national provider of personal identity theft protection service. Also, there are competitors offering free credit scores including Credit Karma in the U.S. and the U.K., ClearScore in the U.K., and Credit Simple and Credit Savvy in Australia. There are also a large number of competitors who offer competing products in specialized areas (such as fraud prevention, risk management and application processing and decisioning solutions) and software companies offering credit modeling services or analytical tools. Our differentiators include our unique data assets, decisioning technology and the features and functionality of our analytical capabilities. We emphasize our improved decision making and product quality while remaining competitive on price. Our marketing services products also compete with the foregoing companies and others who offer demographic information products, including Acxiom, Harte-Hanks and infoGROUP. We also compete with Fair Isaac Corporation with respect to certain of our analytical tools and solutions. |

| • | FCRA - The Fair Credit Reporting Act (“FCRA”) regulates consumer reporting agencies, including us, as well as data furnishers and users of consumer reports such as banks and other companies. FCRA provisions govern the accuracy, fairness and privacy of information in the files of consumer reporting agencies (“CRAs”) that engage in the practice of assembling or evaluating certain information relating to consumers for certain specified purposes. The FCRA limits the type of information that may be reported by CRAs, limits the distribution and use of consumer reports and establishes consumer rights to access, freeze and dispute their credit files. CRAs are required to follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates and if a consumer disputes the accuracy of any information in the consumer’s file, to conduct a reasonable reinvestigation. CRAs are required to make available to consumers a free annual credit report and free credit freezes. The FCRA imposes many other requirements on CRAs, data furnishers and users of consumer report information. Violation of the FCRA can result in civil and criminal penalties. The FCRA contains an attorney fee shifting provision to provide an incentive for consumers to bring individual or class action lawsuits against a CRA for violations of the FCRA. Regulatory enforcement of the FCRA is under the purview of the United States Federal Trade Commission (“FTC”), the Consumer Financial Protection Bureau (“CFPB”), and state attorneys general, acting alone or in concert with one another. |

[removed: Litigation] [added: Litigation] and Investigations related to the 2017 Cybersecurity [removed: Incident][added: Incident]

[removed: Since] [added: Following] the 2017 cybersecurity incident, hundreds of class actions and other lawsuits [removed: have been] [added: were] filed against us typically alleging harm from the 2017 cybersecurity incident and seeking various remedies, including monetary and injunctive relief.

We dispute the allegations in the [removed: complaints described below] [added: remaining lawsuits] and intend to defend against such claims.

Set forth below are descriptions of the main categories of these [removed: lawsuits and investigations.][added: matters.]

The [removed: plaintiffs] [added: plaintiffs/claimants] in these [removed: cases, who purport to represent various classes of U.S. consumers and small businesses,] [added: cases have] generally [removed: claim] [added: claimed] to have been harmed by alleged actions and/or omissions by Equifax in connection with the 2017 cybersecurity incident and assert a variety of common law and statutory claims seeking [added: primarily] monetary [removed: damages, injunctive relief and other related relief.][added: damages.]

[removed: In addition, certain] [added: These] class actions [removed: have been filed by financial institutions that] allege [removed: their] [added: that the financial institutions’] businesses have been placed at risk due to the 2017 cybersecurity [removed: incident and] [added: incident,] generally assert [removed: various] common law claims such as claims for [removed: negligence and breach of contract,] [added: negligence,] as well as, in some cases, statutory [removed: claims.][added: claims and seek compensatory damages, injunctive relief and other related relief.]

[removed: Three] [added: The] Indian Tribes [removed: filed suits in federal court asserting putative class actions relating to the 2017 cybersecurity incident] brought [added: their claims purportedly] on behalf of themselves and other similarly situated federally recognized Indian Tribes and [removed: Nations.]

The [added: Company moved to dismiss the financial institutions’ consolidated class action complaint in its entirety, and the] MDL Court dismissed certain [removed: claims brought by the consumer and financial institution plaintiffs,] [added: claims,] while allowing other claims [removed: by those plaintiffs] to proceed.

[added: *Georgia State Court Consumer Class Actions.*] Four putative class actions arising from the 2017 cybersecurity incident were filed against us in Fulton County Superior Court and Fulton County State Court in Georgia based on similar allegations and theories as alleged in the U.S. [removed: consumer class actions pending in the] [added: Consumer] MDL [removed: Court] [added: Litigation] and seek monetary damages, injunctive relief and other related relief on behalf of Georgia citizens.

These cases [removed: have been] [added: were] transferred to a single judge in the Fulton County Business Court and three of the cases were consolidated into a single action.

[removed: Seven] [added: *Canadian Class Actions.* Eight] Canadian class actions, [removed: five] [added: six] of which are on behalf of a national class of approximately 19,000 Canadian consumers, have been filed against us in Ontario, Saskatchewan, [removed: Quebec and] [added: Quebec,] British [removed: Columbia.][added: Columbia and Alberta.]

[added: The plaintiffs in each case seek] class certification/authorization on behalf of Canadian consumers whose personal information was allegedly impacted by the 2017 cybersecurity incident.

In some cases, plaintiffs also seek class certification on behalf of [added: a larger group of] Canadian consumers who had contracts for subscription products with Equifax around the time of the [added: incident or earlier and were not impacted by the] incident.

[added: *Securities Class Action Litigation.*] A consolidated putative class action lawsuit alleging violations of [removed: various] [added: certain] federal securities laws in connection with statements and alleged omissions regarding our cybersecurity systems and controls [removed: is pending] [added: was filed] against us and [removed: certain of] our [removed: current and] former [removed: executives, officers] [added: Chairman] and [removed: directors] [added: Chief Executive Officer] in the U.S. District Court for the Northern District of Georgia.

[removed: The] Company moved to dismiss the [removed: consolidated class action] complaint in its entirety.

[added: *Shareholder Derivative Litigation.*] A consolidated putative shareholder derivative action naming certain of our current and former executives, officers and directors as defendants and naming us as a nominal defendant [removed: is pending] [added: was filed] in the U.S. District Court for the Northern District of Georgia.

We [removed: have] appointed a committee of independent directors [added: (the “Demand Review Committee”)] empowered to evaluate and respond in our best interests to the claims and related litigation demands.

[removed: Civil] [added: Separate civil] enforcement actions [removed: have been] [added: were] filed against us [added: in state court] by the [added: respective] Attorneys General of [removed: Massachusetts] [added: Indiana] and [removed: West Virginia] [added: Massachusetts] alleging violations of commonwealth/state consumer protection [removed: laws.][added: laws and seeking injunctive relief, civil penalties, restitution, costs and other relief.]

[removed: Over 1,000] [added: *Individual Consumer Litigation.* We have several hundred] individual consumer [removed: actions, including multi-plaintiff actions, have been filed] [added: actions pending] against us in state (general jurisdiction and small claims) and federal courts across the U.S. related to the 2017 cybersecurity incident.

Where possible, actions filed in [removed: federal court] or removed to federal court [removed: have been] [added: were] noticed for transfer to the MDL Court.

The New York State Attorney General Investor Protection Bureau (“IPB”) issued a subpoena [removed: on] [added: in] September [removed: 20,] 2017 relating to [removed: an] [added: its] investigation of whether there has been a violation of the Martin Act.

Although we [removed: are actively cooperating with] [added: continue to cooperate in] the above investigations and inquiries, an adverse outcome to any such investigations and inquiries could subject us to fines or other obligations, which may have an adverse effect on how we operate our business or our results of operations.

[removed: ACCC Investigation][added: ACCC Investigation]

In March 2017, the [removed: Australian Competition and Consumer Commission (the “ACCC”)] [added: ACCC] commenced an investigation to determine whether the Company has been or is engaged in unlawful acts or practices relating to advertising, marketing and sale of consumer reports, credit scores or credit monitoring products in violation of the Australian Consumer Law, which prohibits misleading or deceptive conduct and false representations.

[removed: California] [added: California] Bankruptcy [removed: Litigation][added: Litigation]

[removed: Other][added: Other]

We were also subject to investigations and inquiries by federal, state and foreign governmental agencies and officials regarding the 2017 cybersecurity incident and related matters.

As described below, most of these lawsuits and government investigations have concluded or been resolved, including pursuant to the settlement agreements described below, while others remain ongoing.

The Company’s participation in these settlements does not constitute an admission by the Company of any fault or liability, and the Company does not admit fault or liability.

Consumer Settlement.

On July 19, 2019 and July 22, 2019, we entered into multiple agreements that resolve the U.S. consolidated consumer class action cases, captioned *In re: Equifax, Inc. Customer Data Security Breach Litigation, MDL No. 2800 (Consumer Cases)* (the “U.S. Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the MSAG Group and the NYDFS (collectively, the “Consumer Settlement”).

Under the terms of the Consumer Settlement, the Company will contribute $380.5 million to a non-reversionary settlement fund (the “Consumer Restitution Fund”) to provide restitution for U.S. consumers identified by the Company whose personal information was compromised as a result of the 2017 cybersecurity incident.

The Consumer Restitution Fund will be used to (1) compensate affected consumers for certain unreimbursed costs or expenditures incurred by affected consumers that are fairly traceable to the 2017 cybersecurity incident, (2) provide affected consumers with an opportunity to enroll in at least four years of credit monitoring services provided by a third party unaffiliated with the Company or alternative compensation for affected consumers who already have other credit monitoring services, (3) provide affected consumers with additional benefits such as identity restoration services and (4) pay reasonable attorneys’ fees and reasonable costs and expenses for the plaintiffs’ counsel in the U.S. Consumer MDL Litigation (not to exceed $80.5 million) and administrative and notice costs.

The Company has agreed to contribute up to an additional $125.0 million to the Consumer Restitution Fund to cover unreimbursed costs and expenditures described in (1) above in the event the $380.5 million in the Consumer Restitution Fund is exhausted.

In accordance with the terms of the Consumer Settlement, in the third quarter of 2019, the Company paid $180.5 million to the MSAG Group and the following monetary penalties: (1) $100.0 million to the CFPB and (2) $10.0 million to the NYDFS.

As part of the Consumer Settlement, the Company also agreed to implement certain business practice commitments related to consumer assistance and its information security program, including conducting third party assessments of its information security program.

In the third quarter of 2019, the agreements with the FTC and CFPB were approved by the U.S. District Court for the Northern District of Georgia.

The settlement with the MSAG Group, which consists of substantially similar agreements with each of the participating jurisdictions, was approved by courts in the relevant jurisdiction also in the third quarter of 2019.

On January 13, 2020, the Northern District of Georgia, the U.S. District Court overseeing centralized pre-trial proceedings for the U.S. Consumer MDL Litigation and numerous other federal court actions relating to the 2017 cybersecurity incident (the “MDL Court”), entered an order granting final approval of the settlement in connection with the U.S. Consumer MDL Litigation, from which several objectors have appealed.

Until the appeals are finally adjudicated or dismissed, we can provide no assurance that the U.S. Consumer MDL Litigation will be resolved as contemplated by the settlement agreement.

If the MDL Court’s order approving the settlement were reversed by an appellate court, there is a risk that we would not be able to settle the U.S. Consumer MDL Litigation on acceptable terms or at all, which could have a material adverse effect on our financial condition.

Other Settlements.

The

On February 12, 2020, we entered into a settlement agreement to resolve the securities class action lawsuit in which the Company agreed to create a settlement fund for the benefit of class members.

The settlement is subject to a number of conditions, including certification of a settlement class, notice, and preliminary and final court approvals.

We can provide no assurance that all conditions will be satisfied or that the necessary court approvals will be obtained.

On February 12, 2020, the Company, by and through the Demand Review Committee, and individual defendants entered into a settlement agreement with the plaintiffs which, subject to court approval, will resolve the matter by agreeing to adopt certain governance changes and obtaining an insurance recovery for the Company.

We can provide no assurance that the necessary court approvals will be obtained.

*Government Lawsuits*.

The Company filed motions to dismiss the actions which were denied.

On December 26, 2019, we filed a motion asking the court in the Indiana action to certify its order denying our motion to dismiss for interlocutory appeal, and that motion was granted on February 6, 2019.

The Company has reached an agreement in principle with each of the Attorneys General of Massachusetts and Indiana to resolve their actions.

These settlements, in which the Company has agreed to make a monetary payment and to injunctive relief consistent with the MSAG Group settlement, are subject to finalizing definitive settlement agreements and court approval in each respective jurisdiction.

*Financial Institutions MDL Class Action*.

Certain class actions were filed by financial institutions and transferred to the MDL Court (the “Financial Institutions MDL Litigation”).

The financial institution plaintiffs filed a motion to amend their class action complaint which was granted in part and denied in part on December 18, 2019.

The majority of the claims which the financial institutions sought to revive by amendment, however, remained dismissed.

The Company has reached an agreement in principle to enter into a class-wide settlement of the remaining financial institutions’ claims.

Upon submission of the final settlement documents and necessary court approvals, the settlement will resolve any remaining claims that could be asserted by the financial institutions before the MDL Court.

The settlement contemplates payment for claims up to a maximum amount and certain non-monetary relief.

The settlement is subject to a number of conditions, including notice, and preliminary and final court approvals.

We can provide no assurance that all conditions will be satisfied or that the necessary court approvals will be obtained.

*Pennsylvania State Court Financial Institution Class Action.* One of the initial named plaintiffs in Financial Institutions MDL Litigation filed a purported class action suit against us in the Court of Common Pleas of Lawrence County, Pennsylvania on behalf of financial institutions headquartered in Pennsylvania.

The claims being asserted in this matter are substantially similar to claims that previously were dismissed in the MDL proceeding for lack of standing.

We filed preliminary objections to the complaint on September 5, 2019, and a hearing on the preliminary objections is scheduled for June 29, 2020.

The Company has reached an agreement in principle to resolve this matter.

In addition, numerous governmental agencies are investigating us in connection with the 2017 cybersecurity incident, which may result in fines, settlements or other relief.

Multidistrict Litigation.

Hundreds of class actions were filed against us in federal and state courts relating to the 2017 cybersecurity incident.

The financial institution class actions seek compensatory damages, injunctive relief and other related relief.

Furthermore, a lawsuit has been filed against us by the City of Chicago with respect to the 2017 cybersecurity incident alleging violations of state laws and local ordinances governing protection of personal data, consumer fraud, breach notice requirements and business practices and seeking declaratory and injunctive relief and the imposition of fines the aggregate amount of which the complaint does not specifically quantify.

Additionally, the Commonwealth of Puerto Rico filed an action on its own behalf and on behalf of the people of Puerto Rico arising out of the 2017 cybersecurity incident.

Beginning on December 6, 2017 and pursuant to multiple subsequent orders, the U.S. Judicial Panel on Multidistrict Litigation ordered the consolidation and transfer for pre-trial proceedings with respect to the U.S. cases pending in federal court discussed above, including the City of Chicago action, the Indian Tribal suits, and the Puerto Rico action, to the Northern District of Georgia as the single U.S. District Court for centralized pre-trial proceedings (the “MDL Court”).

Based on these orders, consolidated proceedings with respect to U.S. consumer and financial institution federal class actions and other lawsuits related to the 2017 cybersecurity incident have been conducted in the MDL Court.

The MDL Court has established separate tracks for the consumer and financial institution class action cases and appointed lead counsel on behalf of plaintiffs in both tracks.

Certain individual plaintiffs with cases pending in the MDL consolidated proceedings, including Puerto Rico and the City of Chicago, have sought the establishment of additional tracks and other related relief.

The MDL Court has not yet ruled on those requests.

The Company moved to dismiss the consolidated class action complaints filed by the U.S. consumer, small business and financial institution plaintiffs in their entirety.

On January 28, 2019, the MDL Court dismissed the small businesses’ consolidated class action complaint in its entirety.

Pursuant to case management orders issued by the MDL Court, consolidated pre-trial proceedings, including discovery between the parties, will proceed on the remaining claims of the U.S. consumer and financial institution plaintiffs.

Georgia State Court Consumer Class Actions.

Canadian Class Actions.

The plaintiffs in each case seek

All purported class actions are at preliminary stages, and we are opposing class certification or authorization in cases where such motions are pending.

TransUnion Litigation.

On November 27, 2017, Trans Union LLC and TransUnion Interactive, Inc. (collectively, “TransUnion”) filed a lawsuit in the U.S. District Court for the Northern District of Illinois against Equifax Information Services LLC, Equifax Inc., and Equifax Consumer Services LLC f/k/a Equifax Consumer Services, Inc. In its lawsuit, TransUnion asserts claims for declaratory relief, breach of contract, and anticipatory repudiation of contract based on our Reciprocal Data Supply Agreement (the “Agreement”), which sets forth the pricing terms for credit monitoring supplied by the parties to each other.

TransUnion seeks a declaration regarding its contractual rights under the Agreement and monetary damages.

On January 26, 2018, we moved to dismiss TransUnion’s claims.

On June 19, 2018, the court granted in part and denied in part our motion to dismiss, dismissing Equifax Inc. from the case.

Discovery has now commenced and is scheduled to end in March 2019.

We dispute the allegations by TransUnion and intend to defend against its claims.

Securities Class Action Litigation.

Pursuant to scheduling and case management orders issued by the court, pre-trial proceedings, including discovery between the parties, will proceed on the remaining claims.

Shareholder Derivative Litigation.

Government Lawsuits.

In addition to the City of Chicago’s and Commonwealth of Puerto Rico’s lawsuits in the MDL Court, the City of San Francisco filed a lawsuit against us in Superior Court in the City of San Francisco on behalf of the People of the State of California alleging violations of California’s unfair competition law due to purported violations of statutory protections of personal data and statutory data breach requirements and seeking statutory penalties, injunctive relief, and restitution for California consumers, among other relief.

The court has stayed the City of San Francisco action until March 29, 2019.

The Massachusetts action is pending in Suffolk Superior Court and seeks permanent injunctive relief, civil penalties, restitution, disgorgement of profits, costs and attorneys’ fees.

The Suffolk Superior Court denied the Company’s motions to stay and dismiss the case, and the case is in discovery.

The West Virginia action is pending in the Circuit Court of Boone County and seeks civil penalties and attorneys’ fees.

Equifax’s motion to stay proceedings was granted on a temporary basis on December 21, 2018, and then continued on January 24, 2019, with the court scheduling a further hearing for February 28, 2019.

The lawsuit filed by the Attorney General of Puerto Rico was transferred to the MDL proceeding, as described above.

The Puerto Rico Department of Consumer Affairs has issued Notices of Infraction related to the Company’s alleged failure to give timely notice of the data breach under Puerto Rico law to the Department and Puerto Rico consumers.

Individual Consumer Litigation.

These claims include more than 2,500 individual plaintiffs.

In addition, there are approximately 50 individual arbitration claims.

[removed: UNITED STATES][added: UNITED STATES]

[removed: SECURITIES] [added: SECURITIES] AND EXCHANGE [removed: COMMISSION][added: COMMISSION]

[removed: FORM 10-K][added: FORM 10-K]

[removed: |] ☒ [removed: |] ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 [removed: |]

For the fiscal year ended December 31, [removed: 2018][added: 2019]

[removed: |] ☐ [removed: |] TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 [removed: |]

[removed: EQUIFAX INC.][added: EQUIFAX INC.]

| Georgia | | [added: | | | |] 58-0401110 | [added: | |]

| (State or other jurisdiction of incorporation or organization) | | [added: | | | |] (I.R.S. Employer Identification No.) | [added: | |]

| 1550 Peachtree [removed: Street,] [added: Street | | |] N.W. | | | [added: Atlanta | | | Georgia | | | | | | 30309 | | | | | | | | | | | |]

| (Address of principal executive offices) | | [added: | | | | | | | | | | | | | | | | | | | | | |] (Zip Code) | [added: | |]

| Title of each class | | [added: | | | | Trading Symbol | | | | | |] Name of each exchange on which registered | [added: | |]

| Common Stock, $1.25 par value per share | | [added: | | | | EFX | | | | | |] New York Stock Exchange | [added: | |]

| ☒ [added: | | |] Large accelerated filer | | [added: | | | |] ☐ [added: | | |] Accelerated filer | | [added: | | | |] ☐ [added: | | |] Non-accelerated filer | | [added: | | | |] ☐ [added: | | |] Smaller reporting company | | [added: | | | |] ☐ [added: | | |] Emerging growth company | [added: | |]

As of June 30, [removed: 2018,] [added: 2019,] the aggregate market value of Registrant’s common stock held by non-affiliates of Registrant was approximately [removed: $15,064,356,603] [added: $16,348,175,266] based on the closing sale price as reported on the New York Stock Exchange.

At January 31, [removed: 2019,] [added: 2020,] there were [removed: 120,699,888] [added: 121,235,722] shares of Registrant’s common stock outstanding.

[removed: DOCUMENTS] [added: DOCUMENTS] INCORPORATED BY [removed: REFERENCE][added: REFERENCE]

Portions of Registrant’s definitive proxy statement for its [removed: 2019] [added: 2020] annual meeting of shareholders are incorporated by reference in Part III of this Form 10-K.

[removed: TABLE] [added: TABLE] OF [removed: CONTENTS][added: CONTENTS]

| | | [removed: Page] | [added: | | | Page | | |]

| [PART [removed: I](#sB3485942E1925276A581D62C40DEC0E2)] [added: I](#i_0_10)] | | | [added: | | | | | |]

| [Item [removed: 1.](#s6CEF638C65FE5BDCBA68F0FF81CF4185)] [added: 1.](#i_0_13)] | [removed: [Business](#s6CEF638C65FE5BDCBA68F0FF81CF4185)] | [removed: [2](#s6CEF638C65FE5BDCBA68F0FF81CF4185)] | [added: [Business](#i_0_13) | | | [2](#i_0_13) | | |]

| [Item [removed: 1A.](#s2CD171311EAB51079D318CDF03CE8730)] [added: 1A.](#i_0_49)] | [added: | |] [Risk [removed: Factors](#s2CD171311EAB51079D318CDF03CE8730)] [added: Factors](#i_0_49)] | [removed: [15](#s2CD171311EAB51079D318CDF03CE8730)] | [added: | [15](#i_0_49) | | |]

| [Item [removed: 1B.](#s711B2A9D35DD5EAEB35AAC83B81B938C)] [added: 1B.](#i_0_52)] | [added: | |] [Unresolved Staff [removed: Comments](#s711B2A9D35DD5EAEB35AAC83B81B938C)] [added: Comments](#i_0_52)] | [removed: [26](#s711B2A9D35DD5EAEB35AAC83B81B938C)] | [added: | [25](#i_0_52) | | |]

| [Item [removed: 2.](#s82245D1210C55515BBBC0D18598C41AF)] [added: 2.](#i_0_55)] | [removed: [Properties](#s82245D1210C55515BBBC0D18598C41AF)] | [removed: [26](#s82245D1210C55515BBBC0D18598C41AF)] | [added: [Properties](#i_0_55) | | | [25](#i_0_55) | | |]

| [Item [removed: 3.](#s7A87BF89CE525F14A7F6526015997D0B)] [added: 3.](#i_0_58)] | [added: | |] [Legal [removed: Proceedings](#s7A87BF89CE525F14A7F6526015997D0B)] [added: Proceedings](#i_0_58)] | [removed: [27](#s7A87BF89CE525F14A7F6526015997D0B)] | [added: | [26](#i_0_58) | | |]

| [Item [removed: 4.](#sD8270E2A71CF5CCA9B0CB2E8F55FC74B)] [added: 4.](#i_0_61)] | [added: | |] [Mine Safety [removed: Disclosures](#sD8270E2A71CF5CCA9B0CB2E8F55FC74B)] [added: Disclosures](#i_0_61)] | [removed: [30](#sD8270E2A71CF5CCA9B0CB2E8F55FC74B)] | [added: | [29](#i_0_61) | | |]

| [PART [removed: II](#sE096ABAC29A95906B78BA7CA21F44096)] [added: II](#i_0_64)] | | | [added: | | | | | |]

| [Item [removed: 5.](#sDF04D797833255AE8F025E73FACAF4B2)] [added: 5.](#i_0_67)] | [added: | |] [Market for the Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity [removed: Securities](#sDF04D797833255AE8F025E73FACAF4B2)] [added: Securities](#i_0_67)] | [removed: [31](#sDF04D797833255AE8F025E73FACAF4B2)] | [added: | [30](#i_0_67) | | |]

| [Item [removed: 6.](#s2BB1D1B5D5F652908717EE3CB68179A6)] [added: 6.](#i_0_70)] | [added: | |] [Selected Financial [removed: Data](#s2BB1D1B5D5F652908717EE3CB68179A6)] [added: Data](#i_0_70)] | [removed: [33](#s2BB1D1B5D5F652908717EE3CB68179A6)] | [added: | [32](#i_0_70) | | |]

| [Item [removed: 7.](#s7518C0CC2CD752F3A7ECBE9A10F1F47C)] [added: 7.](#i_0_73)] | [added: | |] [Management’s Discussion and Analysis of Financial Condition and Results of [removed: Operations](#s7518C0CC2CD752F3A7ECBE9A10F1F47C)] [added: Operations](#i_0_73)] | [removed: [35](#s7518C0CC2CD752F3A7ECBE9A10F1F47C)] | [added: | [34](#i_0_73) | | |]

| [Item [removed: 7A.](#s4DA5A674B09D5FD6993698C7E762149C)] [added: 7A.](#i_0_91)] | [added: | |] [Quantitative and Qualitative Disclosures About Market [removed: Risk](#s4DA5A674B09D5FD6993698C7E762149C)] [added: Risk](#i_0_91)] | [removed: [58](#s4DA5A674B09D5FD6993698C7E762149C)] | [added: | [57](#i_0_91) | | |]

| [Item [removed: 8.](#s6C3FC24D24D852A7AA832F84A40C917C)] [added: 8.](#i_0_94)] | [added: | |] [Financial Statements and Supplementary [removed: Data](#s6C3FC24D24D852A7AA832F84A40C917C)] [added: Data](#i_0_94)] | [removed: [59](#s6C3FC24D24D852A7AA832F84A40C917C)] | [added: | [58](#i_0_94) | | |]

| [Item [removed: 9.](#s2991760D6A245FB9B1A4B5B1FF17F61F)] [added: 9.](#i_0_208)] | [added: | |] [Changes in and Disagreements with Accountants on Accounting and Financial [removed: Disclosure](#s2991760D6A245FB9B1A4B5B1FF17F61F)] [added: Disclosure](#i_0_208)] | [removed: [115](#s2991760D6A245FB9B1A4B5B1FF17F61F)] | [added: | [115](#i_0_208) | | |]

| [Item [removed: 9A.](#sAB03EB669A325238AD3B99C26A605024)] [added: 9A.](#i_0_211)] | [added: | |] [Controls and [removed: Procedures](#sAB03EB669A325238AD3B99C26A605024)] [added: Procedures](#i_0_211)] | [removed: [115](#sAB03EB669A325238AD3B99C26A605024)] | [added: | [115](#i_0_211) | | |]

| [Item [removed: 9B.](#s716C0559AED952B5A1B379A639136798)] [added: 9B.](#i_0_214)] | [added: | |] [Other [removed: Information](#s716C0559AED952B5A1B379A639136798)] [added: Information](#i_0_214)] | [removed: [115](#s716C0559AED952B5A1B379A639136798)] | [added: | [115](#i_0_214) | | |]

| [PART [removed: III](#sBB0F13ACA1145B7E9F12F08725D75C28)] [added: III](#i_0_217)] | | | [added: | | | | | |]

| [Item [removed: 10.](#s1E777C4C0B8453059A4FE08AA3CD3EAF)] [added: 10.](#i_0_220)] | [added: | |] [Directors, Executive Officers and Corporate [removed: Governance](#s1E777C4C0B8453059A4FE08AA3CD3EAF)] [added: Governance](#i_0_220)] | [removed: [116](#s1E777C4C0B8453059A4FE08AA3CD3EAF)] | [added: | [116](#i_0_220) | | |]

| [Item [removed: 11.](#s5073E0983CDD57EA978AD7D0CF09AB4D)] [added: 11.](#i_0_223)] | [added: | |] [Executive [removed: Compensation](#s5073E0983CDD57EA978AD7D0CF09AB4D)] [added: Compensation](#i_0_223)] | [removed: [117](#s5073E0983CDD57EA978AD7D0CF09AB4D)] | [added: | [117](#i_0_223) | | |]

| [Item [removed: 12.](#sB9815A93D5EA5AA8BAA0BBBBAB198D8D)] [added: 12.](#i_0_226)] | [added: | |] [Security Ownership of Certain Beneficial Owners and Management and Related Stockholder [removed: Matters](#sB9815A93D5EA5AA8BAA0BBBBAB198D8D)] [added: Matters](#i_0_226)] | [removed: [117](#sB9815A93D5EA5AA8BAA0BBBBAB198D8D)] | [added: | [117](#i_0_226) | | |]

| | | | | | | | | |

| | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | | | | | | |

| | | | | | | | | |

| | | | | | | | | |

| | | | [Signatures](#i_0_247) | | | [122](#i_0_247) | | |

10-K 1 efx10k20181231.htm 10-K

| | |

| --- | --- |

| | | |

| --- | --- | --- |

| Atlanta, Georgia | | 30309 |

Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of Regulation S-K is not contained herein, and will not be contained, to the best of Registrant’s knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any amendment to this Form 10-K.

| | [Signatures](#s664C52B84DAC5804825E9E2E05518D78) | [121](#s664C52B84DAC5804825E9E2E05518D78) |

We ordinarily lease office space for conducting our business and are obligated under approximately [removed: 100] [added: 85] leases and other rental arrangements for our field locations.

We owned 8 office buildings at December 31, [removed: 2018,] [added: 2019,] including our executive offices, one campus which houses our Alpharetta, Georgia [removed: data] [added: technology] center, a building utilized by our Workforce Solutions operations located in St. Louis, Missouri, as well as three buildings utilized by our Latin America [removed: operations located in Mexico City, Mexico and Asuncion, Paraguay.][added: operations.]

[removed: PART II][added: PART II]

Equifax’s common stock is traded on the New York Stock Exchange under the symbol “EFX.” As of January 31, [removed: 2019,] [added: 2020,] Equifax had approximately [removed: 3,330] [added: 3,121] holders of record; however, Equifax believes the number of beneficial owners of common stock exceeds this number.

[removed: Shareholder] [added: Shareholder] Return Performance [removed: Graph][added: Graph]

The graph assumes that the value of the investment in our Common Stock and each index was $100 on the last trading day of [removed: 2013] [added: 2014] and that all quarterly dividends were reinvested without commissions.

[removed: COMPARATIVE] [added: COMPARATIVE] FIVE-YEAR CUMULATIVE TOTAL RETURN AMONG EQUIFAX INC., S&P 500 INDEX, AND S&P 500 BANKS INDEX (INDUSTRY [removed: GROUP)][added: GROUP)]

[removed: ][added: ]

| | [removed: Fiscal] [added: | | Fiscal] Year Ended December [removed: 31,] [added: 31,] | | | | | | | | | | | | | | | | | [added: | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| | [removed: Initial] | | [added: Initial] | [removed: 2014] | | | [removed: 2015] | | [added: 2015] | [removed: 2016] | | | [removed: 2017] | | [added: 2016] | [removed: 2018] | | [added: | | | 2017 | | | | | | 2018 | | | | | | 2019 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| Equifax Inc. | [added: | |] 100.00 | | | [removed: 153.68] | | | 214.06 | | | [added: | | |] 226.90 | | | [added: | | |] 228.22 | | | [added: | | |] 143.32 | | [added: | | | | 183.98 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| S&P 500 Index | [added: | |] 100.00 | | | [removed: 150.51] | | | 152.59 | | | [added: | | |] 169.24 | | | [added: | | |] 205.24 | | | [added: | | |] 150.33 | | [added: | | | | 173.86 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| S&P 500 Banks Index (Industry Group) | [added: | |] 100.00 | | | [removed: 149.79] | | | 148.23 | | | [added: | | |] 178.13 | | | [added: | | |] 214.75 | | | [added: | | |] 148.30 | | [added: | | | | 180.55 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

The table below contains information with respect to purchases made by or on behalf of Equifax of its common stock during the fourth quarter ended December 31, [removed: 2018:][added: 2019:]

[removed: Issuer] [added: Issuer] Purchases of Equity [removed: Securities][added: Securities]

| Period | | [removed: Total] [added: | | | | Total] Number of Shares [removed: Purchased] [added: Purchased] (1) | | | [removed: Average] [added: | | | Average] Price Paid Per [removed: Share] [added: Share] (2) | | | | [removed: Total] [added: | | Total] Number of Shares Purchased as Part of Publicly-Announced Plans or [removed: Programs] [added: Programs] | | | [removed: Maximum] [added: | | | Maximum] Number (or Approximate Dollar Value) of Shares that May Yet Be Purchased Under the Plans or [removed: Programs] [added: Programs] (3) | | |

| October 1 - October 31, [removed: 2018] [added: 2019] | | [removed: 540] | | | [added: | 1 | | | | | |] $ | — | | | [added: | |] — | | | [added: | | |] $ | 590,092,166 | |

| November 1 - November 30, [removed: 2018] [added: 2019] | | [removed: 295] | | | [added: | 176 | | | | | |] $ | — | | | [added: | |] — | | | [added: | | |] $ | 590,092,166 | |

| December 1 - December 31, [removed: 2018] [added: 2019] | | [removed: 7,044] | | | [added: | 4,970 | | | | | |] $ | — | | | [added: | |] — | | | [added: | | |] $ | 590,092,166 | |

| Total | | [removed: 7,879] | | | [added: | 5,147 | | | | | |] $ | — | | | [added: | |] — | | | [added: | | |] $ | 590,092,166 | |

[removed: |] (1) [removed: |] The total number of shares purchased includes, if applicable: (a) shares purchased pursuant to our publicly-announced share repurchase program, or Program; and (b) shares surrendered, or deemed surrendered, in satisfaction of the exercise price and/or to satisfy tax withholding obligations in connection with the exercise of employee stock options and vesting of restricted stock, totaling [removed: 540 shares] [added: 1 share] for the month of October [removed: 2018, 295] [added: 2019, 176] shares for the month of November [removed: 2018] [added: 2019] and [removed: 7,044] [added: 4,970] shares for the month of December [removed: 2018. |][added: 2019.]

[removed: |] (2) [removed: |] Average price paid per share for shares purchased as part of our Program (includes brokerage commissions). [removed: |]

[removed: | (3) | We did not repurchase any common shares during the twelve months ended December 31, 2018.] At December 31, [removed: 2018,] [added: 2019,] the amount authorized for future share repurchases under the Program was $590.1 million. [removed: |]

Information relating to compensation plans under which the Company’s equity securities are authorized for issuance is included in the section captioned “Equity Compensation Plan Information” in our [removed: 2019] [added: 2020] Proxy Statement and is incorporated herein by reference.

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

(3) We did not repurchase any common shares during the twelve months ended December 31, 2019.

| | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | |

| --- | --- |

The summary of operations data for the years ended December 31, [added: 2019,] 2018, [removed: 2017,] and [removed: 2016,] [added: 2017,] and the balance sheet data as of December 31, [removed: 2018] [added: 2019] and [removed: 2017,] [added: 2018,] have been derived from our audited Consolidated Financial Statements included in this report.

The summary of operations data for the years ended December 31, [removed: 2015] [added: 2016] and [removed: 2014,] [added: 2015,] and the balance sheet data as of December 31, [removed: 2016, 2015] [added: 2017, 2016] and [removed: 2014,] [added: 2015,] have been derived from our audited Consolidated Financial Statements not included in this report.

| | [removed: Twelve] [added: | | Twelve] Months Ended December [removed: 31,] [added: 31,] | | | | | | | | | | | | | | | | | | | [added: | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| | [removed: 2018] [added: | | 2019] (1) (2) | | | | [removed: 2017] [added: | | 2018 (2)] (3) [added: | | | | | | 2017 (2)] (4) | | | | [added: | |] 2016 (5) | | | | [added: | |] 2015 [added: (3)] (6) [removed: (7)] | | | | [removed: 2014 (8)] | | | [added: | | | | | | | | | | | | | | | | | | | |]

| | [removed: (In] [added: | | *(In] millions, except per share [removed: data)] [added: data)*] | | | | | | | | | | | | | | | | | | | [added: | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| Summary of Operations: | | | | | | | | | | | | | | | | | | | | [added: | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| Operating revenue | [added: | | $ | 3,507.6 | | | | |] $ | 3,412.1 | | | [added: | |] $ | 3,362.2 | | | [added: | |] $ | 3,144.9 | | | [added: | |] $ | 2,663.6 | | | [removed: $] | [removed: 2,436.4] | | [added: | | | | | | | | | | | | | | | | | | | |]

| Operating expenses | [added: | | 3,843.0 | | | | | |] 2,964.1 | | | | [added: | |] 2,530.5 | | | | [added: | |] 2,319.8 | | | | [added: | |] 1,963.6 | | | | [removed: 1,794.5] | | | [added: | | | | | | | | | | | | | | | | | | | |]

| Operating [added: (loss)] income | [added: | | (335.4) | | | | | |] 448.0 | | | | [added: | |] 831.7 | | | | [added: | |] 825.1 | | | | [added: | |] 700.0 | | | | [removed: 641.9] | | | [added: | | | | | | | | | | | | | | | | | | | |]

| Consolidated [added: (loss)] income from continuing operations | [added: | | (392.8) | | | | | |] 306.3 | | | | [added: | |] 598.0 | | | | [added: | |] 495.1 | | | | [added: | |] 434.8 | | | | [removed: 374.0] | | | [added: | | | | | | | | | | | | | | | | | | | |]

| Net [added: (loss)] income attributable to Equifax | [added: | | $ | (398.8) | | | | |] $ | 299.8 | | | [added: | |] $ | 587.3 | | | [added: | |] $ | 488.8 | | | [added: | |] $ | 429.1 | | | [removed: $] | [removed: 367.4] | | [added: | | | | | | | | | | | | | | | | | | | |]

| Dividends paid to Equifax shareholders | [added: | | $ | 188.7 | | | | |] $ | 187.9 | | | [added: | |] $ | 187.4 | | | [added: | |] $ | 157.6 | | | [added: | |] $ | 137.8 | | | [removed: $] | [removed: 121.2] | | [added: | | | | | | | | | | | | | | | | | | | |]

| Diluted earnings per share | | | | | | | | | | | | | | | | | | | | [added: | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| Net [added: (loss)] income attributable to Equifax | [added: | | $ | (3.27) | | | | |] $ | 2.47 | | | [added: | |] $ | 4.83 | | | [added: | |] $ | 4.04 | | | [added: | |] $ | 3.55 | | | [removed: $] | [removed: 2.97] | | [added: | | | | | | | | | | | | | | | | | | | |]

| Cash dividends declared per share | [added: | | $ | 1.56 | | | | |] $ | 1.56 | | | [added: | |] $ | 1.56 | | | [added: | |] $ | 1.32 | | | [added: | |] $ | 1.16 | | | [removed: $] | [removed: 1.00] | | [added: | | | | | | | | | | | | | | | | | | | |]

| Weighted-average shares outstanding (diluted) | [added: | | 122.0 | | | | | |] 121.4 | | | | [added: | |] 121.5 | | | | [added: | |] 121.1 | | | | [added: | |] 120.9 | | | | [removed: 123.5] | | | [added: | | | | | | | | | | | | | | | | | | | |]

| | [removed: As] [added: | | As] of December [removed: 31,] [added: 31,] | | | | | | | | | | | | | | | | | | | [added: | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| | [removed: (In millions)] | | [added: *(In millions)*] | | | | | | | | | | | | | | | | | [added: | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| Balance Sheet Data: | | | | | | | | | | | | | | | | | | | | [added: | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |]

| Total assets | [added: | | $ | 7,909.0 | | | | |] $ | 7,153.2 | | | [added: | |] $ | 7,233.4 | | | [added: | |] $ | 6,664.0 | | | [added: | |] $ | 4,501.5 | | | [removed: $] | [removed: 4,661.0] | | [added: | | | | | | | | | | | | | | | | | | | |]

| Short-term debt and current maturities | [added: | | 3.1 | | | | | |] 4.9 | | | | [added: | |] 965.3 | | | | [added: | |] 585.4 | | | | [added: | |] 49.3 | | | | [removed: 380.4] | | | [added: | | | | | | | | | | | | | | | | | | | |]

| Long-term debt, net of current portion | [added: | | 3,379.5 | | | | | |] 2,630.6 | | | | [added: | |] 1,739.0 | | | | [added: | |] 2,086.8 | | | | [added: | |] 1,138.4 | | | | [removed: 1,145.7] | | | [added: | | | | | | | | | | | | | | | | | | | |]

| Total debt, net | [added: | | 3,382.6 | | | | | |] 2,635.5 | | | | [added: | |] 2,704.3 | | | | [added: | |] 2,672.2 | | | | [added: | |] 1,187.7 | | | | [removed: 1,526.1] | | | [added: | | | | | | | | | | | | | | | | | | | |]

| Total equity | [added: | | 2,622.9 | | | | | |] 3,155.7 | | | | [added: | |] 3,239.0 | | | | [added: | |] 2,721.3 | | | | [added: | |] 2,350.4 | | | | [removed: 2,234.6] | | | [added: | | | | | | | | | | | | | | | | | | | |]

[removed: | (1) | During the year ended December 31, 2018, the Company recorded $401.2 million of pre-tax expenses related to the 2017 cybersecurity incident and insurance recoveries of $75.0 million for net expenses of $326.2 million.] Costs related to the 2017 cybersecurity incident are defined as incremental costs to transform our information technology infrastructure and data security; legal fees and professional services costs to investigate the 2017 cybersecurity incident and respond to legal, government and regulatory claims; as well as costs to provide [removed: the] free product [removed: and related support to the consumer. |]

[removed: | (2) | During] [added: (3)During] the fourth quarter of [removed: 2018,] [added: 2018 and the first quarter of 2015,] we recorded a restructuring charge of $46.1 million [added: and $20.7 million, respectively,] all of which is recorded in selling, general, and administrative expenses in our Consolidated Statements of [added: (Loss)] Income. [removed: The restructuring charge primarily relates to a reduction in headcount to support the Company’s strategic objectives and increase the integration of our global operations. For additional information, see Note 11 of the Notes to the Consolidated Financial Statements in this report. |]

[removed: | (5) | In the first quarter of 2016, we completed the acquisition of 100% of the ordinary voting shares of Veda for cash consideration plus debt assumed of approximately $1.9 billion. For the year ended December 31, 2016, we recorded $40.2 million ($28.2 million, net of tax) for Veda acquisition related amounts.] Of this amount, $30.1 million relates to transaction and integration costs in operating income, $9.2 million is recorded in other income and is the impact of foreign currency changes on the transaction structure, including [removed: the] economic hedges, $0.2 million is recorded in depreciation and amortization, and $0.7 million is recorded in interest expense. [removed: |]

[removed: | (7) | During the second quarter of 2015, the management of Boa Vista Servicos S.A. (“BVS”), in which we hold a 15% cost method investment, updated the financial projections of BVS. The updated projections, along with the continued weakness in the Brazilian consumer and small commercial credit markets were considered indicators of impairment.] As a result of these changes, and the associated near-term changes in cash flow expected from the business, we recorded a 46.0 million Brazilian Reais ($14.8 million) impairment of our investment. [removed: |]

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | 2019 (1) (2) | | | | | | 2018 (2) (3) | | | | | | 2017 (2) (4) | | | | | | 2016 (5) | | | | | | 2015 (3) (6) | | | | | | | | | | | | | | | | | | | | | | | | | | |

(1)During the year ended December 31, 2019, the Company recorded $800.9 million of losses, net of insurance recoveries, associated with certain legal proceedings and government investigations related to the 2017 cybersecurity incident, exclusive of our legal professional services expenses.

For additional information, see Note 6 of the Notes to the Consolidated Financial Statements in this report.

(2)During the years ended December 31, 2019, 2018 and 2017, the Company recorded $337.3 million, $326.2 million, and $114.0 million, respectively, of pre-tax expenses, net of cybersecurity insurance recoveries, for costs related to the 2017 cybersecurity incident.

and related support to consumers.

For additional information, see Note 6 of the Notes to the Consolidated Financial Statements in this report.

These restructuring charges primarily relate to a reduction in headcount to support the Company’s strategic objectives and increase the integration of our global operations.

For additional information, see Note 11 of the Notes to the Consolidated Financial Statements in this report.

(4)The Tax Cuts and Jobs Act of 2017 (“Tax Act”), as signed by the President of the United States on December 22, 2017, significantly revised U.S. tax law.

The legislation positively impacted the Company’s ongoing effective tax rate due to the reduction of the U.S. federal corporate tax rate from 35% to 21%.

The Tax Act made major changes to the U.S. international tax system.

Under previous law, foreign earnings were subject to U.S. tax when repatriated to the U.S. Under the Tax Act, foreign earnings are generally exempt from U.S. tax.

Additionally, there is a one-time deemed repatriation tax on undistributed foreign earnings and profits.

The Tax Act imposes other U.S. taxes on “global intangible low taxed income” and “base erosion anti-abuse transactions.” Other significant changes included limitations on the deductibility of interest expense and executive compensation, and repeal of the deduction for domestic production activities.

As a result of the Tax Act, the Company recorded adjustments totaling a net tax benefit of $48.3 million in the fourth quarter of 2017 to provisionally account for the estimated impact.

Refer to Note 7 of the Notes to the Consolidated Financial Statements in this Form 10-K for additional information.

We also prospectively applied the provisions of ASU 2016-09 “Compensation - Stock Compensation (Topic 718),” related to the recognition of windfall tax benefits in the Consolidated Statement of Income which resulted in the recognition of $26.7 million of tax benefits for the year ended December 31, 2017.

(5)In the first quarter of 2016, we completed the acquisition of 100% of the ordinary voting shares of Veda Group Limited (“Veda”) for cash consideration plus debt assumed of approximately $1.9 billion.

For the year ended December 31, 2016, we recorded $40.2 million ($28.2 million, net of tax) for Veda acquisition related amounts.

(6)During the second quarter of 2015, the management of Boa Vista Servicos S.A. (“BVS”), in which we hold a 15% cost method investment, updated the financial projections of BVS.

The updated projections, along with the continued weakness in the Brazilian consumer and small commercial credit markets were considered indicators of impairment.

| | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | |

| --- | --- |

| (3) | During the year ended December 31, 2017, the Company recorded $164.0 million of pre-tax expenses related to the 2017 cybersecurity incident and insurance recoveries of $50.0 million for net expenses of $114.0 million. Expenses include costs to investigate and remediate the 2017 cybersecurity incident and legal and other professional services related thereto, all of which were expensed as incurred. Additionally, as a result of the 2017 cybersecurity incident, we offered free credit file monitoring and identity theft protection to all U.S. consumers. We recorded the expenses necessary to provide this service to those who signed up during 2017. For additional information, see Note 6 of the Notes to the Consolidated Financial Statements in this report. |

| (4) | The Tax Cuts and Jobs Act of 2017 (“Tax Act”), as signed by the President of the United States on December 22, 2017, significantly revised U.S. tax law. The legislation positively impacted the Company’s ongoing effective tax rate due to the reduction of the U.S. federal corporate tax rate from 35% to 21%. The Tax Act made major changes to the U.S. international tax system. Under previous law, foreign earnings were subject to U.S. tax when repatriated to the U.S. Under the Tax Act, foreign earnings are generally exempt from U.S. tax. Additionally, there is a one-time deemed repatriation tax on undistributed foreign earnings and profits (the “transition tax”). The Tax Act imposes other U.S. taxes on “global intangible low taxed income” and “base erosion anti-abuse transactions.” Other significant changes included limitations on the deductibility of interest expense and executive compensation, and repeal of the deduction for domestic production activities. As a result of the current interpretation and estimated impact of the Tax Act, the Company recorded adjustments totaling a net tax benefit of $48.3 million in the fourth quarter of 2017 to provisionally account for the estimated impact. Refer to Note 7 of the Notes to the Consolidated Financial Statements in this Form 10-K for additional information. We also prospectively applied the provisions of ASU 2016-09 “Compensation - Stock Compensation (Topic 718),” related to the recognition of windfall tax benefits in the Consolidated Statement of Income which resulted in the recognition of $26.7 million of tax benefits for the year ended December 31, 2017. |

| (6) | In the first quarter of 2015, we recorded a $20.7 million restructuring charge ($13.2 million, net of tax) all of which was recorded in selling, general and administrative expenses on our Consolidated Statements of Income. This charge resulted from our continuing efforts to realign our internal resources to support the Company’s strategic objectives and increase the integration of our global operations. |

| (8) | During the first quarter of 2014, we acquired 100% of the stock of TDX, a data, technology and services company in the United Kingdom that specializes in debt collections and recovery management through the use of analytics, data exchanges and technology platforms. The results of this acquisition have been included in our USIS and International operating segments subsequent to the acquisition. |

| [removed: Index] [added: Index] to Financial [removed: Statements] [added: Statements] | | [added: | | | |]

| [Report of Independent Registered Public Accounting Firm on Internal Control over Financial [removed: Reporting](#sFC1FA9956B145D9FB76C8948508BB353)] [added: Reporting](#i_0_97)] | [removed: [60](#sFC1FA9956B145D9FB76C8948508BB353)] | [added: | [59](#i_0_97) | | |]

[removed: | [Report] [added: Report] of Independent Registered Public Accounting [removed: Firm](#s249321F8CA2D5976ADC29AF302C59958) | [61](#s249321F8CA2D5976ADC29AF302C59958) |][added: Firm]

| [Consolidated Statements of [added: (Loss)] Income for each of the three years in the period ended December 31, [removed: 2018](#s314E4ECBE013591796B4BD347FF2D7AE)] [added: 2019](#i_0_103)] | [removed: [62](#s314E4ECBE013591796B4BD347FF2D7AE)] | [added: | [63](#i_0_103) | | |]

| [Consolidated Statements of Comprehensive [added: (Loss)] Income for each of the three years in the period ended December 31, [removed: 2018](#sCBCAF4DDFC6B56D285941ECEDCCF81C3)] [added: 2019](#i_0_106)] | [removed: [63](#sCBCAF4DDFC6B56D285941ECEDCCF81C3)] | [added: | [64](#i_0_106) | | |]

| [Consolidated Balance Sheets at December 31, [removed: 2018] [added: 2019] and [removed: 2017](#s1617D262E13D5F6FB40B83017CC8D82C)] [added: 2018](#i_0_109)] | [removed: [64](#s1617D262E13D5F6FB40B83017CC8D82C)] | [added: | [65](#i_0_109) | | |]

| [Consolidated Statements of Cash Flows for each of the three years in the period ended December 31, [removed: 2018](#sCB095CAC1AF45BAAA4852F7C53A6AE94)] [added: 2019](#i_0_115)] | [removed: [65](#sCB095CAC1AF45BAAA4852F7C53A6AE94)] | [added: | [66](#i_0_115) | | |]

| [Consolidated Statements of Shareholders’ Equity and Other Comprehensive [added: (Loss)] Income for each of the three years in the period ended December 31, [removed: 2018](#s7B86D143DEBF580BAF8038EB0477CF2A)] [added: 2019](#i_0_118)] | [removed: [66](#s7B86D143DEBF580BAF8038EB0477CF2A)] | [added: | [67](#i_0_118) | | |]

[removed: | [Notes to Consolidated Financial Statements](#sA34EA2FFCA87526CAE10A43E3755F1E0) | [68](#sA34EA2FFCA87526CAE10A43E3755F1E0) |][added: NOTES TO CONSOLIDATED FINANCIAL STATEMENTS]

[removed: Report] [added: Report] of Independent Registered Public Accounting [removed: Firm][added: Firm]

[removed: Opinion] [added: Opinion] on Internal Control over Financial [removed: Reporting][added: Reporting]

We have audited Equifax Inc.’s internal control over financial reporting as of December 31, [removed: 2018,] [added: 2019,] based on criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (“2013 framework”) (the COSO criteria).

In our opinion, Equifax Inc. (the Company) maintained, in all material respects, effective internal control over financial reporting as of December 31, [removed: 2018,] [added: 2019,] based on the COSO criteria.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated balance sheets of the Company as of December 31, [removed: 2018] [added: 2019] and [removed: 2017,] [added: 2018,] the related consolidated statements of [added: (loss)] income, comprehensive [removed: income (loss),] [added: (loss) income,] cash flows, and shareholders’ equity and other comprehensive [removed: income(loss)] [added: income (loss)] for each of the three years in the period ended December 31, [removed: 2018,] [added: 2019,] and the related notes and financial statement schedule listed in the Index at Item 15(a)(2) (collectively referred to as the “consolidated financial statements”) and our report dated February [removed: 21, 2019] [added: 20, 2020] expressed an unqualified opinion thereon.