Equifax 10-Q 2021-09-30

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-Q

For the quarterly period ended September 30, 2021

OR

For the transition period from to .

Commission File Number: 001-06605

EQUIFAX INC.

(Exact name of registrant as specified in its charter)

404-885-8000

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer or a smaller reporting company. See definitions of “large accelerated filer,” “accelerated filer” and “smaller reporting company” in Rule 12b-2 of the Exchange Act. (Check one):

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act.

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

On October 8, 2021, there were 122,001,519 shares of the registrant’s common stock outstanding.

EQUIFAX INC.

QUARTERLY REPORT ON FORM 10-Q

QUARTER ENDED SEPTEMBER 30, 2021

INDEX

FORWARD-LOOKING STATEMENTS

This report contains information that may constitute “forward-looking statements.” Generally, the words “believe,” “expect,” “intend,” “estimate,” “anticipate,” “project,” “will,” “may” and similar expressions identify forward-looking statements, which generally are not historical in nature. All statements that address operating performance, events or developments that we expect or anticipate will occur in the future, including statements relating to future operating results, the 2017 cybersecurity incident, improvements in our information technology and data security infrastructure, including as a part of our cloud data and technology transformation, our strategy, our ability to mitigate or manage disruptions posed by COVID-19, the impact of COVID-19 and changes in U.S. and worldwide economic conditions that materially impact consumer spending, consumer debt and employment and the demand for Equifax's products and services, our culture, our ability to innovate, the market acceptance of new products and services and similar statements about our business plans are forward-looking statements. Management believes that these forward-looking statements are reasonable as and when made. However, forward-looking statements are subject to certain risks and uncertainties that could cause actual results to differ materially from the Company’s historical experience and our present expectations or projections. These risks and uncertainties include, but are not limited to, those described in Part II, “Item 1A. Risk Factors,” and elsewhere in our Annual Report on Form 10-K for the year ended December 31, 2020, as well as subsequent reports filed with the Securities and Exchange Commission. As a result of such risks and uncertainties, we urge you not to place undue reliance on any such forward-looking statements. Forward-looking statements speak only as of the date when made. We undertake no obligation to publicly update or revise any forward-looking statements, whether as a result of new information, future events or otherwise, except as required by law.

PART I. FINANCIAL INFORMATION

EQUIFAX INC.

CONSOLIDATED STATEMENTS OF INCOME

(Unaudited)

See Notes to Consolidated Financial Statements.

EQUIFAX INC.

CONSOLIDATED STATEMENTS OF INCOME

(Unaudited)

See Notes to Consolidated Financial Statements.

EQUIFAX INC.

CONSOLIDATED STATEMENTS OF COMPREHENSIVE INCOME (LOSS)

(Unaudited)

Showing the first 8K of 105K characters. Open the full section

As used herein, the terms Equifax, the Company, we, our and us refer to Equifax Inc., a Georgia corporation, and its consolidated subsidiaries as a combined entity, except where it is clear that the terms mean only Equifax Inc.

All references to earnings per share data in Management’s Discussion and Analysis, or MD&A, are to diluted earnings per share, or EPS, unless otherwise noted. Diluted EPS is calculated to reflect the potential dilution that would occur if stock options or other contracts to issue common stock were exercised and resulted in additional common shares outstanding.

BUSINESS OVERVIEW

Equifax Inc. is a global data, analytics and technology company. We provide information solutions for businesses, governments and consumers, and we provide human resources business process outsourcing services for employers. We have a large and diversified group of clients, including financial institutions, corporations, government agencies and individuals. Our services are based on comprehensive databases of consumer and business information derived from numerous sources including credit, financial assets, telecommunications and utility payments, employment, income, demographic and marketing data. We use advanced statistical techniques, machine learning and proprietary software tools to analyze available data to create customized insights, decision-making solutions and processing services for our clients. We also provide information, technology and services to support debt collections and recovery management. Additionally, we are a leading provider of payroll-related and human resource management business process outsourcing services in the U.S. For consumers, we provide products and services to help people understand, manage and protect their personal information and make more informed financial decisions.

We currently operate in four global regions: North America (U.S. and Canada), Asia Pacific (Australia, New Zealand and India), Europe (the U.K., Spain and Portugal) and Latin America (Argentina, Chile, Costa Rica, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay). We maintain support operations in the Republic of Ireland, Chile, Costa Rica and India. We also offer Equifax branded credit services in Russia through a joint venture, have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia and Singapore and have an investment in a consumer and commercial credit information company in Brazil.

Recent Events and Company Outlook

As further described in our 2020 Form 10-K, we operate in the U.S., which represented 78% of our revenue in 2020, and internationally in more than 20 countries. Our products and services span a wide variety of vertical markets including financial services, mortgage, federal, state and local governments, automotive, telecommunications and many others.

In March 2020, the World Health Organization designated the novel coronavirus disease (“COVID-19”) as a global pandemic. The impact of COVID-19 and related actions to attempt to control its spread began to impact our consolidated operating results in the first quarter of 2020. During 2020, the impact on the operating results in each country in which we operate differed based on the conditions and the vertical markets we serve in that country with the impact of the pandemic experienced most severely by our International business. Details of the impact of COVID-19 to our 2020 results can be found under the heading “Segment Financial Results” in the Management’s Discussion and Analysis of Financial Condition and Results of Operation section of the 2020 Form 10-K. In the third quarter and first nine months of 2021, as efforts to minimize the spread of COVID-19 have been more successful and access to vaccinations has increased, our consolidated revenue grew when compared to 2020, reflecting the U.S. mortgage market demand in 2021 compared to 2020, recovering country

economies, Equifax-initiative growth and, to a lesser extent, revenue from acquired companies. A more thorough discussion of our business unit results are included under the heading “Segment Financial Results” in the Management’s Discussion and Analysis of Financial Condition and Results of Operation section of this Form 10-Q. We are unable to determine the severity or duration of the impact of the COVID-19 pandemic on the individual markets in the countries we serve or how this impact will change with time. Although consolidated revenue has grown during the third quarter and first nine months of 2021 when compared to 2020, due to the uncertain effects on the global economy caused by the impact of COVID-19, the impact on our future results of operations related to the COVID-19 pandemic are unclear.

We expect that the global COVID-19 pandemic will continue to impact our business and results of operations. While the COVID-19 pandemic affects the countries in which we operate, our critical priorities remain as follows:

(i)the health and safety of our employees and their families;

(ii)providing support to consumers;

(iii)helping our customers execute their changing business plans by providing innovative solutions combining our unique data assets and leading analytical and technology capabilities; and

(iv)executing on our cloud technology, data and security transformation per our previously stated plans.

We are generally following the requirements and protocols published by the U.S. Centers for Disease Control and the World Health Organization, and federal, state and local governments. In jurisdictions where local restrictions have been lifted, as is the case at our major U.S. locations, our employees are returning to work to their assigned offices in conjunction with jurisdictional guidance. In jurisdictions where the local restrictions that were implemented to prevent the further spread of the virus allow, our employees can work from their assigned offices or from home. Generally across our facilities, we have undertaken actions to make these sites safer. We have also substantially reduced employee travel. If public health authorities dictate further measures to limit further spread of the virus, we may need to reinstate our business continuity plans in certain countries or regions in which we operate. As of the date of this filing, we do not believe our work from home and return to office protocols have materially adversely impacted our internal controls, financial reporting systems or our operations.

Our data and analytics, product and sales teams are focused on how to refine existing products and services, as well as generate new products and services, to meet the changing needs of our customers in this environment. Our technology teams continue to execute on our cloud technology, data and security transformation, including the continued migration of our technology to cloud native environments. To date, the change to our working environment has not caused material disruptions in the execution of these plans.

As a response to the ongoing COVID-19 pandemic, we implemented plans to manage our costs. We limited the addition of new employees and third party contracted services, limited most travel except where necessary to meet customer or regulatory needs, and acted to limit discretionary spending. The pace of recovery of the global economy from the COVID-19 induced recession remains uncertain and may affect certain markets or regions we serve differently. Any future asset impairment charges, increase in allowance for doubtful accounts, or restructuring charges could be more likely and will be dependent on the severity and duration of the pandemic.

In light of the evolving health, social, economic and business environment, governmental regulations or mandates, and business disruptions that could occur, the potential impact that COVID-19 could have on our financial condition and operating results remains uncertain.

For more in

Showing the first 8K of 94K characters. Open the full section

For information regarding our exposure to certain market risks, see “Quantitative and Qualitative Disclosures about Market Risk,” in Part II, Item 7A of our 2020 Form 10-K. There were no material changes to our market risk exposure during the three and nine months ended September 30, 2021.

As of the end of the period covered by this report, an evaluation was carried out by the Company’s management, with the participation of our Chief Executive Officer and Chief Financial Officer, of the effectiveness of our disclosure controls and procedures (as defined in Rule 13a-15(e) under the Securities Exchange Act of 1934). Based upon that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that these disclosure controls and procedures were effective as of the end of the period covered by this report. In addition, no change in our internal control over financial reporting (as defined in Rule 13a-15(f) under the Securities Exchange Act of 1934) occurred during our most recent fiscal quarter that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.

PART II. OTHER INFORMATION

ITEM 1. LEGAL PROCEEDINGS

Litigation and Investigations related to the 2017 Cybersecurity Incident

In 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of certain personally identifiable information of U.S., Canadian and U.K. consumers. Following the 2017 cybersecurity incident, hundreds of class actions and other lawsuits were filed against us typically alleging harm from the incident and seeking various remedies, including monetary and injunctive relief. We were also subject to investigations and inquiries by federal, state and foreign governmental agencies and officials regarding the 2017 cybersecurity incident and related matters. Most of these lawsuits and government investigations have concluded or been resolved, including pursuant to the settlement agreements described below, while others remain ongoing. The Company’s participation in these settlements does not constitute an admission by the Company of any fault or liability, and the Company does not admit fault or liability.

Consumer Settlement.

On July 19, 2019 and July 22, 2019, we entered into multiple agreements that resolve the U.S. consolidated consumer class action cases, captioned In re: Equifax, Inc. Customer Data Security Breach Litigation, MDL No. 2800 (the “U.S. Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the Attorneys General of 48 states, the District of Columbia and Puerto Rico and the NYDFS (collectively, the “Consumer Settlement”). Under the terms of the Consumer Settlement, the Company will contribute $380.5 million to a non-reversionary settlement fund (the “Consumer Restitution Fund”) to provide restitution for U.S. consumers identified by the Company whose personal information was compromised as a result of the 2017 cybersecurity incident as well as to pay reasonable attorneys’ fees and reasonable costs and expenses for the plaintiffs’ counsel in the U.S. Consumer MDL Litigation (not to exceed $80.5 million), settlement administration costs and notice costs. The Company has agreed to contribute up to an additional $125.0 million to the Consumer Restitution Fund to cover certain unreimbursed costs and expenditures incurred by affected U.S. consumers in the event the $380.5 million in the Consumer Restitution Fund is exhausted. The Company also agreed to various business practice commitments related to consumer assistance and its information security program, including conducting third party assessments of its information security program.

On January 13, 2020, the Northern District of Georgia, the U.S. District Court overseeing centralized pre-trial proceedings for the U.S. Consumer MDL Litigation and numerous other federal court actions relating to the 2017 cybersecurity incident (the “MDL Court”), entered an order granting final approval of the settlement in connection with the U.S. Consumer MDL Litigation. The MDL Court entered an amended order granting final approval of the settlement (the “Final Approval Order”) on March 17, 2020. Several objectors appealed the Final Approval Order to the U.S. Court of Appeals for the Eleventh Circuit (the “Eleventh Circuit”). On June 3, 2021, the Eleventh Circuit issued an order reversing the MDL Court’s grant of incentive awards to class representatives, but affirming all other aspects of the Final Approval Order. Several objectors filed petitions with the Eleventh Circuit seeking a rehearing, and on July 29, 2021, the Eleventh Circuit denied those petitions. On August 12, 2021, the MDL Court made the Eleventh Circuit’s mandate the judgment of the MDL Court. Since that time, one objector has filed a petition for a writ of certiorari with the U.S. Supreme Court. The deadline for any other objectors to file such petitions is October 27, 2021. Until all such petitions to the U.S. Supreme Court are finally adjudicated or dismissed, we can provide no assurance that the U.S. Consumer MDL Litigation will be resolved as contemplated by the settlement agreement. If the Eleventh Circuit’s June 3, 2021 order affirming approval of the settlement (except with respect to incentive awards, as discussed above) is reviewed and reversed by the U.S. Supreme Court, there is a risk that we would not be able to settle the U.S. Consumer MDL Litigation on acceptable terms or at all, which could have a material adverse effect on our financial condition and results of operations.

Other Matters.

We face other lawsuits and government investigations related to the 2017 cybersecurity incident that have not yet been concluded or resolved. These ongoing matters may result in judgments, fines or penalties, settlements or other relief. We dispute the allegations in the remaining lawsuits and intend to defend against such claims. Set forth below are descriptions of the main categories of these matters.

Georgia State Court Consumer Class Actions. Four putative class actions arising from the 2017 cybersecurity incident were filed against us in Fulton County Superior Court and Fulton County State Court in Georgia based on similar allegations and theories as alleged in the U.S. Consumer MDL Litigation and seek monetary damages, injunctive relief and other related relief on behalf of Georgia citizens. These cases were transferred to a single judge in the Fulton County Business Court and

three of the cases were consolidated into a single action. On July 27, 2018, the Fulton County Business Court granted the Company’s motion to stay the remaining single case, and on August 17, 2018, the Fulton County Business Court granted the Company’s motion to stay the consolidated case. These cases remain stayed pending final resolution of the U.S. Consumer MDL Litigation.

Canadian Class Actions. Five putative Canadian class actions, four of which are on behalf of a national class of approximately 19,000 Canadian consumers, are pending against us in Ontario, British Columbia and Alberta. Each of the proposed Canadian class actions asserts a number of common law and statutory claims seeking monetary damages and other related relief in connection with the 2017 cybersecurity incident. In addition to seeking class certification on behalf of Canadian consumers whose personal information was allegedly impacted by the 2017 cybersecurity incident, in some cases, plaintiffs also seek class certification on behalf of a larger group of Canadian consumers who had contracts for subscription products with Equifax around the time of the incident or earlier and were not impacted by the incident.

On December 13, 2019, the court in Ontario granted certification of a nationwide class that includes all impacted Canadians as well as Canadians who had subscription products with Equifax between March 7, 2017 and July 30, 2017 who were not impacted by the incident. We appealed one of the claims on which a class was certified and on June 9, 2021, our appeal was granted by the Ontario Divisional Court. The plaintiff has since filed a notice of further appeal. All remaining purported class actions are at preliminary stages or stayed.

Government Investigations. We have cooperated with federal, state and foreign governmental agencies and officials investigating or otherwise seeking information, testimony and/or documents, regarding the 2017 cybersecurity incident and related matters and most of these investigations have been resolved as discussed in prior filings.

The U.K.’s Financial Conduct Authority (“FCA”) opened an enforcement investigation against our U.K. subsidiary, Equifax Limited, in October 2017. The investigation by the FCA has involved a number of information requirements and interviews. We continue to respond to the information requirements and are cooperating with the investigation.

Although we continue to cooperate in the above investigations and inquiries, an adverse outcome to any such investigations and inquiries could subject us to fines or other obligations, which could have a material adverse effect on our financial condition and results of operations.

Other

Equifax has been named as a defendant in various other legal actions, including administrative claims, regulatory matters, government investigations, class actions and other litigation arising in connection with our business. Some of the legal actions include claims for substantial compensatory or punitive damages or claims for indeterminate amounts of damages. We believe we have defenses to and, where appropriate, will contest many of these matters. Given the number of these matters, some are likely to result in adverse judgments, penalties, injunctions, fines or other relief. We may explore potential settlements before a case is taken through trial because of the uncertainty and risks inherent in the litigation process.

For information regarding our accounting for legal contingencies, see Note 6 of the Notes to Consolidated Financial Statements in this Form 10-Q.

There have been no material changes with respect to the risk factors disclosed in our 2020 Form 10-K.

ITEM 2. UNREGISTERED SALES OF EQUITY SECURITIES AND USE OF PROCEEDS

The following table contains information with respect to purchases made by or on behalf of Equifax or any “affiliated purchaser” (as defined in Rule 10b-18(a) (3) under the Securities Exchange Act of 1934), of our common stock during our third quarter ended September 30, 2021:

(1)The total number of shares purchased for the quarter includes shares surrendered, or deemed surrendered, in satisfaction of the exercise price and/or to satisfy tax withholding obligations in connection with the exercise of employee stock options, totaling 20,336 shares for the month of July 2021, 1,358 shares for the month of August 2021, and 30,776 shares for the month of September 2021.

(2)Average price paid per share for shares purchased as part of our share repurchase program (includes brokerage commissions). For the quarter ended September 30, 2021 we did not repurchase any shares of our common stock under our share repurchase program.

(3)At September 30, 2021, the amount authorized for future share repurchases under the share repurchase program was $520.2 million. The program does not have a stated expiration date.

Dividend and Share Repurchase Restrictions

Our Revolver restricts our ability to pay cash dividends on our capital stock or repurchase capital stock if a default or event of default exists or would result if these payments were to occur, according to the terms of the applicable credit agreements.

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.