Mastercard (MA) 10-K risk factor changes: FY2024 vs FY2023

Damage to our reputation or [removed: that of our] brands resulting from an account data breach of [removed: either] our systems and networks or [removed: the systems and networks] [added: those] of our customers, merchants and other third parties could decrease the use and acceptance of our products and services.

While we offer [removed: cyber and intelligence products] [added: security solutions] that are designed to prevent, detect and respond to fraud and cyber-attacks, there can be no assurance that such security solutions will perform as expected or address all possible security threats.

Real or perceived defects, failures, errors or vulnerabilities in our security [removed: solutions, such as our cyber and intelligence products,] [added: solutions] could adversely impact our reputation, customer confidence in our solutions and our business and may subject us to litigation, governmental audits and investigation or other liabilities.

[removed: In addition, fraudulent activity] [added: However, increased fraud levels] and [removed: increasing] cyber-attacks [removed: have encouraged legislative and regulatory intervention,] [added: involving our products, services and/or network, or misconduct or negligence by third parties switching or otherwise servicing our products] and [added: services] could damage our reputation and reduce the use and acceptance of our products and services [removed: or] [added: and/or] increase our compliance costs.

Despite various mitigation efforts that we undertake, there can be no assurance that [added: we, or third parties with which] we [added: work,] will not suffer material breaches and resulting losses in the future.

[removed: In addition, we cannot be sure] that our existing insurance coverage will continue to be available on acceptable terms or at all, or that our insurers will not deny coverage as to any future claim.

As a result, [removed: information security and] [added: we remain focused on] the continued development and enhancement of our controls, processes and practices designed to protect our computer systems, software, data and networks from attack, damage or unauthorized [removed: access remain a priority for us.][added: access.]

Our transaction switching systems and other offerings [removed: have experienced in limited instances and] may [removed: continue to] experience interruptions as a result of technology malfunctions, supply-chain attacks, fire, floods, earthquakes, weather events, power outages, telecommunications disruptions, terrorism, workplace violence, accidents or other catastrophic events (including those related to climate change).

Although we maintain an enterprise resiliency program to analyze risk, assess potential impacts, and develop effective response strategies, we cannot ensure that our business would be immune to these [removed: risks, because of the intrinsic importance of our switching systems to our business, any interruption or degradation could adversely affect the perception of the reliability of products carrying our brands and materially adversely affect our overall business and our results of operations.][added: risks.]

Our business agreements with these customers may not ultimately reduce the risk [removed: inherent] [added: (inherent] in our [removed: business] [added: business)] that customers may terminate their relationships with us in favor of relationships with our competitors, or for other reasons, or might not meet their contractual obligations to us.

[removed: Our customers’] [added: The] industries [added: in which our customers participate] have undergone substantial, accelerated consolidation in the past.

Potential future consolidation could occur as a result of bank failures, similar to those that occurred in the U.S. [removed: during 2023.][added: in recent years.]

[removed: Consolidation could also produce a smaller number of large customers, which could increase their] bargaining power and lead to lower prices and/or more favorable terms for our customers.

Merchants’ continued focus on acceptance costs may lead to additional litigation and regulatory proceedings [removed: and] [added: and/or] increase our incentive program costs, which could materially and adversely affect our profitability.

Certain larger merchants are also able to negotiate incentives from us and pricing concessions from our issuer and acquirer customers as a condition [removed: to] [added: of] accepting our products.

Our work with governments exposes us to [removed: unique] risks that could have a material impact on our business and results of operations.

Changes in governmental priorities or other political developments, including disruptions in governmental operations, could impact approved funding and result in [added: scope] changes [removed: in the scope,] or [removed: lead to the termination,] [added: termination] of the arrangements or contracts we or financial institutions enter into with respect to our [removed: payment] products and services.

- Working or contracting with governments, either directly or via our financial institution customers, can subject us to heightened reputational risks, including extensive scrutiny and publicity, as well as a potential association with the policies of [removed: a government as a result of a business arrangement with that government.][added: those governments.]

- Consumers and businesses [removed: lowering] [added: reducing] spending, which could impact domestic and cross-border spend

- Debt limit and budgetary discussions in the U.S. [removed: has] [added: have] affected, and could further affect, the U.S. credit rating, impacting consumer confidence and spending

Cross-border activity [removed: has,] [added: has been,] and may continue to be, adversely affected by world geopolitical, economic, health, weather and other conditions.

- [removed: the global COVID-19 pandemic] [added: Global pandemics] (and [removed: the potential of any] [added: related] post-pandemic global economic [removed: impact)] [added: impacts)] and potential separate outbreaks of flu, viruses and other diseases (any of which could result in future epidemics or pandemics)

- [removed: current] [added: Current] and potential future geopolitical conflicts, as well as expansion into regional or global conflicts, and the resulting impacts to our business [removed: (this includes Russia’s invasion of Ukraine and the actions taken by the U.S., the EU, other governments and Mastercard in response)]

*Standards.* Our operations as a global payments network rely in part on global interoperable standards to help facilitate [removed: safe and simple] payments.

To the extent geopolitical events [added: or government intervention] result in jurisdictions no longer participating in the creation or adoption of these standards, or the creation of competing standards, [removed: the] [added: our] products and services [removed: we offer] could be negatively impacted.

[removed: Factors such as those discussed above have adversely impacted our business, results of operations and financial condition, and any] [added: Any] of these developments potentially could have a material adverse impact on our overall business and results of operations.

During [removed: 2023,] [added: 2024,] approximately 70% of our revenue was generated from activities outside the [removed: U.S. This revenue (and the related expense)] [added: U.S., which] could be transacted in a non-functional [removed: currency or valued based on a currency other than the functional currency of the entity generating the revenues.][added: currency.]

In addition, [removed: some of] the revenue we generate [removed: outside the U.S.] [added: in entities with non-U.S. dollar functional currencies] is subject to unpredictable currency [removed: fluctuations] [added: fluctuations,] including [removed: devaluation of currencies] where the values of other currencies change relative to the U.S. dollar.

Brand, Reputational Impact and [removed: ESG][added: Environmental, Social and Governance]

Moreover, adverse developments with respect to our industry or the industries of our customers or other companies and organizations that use our products and services (including certain legally permissible but high-risk merchant categories, such as adult content, firearms, alcohol and tobacco) may also, by association, impair our reputation, or result in greater public, regulatory or legislative scrutiny, [added: as well as potential litigation.]

[added: -] Under some circumstances, our use of social media, or the use of social media by others as a channel for criticism or other purposes, could also cause rapid, widespread reputational harm to our brands by disseminating rapidly and globally actual or perceived damaging information about us, our products or merchants or other end users who utilize our products.

[removed: These] [added: We often partner with other consumer] brands [removed: include] [added: on payment solutions, including] large digital companies and other technology companies who are our customers and use our networks to build their own acceptance brands.

[removed: ESG] [added: Environmental, social and governance] matters and related stakeholder reaction may impact our reputation, [removed: expose us to] [added: increase] legal [removed: requirements and liability] [added: exposure] and/or have other business impacts, which could adversely affect our overall business and/or results of operations.

Consumers, investors, employees and other stakeholders are increasingly focused on [removed: ESG practices.][added: these impacts.]

To the extent any of our [removed: ESG] disclosures, public statements and metrics [added: about these matters] are subsequently viewed as inaccurate, or we are unable to execute on [removed: our ESG] [added: these] initiatives, we may be viewed negatively by stakeholders concerned about these matters.

In addition, various jurisdictions are increasingly adopting or considering [removed: laws and] [added: laws,] regulations [added: and oversight expectations] that have or would impact us pertaining to [removed: ESG governance, strategy, risk management] [added: environmental, social] and [removed: metrics/targets/results.][added: governance matters, including required corporate reporting and disclosures.]

These requirements [removed: have,] [added: have resulted in,] and are likely to continue [removed: to,] [added: to] result [removed: in] [added: in,] increased compliance costs for our business and supply chain, which may increase our operating costs.

Moreover, as governments, investors and other stakeholders face pressure to address climate change and other [removed: ESG] [added: environmental, social and governance] matters, these stakeholders may express new expectations and focus investments in ways that could cause significant shifts in commerce and consumption behaviors.

We may not be able to attract and retain a highly qualified [removed: and diverse] workforce, or maintain our corporate culture, which could harm our overall business and results of operations.

[removed: While attrition and pace of hiring has slowed due to economic uncertainty, the] [added: The] market for specialized skill-sets remains highly competitive, particularly in technology and other areas that are important to the growth of our business.

significantly due to a significant portion of our workforce working in a hybrid environment.

These threats also may be further enhanced in frequency or effectiveness through threat actors’ use of AI.

Our operations rely on the secure transmission, storage and other processing of confidential, proprietary, sensitive and personal information and technology in our computer systems and networks, as well as the systems of our third-party providers.

Our customers and other parties in the payments value chain, as well as account holders, rely on our digital technologies, computer systems, software and networks to conduct their operations.

In addition, to access our products and services, our customers and account holders increasingly use personal smartphones, tablet PCs and other mobile devices that may be beyond our control.

We, like other financial technology organizations, routinely are subject to cyber-threats and our technologies, systems and networks, as well as the systems of our third-party providers, have been subject to attempted cyber-attacks.

Because of our position in the payments value chain, we believe that we are likely to continue to be a target of such threats and attacks.

Geopolitical events and resulting government activity could also lead to information security threats and attacks by affected or sympathizing jurisdictions or other actors, which could put our information and assets at risk, as well as result in network disruption.

To date, we have not experienced any material impact relating to cyber-attacks or other information security breaches.

However, future attacks or breaches could lead to security breaches of the networks, systems (including third-party provider systems) or devices that our customers use to access our products and services, which in turn could result in the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary, sensitive and personal information (including account data information) or data security compromises.

Such attacks or breaches could also cause service interruptions, malfunctions or other failures in the physical infrastructure, networks or operations systems that support our business and customers (such as the lack of availability of our services), as well as the operations of our customers or other third parties.

In addition, they could lead to damage to our reputation with our customers, other stakeholders and the broader payments ecosystem, additional costs to us (such as repairing systems, adding new personnel or protection technologies or compliance costs), regulatory penalties, financial losses to both us and our customers and partners and the loss of customers and business opportunities.

These consequences could be further pronounced in jurisdictions in which we are deemed critical national infrastructure.

If such attacks are not detected immediately, or disclosed as required by law, their effect could be compounded.

In addition, companies have generally experienced in recent years an increase in fraudulent activity and cyber-attacks.

We continue to take measures to make card and digital payments more secure.

Further, such occurrences have resulted in and could further result in legislative or regulatory intervention, which could lead to enhanced security requirements and liabilities.

In addition, we cannot be sure

We have experienced in limited instances, and may continue to experience, some types of these interruptions.

Due to the intrinsic importance of our switching systems to our business, any interruption or degradation could adversely affect the perception of the reliability of products carrying our brands and materially adversely affect our overall business and our results of operations.

Consolidation could also produce a smaller number of large customers, which could increase their

In addition, threat intelligence gathering services provided to governments through our acquisition of Recorded Future could negatively impact how we are viewed by other jurisdictions.

Impacts from currency fluctuations are included in our net income.

Our brand and reputation are associated with the ways in which we impact environmental, social and governance matters.

These matters include initiatives to reduce greenhouse gas emissions, help everyone participate equitably in the digital economy and create a workplace that provides equal opportunities for all of our employees.

Moreover, in recent years, we have received negative feedback from stakeholders on the adequacy of our environmental, social and governance initiatives.

We have also increasingly been receiving negative feedback from anti-environmental, social and governance stakeholders in opposition to such initiatives.

Stakeholders from both

sides of this issue may continue to view us negatively and take public action against us to the extent that we do not satisfy their conflicting views or expectations.

Any of the above issues could have a material or adverse impact to our overall business and/or results of operations.

We also face increasing regulation with respect to new pay and benefits transparency requirements, which could subject us to liability or reputational harm if we do not adhere to these requirements in a timely manner.

As our workforce composition continues to change, our employees may have different expectations with respect to flexibility and well-being support, and may have different career motivations (such as pursuing project-based work or other gig opportunities, as opposed to linear career paths).

Additionally, employees may require different levels of support as to re-skilling and upskilling in order to adapt to advancements in our industry and changes in technology.

Further, certain current and prospective employees may have expectations as to positions we take on environmental, social and governance matters.

To the extent we are unable to effectively meet and/or balance these different expectations, motivations and needs, we could experience a negative impact to the quality of our corporate culture, the productivity of our workforce, our ability to innovate and our ability to attract and retain talent.

Moreover, we have spent, and may continue to spend, time and money on acquisitions or projects that do

In addition, as we are subject to increased regulation across the globe, jurisdictions could require us to extend our guarantee to additional obligations, which could have an impact on our cost of operations.

Any of the above issues or events could have a material or adverse impact to our overall business and/or results of operations.

In March 2024, Mastercard Foundation began selling shares pursuant to an orderly and structured plan to diversify its Mastercard shares over a seven-year

PART I

While we are continuing to take measures to make card and digital payments more secure, increased fraud levels involving our products and services, or misconduct or negligence by third parties switching or otherwise servicing our products and services, could lead to legislative or regulatory intervention, such as enhanced security requirements and liabilities, as well as damage to our reputation.

Resulting exchange gains and losses are included in our net income.

as well as potential litigation.

- We have been pursuing the use of social media channels at an increasingly rapid pace.

In order to compete with other powerful consumer brands that are also becoming part of the consumer payment experience, we often partner with those brands on payment solutions.

Our brand and reputation are associated with our public commitments to various ESG initiatives, including our goals relating to climate (such as our commitment to achieve net-zero emissions by 2040), financial inclusion, and DEI.

Stakeholders (including those in support of or in opposition to ESG principles) may also have a negative view of us to the extent we are perceived to have not responded appropriately to their ESG concerns or take positions that are contrary to their views or expectations.

These include required corporate reporting and disclosures on specific topics (such as climate and human rights) as well as broader matters (such as other environmental matters, treatment of employees and diversity of workforce).

To the extent we cannot design our processes and practices to support equitable outcomes, our ability to attract talent may be significantly impacted and we may experience talent attrition.

Further,

Our flexibility policies and programs (in particular, those related to work arrangements) may impact the well-being and productivity of our workforce, which in turn could have a negative impact on the quality of our corporate culture and our ability to innovate.

To the extent these policies (including our team-based agreements) do not meet candidate or employee expectations for flexibility, this could also impact our ability to attract and retain talent.

These impacts could materially and adversely affect our results of operations.

Should an event occur that triggers these obligations, such an event could materially and adversely affect our overall business and results of operations.

See Note [removed: 7 (Investments) and Note] 21 (Legal and Regulatory Proceedings) to the consolidated financial statements included in Part II, Item 8 [removed: of this Report] for further [removed: discussion related to certain of our non-GAAP financial measures.][added: discussion.]

The impact of currency translation represents the effect of translating operating results where the functional currency is different [removed: than] [added: from] our U.S. dollar reporting currency.

The impact of the related realized gains and losses resulting from our foreign exchange derivative contracts designated as cash flow hedging instruments [added: (specifically those that manage the impact of foreign currency variability on anticipated revenues and expenses)] is recognized in the respective financial statement line item on the [removed: statement] [added: statements] of operations when the underlying forecasted transactions impact earnings.

The translational and transactional impact of currency and the related impact of our foreign exchange derivative contracts designated as cash flow hedging instruments [removed: (“Currency impact”)] [added: as specified in the preceding paragraph (collectively the “Currency Impact”)] has been excluded from our currency-neutral growth rates and has been identified in the [removed: non-GAAP information] [added: “Non-GAAP Reconciliations” tables] below and our “Drivers of Change” tables.

| Reported - GAAP | | | | | | $ | 22,237 | | | | | $ | 9,973 | | | | | 55.2 | | % | | | | $ | (532) | | | | | 15.4 | | % | | | | $ | 9,930 | | | | | [removed: $ |] 10.22 | | [added: |]

| | | | | | | Year ended December 31, [removed: 2021] [added: 2024] | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| (Gains) losses on equity investments | | | | | | | | | | | | | | | | | | | | | | | | [removed: (645)] [added: 29] | | | | | | [removed: (0.5)] [added: —] | | % | | | | [removed: (497)] [added: 25] | | | | | | [removed: (0.50)] [added: 0.03] | | |

| Litigation provisions | | | | | | | | | | | | [removed: (94) | | | | | | 0.5] [added: (1)] | | % | | | | [added: 0.5 ppt] | | | | | | 0.1 [added: ppt] | | [removed: %] | | | | [removed: 74] [added: 1] | | [added: %] | | | | [removed: 0.07] [added: 1] | | [added: %] |

| Litigation provisions | | | | | | | | | | | | (1) | | % | | | | [removed: 0.5] [added: 0.3] | | ppt | | | | [removed: 0.1] [added: —] ppt | | | | | | 1 | | % | | | | 1 | | % |

| Adjusted - Non-GAAP | | | | | | 13 | | % | | | | 10 | | % | | | | 1.0 [added: ppt] | | [removed: ppt] | | | | 2.8 ppt | | | | | | 12 | | % | | | | 15 | | % |

| Currency [removed: impact] [added: Impact] | | | | | | — | | % | | | | — | | % | | | | (0.1) [added: ppt] | | [removed: ppt] | | | | (0.1) ppt | | | | | | — | | % | | | | — | | % |

| Adjusted - Non-GAAP - currency-neutral | | | | | | 13 | | % | | | | 11 | | % | | | | 0.9 [added: ppt] | | [removed: ppt] | | | | 2.7 ppt | | | | | | 12 | | % | | | | 15 | | % |

| | | | | | | Year Ended December 31, [removed: 2022] [added: 2024] as compared to the Year Ended December 31, [removed: 2021] [added: 2023] | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| Reported - GAAP | | | | | | [removed: 18] [added: 12] | | % | | | | 13 | | % | | | | [removed: 1.8] [added: (0.5)] | | ppt | | | | [removed: (0.4)] [added: (2.3)] | | ppt | | | | [removed: 14] [added: 15] | | % | | | | 17 | | % |

| (Gains) losses on equity investments | | | | | | | | | | | | | | | | | | | | | | | | [removed: 0.5] [added: (0.1)] ppt | | | | | | [removed: 8] [added: —] | | % | | | | [removed: 9] [added: —] | | % |

| Adjusted - Non-GAAP | | | | | | [removed: 18] [added: 12] | | % | | | | 11 | | % | | | | [removed: 2.7 ppt] [added: 0.4] | | [added: ppt] | | | | [removed: 0.3] [added: (2.3)] ppt | | | | | | [removed: 24] [added: 17] | | % | | | | [removed: 27] [added: 19] | | % |

| Currency [removed: impact] [added: Impact] | | | | | | [removed: 5] [added: 1] | | % | | | | [removed: 3] [added: —] | | % | | | | [removed: 0.8 ppt] [added: 0.3] | | [added: ppt] | | | | [removed: 0.2] [added: 0.1] ppt | | | | | | [removed: 8] [added: 1] | | % | | | | [removed: 8] [added: 1] | | % |

| Adjusted - Non-GAAP - currency-neutral | | | | | | [removed: 23] [added: 13] | | % | | | | [removed: 14] [added: 11] | | % | | | | [removed: 3.4 ppt] [added: 0.7] | | [added: ppt] | | | | [removed: 0.5] [added: (2.2)] ppt | | | | | | [removed: 32] [added: 18] | | % | | | | [removed: 34] [added: 21] | | % |

Cross-border Volume [removed: Growth2] [added: Growth] measures the growth of cross-border dollar volume during the period, on a local currency basis and U.S. dollar-converted basis, for all Mastercard-branded programs.

Switched [removed: Transactions2] [added: Transactions] measures the number of transactions switched by Mastercard, which is defined as the number of transactions initiated and switched through our network during the period.

| | | | | | | [removed: 2023] [added: 2024] | | | | | | [added: 2023] | | | | | | 2022 | | | | | | [added: 2024] | | | [added: | | | 2023 | | |]

| Mastercard-branded GDV growth 1 | | | | | | [removed: 10%] [added: 8%] | | | | | | [removed: 12%] [added: 11%] | | | | | | [removed: 6%] [added: 11%] | | | | | | 12% | | |

| United States | | | | | | [removed: 6%] [added: 7%] | | | | | | [removed: 6%] [added: 7%] | | | | | | [removed: 10%] [added: 6%] | | | | | | [removed: 10%] [added: 6%] | | |

| Worldwide less United States | | | | | | [removed: 13%] [added: 9%] | | | | | | [removed: 15%] [added: 12%] | | | | | | [removed: 4%] [added: 13%] | | | | | | [removed: 13%] [added: 15%] | | |

| Cross-border volume growth 1 | | | | | | [removed: 25%] [added: 17%] | | | | | | [removed: 24%] [added: 18%] | | | | | | [removed: 33%] [added: 25%] | | | | | | [removed: 45%] [added: 24%] | | |

| | | | | | | [added: 2024 | | | | | |] 2023 | | | | | | 2022 | | | [added: | | | 2024 | | | | | | 2023 | | |]

| Switched transactions growth | | | | | | [removed: 14%] [added: 11%] | | | | | | [removed: 12%] [added: 14%] | | |

These assessments can also include connectivity services and network [removed: access] [added: access,] which are based on the volume of data transmitted and the number of authorization and settlement messages.

- Other network assessments are [removed: primarily] charges for licensing, implementation and other franchise fees.

| | | | | | | [removed: Year] [added: Years] ended December 31, | | | | | | | | | | | | | | | | | | [removed: 2023] [added: 2024] | | | | | | | | | | | | [removed: 2022] [added: 2023] | | | | | | | | |

| | | | | | | [removed: 2023] [added: 2024] | | | | | | [removed: 2022] [added: 2023] | | | | | | [removed: 2021] [added: 2022] | | | | | | As reported | | | | | | Currency-neutral | | | | | | As [removed: Reported] [added: reported] | | | | | | Currency-neutral | | |

| Domestic assessments | | | | | | $ | [removed: 9,566] [added: 10,245] | | | | | $ | [removed: 8,794] [added: 9,566] | | | | | $ | [removed: 8,064] [added: 8,794] | | | | | [removed: 9%] [added: 7%] | | | | | | 9% | | | | | | 9% | | | | | | [removed: 12%] [added: 9%] | | |

| Cross-border assessments | | | | | | [removed: 8,409] [added: 10,181] | | | | | | [removed: 6,597] [added: 8,409] | | | | | | [removed: 4,646] [added: 6,597] | | | | | | [removed: 27%] [added: 21%] | | | | | | [removed: 28%] [added: 22%] | | | | | | [removed: 42%] [added: 27%] | | | | | | [removed: 53%] [added: 28%] | | |

| Transaction processing assessments | | | | | | [removed: 12,067] [added: 13,602] | | | | | | [removed: 10,646] [added: 12,067] | | | | | | [removed: 9,041] [added: 10,646] | | | | | | 13% | | | | | | [removed: 13%] [added: 14%] | | | | | | [removed: 18%] [added: 13%] | | | | | | [removed: 23%] [added: 13%] | | |

| Other network assessments | | | | | | [removed: 963] [added: 936] | | | | | | [removed: 766] [added: 963] | | | | | | [removed: 668] [added: 766] | | | | | | [removed: 26%] [added: (3)%] | | | | | | [removed: 26%] [added: (3)%] | | | | | | [removed: 15%] [added: 26%] | | | | | | [removed: 14%] [added: 26%] | | |

Our primary [removed: revenue] functional currencies are the U.S. dollar, euro, British pound and the Brazilian real.

Changes in currency exchange rates directly impact the calculation of gross dollar volume (“GDV”), which [removed: are] [added: is] used in the calculation of our key metrics related to domestic assessments and cross-border assessments as well as certain volume-related rebates and incentives.

In 2023, GDV on a U.S. dollar-converted basis increased [removed: 10.4%,] [added: 10.6%,] while GDV on a local currency basis increased [removed: 11.9%] [added: 12.2%] versus 2022.

In [removed: 2022,] [added: 2024,] GDV on a U.S. dollar-converted basis increased [removed: 5.9%,] [added: 8.1%,] while GDV on a local currency basis increased [removed: 12.3%] [added: 10.5%] versus [removed: 2021.][added: 2023.]

Further, the impact from transactional currency occurs in our key [removed: metric] [added: metrics] related to transaction processing assessments [added: and other network assessments] as well as value-added services and solutions revenue and operating expenses when the transacting currency of these items is different than the functional currency of the entity.

Non-GAAP Reconciliations

| Reported - GAAP | | | | | | $ | 28,167 | | | | | $ | 12,585 | | | | | 55.3 | | % | | | | $ | (328) | | | | | 15.6 | | % | | | | $ | 12,874 | | | | | $ | 13.89 | |

| Litigation provisions | | | | | | | | | | | | (680) | | | | | | 2.4 | | % | | | | | | | | | | 0.5 | | % | | | | 495 | | | | | | 0.53 | | |

| Restructuring charge | | | | | | | | | | | | (190) | | | | | | 0.7 | | % | | | | | | | | | | 0.1 | | % | | | | 147 | | | | | | 0.16 | | |

| Adjusted - Non-GAAP | | | | | | $ | 28,167 | | | | | $ | 11,714 | | | | | 58.4 | | % | | | | $ | (300) | | | | | 16.2 | | % | | | | $ | 13,541 | | | | | $ | 14.60 | |

Not applicable.

| Restructuring charge | | | | | | | | | | | | (2) | | % | | | | 0.7 ppt | | | | | | 0.1 ppt | | | | | | 1 | | % | | | | 1 | | % |

Not applicable.

| | | | | | | 2024 | | | | | | | | | | | | 2023 | | | | | | | | |

| | | | | | | 2024 | | | | | | 2023 | | |

Not meaningful.

Net revenue increased 12%, or 13% on a currency-neutral basis, in 2024 versus the prior year.

The increase was driven primarily by (1) growth in our underlying key drivers, (2) our consumer acquisition and engagement and business and market insight services, (3) our security and digital and authentication solutions and (4) pricing.

| | | | | | | 2024 | | | | | | 2023 | | | | | | 2024 | | | | | | 2023 | | | | | | 2024 | | | | | | 2023 | | | | | | 2024 | | | | | | 2023 | | | | | | 2024 | | | | | | 2023 | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

Not applicable.

Not meaningful.

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | | | | 2024 | | | | | | 2023 | | | | | | 2024 | | | | | | 2023 | | | | | | 2024 | | | | | | 2023 | | | | | | 2024 | | | | | | 2023 | | | | | | 2024 | | | | | | 2023 | | |

Not applicable.

Advertising and marketing expenses decreased 1%, on both an as-reported and a currency-neutral basis, in 2024 versus the prior year.

In 2024, we recorded charges of $680 million, primarily as a result of a legal provision associated with the U.K. consumer class action settlement, settlements with a number of U.K. merchants and a change in estimate related to the claims of merchants who opted out of the U.S. merchant class litigation.

In 2023, we recorded charges of $539 million, primarily as a result of changes in the estimate related to the claims of merchants who opted out of the U.S. merchant class litigation and settlements with a number of U.K. and Pan-European merchants.

In 2022, we recorded charges of $356 million, primarily as a result of settlements (both final and agreements in principle) with a number of U.K. merchants and a change in estimate related to the claims of merchants who opted out of the U.S. merchant class litigation.

Additionally, a change in our geographic mix of earnings in 2024 contributed to the lower effective income tax rates compared to the prior year.

In 2024, we did not experience a material impact as a result of Pillar 2 Rules.

However, in 2025, we expect the Pillar 2 Rules will primarily offset the reduction to our effective income tax rate resulting from our incentive grant received from the Singapore Ministry of Finance.

For the year ended December 31, 2024, this incentive grant reduced our effective income tax rate by approximately 4%.

| | | | | | | 2024 | | | | | | 2023 | | |

Cash Flows

In April 2024, $1 billion of principal related to the 2014 USD Notes matured and was paid.

In July 2024, INR28.1 billion ($336 million as of payment date) of principal related to the 2023 INR Term Loan matured and was paid.

During 2024, we issued a total of $4 billion of debt, as follows:

- In May 2024, we issued $1 billion principal amount of notes due May 2034

The issuances in 2024 are collectively referred to as the “2024 USD Notes”.

| Shares repurchased in 2024 | | | | | | 23.0 | | |

| Dollar-value of shares repurchased in 2025 (through February 7, 2025) | | | | | | $ | 959 | |

We believe the presentation of currency-neutral growth rates provides relevant information to facilitate an understanding of our operating results.

| Reported - GAAP | | | | | | $ | 18,884 | | | | | $ | 8,802 | | | | | 53.4 | | % | | | | $ | 225 | | | | | 15.7 | | % | | | | $ | 8,687 | | | | | 8.76 | | |

| Indirect tax matter | | | | | | | | | | | | (82) | | | | | | 0.4 | | % | | | | 6 | | | | | | 0.1 | | % | | | | 69 | | | | | | 0.07 | | |

| Adjusted - Non-GAAP | | | | | | $ | 18,884 | | | | | $ | 8,627 | | | | | 54.3 | | % | | | | $ | (413) | | | | | 15.4 | | % | | | | $ | 8,333 | | | | | $ | 8.40 | |

Not applicable

PART II

ITEM 7.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

| Litigation provisions | | | | | | | | | | | | (3) | | % | | | | 1.1 ppt | | | | | | 0.3 ppt | | | | | | 2 | | % | | | | 2 | | % |

| Russia-related impacts | | | | | | — | | % | | | | (1) | | % | | | | 0.2 ppt | | | | | | — ppt | | | | | | — | | % | | | | — | | % |

| Indirect tax matter | | | | | | | | | | | | 1 | | % | | | | (0.4) ppt | | | | | | (0.1) ppt | | | | | | (1) | | % | | | | (1) | | % |

Not applicable

Starting in the first quarter of 2022, data related to sanctioned Russian banks was not reported to us and therefore such amounts are not included.

Subsequent to the suspension of our business operations in Russia in March 2022, there is no Russian data to be reported.

2 Growth rates are normalized to eliminate the effects of differing switching and carryover days between periods, as needed.

Carryover days are those where transactions and volumes from days where the Company does not clear and settle are processed.

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| Mastercard-branded GDV growth adjusted for Russia 1,2 | | | | | | 11% | | | | | | 12% | | | | | | 10% | | | | | | 18% | | |

| Worldwide less United States GDV growth adjusted for Russia 1,2 | | | | | | 13% | | | | | | 15% | | | | | | 11% | | | | | | 22% | | |

| Cross-border volume growth adjusted for Russia 1,2 | | | | | | 25% | | | | | | 25% | | | | | | 37% | | | | | | 50% | | |

| | | | | | | | | | | | | | | |

| Switched transactions growth adjusted for Russia 2 | | | | | | 16% | | | | | | 21% | | |

2 Starting in the first quarter of 2022, as a result of imposed sanctions and the suspension of our business operations in Russia, we have provided adjusted growth rates for our key drivers excluding activity from Russian issued cards from the prior periods.

nonfunctional currency monetary assets and liabilities.

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

Not meaningful

For the year ended December 31, 2023, net revenue increased 13% versus the comparable period in 2022.

The increase was driven primarily by the continued growth of (i) our cyber and intelligence solutions, driven by our underlying key drivers and the scaling of our fraud and security solutions, as well as (ii) our consulting, marketing and loyalty solutions.

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

Not applicable

Adjusted operating expenses increased 10%, or 11% on a currency-neutral basis, versus the prior year, which includes a 1 percentage point increase from acquisitions.

On both an as reported and as adjusted basis, the increase was primarily due to higher personnel costs to support the continued investment in our business and the delivery of services to our customers.

Not meaningful

A hypothetical 10% adverse change in the value of the functional currencies would not have a material impact to the fair value of our short duration foreign exchange derivative contracts outstanding at December 31, [removed: 2023] [added: 2024] and [removed: 2022,] [added: 2023,] respectively.

[removed: As of December 31, 2022, the] [added: The] effect of a hypothetical 10% adverse change in the value of the U.S. dollar could result in a fair value loss of approximately [removed: $203] [added: $279] million on our foreign exchange derivative contracts designated as a net investment hedge [added: at December 31, 2024,] before considering the offsetting effect of the underlying hedged activity.

A hypothetical 100 basis point adverse change in interest rates would not have a material impact to the fair value of our investments at December 31, [removed: 2023] [added: 2024] and [removed: 2022.][added: 2023.]

The effect of a hypothetical 100 basis point adverse change in interest rates [removed: would not have] [added: could result in] a [removed: material impact to] [added: fair value loss of approximately $20 million and $29 million on] the fair value of our interest rate derivative contracts designated as a fair value hedge of our fixed-rate debt at December 31, [removed: 2023] [added: 2024] and [removed: 2022,] [added: 2023,] respectively, before considering the offsetting effect of the underlying hedged activity.

| As of December 31, [removed: 2023] [added: 2024] and [removed: 2022] [added: 2023] and for the years ended December 31, [removed: 2023, 2022] [added: 2024, 2023] and [removed: 2021] [added: 2022] | | | | | | | | | | | |

| | | | [Management’s report on internal control over financial [removed: reporting](#i723bd5ed79eb47ff8ce5352df17ef4e6_91)] [added: reporting](#ic73669c37deb437ebc9a21db437a6a87_97)] | | | | | | [removed: [65](#i723bd5ed79eb47ff8ce5352df17ef4e6_91)] [added: [62](#ic73669c37deb437ebc9a21db437a6a87_97)] | | |

| | | | [Report of independent registered public accounting [removed: firm](#i723bd5ed79eb47ff8ce5352df17ef4e6_94)] [added: firm](#ic73669c37deb437ebc9a21db437a6a87_100)] (PCAOB ID 238) | | | | | | [removed: [66](#i723bd5ed79eb47ff8ce5352df17ef4e6_94)] [added: [63](#ic73669c37deb437ebc9a21db437a6a87_100)] | | |

| | | | [Consolidated [removed: Statement of Operations](#i723bd5ed79eb47ff8ce5352df17ef4e6_97)] [added: Statement](#ic73669c37deb437ebc9a21db437a6a87_103)[s](#ic73669c37deb437ebc9a21db437a6a87_103) [of Operations](#ic73669c37deb437ebc9a21db437a6a87_103)] | | | | | | [removed: [68](#i723bd5ed79eb47ff8ce5352df17ef4e6_97)] [added: [65](#ic73669c37deb437ebc9a21db437a6a87_103)] | | |

| | | | [Consolidated [removed: Statement of] [added: Statement](#ic73669c37deb437ebc9a21db437a6a87_106)[s](#ic73669c37deb437ebc9a21db437a6a87_106) [of] Comprehensive [removed: Income](#i723bd5ed79eb47ff8ce5352df17ef4e6_100)] [added: Income](#ic73669c37deb437ebc9a21db437a6a87_106)] | | | | | | [removed: [69](#i723bd5ed79eb47ff8ce5352df17ef4e6_100)] [added: [66](#ic73669c37deb437ebc9a21db437a6a87_106)] | | |

| | | | [Consolidated Balance [removed: Sheet](#i723bd5ed79eb47ff8ce5352df17ef4e6_103)] [added: Sheet](#ic73669c37deb437ebc9a21db437a6a87_109)s] | | | | | | [removed: [70](#i723bd5ed79eb47ff8ce5352df17ef4e6_103)] [added: [67](#ic73669c37deb437ebc9a21db437a6a87_109)] | | |

| | | | [Consolidated [removed: Statement of] [added: Statement](#ic73669c37deb437ebc9a21db437a6a87_112)[s](#ic73669c37deb437ebc9a21db437a6a87_112) [of] Changes in [removed: Equity](#i723bd5ed79eb47ff8ce5352df17ef4e6_106)] [added: Equity](#ic73669c37deb437ebc9a21db437a6a87_112)] | | | | | | [removed: [71](#i723bd5ed79eb47ff8ce5352df17ef4e6_106)] [added: [68](#ic73669c37deb437ebc9a21db437a6a87_112)] | | |

| | | | [Consolidated [removed: Statement of] [added: Statement](#ic73669c37deb437ebc9a21db437a6a87_115)[s](#ic73669c37deb437ebc9a21db437a6a87_115) [of] Cash [removed: Flows](#i723bd5ed79eb47ff8ce5352df17ef4e6_109)] [added: Flows](#ic73669c37deb437ebc9a21db437a6a87_115)] | | | | | | [removed: [73](#i723bd5ed79eb47ff8ce5352df17ef4e6_109)] [added: [70](#ic73669c37deb437ebc9a21db437a6a87_115)] | | |

| | | | [Notes to consolidated financial [removed: statements](#i723bd5ed79eb47ff8ce5352df17ef4e6_112)] [added: statements](#ic73669c37deb437ebc9a21db437a6a87_118)] | | | | | | [removed: [74](#i723bd5ed79eb47ff8ce5352df17ef4e6_112)] [added: [71](#ic73669c37deb437ebc9a21db437a6a87_118)] | | |

As required by Section 404 of the Sarbanes-Oxley Act of 2002, management has assessed the effectiveness of Mastercard’s internal control over financial reporting as of December 31, [removed: 2023.][added: 2024.]

Management has concluded that, based on its assessment, Mastercard’s internal control over financial reporting was effective as of December 31, [removed: 2023.][added: 2024.]

The effectiveness of Mastercard’s internal control over financial reporting as of December 31, [removed: 2023] [added: 2024] has been audited by PricewaterhouseCoopers LLP, an independent registered public accounting firm, as stated in their report which appears on the next page.

We have audited the accompanying consolidated balance [removed: sheet] [added: sheets] of Mastercard Incorporated and its subsidiaries (the “Company”) as of December 31, [removed: 2023] [added: 2024] and [removed: 2022,] [added: 2023,] and the related consolidated statements of operations, comprehensive income, changes in equity and cash flows for each of the three years in the period ended December 31, [removed: 2023,] [added: 2024,] including the related notes (collectively referred to as the “consolidated financial statements”).

We also have audited the Company’s internal control over financial reporting as of December 31, [removed: 2023,] [added: 2024,] based on criteria established in Internal Control - Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of the Company as of December 31, [removed: 2023] [added: 2024] and [removed: 2022,] [added: 2023,] and the results of its operations and its cash flows for each of the three years in the period ended December 31, [removed: 2023] [added: 2024] in conformity with accounting principles generally accepted in the United States of America.

Also in our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, [removed: 2023,] [added: 2024,] based on criteria established in Internal Control - Integrated Framework (2013) issued by the COSO.

A company’s internal control over financial reporting includes those policies and procedures that (i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (iii) provide reasonable [removed: assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.]

As described in Notes 1 and 3 to the consolidated financial statements, the Company provides certain customers with rebates and incentives which are a portion of total net revenue of [removed: $25.1] [added: $28.2] billion for the year ended December 31, [removed: 2023.][added: 2024.]

[removed: February 13, 2024][added: | | | | | | | 2024 | | |]

| Consolidated [removed: Statement] [added: Statements] of Operations | | | | | | | | | | | | | | | | | | | | |

| | | | | | | [removed: 2023] [added: 2024] | | | | | | [removed: 2022] [added: 2023] | | | | | | [removed: 2021] [added: 2022] | | |

| Net Revenue | | | | | | $ | [removed: 25,098] [added: 28,167] | | | | | $ | [removed: 22,237] [added: 25,098] | | | | | $ | [removed: 18,884] [added: 22,237] | |

| General and administrative | | | | | | [removed: 8,927] [added: 10,193] | | | | | | [removed: 8,078] [added: 8,927] | | | | | | [removed: 7,087] [added: 8,078] | | |

| Advertising and marketing | | | | | | [removed: 825] [added: 815] | | | | | | [removed: 789] [added: 825] | | | | | | [removed: 895] [added: 789] | | |

| Depreciation and amortization | | | | | | [removed: 799] [added: 897] | | | | | | [removed: 750] [added: 799] | | | | | | [removed: 726] [added: 750] | | |

| Provision for litigation | | | | | | [removed: 539] [added: 680] | | | | | | [removed: 356] [added: 539] | | | | | | [removed: 94] [added: 356] | | |

| Total operating expenses | | | | | | [removed: 11,090] [added: 12,585] | | | | | | [removed: 9,973] [added: 11,090] | | | | | | [removed: 8,802] [added: 9,973] | | |

| Operating income | | | | | | [removed: 14,008] [added: 15,582] | | | | | | [removed: 12,264] [added: 14,008] | | | | | | [removed: 10,082] [added: 12,264] | | |

| Investment income | | | | | | [removed: 274] [added: 327] | | | | | | [removed: 61] [added: 274] | | | | | | [removed: 11] [added: 61] | | |

| Gains (losses) on equity investments, net | | | | | | [removed: (61)] [added: (29)] | | | | | | [removed: (145)] [added: (61)] | | | | | | [removed: 645] [added: (145)] | | |

| Interest expense | | | | | | [removed: (575)] [added: (646)] | | | | | | [removed: (471)] [added: (575)] | | | | | | [removed: (431)] [added: (471)] | | |

| Other income (expense), net | | | | | | [removed: (7)] [added: 20] | | | | | | [removed: 23] [added: (7)] | | | | | | [removed: —] [added: 23] | | |

| Total other income (expense) | | | | | | [removed: (369)] [added: (328)] | | | | | | [removed: (532)] [added: (369)] | | | | | | [removed: 225] [added: (532)] | | |

| Income before income taxes | | | | | | [removed: 13,639] [added: 15,254] | | | | | | [removed: 11,732] [added: 13,639] | | | | | | [removed: 10,307] [added: 11,732] | | |

| Income tax expense | | | | | | [removed: 2,444] [added: 2,380] | | | | | | [removed: 1,802] [added: 2,444] | | | | | | [removed: 1,620] [added: 1,802] | | |

| Net Income | | | | | | $ | [removed: 11,195] [added: 12,874] | | | | | $ | [removed: 9,930] [added: 11,195] | | | | | $ | [removed: 8,687] [added: 9,930] | |

Market risk is the potential for economic losses to be incurred on market risk sensitive instruments arising from adverse changes in factors such as foreign currency exchange rates and interest rates.

Our exposure to market risk from changes in foreign currency exchange rates and interest rates is limited.

Management monitors risk exposures on an ongoing basis and establishes and oversees the implementation of policies governing our funding, investments and use of derivative financial instruments to manage these risks.

Foreign currency and interest rate exposures are managed through our risk management activities, which are discussed further in Note 23 (Derivative and Hedging Instruments) to the consolidated financial statements included in Part II, Item 8.

Foreign Exchange Risk

We enter into foreign exchange derivative contracts to manage currency exposure associated with anticipated receipts and disbursements occurring in a currency other than the functional currency of the entity.

We may also enter into foreign exchange derivative contracts to offset possible changes in value of assets and liabilities due to foreign exchange fluctuations.

The objective of these activities is to reduce our exposure to gains and losses resulting from fluctuations of foreign currencies against our functional currencies, principally the U.S. dollar and euro.

The effect of a hypothetical 10% adverse change in the value of the functional currencies could result in a fair value loss of approximately $475 million and $414 million on our foreign exchange derivative contracts outstanding at December 31, 2024 and 2023, respectively, before considering the offsetting effect of the underlying hedged activity.

Management’s assessment of, and conclusion on, the effectiveness of internal controls over financial reporting did not include the internal controls of RF Ultimate Parent, Inc. (“Recorded Future”), which was acquired in December 2024.

Recorded Future is a wholly-owned subsidiary whose total assets and total revenues excluded from management’s assessment of internal controls represented approximately 1% and less than 1%, respectively, of the related consolidated financial statement amounts as of and for the year ended December 31, 2024.

As described in Management’s report on internal control over financial reporting, management has excluded RF Ultimate Parent, Inc. from its assessment of internal control over financial reporting as of December 31, 2024, because it was acquired by the Company in a purchase business combination during 2024.

We have also excluded RF Ultimate Parent, Inc. from our audit of internal control over financial reporting.

RF Ultimate Parent, Inc. is a wholly-owned subsidiary whose total assets and total revenues excluded from management’s assessment and our audit of internal control over financial reporting represent approximately 1% and less than 1%, respectively, of the related consolidated financial statement amounts as of and for the year ended December 31, 2024.

assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

February 12, 2025

| Restricted cash and restricted cash equivalents | | | | | | 492 | | | | | | 32 | | |

| Balance at December 31, 2023 | | | | | | — | | | | | | — | | | | | | 5,893 | | | | | | (60,429) | | | | | | 62,564 | | | | | | (1,099) | | | | | | 6,929 | | | | | | 46 | | | | | | 6,975 | | |

| Dividends | | | | | | — | | | | | | — | | | | | | — | | | | | | — | | | | | | (2,526) | | | | | | — | | | | | | (2,526) | | | | | | — | | | | | | (2,526) | | |

| Balance at December 31, 2024 | | | | | | $ | — | | | | | $ | — | | | | | $ | 6,442 | | | | | $ | (71,431) | | | | | $ | 72,907 | | | | | $ | (1,433) | | | | | $ | 6,485 | | | | | $ | 30 | | | | | $ | 6,515 | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

The Company’s services and solutions include, among others, security solutions, consumer acquisition and engagement services, and business and market insights, all of which draw on Mastercard’s principled and responsible use of secure data.

Certain prior period amounts have been reclassified to conform to the 2024 presentation.

For those contracts that include multiple performance obligations, the Company allocates revenue to each performance obligation based on its relative standalone selling price (“SSP”).

Customer incentives to be paid to customers under business agreements are included in accrued expenses and other liabilities on the consolidated balance sheets.

The credit loss component of the impairment is recognized as an allowance and recorded in other income (expense), net on the consolidated statements of

Any amounts excluded from effectiveness testing of cash flow hedges are recognized in earnings over the life of the hedging instrument.

*Foreign currency remeasurement and translation* - Revenue and expense transactions in currencies other than applicable functional currency of an entity are converted to the functional currency at the exchange rate on the transaction date.

The Company also records an excise tax of 1% on the fair market value of net repurchases of shares of its common stock within treasury stock.

In December 2024, Mastercard acquired a 100% equity interest in RF Ultimate Parent, Inc. (“Recorded Future”), a global threat intelligence company, for cash consideration of $2.7 billion.

This acquisition is expected to add threat intelligence capabilities to Mastercard’s identity, fraud prevention, real-time decisioning and cybersecurity services.

The Company is evaluating and finalizing the purchase accounting for the businesses acquired during 2024.

| | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| Restricted cash for litigation settlement | | | | | | — | | | | | | 589 | | |

| | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | |

| | | | | | | (in millions, except per share data) | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| Balance at December 31, 2020 | | | | | | $ | — | | | | | $ | — | | | | | $ | 4,982 | | | | | $ | (36,658) | | | | | $ | 38,747 | | | | | $ | (680) | | | | | $ | 6,391 | | | | | $ | 97 | | | | | $ | 6,488 | |

| Acquisition of non-controlling interest | | | | | | — | | | | | | — | | | | | | (122) | | | | | | — | | | | | | — | | | | | | — | | | | | | (122) | | | | | | (17) | | | | | | (139) | | |

| Dividends | | | | | | — | | | | | | — | | | | | | — | | | | | | — | | | | | | (1,781) | | | | | | — | | | | | | (1,781) | | | | | | — | | | | | | (1,781) | | |

| Balance at December 31, 2022 | | | | | | — | | | | | | — | | | | | | 5,298 | | | | | | (51,354) | | | | | | 53,607 | | | | | | (1,253) | | | | | | 6,298 | | | | | | 58 | | | | | | 6,356 | | |

| | | | | | | (in millions, except per share data) | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| Acquisition of redeemable non-controlling interests | | | | | | — | | | | | | (4) | | | | | | — | | |

| Acquisition of non-controlling interest | | | | | | — | | | | | | — | | | | | | (133) | | |

| Contingent consideration paid | | | | | | — | | | | | | — | | | | | | (64) | | |

The Company’s value-added services include, among others, cyber and intelligence solutions designed to allow all parties to transact securely, easily and with confidence, as well as other services that provide proprietary insights, drawing on Mastercard’s principled and responsible use of secure consumer and merchant data.

The Company’s investments in new networks, such as open banking solutions and digital identity capabilities, support and strengthen payments and services solutions.

During 2023, the Company fully reduced its Restricted cash for litigation settlement balance as the settlement became final in August 2023.

*Contingent consideration* - Certain business combinations involve the potential for future payment of consideration that is contingent upon the achievement of performance milestones.

These liabilities are classified within Level 3 of the Valuation Hierarchy as the inputs used to measure fair value are unobservable and require management’s judgment.

The fair value of the contingent consideration at the acquisition date and subsequent periods is determined utilizing an income approach based on a Monte Carlo technique and is recorded in other current liabilities and other liabilities on the consolidated balance sheet.

Changes to projected performance milestones of the acquired businesses could result in a higher or lower contingent consideration liability.

outstanding ownership interest.

commencement date in determining the present value of lease payments.

Revenue and expense accounts are remeasured at the weighted-average exchange rate for the period.

All share-based compensation expenses are recorded in general and administrative expenses on the consolidated statement of operations.

This guidance is expected to impact the disclosures only with no impact to the results of operations, financial position or cash flows.

In March 2021, Mastercard acquired a majority of the Corporate Services business of Nets Denmark A/S (“Nets”) for €3.0 billion (approximately $3.6 billion as of the date of acquisition) in cash consideration based on a €2.85 billion enterprise value, adjusted for cash and net working capital at closing.

The business acquired is primarily comprised of clearing and instant payment services and e-billing solutions.

The goodwill arising from this acquisition is primarily attributable to the synergies expected to arise through geographic, product and customer expansion, the underlying technology and workforce acquired.

In June 2021, Mastercard acquired a 100% equity interest in Ekata, Inc. (“Ekata”) for cash consideration of $861 million, based on an $850 million enterprise value, adjusted for cash and net working capital at closing.

The acquisition of Ekata is expected to broaden the Company’s digital identity verification capabilities.

Mastercard acquired additional businesses in 2021 for consideration of $272 million.

These businesses were not considered individually material to Mastercard.

| | | | | | | | | | | | | | | |

| | | | | | | 2022 | | | | | | 2021 | | |

Anti-Money Laundering, Countering the Financing of Terrorism, Economic Sanctions and Anti-Corruption. We are subject to anti-money laundering (“AML”) and countering the financing of terrorism (“CFT”) laws and regulations globally, including the U.S. Bank Secrecy Act and the USA PATRIOT Act, as well as the various economic sanctions programs, including those imposed and administered by the U.S. Office of Foreign Assets Control [removed: (“OFAC”).][added: (“OFAC”) and the European Union.]

In the U.S., these obligations include requiring the screening of account holders and [removed: merchants, respectively,] [added: merchants] against OFAC sanctions lists (including the SDN List).

Issuer and Acquirer Practices Legislation and Regulation. Our issuers and acquirers are subject to numerous regulations and investigations applicable to banks, financial institutions and other licensed entities, [removed: impacting us as a consequence.][added: which can indirectly impact us.]

Additionally, regulations such as the [removed: revised] [added: EU’s] Payment Services Directive [removed: (commonly referred to as “PSD2”)] in the EEA require financial institutions to provide third-party payment processors access to consumer payment accounts, enabling them to route transactions away from Mastercard products and provide payment initiation and account information services directly to consumers who use our products.

[removed: This] [added: Authorities in the EU are also revising standards relating to the authentication of transactions, which] may increase the number of transactions that consumers abandon if we are unable to ensure a frictionless authentication experience under the new standards.

Regulation of [removed: Internet, Digital Transactions] [added: Internet] and High-Risk Merchant Categories. Various jurisdictions have enacted [removed: or have proposed] regulation related to internet transactions [removed: which applies to payments system participants,] [added: (such as laws surrounding gambling,] including [added: fantasy sports), which impacts both] us and our customers.

We [removed: may] [added: are] also [removed: be] impacted by evolving laws surrounding [removed: gambling, including fantasy sports, as well as] certain legally permissible but high-risk merchant categories, such as adult content, firearms, alcohol and tobacco.

Privacy, Data Protection, AI and Information Security. Aspects of our operations or business are subject to increasingly complex and fragmented privacy, [removed: data] [added: data, AI] and information security laws and regulations in the U.S., the EU and elsewhere around the world.

For example, in the U.S., we and our customers are respectively subject to, among other laws and regulations, Federal Trade Commission and federal banking agency information safeguarding requirements under the Gramm-Leach-Bliley Act [removed: (“GLBA”)] [added: (GLBA)] that require, among other things, the maintenance of a written, comprehensive information security program and, increasingly, a number of state data and privacy laws.

With respect to information security, [added: we are subject to] the U.S. Securities and Exchange Commission (the “SEC”) [removed: adopted new] disclosure rules that require, among other things, disclosing material cybersecurity incidents in a Current Report on Form 8-K, generally within four business days of determining an incident is material.

Laws and regulations in this area are constantly evolving due to several factors, including increasing data collection and data flows, numerous data breaches and security incidents, more sensitive data categories, and emerging technologies such as [removed: AI.][added: AI (which is now subject to regulation in the EU as well as other places).]

[removed: In] addition, the interpretation and application of these privacy, data protection and information security laws and regulations are often uncertain and in a state of flux, thus requiring constant monitoring for compliance.

[removed: Specific topics] [added: Regulations already adopted or being considered] include [removed: climate (such] [added: required corporate reporting and disclosures on topics with respect to climate, such] as the U.K. Streamlined Energy and Carbon Reporting, the EU Corporate Sustainability Reporting [removed: Directive, or “EU CSRD”, and] [added: Directive (“EU CSRD”), and, to] the [added: extent they become effective,] SEC [removed: proposed] rules related to climate [removed: change) and human rights (such as the EU Corporate Sustainability Due Diligence Directive).][added: change.]

Additional Regulatory Developments. Various regulatory agencies also continue to examine a wide variety of issues that could impact us, including evolving laws [added: and guidance] surrounding buy-now-pay-later, open banking, [added: credit reporting,] digital currencies, marijuana, prepaid payroll cards, identity theft, account management guidelines, disclosure [removed: rules] [added: rules, marketing] and [removed: marketing.][added: operational resilience.]

| | | | Payments Industry Regulation | | | | | | | | | | | | Competition and Technology | | | | | | Brand, Reputational Impact and [removed: ESG] [added: Environmental, Social and Governance] | | | | | |

Moreover, several jurisdictions are demonstrating increased interest about the network fees we charge to our customers (in some cases as part of broader market reviews of retail payments), which could in the future lead to regulation [removed: of] [added: relating to] our network fees.

This type of regulation and oversight is related to switching [removed: activities (authorization, clearing and settlement),] [added: activities,] and includes policies, procedures and requirements related to risk management, collateral, participant default, timely switching of financial transactions, and capital and financial resources.

[removed: The] [added: Our strategic] expansion of our products and services [removed: as part of our multi-rail strategy] has also created the need for us to obtain new types and increasing numbers of regulatory licenses, resulting in increased supervision and additional compliance burdens distinct from those imposed on our [removed: core] payment network activities.

[removed: These] [added: For example, certain of our subsidiaries maintain money transfer] licenses [added: that] typically impose supervisory and examination requirements, as well as capital, safeguarding, risk management and other business obligations.

In addition, any regulation that is enacted related to the type and level of network fees [added: we charge our customers could also materially and adversely impact our results of operations.]

[removed: we charge] [added: These responses could result in a decrease in] our [removed: customers] [added: overall transaction volumes, which in turn] could [removed: also] materially and adversely impact our results of operations.

Regulators could also require us to obtain prior approval for changes to our system rules, procedures or operations, or could require customization with regard to such [removed: changes, which could negatively impact us.]

Increased [removed: regulatory, legislative and litigation] activity with respect to interchange rates could have an adverse impact on our business.

Interchange rates are a significant component of the costs that merchants pay in connection with the acceptance of products associated with our [removed: core] payment network.

Additionally, our no-surcharge rules now permit U.S. and Canadian merchants to surcharge credit cards (subject to certain [removed: limitations), which over time could lead merchants in some or all merchant categories in these jurisdictions to choose to surcharge as permitted.][added: limitations).]

Preferential [removed: and] [added: or] protective government actions related to domestic payment services could adversely affect our ability to maintain or increase our revenues.

Governments in some countries have acted, or in the future may act, to provide resources, preferential treatment or other protection to selected national [added: or domestic] payment and switching providers, or have created, or may in the future create, their own national provider.

[removed: This action] [added: These actions] may displace us from, prevent us from entering into, or substantially restrict us from participating in, particular geographies, and may prevent us from competing effectively against those providers.

- Some jurisdictions have implemented, or are [removed: considering,] [added: considering implementing,] requirements to collect, store and/or process data within their borders, as well as prohibitions on the transfer of data abroad, leading to technological and operational implications as well as increased compliance burdens and other costs.

- Geopolitical events [removed: (such as Russia’s invasion of Ukraine)] and [added: any] resulting OFAC sanctions, adverse trade policies, enforcement of U.S. laws related to countering the financing of terrorism, economic sanctions and anti-corruption, or other types of government actions could lead affected or other jurisdictions to take actions in response that could adversely affect our business.

[removed: Moreover, given] [added: jurisdictions may have with respect to] our [added: business, including our] decision to suspend business operations in Russia, [removed: other separate] [added: such] jurisdictions may decide to begin to or increase their focus on growing local payment networks and other solutions.

- Governments have been increasingly creating and expanding local payments [removed: structures (such as the Brazilian Instant Payment System-PIX, FedNow in the U.S. and UPI in India),] [added: structures,] which are increasingly being considered as alternatives to traditional domestic payment solutions and schemes such as ours.

While policymakers around the globe [added: often] look to the EU and the GDPR when adopting new or updated privacy and data protection laws, divergences have occurred and continue to occur.

Overall, these myriad laws and regulations may require us to modify [added: or limit] our data processing practices and policies, incur substantial compliance-related costs and expenses, and otherwise suffer adverse impacts on our business.

Failure to comply with any of these laws, regulations and requirements [added: (including as a result of conflicting regulations)] could result in fines, sanctions or other enforcement actions or penalties, which could materially and adversely affect our results of operations and overall business, as well as have an impact on our reputation.

As a user and deployer of AI technology, we are also subject to increasing and evolving laws and regulations related to AI [removed: governance] [added: governance, including the EU AI Act,] and new applications of existing laws and regulations to AI.

How our use and deployment of AI will be regulated [removed: remains uncertain given] [added: is still developing as policymakers around] the [added: world consider how to regulate AI, and] uncertainty [removed: that exists] [added: remains] as to how AI technology will [removed: develop.][added: continue to advance.]

In particular, AI algorithms may generate inaccurate, unintended, [removed: unfair] [added: unfair, biased] or discriminatory [removed: outcomes, which] [added: outcomes (which] may not be easily detectable or [removed: explainable,] [added: explainable)] and may inadvertently [added: disclose confidential information and/or] breach intellectual property, privacy or other [removed: rights, as well as confidential information.][added: rights.]

Further, as we acquire new companies and develop integrated and personalized products and services to meet the needs of a changing marketplace, we have expanded [added: and may further expand] our data profile through additional data types and sources, across multiple channels, and involving new partners.

This expansion has amplified [added: and may continue to amplify] the impact of these various laws and regulations on our [removed: business.][added: business or subject us to new laws and regulations.]

Preferential or Protective Government Actions. Some governments have taken action to provide resources, preferential treatment or other protection to selected domestic payments and processing providers, as well as to create their own national providers.

For example, governments in some countries mandate switching of domestic payments either entirely in that country or by only domestic companies.

Some jurisdictions are currently considering adopting or have adopted data localization requirements, which mandate the collection, storage, and/or other processing of data within their borders.

This is the case, for instance, in India, China and Saudi Arabia.

Various forms of data localization requirements or data transfer restrictions are also under consideration in other countries and jurisdictions, including the EU.

We and our customers may also be subject to evolving U.S. federal and/or state AI laws and regulations.

In

Sustainability Disclosures. Various jurisdictions have adopted or are increasingly considering adopting laws, regulations and oversight expectations requiring disclosure on environmental, social and governance matters.

Other adopted or potential regulations focus on social topics, including human rights, such as the EU Corporate Sustainability Due Diligence Directive, the treatment of employees and diversity of workforce, such as in the EU CSRD.

changes, which could negatively impact us.

If, over time, an increased number of merchants choose to surcharge as permitted, this could result in consumers viewing our products less favorably and/or using alternative means of payment.

Moreover, because of various concerns

For example, our acquisition of Recorded Future, a global threat intelligence company, increases our exposure to certain laws and regulations, including global cybercrime and other laws and regulations in various jurisdictions.

We are subject to AML and CFT laws and regulations globally.

- Account-based Payments Systems.

With respect to government-backed solutions, including those involving DPI, government participation in structures could prevent us from entering into, or substantially restrict us from participating in, particular geographies.

- Payments industry participants may develop their own products and services to support our switched transaction and payments offerings, forcing us to change our pricing or practices for our own offerings in order to compete.

In addition, we face a heightened risk that data we share with these companies as part of our products and services could be used in a way that could put us at a competitive disadvantage.

As a result, we may not be able to grow our volume and/or services enough to compensate for the additional costs related to these increased incentives and pricing discounts.

In addition to decisions made by competitors and customers, we also face pressure from pricing regulation and litigation.

Additionally, we face pricing pressure related to real-time account-based payment schemes.

The payments industry is subject to rapid and significant technological changes, including new technologies and changes to existing technologies (such as cryptocurrency and blockchain, AI, machine learning, privacy enhancement and cybersecurity).

They may also result in new and innovative payment methods, products and services.

Additionally, there are a number of factors relating to technology change that could impact us.

These include: the inability of third parties on which we rely for the development of and access to new technologies to keep pace with technological changes; potential action from third-party patent holders, including notices or inquiries threatening litigation against us or our customers for alleged

patent infringement or demanding significant license fees; the scope of, as well as customer and merchant resistance to, industry-wide solutions and standards (such as those related to tokenization or other safety and security technologies); any difficulty we may experience in attracting and retaining employees with technology expertise; and the need to invest resources for new technologies, which could lead to further additional expenses.

Any of these developments could impact our ability to develop and adopt new technologies, as well as improve and keep pace with current technologies and reflect such technology in our payments offerings.

As a result, we may need to alter our technology and delivery model, potentially resulting in additional expenses and/or other operational impacts.

If we fail to sufficiently develop and adopt new technologies, or improve and keep pace with current technologies and reflect such technology in our payments offerings, our payments offerings could be negatively impacted and/or we could be put at a competitive disadvantage.

This could impact our ability to compete with new technologies and products, as well as encourage customers that use our technology to enhance and deliver their payment-related products and services (including fintechs and technology companies) to use their own technology to compete against us.

These types of threats have risen

PSD2 also requires a new standard for authentication of transactions, which necessitates additional verification information from consumers to complete transactions.

PART I

ESG. Various jurisdictions have adopted or are increasingly considering adopting laws and regulations impacting our reporting on ESG governance, strategy, risk management, metrics and targets, and results.

Regulations already adopted or being considered include required corporate reporting and disclosures on specific topics as well as broader ESG matters.

Broader ESG matters include other environmental matters, treatment of employees and diversity of workforce (such as in the EU CSRD).

ITEM 1A.

RISK FACTORS

For example, certain of our subsidiaries maintain money transfer licenses to support certain activities.

This could result in consumers viewing our products less favorably and/or using alternative means of payment instead of electronic products, which could result in a decrease in our overall transaction volumes, and which in turn could materially and adversely impact our results of operations.

For example, merchants could switch (and in some cases are switching) transactions directly with issuers.

Additionally, processors could process transactions directly between issuers and acquirers.

Large scale consolidation within processors could result in these processors developing bilateral agreements or in some cases switching the entire transaction on their own network, thereby disintermediating us.

These companies may also develop products or services that compete with our customers within the payments ecosystem and, as a result, could diminish demand for our products and services.

When we do partner with fintechs and technology companies, we face a heightened risk when we share data as part of those relationships.

While we share this data in a controlled manner subject to applicable anonymization and privacy and data standards, sharing this data without proper oversight could provide partners with a competitive advantage.

- Competitors, customers, fintechs, technology companies, governments and other industry participants may develop products that compete with or replace products and services we currently provide to support our switched transaction and payments offerings.

These products could either replace, or force us to change our pricing or practices, for these offerings.

Our inability to switch additional transaction volumes or to provide additional services to our customers at levels sufficient to compensate for such lower fees or increased costs in the future could materially and adversely affect our overall business and results of operations.

Roadmap for Enhancing Cross-border Payments)).

The payments industry is subject to rapid and significant technological changes, which can impact our business in several ways:

Moreover, these changes could result in new and innovative payment methods, products and services that could place us at a competitive disadvantage and that could reduce the use of our products and services.

- We rely in part on third parties (including some of our competitors and potential competitors) for the development of and access to new technologies.

The inability of these companies to keep pace with technological developments, or the acquisition of these companies by competitors, could negatively impact our offerings.

- Our ability to develop and adopt new services and technologies may be inhibited by industry-wide solutions and standards (such as those related to EMV, tokenization or other safety and security technologies), and by resistance from customers or merchants to such changes.

- Our ability to develop evolving systems and products may be inhibited by any difficulty we may experience in attracting and retaining employees with technology expertise.

- Our ability to adopt these technologies can also be inhibited by intellectual property rights of third parties.

We have received, and we may in the future receive, notices or inquiries from patent holders (including operating companies or non-practicing entities) suggesting that we may be infringing patents or that we need to license the use of their patents to avoid infringement.

Such notices may, among other things, threaten litigation against us or our customers or demand significant license fees.

- Our ability to develop new technologies and reflect technological changes in our payments offerings requires resources, which has resulted in and may further result in additional expenses.

- We work with fintechs, technology companies (such as digital players and mobile providers) and traditional customers that use our technology to enhance payment safety and security and to deliver their payment-related products and services quickly and efficiently to consumers.

Our inability to keep pace technologically could negatively impact the willingness of these customers to work with us, and could encourage them to use their own technology and compete against us.

- Various central banks are experimenting with CBDCs which may be launched with their own networks to transfer money between participants.

Failure to keep pace with these technological developments or otherwise bring to market products that reflect these technologies could lead to a decline in the use of our products, which could have a material adverse impact on our overall business and results of operations.

These types of threats have risen significantly due to a significant portion of our workforce working in a hybrid environment.

These threats also may be further enhanced in frequency or effectiveness through threat actors’ use of AI.

Our operations rely on the secure transmission, storage and other processing of confidential, proprietary, sensitive and personal information and technology in our computer systems and networks, as well as the systems of our third-party providers.

Our customers and other parties in the payments value chain, as well as account holders, rely on our digital technologies, computer systems, software and networks to conduct their operations.

In addition, to access our products and services, our customers and account holders increasingly use personal smartphones, tablet PCs and other mobile devices that may be beyond our control.

We, like other financial technology organizations, routinely are subject to cyber-threats and our technologies, systems and networks, as well as the systems of our third-party providers, have been subject to attempted cyber-attacks.

Because of our position in the payments value chain, we believe that we are likely to continue to be a target of such threats and attacks.

For the fiscal year ended December 31, [removed: 2023][added: 2024]

| | | | | | | [removed: ] [added: ] | | | | | | | | | | | | | | |

| [removed: Class] [added: Class] A Common Stock, par value $0.0001 per [removed: share] [added: share] | | | | | | [removed: MA] [added: MA] | | | | | | [removed: New] [added: New] York Stock [removed: Exchange] [added: Exchange] | | |

| [removed: 2.1%] [added: 2.1%] Notes due [removed: 2027] [added: 2027] | | | | | | [removed: MA27] [added: MA27] | | | | | | [removed: New] [added: New] York Stock [removed: Exchange] [added: Exchange] | | |

| [removed: 1.0%] [added: 1.0%] Notes due [removed: 2029] [added: 2029] | | | | | | [removed: MA29A] [added: MA29A] | | | | | | [removed: New] [added: New] York Stock [removed: Exchange] [added: Exchange] | | |

| [removed: 2.5%] [added: 2.5%] Notes due [removed: 2030] [added: 2030] | | | | | | [removed: MA30] [added: MA30] | | | | | | [removed: New] [added: New] York Stock [removed: Exchange] [added: Exchange] | | |

| If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. | | | | | | | | | | | | | | | | | | | | | [removed: ☒] [added: ☐] | | |

The aggregate market value of the registrant’s Class A common stock, par value $0.0001 per share, held by non-affiliates (using the New York Stock Exchange closing price as of June [removed: 30, 2023,] [added: 28, 2024,] the last business day of the registrant’s most recently completed second fiscal quarter) was approximately [removed: $328.8] [added: $364.4] billion.

As of February [removed: 8, 2024,] [added: 7, 2025,] there were [removed: 925,723,131] [added: 904,889,521] shares outstanding of the registrant’s Class A common stock, par value $0.0001 per share and [removed: 7,168,369] [added: 6,818,985] shares outstanding of the registrant’s Class B common stock, par value $0.0001 per share.

| Portions of the registrant’s definitive proxy statement for the [removed: 2024] [added: 2025] Annual Meeting of Stockholders are incorporated by reference into Part III hereof. | | |

[removed: ][added: ]

MASTERCARD INCORPORATED FISCAL YEAR [removed: 2023] [added: 2024] FORM 10-K ANNUAL REPORT

| PART I | | | [removed: [6](#i723bd5ed79eb47ff8ce5352df17ef4e6_16)] [added: [6](#ic73669c37deb437ebc9a21db437a6a87_16)] | | | [Item [removed: 1.](#i723bd5ed79eb47ff8ce5352df17ef4e6_16)] [added: 1.](#ic73669c37deb437ebc9a21db437a6a87_16)] | | | [removed: [Business](#i723bd5ed79eb47ff8ce5352df17ef4e6_16)] [added: [Business](#ic73669c37deb437ebc9a21db437a6a87_16)] | | |

| [removed: [27](#i723bd5ed79eb47ff8ce5352df17ef4e6_19)] [added: [25](#ic73669c37deb437ebc9a21db437a6a87_19)] | | | [Item [removed: 1A.](#i723bd5ed79eb47ff8ce5352df17ef4e6_19)] [added: 1A.](#ic73669c37deb437ebc9a21db437a6a87_19)] | | | [Risk [removed: factors](#i723bd5ed79eb47ff8ce5352df17ef4e6_19)] [added: factors](#ic73669c37deb437ebc9a21db437a6a87_19)] | | | | | |

| [removed: [41](#i723bd5ed79eb47ff8ce5352df17ef4e6_22)] [added: [39](#ic73669c37deb437ebc9a21db437a6a87_22)] | | | [Item [removed: 1B.](#i723bd5ed79eb47ff8ce5352df17ef4e6_22)] [added: 1B.](#ic73669c37deb437ebc9a21db437a6a87_22)] | | | [Unresolved staff [removed: comments](#i723bd5ed79eb47ff8ce5352df17ef4e6_22)] [added: comments](#ic73669c37deb437ebc9a21db437a6a87_22)] | | | | | |

| [removed: [41](#i723bd5ed79eb47ff8ce5352df17ef4e6_1099511629840)] | | | [added: | | |] [Item [removed: 1C.](#i723bd5ed79eb47ff8ce5352df17ef4e6_1099511629840)] [added: 1C. C](#ic73669c37deb437ebc9a21db437a6a87_25)ybersecurity] | | | [removed: [C](#i723bd5ed79eb47ff8ce5352df17ef4e6_1099511629840)[ybersecurity](#i723bd5ed79eb47ff8ce5352df17ef4e6_1099511629840)] | | | | | | [added: | | |]

| [removed: [43](#i723bd5ed79eb47ff8ce5352df17ef4e6_25)] [added: [41](#ic73669c37deb437ebc9a21db437a6a87_28)] | | | [Item [removed: 2.](#i723bd5ed79eb47ff8ce5352df17ef4e6_25)] [added: 2.](#ic73669c37deb437ebc9a21db437a6a87_28)] | | | [removed: [Properties](#i723bd5ed79eb47ff8ce5352df17ef4e6_25)] [added: [Properties](#ic73669c37deb437ebc9a21db437a6a87_28)] | | | | | |

| [removed: [43](#i723bd5ed79eb47ff8ce5352df17ef4e6_28)] [added: [41](#ic73669c37deb437ebc9a21db437a6a87_31)] | | | [Item [removed: 3.](#i723bd5ed79eb47ff8ce5352df17ef4e6_28)] [added: 3.](#ic73669c37deb437ebc9a21db437a6a87_31)] | | | [Legal [removed: proceedings](#i723bd5ed79eb47ff8ce5352df17ef4e6_28)] [added: proceedings](#ic73669c37deb437ebc9a21db437a6a87_31)] | | | | | |

| [removed: [43](#i723bd5ed79eb47ff8ce5352df17ef4e6_31)] [added: [41](#ic73669c37deb437ebc9a21db437a6a87_34)] | | | [Item [removed: 4.](#i723bd5ed79eb47ff8ce5352df17ef4e6_31)] [added: 4.](#ic73669c37deb437ebc9a21db437a6a87_34)] | | | [Mine safety [removed: disclosures](#i723bd5ed79eb47ff8ce5352df17ef4e6_31)] [added: disclosures](#ic73669c37deb437ebc9a21db437a6a87_34)] | | | | | |

| | | | [removed: [44](#i723bd5ed79eb47ff8ce5352df17ef4e6_34)] [added: [42](#ic73669c37deb437ebc9a21db437a6a87_37)] | | | [removed: [\-](#i723bd5ed79eb47ff8ce5352df17ef4e6_34)] [added: [\-](#ic73669c37deb437ebc9a21db437a6a87_37)] | | | [Information about our executive [removed: officers](#i723bd5ed79eb47ff8ce5352df17ef4e6_34)] [added: officers](#ic73669c37deb437ebc9a21db437a6a87_37)] | | |

| PART II | | | [removed: [47](#i723bd5ed79eb47ff8ce5352df17ef4e6_40)] [added: [45](#ic73669c37deb437ebc9a21db437a6a87_43)] | | | [Item [removed: 5.](#i723bd5ed79eb47ff8ce5352df17ef4e6_40)] [added: 5.](#ic73669c37deb437ebc9a21db437a6a87_43)] | | | [Market for registrant’s common equity, related stockholder matters and issuer purchases of equity [removed: securities](#i723bd5ed79eb47ff8ce5352df17ef4e6_40)] [added: securities](#ic73669c37deb437ebc9a21db437a6a87_43)] | | |

| [removed: [47](#i723bd5ed79eb47ff8ce5352df17ef4e6_43)] [added: [45](#ic73669c37deb437ebc9a21db437a6a87_46)] | | | [Item [removed: 6.](#i723bd5ed79eb47ff8ce5352df17ef4e6_43)] [added: 6.](#ic73669c37deb437ebc9a21db437a6a87_46)] | | | Reserved | | | | | |

| [removed: [48](#i723bd5ed79eb47ff8ce5352df17ef4e6_46)] [added: [46](#ic73669c37deb437ebc9a21db437a6a87_49)] | | | [Item [removed: 7.](#i723bd5ed79eb47ff8ce5352df17ef4e6_46)] [added: 7.](#ic73669c37deb437ebc9a21db437a6a87_49)] | | | [Management’s discussion and analysis of financial condition and results of [removed: operations](#i723bd5ed79eb47ff8ce5352df17ef4e6_46)] [added: operations](#ic73669c37deb437ebc9a21db437a6a87_49)] | | | | | |

| [removed: [62](#i723bd5ed79eb47ff8ce5352df17ef4e6_85)] [added: [60](#ic73669c37deb437ebc9a21db437a6a87_91)] | | | [Item [removed: 7A.](#i723bd5ed79eb47ff8ce5352df17ef4e6_85)] [added: 7A.](#ic73669c37deb437ebc9a21db437a6a87_91)] | | | [Quantitative and qualitative disclosures about market [removed: risk](#i723bd5ed79eb47ff8ce5352df17ef4e6_85)] [added: risk](#ic73669c37deb437ebc9a21db437a6a87_91)] | | | | | |

| [removed: [64](#i723bd5ed79eb47ff8ce5352df17ef4e6_88)] [added: [61](#ic73669c37deb437ebc9a21db437a6a87_94)] | | | [Item [removed: 8.](#i723bd5ed79eb47ff8ce5352df17ef4e6_88)] [added: 8.](#ic73669c37deb437ebc9a21db437a6a87_94)] | | | [Financial statements and supplementary [removed: data](#i723bd5ed79eb47ff8ce5352df17ef4e6_88)] [added: data](#ic73669c37deb437ebc9a21db437a6a87_94)] | | | | | |

| [removed: [115](#i723bd5ed79eb47ff8ce5352df17ef4e6_196)] [added: [108](#ic73669c37deb437ebc9a21db437a6a87_202)] | | | [Item [removed: 9.](#i723bd5ed79eb47ff8ce5352df17ef4e6_196)] [added: 9.](#ic73669c37deb437ebc9a21db437a6a87_202)] | | | [Changes in and disagreements with accountants on accounting and financial [removed: disclosure](#i723bd5ed79eb47ff8ce5352df17ef4e6_196)] [added: disclosure](#ic73669c37deb437ebc9a21db437a6a87_202)] | | | | | |

| [removed: [115](#i723bd5ed79eb47ff8ce5352df17ef4e6_199)] [added: [108](#ic73669c37deb437ebc9a21db437a6a87_205)] | | | [Item [removed: 9A.](#i723bd5ed79eb47ff8ce5352df17ef4e6_199)] [added: 9A.](#ic73669c37deb437ebc9a21db437a6a87_205)] | | | [Controls and [removed: procedures](#i723bd5ed79eb47ff8ce5352df17ef4e6_199)] [added: procedures](#ic73669c37deb437ebc9a21db437a6a87_205)] | | | | | |

| [removed: [116](#i723bd5ed79eb47ff8ce5352df17ef4e6_202)] [added: [109](#ic73669c37deb437ebc9a21db437a6a87_208)] | | | [Item [removed: 9B.](#i723bd5ed79eb47ff8ce5352df17ef4e6_202)] [added: 9B.](#ic73669c37deb437ebc9a21db437a6a87_208)] | | | [Other [removed: information](#i723bd5ed79eb47ff8ce5352df17ef4e6_202)] [added: information](#ic73669c37deb437ebc9a21db437a6a87_208)] | | | | | |

| PART III | | | [removed: [118](#i723bd5ed79eb47ff8ce5352df17ef4e6_208)] [added: [111](#ic73669c37deb437ebc9a21db437a6a87_217)] | | | [Item [removed: 10.](#i723bd5ed79eb47ff8ce5352df17ef4e6_208)] [added: 10.](#ic73669c37deb437ebc9a21db437a6a87_217)] | | | [Directors, executive officers and corporate [removed: governance](#i723bd5ed79eb47ff8ce5352df17ef4e6_208)] [added: governance](#ic73669c37deb437ebc9a21db437a6a87_217)] | | |

| [removed: [118](#i723bd5ed79eb47ff8ce5352df17ef4e6_211)] [added: [111](#ic73669c37deb437ebc9a21db437a6a87_220)] | | | [Item [removed: 11.](#i723bd5ed79eb47ff8ce5352df17ef4e6_211)] [added: 11.](#ic73669c37deb437ebc9a21db437a6a87_220)] | | | [Executive [removed: compensation](#i723bd5ed79eb47ff8ce5352df17ef4e6_211)] [added: compensation](#ic73669c37deb437ebc9a21db437a6a87_220)] | | | | | |

| [removed: [118](#i723bd5ed79eb47ff8ce5352df17ef4e6_214)] [added: [111](#ic73669c37deb437ebc9a21db437a6a87_223)] | | | [Item [removed: 12.](#i723bd5ed79eb47ff8ce5352df17ef4e6_214)] [added: 12.](#ic73669c37deb437ebc9a21db437a6a87_223)] | | | [Security ownership of certain beneficial owners and management and related stockholder [removed: matters](#i723bd5ed79eb47ff8ce5352df17ef4e6_214)] [added: matters](#ic73669c37deb437ebc9a21db437a6a87_223)] | | | | | |

| [removed: [118](#i723bd5ed79eb47ff8ce5352df17ef4e6_217)] [added: [111](#ic73669c37deb437ebc9a21db437a6a87_226)] | | | [Item [removed: 13.](#i723bd5ed79eb47ff8ce5352df17ef4e6_217)] [added: 13.](#ic73669c37deb437ebc9a21db437a6a87_226)] | | | [Certain relationships and related transactions, and director [removed: independence](#i723bd5ed79eb47ff8ce5352df17ef4e6_217)] [added: independence](#ic73669c37deb437ebc9a21db437a6a87_226)] | | | | | |

| [removed: [118](#i723bd5ed79eb47ff8ce5352df17ef4e6_220)] [added: [111](#ic73669c37deb437ebc9a21db437a6a87_229)] | | | [Item [removed: 14.](#i723bd5ed79eb47ff8ce5352df17ef4e6_220)] [added: 14.](#ic73669c37deb437ebc9a21db437a6a87_229)] | | | [Principal accountant fees and [removed: services](#i723bd5ed79eb47ff8ce5352df17ef4e6_220)] [added: services](#ic73669c37deb437ebc9a21db437a6a87_229)] | | | | | |

| PART IV | | | [removed: [120](#i723bd5ed79eb47ff8ce5352df17ef4e6_226)] [added: [113](#ic73669c37deb437ebc9a21db437a6a87_235)] | | | [Item [removed: 15.](#i723bd5ed79eb47ff8ce5352df17ef4e6_226)] [added: 15.](#ic73669c37deb437ebc9a21db437a6a87_235)] | | | [Exhibits and financial statement [removed: schedules](#i723bd5ed79eb47ff8ce5352df17ef4e6_226)] [added: schedules](#ic73669c37deb437ebc9a21db437a6a87_235)] | | |

| [removed: [120](#i723bd5ed79eb47ff8ce5352df17ef4e6_229)] [added: [113](#ic73669c37deb437ebc9a21db437a6a87_238)] | | | [Item [removed: 16.](#i723bd5ed79eb47ff8ce5352df17ef4e6_229)] [added: 16.](#ic73669c37deb437ebc9a21db437a6a87_238)] | | | [Form 10-K [removed: summary](#i723bd5ed79eb47ff8ce5352df17ef4e6_229)] [added: summary](#ic73669c37deb437ebc9a21db437a6a87_238)] | | | | | |

- the inability to attract and retain a highly qualified [removed: and diverse] workforce, or maintain our corporate culture

| | | | | | | [Item 1. [removed: Business](#i723bd5ed79eb47ff8ce5352df17ef4e6_16)] [added: Business](#ic73669c37deb437ebc9a21db437a6a87_16)] | | | | | | | | | | | |

| | | | | | | [Item 1A. Risk [removed: factors](#i723bd5ed79eb47ff8ce5352df17ef4e6_19)] [added: factors](#ic73669c37deb437ebc9a21db437a6a87_19)] | | | | | | | | | | | |

| | | | | | | [Item 1B. Unresolved staff [removed: comments](#i723bd5ed79eb47ff8ce5352df17ef4e6_22)] [added: comments](#ic73669c37deb437ebc9a21db437a6a87_22)] | | | | | | | | | | | |

| | | | | | | [Item 2. [removed: Properties](#i723bd5ed79eb47ff8ce5352df17ef4e6_25)] [added: Properties](#ic73669c37deb437ebc9a21db437a6a87_28)] | | | | | | | | | | | |

| [39](#ic73669c37deb437ebc9a21db437a6a87_25) | | | [Item 1C.](#ic73669c37deb437ebc9a21db437a6a87_25) | | | [Cybersecurity](#ic73669c37deb437ebc9a21db437a6a87_25) | | | | | |

| [109](#ic73669c37deb437ebc9a21db437a6a87_2245) | | | [Item 9C.](#ic73669c37deb437ebc9a21db437a6a87_2245) | | | [Disclosure Regarding Foreign Jurisdictions that Prevent Inspections](#ic73669c37deb437ebc9a21db437a6a87_2245) | | | | | |

These services and solutions include, among others, security solutions, consumer acquisition and engagement services, and business and market insights, all of which draw on our principled and responsible use of secure data. Our capabilities strengthen, reinforce and complement each other and are fundamentally interdependent.

| $28.2B | | | | | | | | | | | | $12.9B | | | | | | | | | | | | $13.89 | | | | | |

| $28.2B | | | | | | | | | | | | $13.5B | | | | | | | | | | | | $14.60 | | | | | |

| up 13% | | | | | | | | | | | | up 18% | | | | | | | | | | | | up 21% | | | | | |

| $13.4B | | | | | | | | | | | | $11.0B | | | Repurchased shares | | | | | | | | | $14.8B | | | | | |

| $9.8T | | | | | | | | | | | | up 18% | | | | | | | | | | | | 159.4B | | | | | |

| up 11% | | | | | | | | | | | | | | | | | | up 11% | | | | | | | | | | | |

| Consumer Credit | | | | | | $ | 3,634 | | | | | 9 | | % | | | | 37 | | % | | | | 1,070 | | | | | | 5 | | % | | | |

- consumer payments

- commercial and new payment flows

- services and other solutions

| Our Strategy | | | | | | | | | | | |

|  | | |  | | |  | | | | | |

| Consumer payments | | | Commercial and new payment flows | | | Services and other solutions | | | | | |

| Enabled by | | | | | | | | | | | |

| People | | | Brand | | | Data & AI | | | | | |

| Technology | | | Franchise | | | Doing well by doing good | | | | | |

Our Strategic Priorities

- Capturing the significant secular opportunity of cash displacement by increasing acceptance through advancing technology and partnering with players across the payments ecosystem, as well as by opening up closed-loop and domestic networks.

We also pursue incremental volume and transactions by extending our reach across under-penetrated card verticals (such as bill pay) and real-time account-based payments

- Driving brand preference through compelling consumer experiences by offering relevant value propositions to consumers (including features, benefits and experiences), providing comprehensive digital functionality (such as Digital First), delivering enhanced security and functionality (increasing tokenization, scaling authentication and streamlining online checkout) and driving increased approval, spend and activation rates

- Investing in the future and driving market transformation by extending the reach of our network to enable the tokenization of credentials, identities, assets and data and the exchange of those items between counterparties (providing security, privacy and control).

We also seek to achieve this transformation by modernizing our card switch to meet evolving needs

Commercial and new payment flows. We focus on capturing opportunities in commercial payments (both point-of-sale purchases and invoiced payments) and disbursements and remittances (specifically, through Mastercard Move, our collection of money movement capabilities that provides solutions for money transfers to consumers from consumers, businesses or governments).

- Accelerating secular shift in commercial point-of-sale purchases by offering differentiated propositions across cards and platforms (both corporate and small business solutions, including expense management, reporting, reconciliation and data insights); expanding distribution of our point-of-sale offerings across financial institutions, new geographies, new channels and small businesses; and growing acceptance

- Capturing commercial invoiced payments by driving engagement across buyers and suppliers to, among other things, simplify workflows, release working capital and improve data reconciliation to reduce end-to-end costs; building on our travel offerings to expand into additional select verticals (including business-to-business (“B2B”) marketplaces, trade and logistics, healthcare, consumer packaged goods and pharmaceuticals); and embedding payments into widely used platforms and workflows

- Modernizing disbursements and remittances by utilizing Mastercard Move to scale use cases across senders (including consumers, businesses and governments) and receiving consumers (both domestic and cross-border) and expand money movement across our global network of financial institution partners

We offer security solutions, consumer acquisition and engagement, business and market insights, gateway, processing and open banking, among other services and solutions (including ACH batch and real-time account-based payments and solutions).

We do so by:

- Differentiating our payments capabilities by combining our wide range of services and solutions in various ways to meet the needs and priorities of our partners, which helps drive market wins and payments growth

- Enhancing and expanding our suite of services to better serve our existing customers, including across new buying centers and new capability areas, as well as to reach new customers

- Scaling distribution by using our technology platforms to enable us to switch more transactions and deliver more services per transaction, selling directly to customers through a dedicated sales force and global account teams, and embedding services with partners (such as tech platforms, system integrators, processors and other networks) to deliver those services at scale

|  | | | | | | •Our payments network helps us scale our services and solutions, and those services and solutions help us differentiate our payments solutions •We grow in payments, which allows us to switch more transactions and bring more transaction data onto the network •We use that data to create insightful services and solutions that can, in turn, help us win new and renewed customer deals and drive greater payments volume growth | | |

Data and AI. We create a range of products and services for our customers using our data and artificial intelligence (“AI”) assets, technology, platforms and expertise.


| | | | •In 2024, we began processing domestic transactions in China through our joint venture. Mastercard-branded cards are now accepted for both domestic and cross-border purchases. | | | | | | | | |

We operate real-time payments infrastructure in several countries around the world.

Commercial and New Payment Flows

| | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| | | | | | | [Item](#i723bd5ed79eb47ff8ce5352df17ef4e6_1099511629840) [1C](#i723bd5ed79eb47ff8ce5352df17ef4e6_1099511629840)[.](#i723bd5ed79eb47ff8ce5352df17ef4e6_1099511629840) [C](#i723bd5ed79eb47ff8ce5352df17ef4e6_1099511629840)ybersecurity | | | | | | | | | | | |

PART I

ITEM 1.

BUSINESS

Item 1.

Business

Our value-added services include, among others, cyber and intelligence solutions designed to allow all parties to transact securely, easily and with confidence, as well as other services that provide proprietary insights, drawing on our principled and responsible use of secure consumer and merchant data. Our investments in new networks, such as open banking solutions and digital identity capabilities, support and strengthen our payments and services solutions.

| $25.1B | | | | | | | | | | | | $11.2B | | | | | | | | | | | | $11.83 | | | | | |

| up 13% | | | | | | | | | | | | up 13% | | | | | | | | | | | | up 16% | | | | | |

| $25.1B | | | | | | | | | | | | $11.6B | | | | | | | | | | | | $12.26 | | | | | |

| $11.2B | | | | | | | | | | | | $9.0B | | | Repurchased shares | | | | | | | | | $12.0B | | | | | |

| $9.0T | | | | | | | | | | | | up 24% | | | | | | | | | | | | 143.2B | | | | | |

| up 12% | | | | | | | | | | | | | | | | | | up 14% | | | | | | | | | | | |

PART I

| Consumer Credit | | | | | | $ | 3,445 | | | | | 12 | | % | | | | 38 | | % | | | | 1,024 | | | | | | 4 | | % | | | |

- expand in payments for consumers, businesses and governments

- extend our services to enhance transactions and drive customer value

- embrace new network opportunities to enable open banking, digital identity and other adjacent network capabilities

Each of our priorities supports and builds upon each other and are fundamentally interdependent.

| Our strategy | | | Our key priorities | | | Powering our success | | | | | |

|  | | |  | | |  | | | | | |

- Driving growth in consumer payments with a focus on accelerating digitization, growing acceptance and pursuing an expanded set of use cases, including through partnerships

- Capturing new payment flows by expanding our multi-rail capabilities and applications to penetrate key flows such as commercial point-of-sale transactions, business-to-business (“B2B”) accounts payable flows, disbursements and remittances and consumer bill payments

- Leaning into new payment innovations including acceptance growth accelerators such as Tap on Phone, cloud commerce and contactless, as well as developing solutions that support digital currencies and blockchain applications

These services include cyber and intelligence solutions, insights and analytics, consulting, marketing, loyalty, processing and payment gateway solutions for e-commerce merchants.

We extend our services by:

- Enhancing the value of payments by making payments safe, secure, intelligent and seamless

- Expanding services to new segments and use cases to address the needs of a larger set of customers, including financial institutions, merchants, governments, digital players and others, while expanding our geographic reach

- Supporting and strengthening new network capabilities, including expanding services associated with digital identities and deploying our expertise in open banking and open data

Embrace new network opportunities. We are building and managing new adjacent network capabilities to power commerce and payments, creating new opportunities to develop and embed services.

- Applying our open banking solutions to help institutions and individuals exchange consumer-permissioned data securely and easily by enabling the reliable access, transmission and management of consumer data (including for opening new accounts, securing loans, increasing credit scores and enabling consumer choice in money movement and personal finance management)

- Enabling digital identity solutions to instill trust in the digital world and help ensure that payments across consumers, businesses, devices and virtual entities are efficient, safe and secure

- Payments provide data and distribution to drive scale and differentiation in services and enable the development and adoption of new network capabilities

- Services improve the security, efficiency and intelligence of payments, improve portfolio performance, differentiate our offerings, strengthen our customer relationships and support our open banking and digital identity networks

- New network opportunities strengthen our digital payments value proposition, including improved authentication with digital identity, and new opportunities to develop and embed services in our expanding product offerings


We also provide switched transaction services to customers where the merchant country and the country of issuance are the same (“domestic transactions”).

We switch over 65% of all transactions for Mastercard and Maestro-branded cards, including nearly all cross-border transactions.

Program highlights

- We are committed to the responsible handling of personal information, and we balance our product development activities with a commitment to transparency and control, fairness and non-discrimination, as well as accountability

- Our multi-layered privacy, data protection and information security programs and practices are designed to ensure the safety, security and responsible use of the information and data our stakeholders entrust to us

- We work with our customers, governments, policymakers and others to help develop and implement standards for safe and secure transactions, as well as privacy-centric data practices

- Our programs are informed by third-party assessments and advice regarding best practices from consultants, peer companies and advisors

- Our programs are designed to align with internationally recognized privacy, data protection and information security standards and undergo regular certifications and attestations

- We continually test our systems to discover and address any potential vulnerabilities

- We have processes for evaluating (among other things) the privacy, data protection and information security infrastructure of our third-party providers (including examining any relevant records), and we seek to manage third-party risk with procedures to onboard our third-party providers, monitor their activity during our engagement (where possible) and off-board such third-party service providers at the end of our engagement

- We maintain a business continuity program and cyber insurance coverage

Governance and oversight of privacy, data protection and information security

Board and Committee responsibilities

Our Board and Risk Committee have specific oversight responsibilities with respect to cybersecurity and privacy risk:

- Risk Committee: Overseeing risks relating to our policies, procedures and strategic approach to information security (inclusive of cybersecurity), privacy and data [removed: protection][added: protection, among other things]

We have a core group of senior executives who are responsible for assessing and managing risk and implementing policies, procedures and strategies pertaining to security [removed: governance and] [added: governance,] data [added: protection and] privacy.

- Chief Privacy and Data Responsibility Officer, who establishes and oversees the programs, policies, processes and controls we have implemented across the organization to ensure compliance with worldwide laws and regulations regarding how we collect, use, share, store, transfer and otherwise process data and [removed: leverage] [added: utilize] AI, while also managing our relevant engagements with regulators, policymakers and key stakeholders

- Chief Data Officer, who [added: establishes and] oversees our efforts to maintain an ethical, responsible enterprise data program that adheres to our high standards for data quality, curation and governance while minimizing data risks

- Data Protection Officer, who reports to the Chief Privacy and Data Responsibility Officer [removed: and] [added: and, with the support of the Global Data Protection Office,] ensures that we continue to adhere to the GDPR and local privacy requirements, including by handling privacy requests from individuals and regulators

[removed: The individuals] [added: Each individual] currently serving in these roles [removed: each meet] [added: meets] the applicable expertise requirements.

Our cybersecurity programs are under the direction of our CSO (in coordination with our Chief Privacy and Data Responsibility [removed: Officer,] [added: Officer and] Chief Data Officer, among others), who receives reports from our cybersecurity teams and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents.

The Risk Committee [removed: chair] [added: Chairperson] provides reports to the Board on such topics.

[removed: In addition, our] [added: Our] Board and the Risk Committee also receive information about these topics as part of regular business and legal and regulatory updates.

Further, the Audit Committee would be informed of a material cybersecurity incident that could have a potential impact on our financial statements.

Program highlights

- We are committed to the responsible handling of personal information, and we balance our product development activities with a commitment to transparency and control, fairness and non-discrimination, as well as accountability

- Our multi-layered privacy, data protection and information security programs and practices are designed to ensure the safety, security and responsible use of the information and data our stakeholders entrust to us

- We work with our customers, governments, policymakers and others to help develop and implement standards for safe and secure transactions, as well as privacy-centric data practices

- Our programs are informed by third-party assessments and advice regarding best practices from consultants, peer companies and advisors

- Our programs are designed to align with internationally recognized privacy, data protection and information security standards and undergo regular certifications and attestations

- We continually test our systems to discover and address any potential vulnerabilities

- We have processes for evaluating (among other things) the privacy, data protection and information security infrastructure of our third-party providers (including examining any relevant records), and we seek to manage third-party risk with procedures to onboard our third-party providers, monitor their activity during our engagement (where possible) and off-board such third-party service providers at the end of our engagement

- We maintain a business continuity program and cyber insurance coverage

Governance and oversight of privacy, data protection and information security

Board and Committee responsibilities

Our Board and Risk Committee have specific oversight responsibilities with respect to cybersecurity and privacy risk:

As of December 31, [removed: 2023,] [added: 2024,] Mastercard and its subsidiaries owned or leased commercial properties throughout the U.S. and other countries around the world, consisting of corporate and regional offices, as well as our operations centers.

| Linda Kirkpatrick *President, Americas* since January 2024 | | | | | | [removed: 47] [added: 48] | | | | | | President, North America (2021-2023) President, U.S. Issuers (2020) Executive Vice President, Merchants and Acceptance (2016-2020) Senior Vice President, Core Merchants (2013-2016) Senior Vice President, Franchise Development (2011-2013) Vice President, U.S. Region (2008-2011) Vice President, Investor Relations | | | | | | | | |

| [removed: Hai Ling*President,] [added: Ling Hai*President,] Asia Pacific, Europe, Middle East & Africa*since January 2024 | | | | | | [removed: 53] [added: 54] | | | | | | Co-President, International Markets (2022-2023) Co-President, Asia Pacific (2015-2021) President, Enterprise Development (2014-2015) President, Greater China (2010-2014) | | | | | | Various roles at Booz Allen Hamilton and Bank of America | | |

| Edward McLaughlin*President and Chief Technology Officer, Mastercard Technology*since May 2017 | | | | | | [removed: 58] [added: 59] | | | | | | Chief Information Officer (2016-2017) Chief Emerging Payments Officer (2010-2015) Various senior leadership roles, including Chief Franchise Development Officer and Senior Vice President, Bill Payment and Healthcare | | | | | | Group Vice President, Product and Strategy, Metavante Corporation Co-Founder and CEO, Paytrust, Inc. | | |

| Sachin Mehra*Chief Financial Officer*since April 2019 | | | | | | [removed: 53] [added: 54] | | | | | | Chief Financial Operations Officer (2018-2019) Executive Vice President, Commercial Products (2015-2018) Executive Vice President and Business Financial Officer, North America (2013-2015) Corporate Treasurer (2010-2013) | | | | | | Various senior positions at Hess Corporation, including Vice President and Treasurer Various senior treasury and finance positions at General Motors Corporation and GMAC | | |

| Michael Miebach *President and Chief Executive Officer* since January 2021 | | | | | | [removed: 56] [added: 57] | | | | | | President (2020) Chief Product Officer (2016-2020) President, Middle East and Africa (2010-2015) | | | | | | Managing Director, Middle East and North Africa and Managing Director, Sub-Saharan Africa, Barclays Bank PLC Various executive positions at Citigroup in Germany, Austria, U.K. and Turkey | | |

| Tim Murphy*Chief Administrative Officer*since April 2021 | | | | | | [removed: 56] [added: 57] | | | | | | General Counsel (2014-2021) Chief Product Officer (2009-2014) Various senior leadership roles, including President, U.S. Region; Executive Vice President, Customer Business Planning and Analysis; and Senior Vice President and Associate General Counsel | | | | | | Associate, Cleary, Gottlieb, Steen and Hamilton, New York and London | | |

| Raja Rajamannar*Chief Marketing and Communications [removed: Officer and President, Healthcare*since January 2016] [added: Officer* since May 2024] | | | | | | [removed: 62] [added: 63] | | | | | | [added: President, Healthcare (2016-2024)] Chief Marketing Officer (2013-2015) | | | | | | Executive Vice President-Senior Business and Chief Transformation Officer, Anthem (formerly, WellPoint, Inc.) (2012- 2013) Senior Vice President and Chief Innovation and Marketing Officer, Humana Inc. (2009-2012) Various management positions at Citigroup, including Executive Vice President and Chief Marketing Officer-Citi Global Cards | | |

| Raj [removed: Seshadri*President, Data and Services*since January 2020] [added: Seshadri*Chief Commercial Payments Officer*since May 2024] | | | | | | [removed: 58] [added: 59] | | | | | | President, [added: Data and Services (2020-2024) President,] U.S. Issuers (2016-2019) | | | | | | Managing Director, Head of iShares U.S. Wealth Advisory business, BlackRock (2014-2016) Managing Director, Global Marketing Officer of iShares, BlackRock, Inc. (2012-2014) Various leadership positions at Citigroup, U.S. Trust Company and McKinsey & Company, Inc. | | |

| Craig Vosburg*Chief [removed: Product] [added: Services] Officer*since [removed: January 2021] [added: May 2024] | | | | | | [removed: 56] [added: 57] | | | | | | [added: Chief Product Officer (2021-2024)] President, North America (2016-2020) Chief Product Officer (2014-2015) Executive Vice President, U.S. Market Development (2010-2014) Various senior leadership roles, including Head of Mastercard Advisors, U.S. and Canada and Head of Mastercard Advisors, Southeast Asia, Greater China and South Asia/Middle East/Africa | | | | | | Senior member-financial services practice, Bain & Company and A.T. Kearney Vice President, CoreStates Financial Corporation | | |

| | | | | | | [Item 5. Market for registrant’s common equity, related stockholder matters and issuer purchases of equity [removed: securities](#i723bd5ed79eb47ff8ce5352df17ef4e6_40)] [added: securities](#ic73669c37deb437ebc9a21db437a6a87_43)] | | | | | | | | | | | |