Moody's 10-K 2023-12-31

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

FORM 10-K

(MARK ONE)

☑ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

FOR THE FISCAL YEAR ENDED December 31, 2023

OR

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

FOR THE TRANSITION PERIOD FROM TO .

COMMISSION FILE NUMBER 1-14037

MOODY’S CORPORATION

(EXACT NAME OF REGISTRANT AS SPECIFIED IN ITS CHARTER)

7 World Trade Center at 250 Greenwich Street, New York, New York 10007

(ADDRESS OF PRINCIPAL EXECUTIVE OFFICES)

(ZIP CODE)

REGISTRANT’S TELEPHONE NUMBER, INCLUDING AREA CODE: (212) 553-0300.

SECURITIES REGISTERED PURSUANT TO SECTION 12(b) OF THE ACT:

SECURITIES REGISTERED PURSUANT TO SECTION 12(g) OF THE ACT:

NONE

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☑ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☑

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☑ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☑ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C.7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☑

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☑

The aggregate market value of Moody’s Corporation Common Stock held by nonaffiliates* on June 30, 2023 (based upon its closing transaction price on the New York Stock Exchange on such date) was approximately $64 billion.

As of January 31, 2024, 182.5 million shares of Common Stock of Moody’s Corporation were outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the Registrant’s definitive proxy statement for use in connection with its annual meeting of stockholders scheduled to be held on April 16, 2024, are incorporated by reference into Part III of this Form 10-K.

The Index to Exhibits is included as Part IV, Item 15(3) of this Form 10-K.

*Calculated by excluding all shares held by executive officers and directors of the Registrant without conceding that all such persons are “affiliates” of the Registrant for purposes of federal securities laws.

MOODY'S 2023 10-K 1

Table of Contents

MOODY’S CORPORATION

INDEX TO FORM 10-K

2 MOODY'S 2023 10-K

Table of Contents

MOODY'S 2023 10-K 3

Table of Contents

GLOSSARY OF TERMS AND ABBREVIATIONS

The following terms, abbreviations and acronyms are used to identify frequently used terms in this report:

4 MOODY'S 2023 10-K

Table of Contents

MOODY'S 2023 10-K 5

Table of Contents

6 MOODY'S 2023 10-K

Table of Contents

MOODY'S 2023 10-K 7

Table of Contents

8 MOODY'S 2023 10-K

Table of Contents

MOODY'S 2023 10-K 9

Table of Contents

PART I

Background

As used in this report, except where the context indicates otherwise, the terms “Moody’s” or the “Company” refer to Moody’s Corporation, a Delaware corporation, and its subsidiaries. The Company’s executive offices are located at 7 World Trade Center at 250 Greenwich Street, New York, NY 10007 and its telephone number is (212) 553-0300.

THE COMPANY

Company Overview

Moody’s is a global integrated risk assessment firm that empowers organizations to anticipate, adapt and thrive in a new era of exponential risk. Our data, analytical solutions and insights help decision-makers identify opportunities and manage the risks of doing business with others.

Moody's is empowering organizations to make better decisions.

Moody's

We provide tools that enable Banks, Insurers, Investors, Corporations and Governments to...

Leveraging our set of data, analytics, & domain expertise across...

Moody’s has two reportable segments: MA and MIS.

			Provider of financial intelligence and analytical tools supporting customers’ growth, efficiency and risk management objectives															Independent provider of credit rating opinions and related information for over 100 years

Financial information and operating results of these segments, including revenue, expenses and Adjusted Operating Income, are included in Part II, Item 8. Financial Statements of this annual report and are herein incorporated by reference.

10 MOODY'S 2023 10-K

Table of Contents

Moody's Analytics Overview

MA empowers financial services, corporate and public sector customers to anticipate risks, adapt and thrive in a new era of exponential risk. MA's combined data, analytics and cloud-based software tools deliver integrated solutions that help customers to start business relationships, monitor and manage risk, and comply and report based on global laws, rules and regulations.

MA is comprised of: i) a premier fixed income and economic research business (Research & Insights); ii) a data business powered by the world’s largest database on companies and credit (Data & Information); and iii) three cloud-based SaaS businesses serving banking, insurance and KYC workflows (Decision Solutions).

MA creates a holistic view on risk provided by our vast set of proprietary data, analytics, and domain expertise across a range of areas, including credit, companies, properties, securities, people, economies, ESG, climate and more. MA's integrated and technology-enabled solutions provide unique capabilities and insights that are embedded in customer workflows.

MOODY'S 2023 10-K 11

Table of Contents

MA by the Numbers
			14,800+									6,600+									900+
MA Customers						Corporates and Professional Services						Real Estate Entities
			160+									2,600+									600+
Countries where MA customers operate						Commercial Banks						Educational Institutions
												1,900+									100+
									Asset Managers						Securities Dealers and Investment Banks
												900+

Showing the first 8K of 65K characters. Open the full section

Please carefully consider the following discussion of significant factors, events and uncertainties that make an investment in the Company’s securities risky and provide important information for the understanding of the “forward-looking” statements discussed in Item 7 of this Form 10-K and elsewhere. These risk factors should be read in conjunction with the other information in this annual report on Form 10-K.

The events and consequences discussed in these risk factors could, in circumstances the Company may not be able to accurately predict, recognize, or control, have a material adverse effect on Moody’s business, financial condition, operating results (including components of the Company’s financial results such as sales and profits), cash flows and stock price. These risk factors do not identify all risks that Moody’s faces. The Company could also be affected by factors, events, or uncertainties that are not presently known to the Company or that the Company currently does not consider to present significant risks. In addition to the effects of general economic conditions, including inflation and related monetary policy actions in response to inflation, changes in international conditions, including the impact of ongoing or new developments in the Russia-Ukraine military conflict and the military conflict in Israel and surrounding areas, and resulting global disruptions on our business and operations discussed in Item 7 of this Form 10-K and in the risk factors below, additional or unforeseen effects from the global economic climate may give rise to or amplify many of these risks discussed below.

A. Legal and Regulatory Risks

Moody’s Faces Risks Related to U.S. Laws and Regulations Applicable to the Financial Industry that Affect th****e Credit Rating Industry and Moody’s Customers.

Moody’s operates in a highly regulated industry and is subject to extensive regulation by federal, state and local authorities in the U.S., including the Reform Act and the Dodd-Frank Act. These regulations are complex, continually evolving and have tended to become more stringent over time. Additionally, changes in Congress may increase the uncertainty with regard to potential changes in these laws and regulations and the enforcement of any new or existing legislation or directives by government authorities. See “Regulation” in Part I, Item 1 of this annual report on Form 10-K for more information. The current laws and regulations:

–seek to encourage, and may result in, increased competition among CRAs and in the credit rating business;

–may result in alternatives to credit ratings or changes in the pricing of credit ratings;

–restrict the use of information in the development or maintenance of credit ratings;

–increase regulatory oversight of the credit markets and CRA operations;

–provide the SEC with direct jurisdiction over CRAs that seek NRSRO status, and grant authority to the SEC to inspect the operations of CRAs; and

–provide for enhanced oversight standards and specialized pleading standards, which may result in increases in the number of legal proceedings claiming liability for losses suffered by investors on rated securities and aggregate legal defense costs.

If these laws and regulations, and any future rulemaking or court rulings, reduce demand for credit ratings or increase costs, Moody’s may be unable to pass such costs through to customers. In addition, there may be uncertainty over the scope, interpretation, administration and enforcement of such laws and regulations. The Company’s compliance and efforts to mitigate the risk of fines, penalties or other sanctions can result in significant expenses. Legal proceedings that are increasingly lengthy can result in uncertainty over and exposure to liability.

It is difficult to accurately assess the future impact of legislative and regulatory requirements on Moody’s business and its customers’ businesses. For example, new laws and regulations may affect MIS’s communications with issuers as part of the rating assignment process, alter the manner in which MIS’s credit ratings are developed, assigned and communicated, affect the manner in which MIS or its customers or users of credit ratings operate, impact the demand for MIS’s credit ratings and alter the economics of the credit ratings business, including by restricting or mandating business models for CRAs. Further, speculation concerning the impact of legislative and regulatory initiatives and the increased uncertainty over potential liability and adverse legal or judicial determinations may negatively affect Moody’s stock price. Although these legislative and regulatory initiatives apply to CRAs and credit markets generally, they may affect Moody’s in a disproportionate manner. Each of these developments increase the costs and legal risk associated with the issuance of credit ratings and can have a material adverse effect on Moody’s operations, profitability and competitiveness, the demand for credit ratings and the manner in which such ratings are utilized.

MOODY'S 2023 10-K 25

Table of Contents

In addition, MA derives a significant amount of its sales from banks and other financial services providers who are subject to regulatory oversight. U.S. banking regulators, including the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System and the Consumer Financial Protection Bureau, as well as many state agencies, have issued guidance to insured depository institutions and other providers of financial services on assessing and managing risks associated with third-party relationships, which include all business arrangements between a financial services provider and another entity, by contract or otherwise, and generally requires banks and financial services providers to exercise comprehensive oversight throughout each phase of a bank or financial service provider’s business arrangement with third-party service providers, and instructs banks and financial service providers to adopt risk management processes commensurate with the level of risk and complexity of their third-party relationships. In light of this, MA’s existing or potential bank and financial services customers subject to this guidance have sought to and may further revise their third-party risk management policies and processes and the terms on which they do business with MA. This can result in delayed or reduced sales to such customers, adversely affect MA’s relationship with such customers, increase the costs of doing business with such customers and/or result in MA assuming greater financial and legal risk under its agreements with such customers.

Moody’s Faces Risks Related to Financial Reforms Outside the U.S. Affecting the Credit Rating Industry, Moody’s Businesses, and Moody’s Customers.

In addition to the extensive and evolving U.S. laws and regulations governing the credit rating industry, foreign jurisdictions have taken measures to regulate CRAs and the markets for credit ratings. In particular, the EU has adopted a common regulatory framework for CRAs operating in the EU and continues to monitor the credit rating industry and analyze approaches that may strengthen existing regulation. Credit ratings emanating from outside the EU are subject to ESMA’s oversight if they are endorsed into the EU, and ratings endorsed into the U.K. are similarly subject to oversight of the FCA. Additionally, other foreign jurisdictions have taken measures to increase regulation of CRAs and markets for credit ratings. See “Regulation” in Part 1, Item 1 of this annual report on Form 10-K for more information.

The EU and other jurisdictions, as discussed further below, adopt legislation and engage in rulemaking on an ongoing basis that significantly impacts operations and the markets for the Company’s p

Showing the first 8K of 72K characters. Open the full section

None.

Governance

Management

The Company maintains a dedicated internal cybersecurity team that interacts with executive management and its business units to identify, assess, manage, and respond to cybersecurity risks and incidents relating to the Company’s information systems and operations. In addition, this internal cybersecurity team is responsible for managing detection, mitigation and remediation of cybersecurity incidents. The internal cybersecurity team is managed by the CISO, who reports to the CAO, who is a member of the executive leadership team. At December 31, 2023, the Company’s internal cybersecurity team consisted of members located in various countries and time zones across the world. The team has members with experience in governance, risk management and compliance, threat monitoring, threat emulation, penetration testing and cyber incident management. Team members have both individual responsibilities and a team focus, covering areas such as network, endpoint device, and e-mail security engineering as well as operations and threat management, monitoring, and response.

The Cyber Committee, chaired by the CISO, and whose members include the CTSO and CAO, as well as other members of senior management and the legal team, is responsible for identifying cybersecurity risks and threats, recommending mitigating actions to strengthen cybersecurity resilience, and meeting risk tolerance thresholds established by senior management. The Cyber

MOODY'S 2023 10-K 35

Table of Contents

Committee also validates that the Company has appropriate people, process and technology capabilities to identify, mitigate and report on cybersecurity risks to the executive leadership team and the Board of Directors. The Cyber Committee meets regularly to allow members of the internal cybersecurity team to present concerns and recommendations for decisions on preventing, identifying, mitigating, and remediating risks and threats. To the extent warranted, the Cyber Committee may additionally be convened on an ad hoc basis. The Cyber Committee makes decisions regarding the reporting of cybersecurity concerns to the executive leadership team, who escalate issues to the Board and/or the Audit Committee as necessary. In the case of incidents that arise, the Cyber Committee, under the direction of the Board and/or executive leadership team when appropriate, works to involve all appropriate personnel with the aim of resolving the incident, performing any required remediation/reporting, and taking appropriate steps to comply with applicable laws and regulations. The process that the Cyber Committee follows upon emergence of incidents is documented in the Company’s Incident Response Plan. Additionally, cybersecurity risks and the adequacy of associated mitigations are analyzed by senior leadership as part of the enterprise risk assessments that are reported to and discussed by the Board.

The CISO has extensive cybersecurity knowledge and skills, gained from over 20 years’ experience working in regulated industries. The CISO holds a number of cybersecurity related certifications, including the Certified Information Systems Security Professional and Certified Information Security Manager. In addition to the CISO, the CTSO has been a close partner and advocate for cybersecurity at the Company, and is consulted or informed on all decisions or risks that affect the Company's technology systems and/or implicate cybersecurity. The CAO is responsible for overseeing the cybersecurity team at the executive leadership level.

Board of Directors and Audit Committee

The Board provides oversight of management’s efforts to assess and manage cybersecurity risks and respond to cybersecurity incidents and threats. In addition, the Audit Committee of the Board of Directors regularly receives reports from management regarding the Company’s financial and compliance risks, including, but not limited to, risks relating to internal controls and cybersecurity risks.

The Board receives regular updates from the CISO, CTSO, and CAO regarding matters related to technology and cybersecurity. The Company has protocols, as discussed below, by which certain cybersecurity concerns, incidents and threats are escalated within the Company and, where appropriate, reported in a timely manner to the Board.

Risk Management and Strategy

The objective of the Company's comprehensive cybersecurity program is to assess, identify, and manage risks from cybersecurity incidents and threats. The Company's cybersecurity program leverages the NIST Framework and it incorporates training and awareness coupled with ongoing monitoring and assessment. The cybersecurity program is an important part of the Company’s enterprise risk management (ERM), with the head of the Company’s ERM program sitting on the Cyber Committee, and sets forth a process for escalating certain incidents to the Company’s ERM group integrated into the Company’s Incident Response Plan.

As part of the cybersecurity program, the Company’s cybersecurity environment is monitored by automated tools on an ongoing basis and an internal cybersecurity team that reviews threats, alerts, and incidents. The Company’s Incident Response Plan provides governance and guidance in responding to information security incidents and is tested regularly for calibration against existing and emerging threats. The Incident Response Plan describes the process to be followed by the Cyber Committee in connection with the oversight of the cybersecurity environment and specific events that occur from time to time. The cybersecurity program undergoes periodic internal and external reviews. In addition, the Company's Internal Controls Department performs an independent assessment of the design and operating effectiveness of the Company’s network of cybersecurity controls in accordance with the NIST Framework. The results of the assessment are periodically shared with the Cyber Committee and the Audit Committee.

The Company’s cybersecurity environment is also subject to routine vulnerability assessment processes. Internal and external teams, including the Cyber Committee, conduct activities such as penetration testing, red teaming, tabletop exercises and phishing drills. Results are measured and assessed for possible improvements. In addition to these ongoing efforts, the Company has a set of third-party risk management tools through which it monitors for cybersecurity risks and threats associated with its third-party service providers. The Incident Response Plan includes processes that define how the Company manages and responds to such risks or threats associated with its third-party service providers.

The Company contracts with reputable third parties to conduct annual external assessments of its cybersecurity program and its components. Government agencies and their contracted agents also conduct periodic reviews in certain jurisdictions where the Company operates. Insurance agents, customers and other market participants routinely assess the Company’s security posture relative to their own standards.

Security Policy and Requirements

The Company has an Information Security Policy and Information Security Standards, which, taken together, describe the standards and minimum requirements that are expected of all business and information security personnel to protect the Company’s information and technology assets. The policy provides a framework guided by security principles designed to address the confidentiality, integrity and availability of the Company’s information assets in the context of internal, external, deliberate and accidental threats, while supporting the Company’s information creation and sharing needs.

The Company is subject to various privacy laws in the jurisdictions where it operates including CCPA and GDPR, as well as U.S. Federal regulation by the FTC, for certain privacy-related aspects of its business, and the Sarbanes-Oxley Act of 2002. The

36 MOODY'S 2023 10-K

Table of Contents

Company is audited in connection with requirements set forth in the Sarbanes-Oxley Act of 2002, and Moody’s Analytics obtains third-party audits in connection with ISO 27001 and SOC 2 certification and attestation reports, respectively, for certain products. As previously mentioned, the Company also aligns with NIST standards in connection with information security, which it uses to evaluate its cybersecurity readiness and resilience, and is required to make various filings and comply with requirements in certain jurisdictions in which it operates.

The Company’s cybersecurity program also includes an information security training and awareness program called InfoSafe for all employees. The program includes annual certification to having read and understood the Company's IT Use Policy, continuing education on phishing awareness, regular communications about cybersecurity best practices, and participation in annual events like Cybersecurity Awareness Month. Employees are expected to complete annual cybersecurity training, and compliance is monitored. The Company uses general and targeted phishing simulations to help employees better recognize and respond to potential threats. The training program is further enhanced by cybersecurity experts speaking at educational events. The Company also offers specialized training modules on emerging cybersecurity threats for its software development teams. The Company’s IT Use Policy outlines a detailed escalation process under which employees are to immediately report any suspected cybersecurity incident.

The cybersecurity threat landscape is dynamic and volatile, and requires significant investment on the part of the Company in terms of talent recruitment and retention, as well as procuring and deploying the correct tools to address threats. Additional information on cybersecurity risks is discussed in Item 1A of Part I, “Risk Factors,” under the heading “Technology Risks,” which should be read in conjunction with the foregoing information.

Moody’s corporate headquarters is located at 7 World Trade Center at 250 Greenwich Street, New York, New York 10007. As of December 31, 2023, Moody’s operations were conducted from 31 U.S. offices and 81 non-U.S. office locations, all of which are leased. These properties are geographically distributed to meet operating and sales requirements worldwide. These properties are generally considered to be both suitable and adequate to meet current operating requirements.

For information regarding legal proceedings, see Part II, Item 8 – “Financial Statements,” Note 21 “Contingencies” in this Form 10-K.

Not applicable.

PART II

Information in response to this Item is set forth under the captions below.

MOODY’S PURCHASES OF EQUITY SECURITIES

For the three months ended December 31, 2023:

(1)Includes surrender to the Company of 10,208; 878; and 496 shares of common stock in October, November and December, respectively, to satisfy tax withholding obligations in connection with the vesting of restricted stock issued to employees.

(2)As of the last day of each of the months.

On February 7, 2022, the Board of Directors authorized $750 million of share repurchase authority. At December 31, 2023, there was approximately $359 million of share repurchase authority remaining under this authorization. On February 5, 2024, the Board of Directors authorized an additional $1 billion in share repurchase authority. There is no established expiration date for the remaining authorizations.

During the fourth quarter of 2023, Moody’s issued a net 100 thousand shares under employee stock-based compensation plans.

MOODY'S 2023 10-K 37

Table of Contents

COMMON STOCK INFORMATION

The Company’s common stock trades on the New York Stock Exchange under the symbol “MCO”. The number of registered shareholders of record at January 31, 2024 was 1,461. A substantially greater number of the Company’s common stock is held by beneficial holders whose shares of record are held by banks, brokers and other financial institutions.

EQUITY COMPENSATION PLAN INFORMATION

The table below sets forth, as of December 31, 2023, certain information regarding the Company’s equity compensation plans.

(1)Includes 2,065,581 options and unvested restricted stock units outstanding under the Company's 2001 Key Employees' Stock Incentive Plan, 66,855 options and unvested restricted stock units outstanding under the Risk Management Solutions, Inc. 2015 Equity Incentive Plan and 5,841 unvested restricted stock units outstanding under the 1998 Non-Employee Directors' Stock Incentive Plan. This number also includes a maximum of 594,140 performance shares outstanding under the Company's 2001 Key Employees' Stock Incentive Plan, which is the maximum number of shares issuable pursuant to performance share awards assuming the maximum payout of 200% of the target award for performance shares granted in 2021, 2022 and 2023. Assuming payout at target, the number of shares to be issued upon the vesting of outstanding performance share awards is 297,070.

(2)Does not reflect unvested restricted stock units or performance share awards included in column (a) because these awards have no exercise price.

(3)Includes 15,956,514 shares available for issuance as under the 2001 Stock Incentive Plan, of which all may be issued as options and 10,173,336 may be issued as awards of unrestricted shares, restricted stock, restricted stock units, performance shares or any other stock-based awards under the 2001 Stock Incentive Plan, 449,049 shares available for issuance as options or restricted stock units under the Risk Management Solutions, Inc. 2015 Equity Incentive Plan, 866,673 shares available for issuance as options, shares of restricted stock, restricted stock units or performance shares under the 1998 Directors Plan, and 2,464,707 shares available for issuance under the Company’s Employee Stock Purchase Plan.

38 MOODY'S 2023 10-K

Table of Contents

PERFORMANCE GRAPH

The following graph compares the total cumulative shareholder return of the Company to the performance of Standard & Poor’s 500 Composite Index and the Russell 3000 Financial Services Index.

The comparison assumes that $100.00 was invested in the Company’s common stock and in each of the foregoing indices on December 31, 2018. The comparison also assumes the reinvestment of dividends, if any. The total return for the Company's common stock was 192% during the performance period as compared with a total return during the same period of 107% and 97% for the S&P 500 Composite Index and the Russell 3000 Financial Services Index, respectively.

COMPARISON OF 5 YEAR CUMULATIVE TOTAL RETURN

Among Moody’s Corporation, the Standard & Poor’s 500 Composite Index, and

the Russell 3000 Financial Services Index

The comparisons in the graph above are provided in response to disclosure requirements of the SEC and are not intended to forecast or be indicative of future performance of the Company’s common stock.

MOODY'S 2023 10-K 39

Table of Contents

This discussion and analysis of financial condition and results of operations should be read in conjunction with the Moody’s Corporation consolidated financial statements and notes thereto included elsewhere in this annual report on Form 10-K.

This Management’s Discussion and Analysis of Financial Condition and Results of Operations contains Forward-Looking Statements. See “Forward-Looking Statements” commencing on page 65 and Item 1A. “Risk Factors” commencing on page 25 for a discussion of uncertainties, risks and other factors associated with these statements.

The Company

Moody’s is a global integrated risk assessment firm that empowers organizations to anticipate, adapt and thrive in a new era of exponential risk. Moody’s reports in two segments: MA and MIS.

MA is a global provider of: i) research and insights; ii) data and information; and iii) decision solutions, which help companies make better and faster decisions. MA leverages its industry expertise across multiple risks such as credit, market, financial crime, supply chain, catastrophe and climate to deliver integrated risk assessment solutions that enable business leaders to identify, measure and manage the implications of interrelated risks and opportunities.

MIS publishes credit ratings and provides assessment services on a wide range of debt obligations, programs and facilities, and the entities that issue such obligations in markets worldwide, including various corporate, financial institution and governmental obligations, and structured finance securities.

Current Matters Impacting Moody's Business

Current Macroeconomic Uncertainties/Market Volatility

The Company continues to monitor current macroeconomic and geopolitical uncertainties that have contributed to volatility in rated issuance volumes, which began in 2022 and have continued into 2023. These uncertainties include, but are not limited to: i) inflation levels; ii) higher interest rates; and iii) volatility in the global capital markets partly resulting from the ongoing military conflicts further discussed below and the failures of certain banking institutions in the first half of 2023. A substantial portion of MIS’s revenue is impacted by the level of issuance activity in the fixed income capital markets, both in the U.S. and internationally. While market volatility has resulted in suppressed rated issuance volumes in certain sectors, the Company believes that these suppressed volumes are predominantly transitory in nature. However, due to various uncertainties, Moody's is unable to predict the severity and duration of current macroeconomic and geopolitical uncertainties and their potential impact on future rated issuance volumes. Refer to Item 1A. “Risk Factors” for further disclosure relating to these risks.

Military Conflicts

The Company continues to closely monitor the impact of the ongoing Russia-Ukraine military conflict and the military conflict in Israel and surrounding areas on all aspects of its business. In response to the Russia-Ukraine military conflict, the Company is no longer conducting commercial operations in Russia for both MA and MIS and is complying with all applicable regulatory restrictions set forth by authorities in the jurisdictions in which Moody's operates. Furthermore, the Company also has withdrawn MIS credit ratings on Russian entities.

While Moody's operations and net assets in Russia and Israel and surrounding areas are not material, broader global market volatility, which partially relates to uncertainties surrounding these military conflicts, has contributed and may continue to contribute to volatility in rated issuance volumes. This impact on rated issuance volumes is more fully discussed in the "Results of Operations" section of this MD&A. The Company is unable to predict either the near-term or longer-term impact that the conflicts may have on its financial position and operating results due to numerous uncertainties regarding the severity and duration of the conflicts and their broader potential macroeconomic impact.

Critical Accounting Estimates

Moody’s discussion and analysis of its financial condition and results of operations are based on the Company’s consolidated financial statements, which have been prepared in accordance with accounting principles generally accepted in the United States. The preparation of these financial statements requires Moody’s to make estimates and judgments that affect reported amounts of assets and liabilities and related disclosures of contingent assets and liabilities at the dates of the financial statements and revenue and expenses during the reporting periods. These estimates are based on historical experience and on other assumptions that are believed to be reasonable under the circumstances. On an ongoing basis, Moody’s evaluates its critical accounting estimates. Actual results may differ from these estimates under different assumptions or conditions. The following accounting estimates are considered critical because they are particularly dependent on management’s judgment about matters that are uncertain at the time the accounting estimates are made and changes to those estimates could have a material impact on the Company’s consolidated results of operations or financial condition.

Goodwill and Other Acquired Intangible Assets

At July 31st of each year, Moody’s evaluates its goodwill for impairment at the reporting unit level, defined as an operating segment (i.e., MA and MIS), or one level below an operating segment (i.e., a component of an operating segment).

40 MOODY'S 2023 10-K

Table of Contents

The Company has four reporting units: two reporting units within MA consisting of businesses that offer: i) data and data-driven analytical solutions; and ii) risk-management software, workflow and CRE solutions, and two within the Company’s ratings business (one for the ICRA business and one that encompasses all of Moody’s other ratings operations).

The Company evaluates the recoverability of goodwill using a two-step impairment test approach at the reporting unit level. In the first step, the Company assesses various qualitative factors to determine whether the fair value of a reporting unit may be less than its carrying amount. If a determination is made based on the qualitative factors that an impairment does not exist, the Company is not required to perform further testing. If the aforementioned qualitative assessment results in the Company concluding that it is more likely than not that the fair value of a reporting unit may be less than its carrying amount, the fair value of the reporting unit will be quantitatively determined and compared to its carrying value including goodwill. If the fair value of the reporting unit exceeds the carrying value of the net assets assigned to that unit, goodwill is not impaired, and the Company is not required to perform further testing. If the fair value of the reporting unit is less than the carrying value, the Company will record a goodwill impairment charge for the amount by which the carrying value exceeds the reporting unit’s fair value. The Company evaluates its reporting units on an annual basis, or more frequently if there are changes in the reporting structure of the Company due to acquisitions, realignments or if there are indicators of potential impairment. For the reporting units where the Company is consistently able to conclude that no impairment exists using only a qualitative approach, the Company’s accounting policy is to perform the second step of the aforementioned goodwill impairment assessment at least once every three years.

The Company last performed quantitative assessments on all reporting units at July 31, 2021, pursuant to a change in reporting unit structure in the MA reportabl

Showing the first 8K of 107K characters. Open the full section

Information in response to this item is set forth under the caption “Market Risk” in Part II, Item 7 on page 59 of this annual report on Form 10-K.

Index to Financial Statements

Schedules are omitted as not required or inapplicable or because the required information is provided in the consolidated financial statements, including the notes thereto.

MOODY'S 2023 10-K 67

Table of Contents

MANAGEMENT’S REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING

Management of Moody’s Corporation is responsible for establishing and maintaining adequate internal control over financial reporting and for the assessment of the effectiveness of internal control over financial reporting. As defined by the SEC in Rules 13a-15(f) and 15d-15(f) under the Securities Exchange Act of 1934, internal control over financial reporting is a process designed by, or under the supervision of, the Company’s principal executive and principal financial officers, or persons performing similar functions, and effected by the Company’s Board, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

Moody’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of assets of the Company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the Company are being made only in accordance with authorizations of Moody’s management and directors; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the Company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Management of the Company evaluated and assessed the design and operational effectiveness of the Company’s internal control over financial reporting as of December 31, 2023 based on criteria established in the Internal Control—Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

Based on the assessment performed, management has concluded that Moody’s maintained effective internal control over financial reporting as of December 31, 2023.

The effectiveness of our internal control over financial reporting as of December 31, 2023 has been audited by KPMG LLP, an independent registered public accounting firm, as stated in their accompanying report which expresses an unqualified opinion on the effectiveness of Moody's internal control over financial reporting as of December 31, 2023.

/s/ ROBERT FAUBER

Robert Fauber

President and Chief Executive Officer

/s/ CAROLINE SULLIVAN

Caroline Sullivan

Interim Chief Financial Officer, Chief Accounting Officer and Corporate Controller

February 14, 2024

68 MOODY'S 2023 10-K

Table of Contents

Report of Independent Registered Public Accounting Firm

To the Shareholders and Board of Directors

Moody’s Corporation:

Opinions on the Consolidated Financial Statements and Internal Control Over Financial Reporting

We have audited the accompanying consolidated balance sheets of Moody's Corporation and subsidiaries (the Company) as December 31, 2023 and 2022, the related consolidated statements of operations, comprehensive income, shareholders’ equity, and cash flows for each of the years in the three-year period ended December 31, 2023, and the related notes (collectively, the consolidated financial statements). We also have audited the Company’s internal control over financial reporting as of December 31, 2023, based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of the Company as of December 31, 2023 and 2022, and the results of its operations and its cash flows for each of the years in the three-year period ended December 31, 2023, in conformity with U.S. generally accepted accounting principles. Also in our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 2023 based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

Basis for Opinions

The Company’s management is responsible for these consolidated financial statements, for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management’s Report on Internal Control over Financial Reporting. Our responsibility is to express an opinion on the Company’s consolidated financial statements and an opinion on the Company’s internal control over financial reporting based on our audits. We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) (PCAOB) and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audits to obtain reasonable assurance about whether the consolidated financial statements are free of material misstatement, whether due to error or fraud, and whether effective internal control over financial reporting was maintained in all material respects.

Our audits of the consolidated financial statements included performing procedures to assess the risks

Showing the first 8K of 294K characters. Open the full section

Not applicable.

Evaluation of Disclosure Controls and Procedures

The Company carried out an evaluation, as required by Rule 13a-15(b) under the Exchange Act, under the supervision and with the participation of the Company’s management, including the Company’s Chief Executive Officer and Interim Chief Financial Officer, of the effectiveness of the design and operation of the Company’s disclosure controls and procedures, as defined in Rule 13a-15(e) of the Exchange Act, as of the end of the period covered by this report (the “Evaluation Date”). Based on such evaluation, such officers have concluded that, as of the Evaluation Date, the Company’s disclosure controls and procedures were effective to provide reasonable assurance that information required to be disclosed by the Company in reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the communication to the Company’s management, including the Company’s Chief Executive Officer and Interim Chief Financial Officer, as appropriate to allow timely decisions regarding required disclosure.

Changes in Internal Control Over Financial Reporting

Information in response to this Item is set forth under the caption “Management’s Report on Internal Control Over Financial Reporting,” in Part II, Item 8 of this annual report on Form 10-K.

The Company’s management, including the Company’s Chief Executive Officer and Interim Chief Financial Officer, has determined that there were no changes in the Company’s internal control over financial reporting that have materially affected, or are reasonably likely to materially affect, these internal controls over financial reporting during the three months ended December 31, 2023.

Limitations on Controls

The Company's disclosure controls and procedures are designed to provide reasonable assurance of achieving the objectives as specified above. The Company's management does not expect, however, that these disclosure controls and procedures will prevent or detect all instances of error or fraud. Any control system, regardless of how well designed and operated, is based upon certain assumptions and can provide only reasonable, not absolute, assurance that its objectives will be met. Further, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur, or that all control issues and instances of fraud, if any, within the Company have been detected.

Not applicable.

Not applicable.

PART III

Except for the information relating to the executive officers of the Company set forth in Part I of this annual report on Form 10-K, the information called for by Items 10-14 is contained in the Company’s definitive proxy statement for use in connection with its annual meeting of stockholders scheduled to be held on April 16, 2024, and is incorporated herein by reference.

Information required by this Item 10 is included under the heading “Information about our Executive Officers” in Part I, Item 1 of this Form 10‑K, as well as under the headings “Item 1–Election of Directors,” “Corporate Governance–Codes of Business Conduct and Ethics,” and “The Audit Committee,” in the 2024 Proxy Statement and is incorporated by reference.

Information required by this Item 11 is included under the headings “Compensation Discussion and Analysis,” “Summary Compensation Table,” “Grants of Plan-Based Awards Table for 2023,” “Outstanding Equity Awards at Fiscal Year-End Table for 2023,” “Option Exercises and Stock Vested Table for 2023,” “Pension Benefits Table for 2023,” “Non-Qualified Deferred Compensation Table,” “Potential Payments Upon Termination or Change in Control,” “Compensation of Directors,” “Relationship of Compensation Practices to Risk Management,” "Pay Versus Performance," “CEO Pay Ratio,” and “Report of the Compensation & Human Resources Committee” in the 2024 Proxy Statement and is incorporated by reference.

Information required by this Item 12 is included under the heading “Equity Compensation Plan Information” in Part II, Item 5 of this Form 10-K, as well as under the heading “Security Ownership of Certain Beneficial Owners and Management” in the 2024 Proxy Statement and is incorporated by reference.

MOODY'S 2023 10-K 123

Table of Contents

Information required by this Item 13 is included under the headings “Corporate Governance–Director Independence” and “Certain Relationships and Related Transactions” in the 2024 Proxy Statement and is incorporated by reference.

Information required by this Item 14 is included under the headings “Item 2–Ratification of Appointment of Independent Registered Public Accountants–Principal Accounting Fees and Services” and “The Audit Committee” in the 2024 Proxy Statement and is incorporated by reference.

PART IV

LIST OF DOCUMENTS FILED AS PART OF THIS REPORT.

(1) Financial Statements.

See Index to Financial Statements on page 67, in Part II. Item 8 of this Form 10-K.

(2) Financial Statement Schedules.

None.

(3) Exhibits.

INDEX TO EXHIBITS

124 MOODY'S 2023 10-K

Table of Contents

MOODY'S 2023 10-K 125

Table of Contents

126 MOODY'S 2023 10-K

Table of Contents