Table of Contents

UNITED STATES SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

FORM 10-K

For the fiscal year ended September 30, 2025

OR

For the transition period from to

Commission file number 001-33977

VISA INC.

(Exact name of Registrant as specified in its charter)

(650) 432-3200

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act:

Class B-1 common stock, par value $0.0001 per share

Class B-2 common stock, par value $0.0001 per share

Class C common stock, par value $0.0001 per share

(Title of each class)

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☑ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or 15(d) of the Act. Yes ☐ No ☑

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☑ No ☐

Indicate by check mark whether the registrant has submitted electronically, every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☑ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☑

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☑

The aggregate market value of the registrant’s class A common stock, held by non-affiliates (using the New York Stock Exchange closing price as of March 31, 2025, the last business day of the registrant’s most recently completed second fiscal quarter) was approximately $601.1 billion. There is currently no established public trading market for the registrant’s class B-1, B-2 or class C common stock.

As of October 30, 2025, the registrant’s shares of common stock outstanding were as follows.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the Registrant’s Proxy Statement for the 2026 Annual Meeting of Shareholders are incorporated herein by reference in Part III of this Annual Report on Form 10-K to the extent stated herein. Such Proxy Statement will be filed with the Securities and Exchange Commission within 120 days of the Registrant’s fiscal year ended September 30, 2025.

Table of Contents

TABLE OF CONTENTS

Unless the context indicates otherwise, reference to Visa, we, us, our or the Company refers to Visa Inc. and its subsidiaries.

Visa and our other trademarks referenced in this report are Visa’s property. This report may contain additional trade names and trademarks of other companies. The use or display of other companies’ trade names or trademarks does not imply our endorsement or sponsorship of, or a relationship with, these companies.

Table of Contents

Forward-Looking Statements

This Annual Report on Form 10-K contains forward-looking statements within the meaning of the U.S. Private Securities Litigation Reform Act of 1995 that relate to, among other things, the impact on our future financial position, results of operations and cash flows; prospects, developments, strategies and growth of our business; anticipated expansion of our products in certain countries and territories; size and growth of the total addressable opportunities in consumer payments, commercial and money movement solutions and value-added services and our ability to capture such opportunities; industry developments; anticipated timing and benefits of our acquisitions; expectations regarding litigation matters, investigations and proceedings; timing and amount of stock repurchases; sufficiency of sources of liquidity and funding; effectiveness of our risk management programs; and expectations regarding the impact of recent accounting pronouncements on our consolidated financial statements. Forward-looking statements generally are identified by words such as “anticipates,” “believes,” “estimates,” “expects,” “intends,” “may,” “projects,” “could,” “should,” “will,” “continue” and other similar expressions. All statements other than statements of historical fact could be forward-looking statements, which speak only as of the date they are made, are not guarantees of future performance and are subject to certain risks, uncertainties and other factors, many of which are beyond our control and are difficult to predict. We describe risks and uncertainties that could cause actual results to differ materially from those expressed in, or implied by, any of these forward-looking statements in Item 1, Item 1A, Item 7 and elsewhere in this report. Except as required by law, we do not intend to update or revise any forward-looking statements as a result of new information, future events or otherwise.

Table of Contents

PART I

OVERVIEW

Visa is one of the world’s leaders in digital payments. Our purpose is to uplift everyone, everywhere by being the best way to pay and be paid. Since Visa’s early days in 1958, we have been in the business of facilitating secure, reliable and efficient global commerce and money movement. We provide transaction processing services (primarily authorization, clearing and settlement) among consumers, issuing and acquiring financial institutions and sellers in a structure we call the “four-party” model. Please see Our Core Business discussion below. As the payments ecosystem continues to evolve, we have broadened this model to include digital banks, digital wallets, a range of financial technology companies (fintechs), governments and non-governmental organizations (NGOs). We are focused on extending, enhancing and investing in our proprietary advanced transaction processing network, VisaNet, to offer a single connection point for facilitating money movement to multiple endpoints through various form factors and innovative technologies across more than 200 countries and territories. Visa is committed to advancing innovation within the payment technology sector. Building upon our track record of industry leadership, including early adoption and integration of artificial intelligence (AI) models in payment systems, Visa continues to invest in the development and deployment of next-generation technologies, such as generative AI (GenAI), stablecoins and agentic commerce. During fiscal 2025, 329 billion payments and cash transactions with Visa’s brand were processed by Visa or other networks, equating to an average of 901 million transactions per day. Of the 329 billion total transactions, 258 billion were processed by Visa.

• We offer a wide range of Visa-branded payment products** that our clients, including nearly 14,500 financial institutions, use to develop and offer payment solutions or services, including credit, debit, prepaid and cash access programs for individual, business and government account holders. During fiscal 2025, Visa’s total payments and cash volume was $17 trillion, and we had nearly 5 billion payment credentials, which are issued Visa card accounts, that were available to be used at more than 175 million merchant locations worldwide.(1)

• We take an open partnership approach** and seek to provide value by enabling access to our global network through multiple integration methods, including programmatic access via application programming interfaces (APIs) and structured data exchange through our Model Context Protocol (MCP) server. We partner with traditional financial institutions and emerging fintech and AI companies to innovate and expand the payments ecosystem, enabling them to leverage our platform infrastructure to accelerate their business growth and market expansion.

• We are using our componentized capabilities and global connectivity** to power all types of payments and deliver services to all types of clients worldwide through our Visa as a Service stack, which has four layers: the foundation layer, the services layer, the solutions layer and the access layer. Our foundation layer comprises the network infrastructure that enables connections to approximately 12 billion cards, bank accounts and digital wallets with more than 175 million merchant locations across more than 200 countries and territories. Our services layer organizes core capabilities, including authentication, risk management and fraud detection, into discrete, reusable components that can be utilized individually or combined into solutions. These modular services are the building blocks of our comprehensive portfolio in our solutions layer, which are enhanced to create new features and capabilities for our clients. Finally, the access layer provides clients the entry point to these solutions via on-demand APIs, our MCP server that enables AI systems to interface with our Visa Intelligent Commerce APIs, and fully managed solutions. The Visa as a Service stack enables organizations of any size to access and scale Visa’s network capabilities globally.

• We are accelerating the migration to digital payments through our network of networks strategy. We aim to provide a single connection point so that Visa clients can enable money movement for businesses, governments and consumers, regardless of which network is used to start or complete the transaction. This model ultimately helps to unify a complex payments ecosystem. Visa’s network of networks approach creates opportunities by facilitating person-to-person (P2P), business-to-consumer (B2C), business-to-business (B2B) and government-to-consumer (G2C) payments, in addition to consumer-to-business (C2B) payments.

(1) Data provided to Visa by acquiring institutions and other third parties as of June 30, 2025.

Table of Contents

• We provide value-added services** to our clients, including Issuing Solutions, Acceptance Solutions, Risk and Security Solutions and Advisory and Other Services.

• We invest in and promote our brand** to benefit our clients and partners through advertising, promotional and sponsorship initiatives with the International Olympic Committee, the International Paralympic Committee, the National Football League, the FIFA World Cup 2026TM and the Red Bull Formula One Teams (the Oracle Red Bull Racing Team and the Visa Cash App RB Formula One Team), among others. We also use these sponsorship assets to showcase our payment innovations.

FISCAL 2025 KEY STATISTICS

**(1)**Please see Item 7 of this report for a reconciliation of our GAAP to non-GAAP financial results.

OUR CORE BUSINESS

In a typical Visa C2B payment transaction, the consumer purchases goods or services from a seller using a Visa card or payment product. The seller presents the transaction data to an acquirer, usually a bank or third-party processing firm that supports acceptance of Visa cards or payment products, for verification and processing. Through VisaNet, the acquirer presents the transaction data to Visa, which in turn sends the transaction data to the issuer to check the account holder’s account balance or credit line for authorization. After the transaction is authorized, the issuer posts the transaction to the consumer’s account and effectively pays the acquirer an amount equal to the value of the transaction, minus the interchange reimbursement fee (IRF). The acquirer pays the amount of the purchase, minus the merchant discount rate (MDR), to the seller.

Visa earns revenue by facilitating money movement across more than 200 countries and territories, among a global set of consumers, sellers, financial institutions and government entities, through innovative technologies.

Table of Contents

Our net revenue in fiscal 2025 consisted of the following:

			SERVICE REVENUE Earned for services provided in support of client usage of Visa’s payment services and value-added services related to certain Issuing Solutions						OTHER REVENUE Consists mainly of value-added services primarily related to Advisory and

Showing the first 8K of 79K characters. Open the full section

Regulatory Risks

We are subject to complex and evolving global regulations that could harm our business and financial results.

As a global payments technology company, we are subject to complex and evolving regulations that govern our operations. Such regulations may increase in quantity, complexity and scope in response to heightened geopolitical tensions. See Item 1—Government Regulation for more information on the most significant areas of regulation that affect our business. The impact of these regulations on us, our clients, and other third parties could limit our ability to enforce our payments system rules; require us to adopt new rules or change existing rules; affect our existing contractual arrangements; and increase our compliance costs. As discussed in more detail below, we may face differing rules and regulations in matters like interchange reimbursement rates, preferred routing, domestic processing and localization requirements, currency conversion, point-of-sale transaction rules and practices, privacy, data use and protection, licensing requirements and associated product technology. As a result, the Visa operating rules and our other contractual commitments may differ from country to country, state to state, or product to product. Complying with these and other regulations increases our costs and operational complexity, and reduces our revenue opportunities.

If widely varying regulations come into existence worldwide, we may have difficulty rapidly adjusting our products, services, fees and other important aspects of our business to comply with the regulations. Our compliance programs and policies are designed to support our compliance with a wide array of regulations and laws, such as regulations regarding anti-money laundering, anti-corruption, competition, money transfer services, privacy and sanctions, and we continually adjust our compliance programs as regulations evolve. However, we cannot guarantee that our practices will be deemed compliant by all applicable regulatory authorities. In the event our controls should fail or we are found to be out of compliance for other reasons, we could be subject to monetary damages, civil and criminal penalties, litigation, investigations and proceedings, and damage to our global brands and reputation.

Increased scrutiny and regulation of the global payments industry, including with respect to interchange reimbursement fees, merchant discount rates, operating rules, risk management protocols and other related practices, could harm our business.

Regulators around the world have been establishing or increasing their authority to regulate various aspects of the payments industry. See Item 1—Government Regulation for more information*.* In the U.S. and many other jurisdictions, we have historically set default IRFs. Even though we generally do not receive any revenue related to IRFs in a payment transaction (in the context of credit and debit transactions, those fees are paid by the acquirers to the issuers; the reverse is true for certain transactions like ATM transactions), IRFs are a factor on which we compete with other payments providers and are therefore an important determinant of the volume of transactions we process. Consequently, changes to these fees, whether voluntarily or by mandate, can substantially affect our overall payments volume and net revenue.

Interchange reimbursement fees, certain operating rules and related practices continue to be subject to increased government regulation globally, and regulatory authorities and central banks in a number of jurisdictions have reviewed or are reviewing these fees, rules and practices. For example:

• Regulations adopted by the U.S. Federal Reserve cap the maximum U.S. debit interchange reimbursement rate received by large financial institutions at 21 cents plus 5 basis points per transaction, plus a possible fraud adjustment of 1 cent. Additionally, the Dodd-Frank Act limits issuers’ and payment networks’ ability to adopt network exclusivity and preferred routing in the debit and prepaid area, which also impacts our business. In response to seller requests, the Federal Reserve has recently taken actions to revisit its regulations that implement these aspects of the Dodd-Frank Act. For example, in October 2022, the Federal Reserve published a final rule effectively requiring issuers to ensure that at least two unaffiliated networks are available for routing ecommerce debit transactions by July 1, 2023. In October 2023, the Federal Reserve issued a proposal for comment that further lowers debit interchange rates, with a mechanism for automatic adjustment every two years. Finally, in August 2025, the District Court for the District of North Dakota ruled that the Federal Reserve exceeded its authority in implementing Regulation II, which sets debit card interchange fees. The court found the Federal Reserve improperly included various costs beyond what the Durbin Amendment allows, such as fraud losses, network fees and other fixed costs, when setting the debit interchange fee standard. As a result, the court vacated Regulation II’s debit interchange fee

Table of Contents

standard. Subsequently, however, the District Court in Kentucky ruled that the Federal Reserve acted within its discretion in setting the debit interchange cap. If the District Court of North Dakota’s decision is affirmed on appeal and ultimately prevails, it could potentially result in the Federal Reserve setting a significantly lower interchange cap for relevant debit transactions in the U.S. Separately, there continues to be interest in regulation of credit interchange fees and routing practices by members of Congress and state legislators. It is possible that the Credit Card Competition Act may be reintroduced in Congress or attempted to be offered as an amendment to unrelated legislation. Previous versions of the legislation were introduced in 2022 and 2023, and required among other things, that large issuing banks offer a choice of at least two unaffiliated networks over which electronic credit transactions may be processed. Finally, some states have passed or are considering passing laws that regulate how interchange can be set and assessed. For example, in May 2024, Illinois passed a law that restricts the assessment of interchange on the state tax and gratuity portions of a transaction, and restricts financial institutions and payment networks, among others, from using payment transaction data for any purpose other than facilitating or processing a transaction. While the Illinois law remains subject to legal challenge, if such laws are allowed to go into effect, they may also impose significant technical and compliance burdens on our business.

• In Europe, the EU’s IFR places an effective cap on consumer credit and consumer debit interchange fees for both domestic and cross-border transactions within the European Economic Area of 30 basis points and 20 basis points, respectively. EU member states have the ability to further reduce these interchange levels within their territories. The European Commission has announced its intention to conduct another impact assessment of the IFR, which could result in even lower caps on interchange rates and the expansion of regulation to other types of products, services and fees.

• Several countries in Latin America continue to explore regulatory measures against payments networks and have either adopted or are exploring interchange caps, including Argentina, Brazil, Chile and Costa Rica. In Asia Pacific, the Reserve Bank of Australia (RBA) which already regulates interchange, recently proposed reducing existing interchange caps on domestic credit and debit transactions and not allowing differential interchange treatment for consumer and commercial transactions. Similarly, in New Zealand, the Commerce Commission recently

Showing the first 8K of 84K characters. Open the full section

Not applicable.

Visa’s Approach to Cybersecurity

As a global company providing payment services to consumers and companies around the world, trust is an indispensable asset. A strong cybersecurity program is a key element to maintaining this trust. As a result, we consider cybersecurity risk one of our key enterprise risks and we assess, identify, and manage such risk as part of our overall enterprise risk management framework. See Item 1A for further discussion on our overall risk factors, including technology and cybersecurity risks.

Cybersecurity Program

Visa’s cybersecurity program has been established to identify, analyze, mitigate, monitor, and govern cybersecurity risk and was designed around widely accepted international standards, such as ISO 27002 and the Payment Card Industry Data Security Standards, as well as applicable legal and regulatory requirements. We implement our cybersecurity program primarily through our Key Controls, which define the requirements for the protection of Visa information and technology assets. All employees must complete annual training on our Key Controls and are required to comply with the requirements. Exceptions to the Key Controls must be approved by an established senior management working group, which is overseen by our Corporate Risk Committee (CRC), the management committee responsible for overseeing Visa’s cybersecurity program and other operational risks. The Key Controls are updated and reviewed annually by our Cybersecurity Governance, Risk and Compliance team and approved by management committees to ensure they continue to address evolving cybersecurity threats and associated legal and regulatory obligations.

As part of our overall business strategy, we have acquired a number of companies for which our full cybersecurity standards may not be appropriate. These designated entities may deliver products and services using systems which are not fully integrated with our standard technology platforms or hosted in our data centers. We have established a separate set of Key Controls for designated entities appropriate to their size and operations that are designed around the same widely accepted international standards noted above, but tailored to the operational reality and business needs of these entities. Regular reporting of our acquired entities’ cybersecurity program is provided to our Chief Information Security Officer (CISO), President of Technology, management committees and the board of directors. For additional information about our structural and organizational risks, see Item 1A of this report.

Incident Response Plans

Visa’s global cybersecurity incident response team provides monitoring of Visa systems and digital assets from three cyber fusion centers in the U.S., United Kingdom, and Singapore. In addition, Visa’s threat intelligence and research teams monitor commercial and government intelligence sources for new and emerging threats. Our cybersecurity awareness team regularly publishes and shares information with Visa employees on emerging threats, such as deepfake and GenAI-powered social engineering schemes.

To address significant cybersecurity incidents and other crisis events, we maintain a business incident response plan, which identifies key stakeholders, defines escalation processes, and sets the thresholds above which our cybersecurity, legal, and crisis management teams will inform management’s Executive and Disclosure Committees as well as when the CEO and his designee will inform the board of directors of an incident. For cybersecurity incidents below these crisis thresholds, we maintain subordinate incident response plans and standard operating procedures used by our security incident response team. Like many companies, we, and some third parties on which we rely periodically experience cybersecurity incidents. However, as of September 30, 2025, we were not aware of any direct or third-party cybersecurity incidents in the past three fiscal years that have materially affected our business strategy, results of operations, or financial condition.

Internal and External Testing

We proactively manage our cybersecurity risk by continually seeking to identify and mitigate potential cybersecurity threats to and vulnerabilities in our information and technology assets, with both internal and external assessments, as appropriate. For example, public-facing technology assets are subject to both internal security

Table of Contents

assessments and external security researcher testing under our vulnerability disclosure and bug bounty programs. Identified threats and vulnerabilities are required to be remediated within stringent timelines, for which compliance and exceptions are tracked in reporting to management and the board of directors.

As further discussed in our risk factors in Item IA of this report, our cybersecurity policies and controls may not be implemented or followed appropriately to mitigate all of our risks. We employ three lines of defense designed to address this risk. The first line of defense consists of the technology teams who develop, build, and deploy our products and services. These teams are trained on and accountable for following our Key Controls. The second line of defense includes separate internal security and risk teams that conduct security assessments of our networks and products, overseeing the remediation of any findings. Finally, our independent internal audit function operates as the third line of defense, assessing the effectiveness of our policies and controls and implementation thereof. We are also subject to regular, detailed examinations by financial regulators and external auditors which often contain a significant cybersecurity component.

Third-party Risk Management

We also apply this same overall framework to our oversight and management of cybersecurity risk from service providers, vendors, suppliers, and other third parties. Our policies require due diligence on our service providers, vendors and suppliers prior to engagement and impose audit rights in our contracts in order to identify cybersecurity risks associated with third-party relationships, proportionate to the inherent risk associated with the products and services provided and the criticality and sensitivity of our information and technology assets to which the third party may have access. As noted in our risk factors in Item IA of this report, our third-party risk management framework may not be implemented effectively or may not be successful or sufficient to mitigate all of our risks. When we become aware that a service provider, vendor, supplier, or other third party has experienced any compromise or failure in the technology infrastructure owned or controlled by such third party, we may attempt to mitigate our risk, including by terminating such third party’s connection to our information and technology assets where appropriate. We also regularly and proactively engage relevant vendors and other third parties to assess risk to Visa information assets when a new vulnerability or compromise is reported that may affect those third parties.

Management’s Role and Responsibilities

Our CISO is responsible for day-to-day management and oversight of our information security program and leads our cybersecurity organization, which comprises approximately 1,000 professionals globally as of September 30, 2025. Our CISO and President of Technology receive regular reports from our cybersecurity personnel in connection with monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO reports directly to our President of Technology and provides quarterly reports on our cybersecurity performance to the CRC.

Our current CISO has over 30 years of industry experience leading enterprise cybersecurity teams and enabling secure and scalable ecommerce and payment platforms at multiple Fortune 500 companies. Since joining Visa in November 2015, he has been a core part of building Visa's Zero Trust Architecture and advancing VisaNet's cybersecurity defense capabilities. Our current President of Technology joined Visa in November 2013 and has over 30 years of experience in leading the development, deployment and operations of broad technology platforms including commerce and transaction technologies, which includes overseeing cybersecurity risk and transformational technology initiatives. At Visa, our President of Technology is responsible for the Company’s technology innovation and investment strategy, product engineering, cybersecurity, global IT, and operations infrastructure, and for accelerating the integration of engineering and product teams.

Board Governance

Visa’s board of directors exercises oversight and control of Visa’s overall enterprise risk management framework and delegates oversight and control of Visa’s cybersecurity program to our audit and risk committee (ARC), which is responsible for ensuring that management has risk-based processes in place designed to assess, identify, and manage cybersecurity risks to which Visa is exposed. As noted in Item 1A, however, these processes may not be sufficient to mitigate all cybersecurity risks. Our CISO provides an update on our cybersecurity program to the ARC twice per year and to the full board of directors annually. The updates to the ARC and the full board of directors provide an overview of our cybersecurity performance, progress against goals, cybersecurity threat landscape, and other relevant developments.

Table of Contents

Our corporate headquarters are located in the San Francisco Bay Area. As of September 30, 2025, we owned or leased office locations around the world, including four global data centers located in the U.S., the United Kingdom and Singapore. We believe that these facilities are suitable and adequate to support our ongoing business needs.

Refer to Note 20—Legal Matters to our consolidated financial statements included in Item 8 of this report.

Not applicable.

Table of Contents

PART II

Our class A common stock has been listed on the New York Stock Exchange under the symbol V. As of October 30, 2025, we had 311 shareholders of record of our class A common stock. The number of beneficial owners is substantially greater than the number of record holders, because a large portion of our class A common stock is held in “street name” by brokers and other financial institutions on behalf of our shareholders. There is currently no established public trading market for our class B-1, B-2 or C common stock. As of October 30, 2025, there were 610, 200 and 332 holders of record of our class B-1, B-2 and C common stock, respectively.

On October 28, 2025, our board of directors declared a quarterly cash dividend of $0.67 per share of class A common stock (determined in the case of all other outstanding common and preferred stock on an as-converted basis) payable on December 1, 2025, to all holders of record as of November 12, 2025.

Subject to legally available funds, we expect to continue paying quarterly cash dividends on our outstanding common and preferred stock in the future. However, the declaration and payment of future dividends is at the sole discretion of our board of directors after taking into account various factors, including our financial condition, settlement indemnifications, operating results, available cash and current and anticipated cash needs.

Issuer Purchases of Equity Securities

The table below presents our purchases of class A common stock for the three months ended September 30, 2025:

(1)Includes applicable taxes.

See Note 15—Stockholders’ Equity to our consolidated financial statements included in Item 8 of this report for further discussion on our share repurchase programs.

Table of Contents

This management’s discussion and analysis provides a review of the results of operations, financial condition and liquidity and capital resources of Visa Inc. and its subsidiaries (Visa, we, us, our or the Company) on a historical basis and outlines the factors that have affected recent earnings, as well as those factors that may affect future earnings. The following discussion and analysis should be read in conjunction with the consolidated financial statements and related notes included in Item 8 of this report.

This section of the report generally discusses fiscal 2025 compared to fiscal 2024. Discussions of fiscal 2024 compared to fiscal 2023 that are not included in this report can be found in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part II, Item 7 in our Annual Report on Form 10-K for the year ended September 30, 2024, filed with the U.S. Securities and Exchange Commission.

Overview

Visa is a global payments technology company that facilitates secure, reliable and efficient global commerce and money movement. We provide transaction processing services (primarily authorization, clearing and settlement) among consumers, issuing and acquiring financial institutions and sellers. We are focused on extending, enhancing and investing in our proprietary advanced transaction processing network, VisaNet, to offer a single connection point for facilitating money movement to multiple endpoints through various form factors and innovative technologies across more than 200 countries and territories. Visa is not a financial institution. We do not issue cards, extend credit or set rates and fees for account holders of Visa products.

Financial overview. A summary of our GAAP and non-GAAP operating results is as follows:

(1)Figures in the table may not recalculate exactly due to rounding. Percentage changes are calculated based on unrounded numbers.

(2)For a full reconciliation of our GAAP to non-GAAP financial results, see tables in Non-GAAP financial results below.

Highlights for fiscal 2025. Net revenue increased 11% over the prior year, primarily due to the growth in processed transactions, nominal cross-border volume, and nominal payments volume, partially offset by higher client incentives. See Results of Operations—Net Revenue below for further discussion. Exchange rate movements did not have a material impact on net revenue growth.

GAAP operating expenses increased 30% over the prior year, primarily driven by higher litigation provision and personnel expenses. See Results of Operations—Operating Expenses below for further discussion. Exchange rate movements did not have a material impact on operating expenses growth.

Non-GAAP operating expenses increased 11% over the prior year, primarily driven by higher personnel, general and administrative, and depreciation and amortization expenses.

Release of preferred stock. In August 2025, we released $1.4 billion of the as-converted value from our series B and C preferred stock and issued 40,080 shares of series A preferred stock in connection with the ninth anniversary of the Visa Europe acquisition. See Note 5—U.S. and Europe Retrospective Responsibility Plans and Note 15—Stockholders’ Equity to our consolidated financial statements included in Item 8 of this report.

Table of Contents

Senior notes. In May 2025, we issued Euro-denominated fixed-rate senior notes in a public offering in an aggregate principal amount of €3.5 billion ($3.9 billion), with maturities ranging between 3 and 19 years. See Note 10—Debt to our consolidated financial statements included in Item 8 of this report.

Acquisition. In December 2024, we acquired Featurespace Limited (Featurespace), a developer of real-time artificial intelligence payments protection technology that helps prevent and mitigate payments fraud and financial crime risks, for a purchase consideration of $946 million. See Note 2—Acquisitions to our consolidated financial statements included in Item 8 of this report.

Interchange multidistrict litigation. During fiscal 2025, we recorded additional accruals of $2.2 billion to address claims associated with the interchange multidistrict litigation. We also made additional deposits of $875 million into the U.S. litigation escrow account. The additional accruals related to the interchange multidistrict litigation could be higher or lower than deposits made into the U.S. litigation escrow account. See Note 5—U.S. and Europe Retrospective Responsibility Plans and Note 20—Legal Matters to our consolidated financial statements included in Item 8 of this report*.*

Continued resolution in the interchange multidistrict litigation will be considered by our board of directors with regards to successive exchange offers for class B common stock. Visa may, but is under no obligation to, conduct a successive exchange offer for class B common stock if (i) one year has passed since the initial exchange offer for the next preceding class of class B common stock; and (ii) if the estimated interchange reimbursement fees at issue in unresolved claims for damages in the U.S. covered litigation have been reduced by 50% or more since the consummation of the prior exchange offer (or in the case of the first successive exchange offer, since October 1, 2023), as determined by Visa. The estimated interchange reimbursement fees at issue in unresolved claims for damages in the U.S. covered litigation was approximately $49.6 billion as of October 1, 2023 and was approximately $39.4 billion(1) as of October 1, 2025.

Common stock repurchases. In April 2025, our board of directors authorized a $30.0 billion share repurchase program, providing multi-year flexibility. During fiscal 2025, we repurchased 54 million shares of our class A common stock in the open market for $18.2 billion. As of September 30, 2025, our share repurchase program had remaining authorized funds of $24.9 billion. See Note 15—Stockholders’ Equity to our consolidated financial statements

Showing the first 8K of 67K characters. Open the full section

Market risk is the potential economic loss arising from adverse changes in market factors. Our exposure to financial market risks results primarily from fluctuations in foreign currency exchange rates, interest rates and equity prices. Aggregate risk exposures are monitored on an ongoing basis.

Foreign Currency Exchange Rate Risk

We are exposed to risks from foreign currency exchange rate fluctuations that are primarily related to changes in the functional currency value of receipts and payments related to non-functional currency denominated transactions. We manage these risks by entering into foreign currency forward contracts that hedge exposures of the variability in the functional currency equivalent of anticipated non-functional currency denominated cash flows. Our foreign currency exchange rate risk management program reduces, but does not entirely eliminate, the impact of foreign currency exchange rate movements.

As of September 30, 2025 and 2024, the effect of a hypothetical 10% weakening in the value of the functional currencies is estimated to create an additional fair value loss of approximately $422 million and $329 million, respectively, on our outstanding foreign currency forward contracts. The loss from this hypothetical weakening would be largely offset by a corresponding gain on our cash flows from foreign currency-denominated revenue and payments. See Note 1—Summary of Significant Accounting Policies and Note 13—Derivative and Hedging Instruments to our consolidated financial statements included in Item 8 of this report.

We are further exposed to foreign currency exchange rate risk related to translation as the functional currency of Visa Europe is the Euro. Translation from the Euro to the U.S. dollar is performed for balance sheet accounts using exchange rates in effect at the balance sheet dates and for revenue and expense accounts using an average exchange rate for the period. Resulting translation adjustments are recorded as a component of accumulated other comprehensive income (loss) on the consolidated balance sheets. A hypothetical 10% change in the Euro against the U.S. dollar compared to the exchange rate as of September 30, 2025 and 2024 would result in a foreign currency translation adjustment of $2.3 billion and $2.1 billion, respectively.

We designated our Euro-denominated senior notes as a net investment hedge against a portion of the foreign exchange rate exposure from our net investment in Visa Europe. Foreign currency adjustments resulting from the Euro-denominated senior notes partially offset the foreign currency translation adjustments resulting from our net investment in Visa Europe. See Note 1—Summary of Significant Accounting Policies and Note 13—Derivative and Hedging Instruments to our consolidated financial statements included in Item 8 of this report.

We are also subject to foreign currency exchange rate risk in daily settlement activities. This risk arises from the timing of rate setting for settlement with clients relative to the timing of market trades for balancing currency positions. Risk in settlement activities is limited through daily operating procedures, including the utilization of Visa settlement systems and our interaction with foreign exchange trading counterparties.

Interest Rate Risk

Our investment portfolio assets are held in both fixed-rate and adjustable-rate securities. Investments in fixed-rate instruments carry a degree of interest rate risk. The fair value of fixed-rate securities may be adversely impacted due to a rise in interest rates. Additionally, a falling-rate environment creates reinvestment risk because as securities mature, the proceeds are reinvested at a lower rate, generating less interest income. As of September 30, 2025 and 2024, a hypothetical 100 basis point increase in interest rates did not have a material impact on the fair value of our investment securities. Any realized losses resulting from such interest rate changes would only occur if we sold the investments prior to maturity. Historically, we have been able to hold investments until maturity.

We have interest rate and cross-currency swap agreements on a portion of our outstanding senior notes that allow us to manage our interest rate exposure through a combination of fixed and floating rates. Together these swap agreements effectively convert a portion of our U.S. dollar denominated fixed-rate payments into U.S. dollar and Euro-denominated floating-rate payments. By entering into interest rate swaps, we have assumed risks associated with market interest rate fluctuations. As of September 30, 2025 and 2024, a hypothetical 100 basis point increase in interest rates did not have a material impact on the interest expense for each fiscal year. See Note 13—Derivative and Hedging Instruments to our consolidated financial statements included in Item 8 of this report.

Table of Contents

Equity Investment Risk

Our equity investments are held in both marketable and non-marketable equity securities. The marketable equity securities include investments in publicly traded companies and the non-marketable equity securities include investments in privately held companies. As of September 30, 2025 and 2024, the carrying value of our investments in publicly traded companies was $142 million and $63 million, respectively, and the carrying value of our non-marketable equity securities was $1.2 billion and $1.4 billion, respectively. These securities are subject to a wide variety of market-related risks that could substantially reduce or increase the fair value of our holdings. A decline in financial condition or operating results of these investments could result in a loss of all or a substantial part of our carrying value in these companies. We regularly review our non-marketable equity securities for possible impairment, which generally involves an analysis of the facts and changes in circumstances influencing the investment, expectations of the entity’s cash flows and capital needs, and the viability of its business model.

Table of Contents

VISA

INDEX TO CONSOLIDATED FINANCIAL STATEMENTS

Report of Independent Registered Public Accounting Firm

To the Stockholders and the Board of Directors

Visa Inc.:

Opinions on the Consolidated Financial Statements and Internal Control Over Financial Reporting

We have audited the accompanying consolidated balance sheets of Visa Inc. and subsidiaries (the Company) as of September 30, 2025 and 2024, the related consolidated statements of operations, comprehensive income, changes in equity, and cash flows for each of the years in the three-year period ended September 30, 2025, and the related notes (collectively, the consolidated financial statements). We also have audited the Company’s internal control over financial reporting as of September 30, 2025, based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of the Company as of September 30, 2025 and 2024, and the results of its operations and its cash flows for each of the years in the three-year period ended September 30, 2025, in conformity with U.S. generally accepted accounting principles. Also in our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of September 30, 2025 based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

Basis for Opinions

The Company’s management is responsible for these consolidated financial statements, for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management’s Report on Internal Control over Financial Reporting. Our responsibility is to express an opinion on the Company’s consolidated financial statements and an opinion on the Company’s internal control over financial reporting based on our audits. We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) (PCAOB) and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audits to obtain reasonable assurance about whether the consolidated financial statements are free of material misstatement, whether due to error or fraud, and whether effective internal control over financial reporting was maintained in all material respects.

Our audits of the consolidated financial statements included performing procedures to assess the risks of material misstatement of the consolidated financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the consolidated financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the consolidated financial statements. Our audit of internal control over financial reporting included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audits also included performing such other procedures as we considered necessary in the circumstances. We believe that our audits provide a reasonable basis for our opinions.

Report of Independent Registered Public Accounting Firm—(Continued)

Definition and Limitations of Internal Control Over Financial Reporting

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Critical Audit Matter

The critical audit matter communicated below is a matter arising from the current period audit of the consolidated financial statements that was communicated or required to be communicated to the audit committee and that: (1) relates to accounts or disclosures that are material to the consolidated financial statements and (2) involved our especially challenging, subjective, or complex judgments. The communication of a critical audit matter does not alter in any way our opinion on the consolidated financial statements, taken as a whole, and we are not, by communicating the critical audit matter below, providing a separate opinion on the critical audit matter or on the accounts or disclosures to which it relates.

Assessment of the litigation accrual for class members opting out of the Damages Class settlement in the Interchange Multidistrict Litigation (MDL)

As discussed in Notes 5 and 20 to the consolidated financial statements, the Company is party to various legal proceed

Showing the first 8K of 237K characters. Open the full section

Not applicable.

Evaluation of Disclosure Controls and Procedures

We maintain a system of disclosure controls and procedures (as defined in the Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934 (Exchange Act)) that is designed to ensure that information required to be disclosed in our Exchange Act reports is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosures.

Under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, we conducted an evaluation of our disclosure controls and procedures. Based on this evaluation, our Chief Executive Officer and our Chief Financial Officer concluded that, as of September 30, 2025, our disclosure controls and procedures were effective at the reasonable assurance level.

Management’s Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over our financial reporting. Management assessed the effectiveness of our internal control over financial reporting as of September 30, 2025 using the criteria set forth in Internal Control*—*Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework). Based on management’s assessment, management has concluded that our internal control over financial reporting was effective as of September 30, 2025.

The effectiveness of our internal control over financial reporting as of September 30, 2025, has been audited by KPMG LLP, an independent registered public accounting firm, as stated in their report which is included in Item 8 of this report.

Inherent Limitations on Effectiveness of Controls and Procedures and Internal Control over Financial Reporting

Our internal control over financial reporting is designed to provide reasonable, but not absolute, assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with U.S. generally accepted accounting principles. There are inherent limitations to the effectiveness of any system of internal control over financial reporting. These limitations include the possibility of human error, the circumvention or overriding of the system and reasonable resource constraints. Because of its inherent limitations, our internal control over financial reporting may not prevent or detect misstatements and instances of fraud. In addition, because we have designed our system of controls based on certain assumptions, which we believe are reasonable, about the likelihood of future events, our system of controls may not achieve its desired purpose under all possible future conditions. Accordingly, our disclosure controls and procedures provide reasonable assurance, but not absolute assurance, of achieving their objectives. Projections of any evaluation of effectiveness to future periods are subject to the risks discussed in Part I, Item 1A—Risk Factors of this report.

Changes in Internal Control over Financial Reporting

In preparation for management’s report on internal control over financial reporting, we documented and tested the design and operating effectiveness of our internal control over financial reporting. There have been no changes in our internal controls over financial reporting that occurred during our fourth quarter of fiscal 2025 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

(b) Trading Plans

None.

Not applicable.

PART III

We will file a definitive proxy statement pursuant to Regulation 14A under the Exchange Act (Proxy Statement) no later than 120 days after the end of the fiscal year ended September 30, 2025. The information required by this item will be included in our Proxy Statement and is incorporated herein by reference.

The information required by this item will be included in our Proxy Statement and is incorporated herein by reference.

The information required by this item will be included in our Proxy Statement and is incorporated herein by reference.

The information required by this item will be included in our Proxy Statement and is incorporated herein by reference.

The information required by this Item will be included in our Proxy Statement and is incorporated herein by reference.

PART IV

The following documents are filed as part of this report:

1.Consolidated Financial Statements

See Index to Consolidated Financial Statements in Item 8 of this report.

2.Consolidated Financial Statement Schedules

None.

3.The following exhibits are filed as part of this report or, where indicated, were previously filed and are hereby incorporated by reference:

Refer to the Exhibit Index herein.

None.

EXHIBIT INDEX