71 added · 83 removed between the two most recent 10-Ks. The risks a company starts — or stops — disclosing are often the story.
Newly disclosed
For example, in November 2025 Visa and Mastercard proposed a lawsuit settlement agreement that would, among other things, require reductions and caps on interchange fees, provide merchants greater options to impose a surcharge on credit transactions, and allow merchants to choose not to accept certain categories of credit cards.
For example, as previously disclosed, in 2025 we entered into agreements to resolve governmental investigations related to historical sales practices for certain U.S. small business customers.
For example, several countries have implemented and are considering the further implementation of tariffs, trade barriers or restrictions and other retaliatory international or domestic policies, as well as other measures affecting cross-border commerce, migration and the flow of information.
Competitors may also use AI technologies more effectively than us or partner with companies that do so, which may increase the attractiveness and availability of their products and services and allow them to offer greater value propositions and realize greater operational efficiencies.
As AI technologies are increasingly integrated into payments and related services, such as through the adoption of agentic commerce, these dynamics may accelerate and new dynamics that are difficult to predict may develop, any of which may disadvantage our business.
Our brand may also be 26 Table of Contents negatively impacted by perceptions about our Card Member base, ability or inability of certain individuals or companies to become customers and their usage of our cards and other products and services, and acceptance of American Express cards by merchants in certain industries, when American Express cards are used for payment for legal, but controversial, products and services, or any government inquiries or legislative scrutiny related to customer acquisition practices or card acceptance or usage.
These risks to our brand and reputation, as well as other risks described herein, are heightened by the increasing sophistication and availability of AI technology, including by assisting with the creation of deepfakes, increasing the velocity of distribution of disinformation and potentially altering the payments landscape in ways that disintermediate or create a negative perception of us.
The use of AI & ML technologies, including generative AI and agentic commerce, has increased rapidly and may be transformative to the payments industry, heightening the risks described herein and others in ways that may be unpredictable and disadvantageous to us.
Our and our partners’ use of AI & ML is subject to various and evolving risks, including flaws in models or datasets that may result in biased or inaccurate results, especially as generative AI has been known to produce false or “hallucinatory” inferences or outputs.
The use of AI may also result in unintended or unexpected outcomes, present significant ethical challenges and heighten risks related to information security, the infringement of intellectual property rights and exposure of proprietary or personal information.
We may also face challenges in our ability to safely deploy AI systems and implement appropriate governance and controls, which may not be as burdensome to our competitors, and which may impair our implementation or impose additional risks.
Adverse consequences of AI & ML remain uncertain but could include flaws in the decisions, predictions, outputs or analysis such technologies produce, subjecting us to competitive harm, legal liability, heightened regulatory scrutiny, greater prevalence of surcharging or other negative point-of-sale practices and brand or reputational harm, as well as decreased demand for our products and services or increased costs.
No longer disclosed
For example, in 2024 Visa and Mastercard proposed a lawsuit settlement agreement that would have, among other things, required reductions and caps on interchange fees and streamlined requirements for merchants who wish to impose a surcharge on credit transactions.
For example, as previously disclosed, we entered into agreements to resolve governmental investigations related to historical sales practices for certain U.S. small business customers, which are described in more detail in Note 12 to the “Consolidated Financial Statements.” In addition, we are cooperating with ongoing regulatory inquiries concerning our rewards and benefits programs, as described in “Supervision and Regulation” under “Business.” Legal proceedings regarding provisions in our merchant contracts, including non-discrimination and honor-all-cards provisions, could have a material adverse effect on our business and result in additional litigation and/or arbitrations, changes to our merchant agreements and/or business practices, substantial monetary damages and damage to our reputation and brand.
For example, the operational rights relating to our prepaid reloadable and gift card business are owned by a business partner and the reloadable operations have experienced disruptions and compliance issues that impacted the ability of our prepaid customers to load and use their cards.
For example, models based on historical data sets might not be accurate predictors of future outcomes, such as because of changes in the credit profile of our Card Members, and they may not be able to predict future outcomes.
If such operations are interrupted, suspended, terminated or otherwise experience further issues in the future, it could further negatively impact our customers’ experience, result in additional costs, litigation and regulatory action, and harm our business and reputation.
These risks to our brand and reputation, as well as other risks described in this Risk Factors section, are heightened by the increasing sophistication and availability of artificial intelligence technology, including by assisting with the creation of deepfakes and increasing the velocity of distribution of disinformation.
Our and our partners’ use of artificial intelligence and machine learning is subject to various risks including flaws in models or datasets that may result in biased or inaccurate results, unintended or unexpected outcomes, ethical considerations regarding artificial intelligence, infringement of intellectual property rights, exposure of proprietary or personal information, heightened security risks and the ability to safely deploy and implement governance and controls for artificial intelligence systems.
Adverse consequences of artificial intelligence and machine learning remain uncertain but could include flaws in the decisions, predictions, outputs or analysis such technologies produce and subjecting us to competitive harm, legal liability, heightened regulatory scrutiny and brand or reputational harm.
Cyber threat actors, including state-sponsored and nation state actors, have rapidly evolved their techniques and increasingly utilize advanced capabilities, including the integration of advanced forms of artificial intelligence and other new technology, which can increase the efficacy, severity, frequency and ease of execution of cyberattacks. 29 Table of Contents Our and our partners’ networks and systems are subject to constant attempts to disrupt business operations and capture, destroy, manipulate or expose various types of information relating to corporate trade secrets, customer information (including Card Member, travel and loyalty program data), colleague information and other sensitive business information (including acquisition activity, non-public financial results and intellectual property).
As such laws are interpreted and applied (in some cases, with significant differences or conflicting requirements across jurisdictions), compliance and technology costs will continue to increase, particularly in the context of ensuring that adequate privacy, data protection, data management, incident management, resiliency, third party management, data transfer, security controls, account access mechanisms and controls related to artificial intelligence and machine learning are in place.
Additionally, new laws and regulations related to automated decision making, artificial intelligence and machine learning as well as the application of existing laws and regulations to these technologies may restrict or impose burdensome and costly requirements on our ability to use them or impact other aspects of our business.
For more information on regulatory and legislative activity in this area, see “Supervision and Regulation — Privacy, Data Protection, Data Management, Artificial Intelligence, Resiliency, Information Security and Cybersecurity” under “Business.” If we are not able to protect our intellectual property, or successfully defend against any infringement or misappropriation assertions brought against us, our revenue and profitability could be negatively affected.