Reputable outlets only (Reuters, WSJ, CNBC, Barron's, and peers). More on Google News ↗
What Changed
Risk factors · Nov 13, 2024 → Nov 6, 2025
75 added · 59 removed between the two most recent 10-Ks. The risks a company starts — or stops — disclosing are often the story.
Newly disclosed
For example, except for limited exceptions: (1) no person may beneficially own more than 15 percent of our class A common stock (or 15 percent of our total outstanding common stock on an as-converted basis), unless our board of directors approves the acquisition of such shares in advance;
For instance, the EU has adopted a comprehensive AI Act that establishes harmonized rules across Europe, with key provisions for high-risk AI systems taking effect in August 2026.
For example, parties may agree not to use our payments network for processing transactions resulting in sellers processing transactions directly with issuers, or processors processing transactions directly with issuers and acquirers. • New or revised industry standards for or related to payments set by individual countries, regions or standard setting organizations may result in additional costs and expenses for Visa and its clients, or otherwise negatively impact the functionality and competitiveness of our products and services.
For example, certain regulators have proposed or adopted, or plan to propose or adopt, rules or standards related to these matters that would apply to our business, including the EU’s Corporate Sustainability Reporting Directive and Corporate Sustainability Due Diligence Directive and the State of California’s legislation requiring broad disclosure of greenhouse gas emissions and other climate-related information.
The increased risk of inadvertent disclosure of confidential information or personal data in connection with the utilization of AI technologies may result in stronger regulatory scrutiny, leading to legal and regulatory investigations and 25 Table of Contents enforcement actions that may negatively affect our business, even if unfounded.
The interplay between payments regulations, data privacy laws and evolving AI regulations may create uncertainty around compliance obligations and potential liability exposure as more participants (including sellers, fintechs, AI developers and enablers) enter the agentic commerce ecosystem.
The fragmented regulatory landscape for emerging technologies such as AI and inconsistent requirements across legal frameworks may amplify difficulties in identifying, preventing or mitigating risk with a single global approach, potentially increasing our compliance costs or stratifying our ability to leverage certain data or technologies for innovation.
We expect to face more competition as AI continues to advance and GenAI and agentic AI capabilities become integrated into payments and related services in two main ways: first, by competitors successfully enhancing their products, services and external offerings with AI to achieve greater and faster product adoption; and second, by competitors providing internal AI tools to upskill their employees for greater operational efficiencies and impact.
In addition, our competitors may have, or in the future may obtain, proprietary rights that would prevent, limit or interfere with our ability to design, use or sell our own AI-based offerings or services to our clients and other third parties.
If we do not continue to invest in developing and supporting our AI-based initiatives, we may fall behind technological developments and evolving industry standards, which would likewise harm our reputation and ability to effectively compete, retain clients or grow our business.
Additionally, the goals or initiatives themselves could potentially subject us to litigation or investigations initiated by government authorities or private actors alleging that our activities related to CRS are anti-competitive, discriminatory or otherwise unlawful.
In addition, in the case of any cyber-attack or other security incident information or security breach or technology failure arising from third-party systems impacting us, any third-party indemnification may not be applicable or sufficient to address the impact of such incidents.
No longer disclosed
For example, except for limited exceptions: • no person may beneficially own more than 15 percent of our class A common stock (or 15 percent of our total outstanding common stock on an as-converted basis), unless our board of directors approves the acquisition of such shares in advance; • no competitor or an affiliate of a competitor may hold more than 5 percent of our total outstanding common stock on an as-converted basis; • the affirmative votes of the class B-1, B-2 and C common stock and series A, B and C preferred stock are required for certain types of consolidations or mergers; • our stockholders may only take action during a stockholders’ meeting and may not act by written consent; and • only our board of directors, Chair, or CEO or any stockholders who have owned continuously for at least one year not less than 15 percent of the voting power of all shares of class A common stock outstanding may call a special meeting of stockholders. 33 Table of Contents
For example, in some regions (Latin America, Southeast Asia and the Middle East), including through intergovernmental organizations such as the 25 Table of Contents Association of Southeast Asian Nations and the GCC, some countries are at varying stages of exploring or operationalizing the cross-border connectivity of such domestic systems.
The EU AI Act comes into force in stages with the key provisions related to high risk AI coming into force in August 2026.
Legal requirements relating to the collection, storage, handling, use, disclosure, transfer, disposal and security of personal data continue to evolve, and we are subject to an increasing number of privacy, data protection, cybersecurity and AI requirements around the world.
There is still limited guidance on the EU AI Act, but it could, depending on how provisions are interpreted and enforced, limit the ability to create and deploy AI systems for uses deemed high-risk in the EU or add increased compliance costs associated with these systems.
In addition to ongoing litigation related to the U.S. migration to EMV-capable cards and point-of-sale terminals, U.S. merchant-affiliated groups and processors have expressed concerns regarding the EMV certification process and some policymakers have expressed concerns about the roles of industry bodies such as EMVCo and the Payment Card Industry Security Standards Council in the development of payment card standards.
New regulations have been enacted and/or are expected in several jurisdictions, including the EU’s Corporate Sustainability Reporting Directive, the SEC climate-related disclosures that could require disclosure of climate-related information and the State of California’s legislation requiring broad disclosure of greenhouse gas emissions and other climate-related information.
Numerous and evolving cybersecurity threats, including advanced and persistent cyber attacks, targeted attacks against our employees and trusted partners, insider threats, social engineering threats, such as phishing or deepfake schemes, including those using synthetic media, could compromise the confidentiality, availability and integrity of data in our systems, particularly on our internet-facing applications, or the systems of our third-party service providers.
In June 2022, the UK’s PSR initiated a market review focusing on post-Brexit increases in interchange rates for transactions between the UK and Europe. • As referenced above, with increased lobbying by merchants and other industry participants, we are also beginning to see regulatory interest in network fees.
In 2022, the New Zealand Parliament passed legislation capping domestic interchange rates for debit and credit products, and the government remains focused on lowering costs of digital payments to businesses and consumers.
For example, merchants could process transactions directly with issuers, or processors could process transactions directly with issuers and acquirers.
The EU has adopted a comprehensive AI Act that applies harmonized rules across Europe with the aim of fostering innovation and respecting fundamental rights.