UNITED STATES

SECURITIES AND EXCHANGE COMMISSION 

Washington, D.C. 20549

____________________________________

FORM 10-K

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2023 

OR
☐	TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from                          to 

Commission File Number 001-06605

____________________________________

EQUIFAX INC.

(Exact name of registrant as specified in its charter)

Georgia	58-0401110
(State or other jurisdiction of incorporation or organization)	(I.R.S. Employer Identification No.)

1550 Peachtree Street	N.W.	Atlanta	Georgia	30309
(Address of principal executive offices)				(Zip Code)

Registrant’s telephone number, including area code: 404-885-8000

Securities registered pursuant to Section 12(b) of the Act: 

Title of each class	Trading Symbol	Name of each exchange on which registered
Common Stock, $1.25 par value per share	EFX	New York Stock Exchange

Securities registered pursuant to Section 12(g) of the Act: None.

____________________________________

Indicate by check mark if Registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Exchange Act (“Act”).  ☒  Yes   ☐  No

Indicate by check mark if Registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.  ☐ Yes  ☒ No

Indicate by check mark whether Registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the Registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.        ☒  Yes   ☐  No

Indicate by check mark whether the Registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T during the preceding 12 months (or for such shorter period that the Registrant was required to submit such files).    Yes  ☒   No  ☐

Indicate by check mark whether the Registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act. (Check one):

☒ Large accelerated filer ☐ Accelerated filer ☐ Non-accelerated filer ☐  Smaller reporting company ☐   Emerging growth company

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act.  ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issues financial statements.  ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant's executive officers during the relevant recovery period pursuant to §240.10D-1(b).  ☐

Indicate by check mark whether the Registrant is a shell company (as defined in Rule 12b-2 of the Act).  ☐  Yes   ☒  No

As of June 30, 2023, the aggregate market value of Registrant’s common stock held by non-affiliates of Registrant was approximately $28,876,038,118 based on the closing sale price as reported on the New York Stock Exchange. At January 31, 2024, there were 123,956,391 shares of Registrant’s common stock outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of Registrant’s definitive proxy statement for its 2024 annual meeting of shareholders are incorporated by reference in Part III of this Form 10-K.

TABLE OF CONTENTS

 

		Page
PART I
Item 1.	Business	2
Item 1A.	Risk Factors	14
Item 1B.	Unresolved Staff Comments	26
Item 1C.	Cybersecurity	26
Item 2.	Properties	29
Item 3.	Legal Proceedings	30
Item 4.	Mine Safety Disclosures	30
PART II
Item 5.	Market for the Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities	31
Item 6.	Reserved	32
Item 7.	Management’s Discussion and Analysis of Financial Condition and Results of Operations	33
Item 7A.	Quantitative and Qualitative Disclosures About Market Risk	54
Item 8.	Financial Statements and Supplementary Data	55
Item 9.	Changes in and Disagreements with Accountants on Accounting and Financial Disclosure	104
Item 9A.	Controls and Procedures	104
Item 9B.	Other Information	104
PART III
Item 10.	Directors, Executive Officers and Corporate Governance	106
Item 11.	Executive Compensation	107
Item 12.	Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters	107
Item 13.	Certain Relationships and Related Transactions and Director Independence	107
Item 14.	Principal Accountant Fees and Services	108
PART IV.
Item 15.	Exhibits and Financial Statement Schedules	109
Item 16.	Form 10-K Summary	112
	Signatures	113

1

PART I

ITEM 1.  BUSINESS

Overview

Equifax Inc. is a global data, analytics and technology company. We provide information solutions for businesses, governments and consumers, and we provide human resources business process automation and outsourcing services for employers. We have a large and diversified group of clients, including financial institutions, corporations, government agencies and individuals. Our services are based on comprehensive databases of consumer and business information derived from numerous sources including credit, financial assets, telecommunications and utility payments, employment, income, educational history, criminal justice data, healthcare professional licensure and sanctions, demographic and marketing data. We use advanced statistical techniques, machine learning and proprietary software tools to analyze available data to create customized insights, decision-making and process automation solutions and processing services for our clients. We are a leading provider of information and solutions used in payroll-related and human resource management business process services in the United States of America (“U.S.”) as well as e-commerce fraud and charge back protection services in North America. For consumers, we provide products and services to help people understand, manage and protect their personal information and make more informed financial decisions. Additionally, we also provide information, technology and services to support debt collections and recovery management.

We currently operate in four global regions: North America (U.S. and Canada), Asia Pacific (Australia, New Zealand and India), Europe (the United Kingdom (“U.K.”), Spain and Portugal) and Latin America (Argentina, Brazil, Chile, Costa Rica, Dominican Republic, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay). We maintain support operations in Chile, Costa Rica, India and Ireland. We also have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and Brazil.

Equifax was originally incorporated under the laws of the State of Georgia in 1913, and its predecessor company dates back to 1899. As used herein, the terms Equifax, the Company, we, our and us refer to Equifax Inc., a Georgia corporation, and its consolidated subsidiaries as a combined entity, except where it is clear that the terms mean only Equifax Inc.

We are organized and report our business results in three operating segments, as follows:

•Workforce Solutions — provides services enabling customers to verify income, employment, educational history, criminal justice data, healthcare professional licensure and sanctions of people in the U.S. (Verification Services), as well as providing our employer customers with services which include unemployment claims management, I-9 and onboarding services, Affordable Care Act compliance management, tax credits and incentives and other complementary employment-based transaction services (Employer Services). Workforce Solutions has established operations in Canada, Australia and the U.K.

•U.S. Information Solutions (“USIS”) — provides consumer and commercial information solutions to businesses in the U.S. including online information, decisioning technology solutions, identity management services, analytical services, e-commerce fraud and charge back protection services, portfolio management services, mortgage information and marketing services. We provide products to consumers in the U.S. to enable them to understand and monitor their credit and help protect their identity. We also sell consumer credit information to resellers who may combine our information with other information to provide direct-to-consumer monitoring, reports and scores.

•International — provides products and services similar to those available in the USIS operating segment but with variations by geographic region. We also provide information, technology and services to support debt collections and recovery management. In addition, we provide products to consumers in Canada, the U.K., Australia and Chile to enable them to understand and monitor their credit and help protect their identity. This operating segment is comprised of our Asia Pacific, Europe, Latin America and Canada business units. It also includes our joint ventures in Cambodia, Malaysia, Singapore and Brazil.

2

Our Business Strategy

Our vision is to be a trusted global leader in data, analytics and technology that creates innovative solutions and insights for our customers. Our business strategy is driven by the following imperatives:

•Leverage our Equifax cloud capabilities and technology investment to accelerate innovation, new products and growth. We are executing a cloud data and technology transformation that is rebuilding our technology infrastructure, including a migration to a public cloud environment that employs virtual private cloud deployment techniques. We are rationalizing and rebuilding our application portfolio using cloud-native services. Our move to cloud-native technology is enabling the continued development of our single data fabric, which is a cloud native platform that enables Equifax to build, manage and deploy data products, as well as implementation of best-in-class cloud-based tools and capabilities. Our growth strategy is to leverage our cloud data and technology transformation to accelerate innovation and new product development; deliver market-leading capabilities to our customers; facilitate customer and partner implementation and integration; improve ease of consumer access to and interaction with Equifax; and strengthen system resiliency and uptime.

•Leverage and expand our differentiated portfolio of data assets. We use proprietary advanced analytical platforms, including capabilities in machine learning, artificial intelligence and advanced visualization tools, to leverage our unique data to develop leading analytical insights that enhance the precision of our customers’ decisioning activities. Based on our cloud native data and technology transformation, we are investing to simplify our customers’ access to our leading analytical and decisioning platforms, in order to speed the development of unique insights and the conversion of these insights into innovative new products and services consumable by our customers through our delivery platforms. We strive to advance these capabilities and bring our customers multi-data solutions at scale by expanding our unique and differentiated data assets and analytics through organic growth, business acquisitions and partnerships.

•Foster a culture of putting customers and consumers first. We are focused on maintaining a culture in which our customers and consumers are at the center of our decision processes, and where we exceed customer and consumer expectations by delivering solutions with speed, flexibility, stability and performance. We prioritize engagement with our customers and strive to accelerate innovation through collaboration. We seek to leverage our cloud native technology and unique data assets and capabilities, as well as customer expertise and data and technology assets, to drive the development of high-value analytical products and services designed to address a broader range of customer and consumer needs. We work to maximize the value of our differentiated data assets, analytics and decisioning to drive new products and services that provide a fuller picture of consumers and commercial entities to our customers in banking and financial services, government, employee hiring and onboarding and other service providers.

•Execute strategic acquisitions that expand our data portfolio and capabilities and drive revenue growth. A critical lever of our strategy is inorganic growth through accretive and strategic acquisitions that drive incremental annual revenue growth. Our acquisition priorities are clear and focused on re-investing in acquisitions that expand our unique differentiated data assets and solutions to strengthen and grow our core businesses. We continue to invest, including through acquisitions and partnerships, to expand our addressable markets and the data and capabilities we offer to solve customer challenges across the services we provide and to expand our access to differentiated data including across identity authentication, fraud mitigation and risk management. We believe there are opportunities to continue to expand in the U.S. and internationally, across the existing financial, mortgage, telecommunications, automotive, insurance, talent management, human resource services, government and other markets that we serve, as well as in new and emerging market segments.

•Continue our leadership in data security. We are committed to being an industry leader in security. We have built an Equifax culture that prioritizes security, and we consider data and technology security, and more broadly risk management, as a primary requirement in all decisions. We make extensive use of advanced data and technology security tools, techniques, services and processes in order to enhance our ability to protect the information with which we are entrusted. We are committed to working openly with our peers, customers and partners to tackle emerging security challenges, document best practices, provide vital data security thought leadership and work together to deliver solutions that benefit both the security community and consumers.

•Build a world-class Equifax team by investing in talent to drive our strategy and promote a culture of innovation. At Equifax, we are committed to nurturing a culture where diverse talent thrives. We are focused on providing meaningful opportunities for career advancement and development, fostering an inclusive work

3

environment, and promoting employee engagement and recognition. We leverage our enterprise-wide talent initiatives to develop, retain and attract a highly-qualified workforce in order to promote our culture of innovation, add diverse perspectives and deliver on our business strategy.

We seek to enhance shareholder value through the disciplined execution of these imperatives and by positioning our Company as a global data, analytics and technology leader with industry-leading security.

Markets and Clients

Our products and services serve clients across a wide range of verticals, including mortgage, financial services, employers, government (state, federal and local), automotive, commercial, identity and fraud, consumer, resellers, healthcare, telecommunications, retail and insurance. We also serve consumers directly. Our revenue streams are highly diversified with our largest client providing approximately 2% of total revenue. The following table summarizes the various end-user markets we serve:

1.Predominantly sold to companies who serve the direct-to-consumer market and includes other small end user markets. Mortgage and auto resellers are excluded from this category as they are included within their respective categories above.

2.Other includes revenue from other miscellaneous end-user markets.

We market our products and services primarily through our own direct sales organization that is structured around sales teams that focus on client segments typically aligned by vertical markets and geography. In the U.S., the vertical market sales teams for the Mortgage, Financial, Government and Automotive markets sell products from both the USIS and Workforce Solutions business units. Sales groups are based in field offices located throughout the U.S., including our headquarters in Atlanta, Georgia, and in the countries where we have operations. We also market our products and services through indirect channels, including alliance partners, joint ventures and other resellers. In addition, we market our products directly to consumers through e-commerce channels.

Revenue from international clients, including end users and resellers, amounted to 23% of our total revenue in 2023, 22% of our total revenue in 2022 and 22% of our total revenue in 2021.

Products and Services

Our products and services help our clients make more informed decisions with higher levels of confidence by leveraging a broad array of data assets. Analytics are used to derive insights from the data that are most relevant for the client’s decisioning needs. The data and insights are then processed through proprietary software and generally transmitted to the client’s operating system to execute the decision.

4

The following chart summarizes the key products and services offered by each of the business units within our segments:

	Workforce Solutions		USIS		International
	Verification Services	Employer Services	Online Information Solutions	Financial Marketing Services	Europe	Asia Pacific	Latin America	Canada
Online data	X		X		X	X	X	X
Portfolio management services	X		X	X	X	X	X	X
Analytical services	X	X	X	X	X	X	X	X
Technology services			X		X	X	X	X
Identity verification services	X	X	X		X	X	X	X
Fraud management services	X	X	X		X	X	X	X
Marketing services				X	X	X	X	X
Direct-to-consumer services		X	X		X	X	X	X
Employment and income verification services	X				X	X		X
Talent management	X	X
Business process outsourcing (BPO)	X	X				X
Debt collection software, services and analytics					X	X	X

Each of our operating segments is described more fully below. For the operating revenue, operating income and total assets for each segment, see Note 13 of the Notes to the Consolidated Financial Statements in Item 8 of this report.

Workforce Solutions

Workforce Solutions operates in the U.S. through two business units:

Verification Services. Verification Services include employment, income, educational history, criminal justice data, healthcare professional licensure and sanctions verification services. Our online verification services enable third-party verifiers, including various governmental agencies, mortgage originators, credit card and automotive lenders and pre-employment screeners, to verify the employee’s employment status and income information. We also offer an offline manual verification service, which expands employment verification to locate data outside our existing automated database. In addition, Verification Services administers a comprehensive source of incarceration, justice and people-based risk intelligence data.

Employer Services. These services are aimed at reducing the cost of the human resources function of businesses through a broad suite of services, including assisting with employment tax matters designed to reduce the cost of unemployment claims through effective claims representation and management and efficient processing to better manage the tax rate that employers are assessed for unemployment taxes; comprehensive services designed to research the availability of employment-related tax credits (e.g., federal work opportunity tax credits and employee retention credits), and to process the necessary filings and assist the client in obtaining the tax credit; tax form management services (which include initial distribution, reissuance and correction of W-2 and 1095-C forms); I-9 management services designed to help clients electronically comply with the immigration laws that require employers to complete an I-9 form for each new hire; immigration case management services; onboarding services using an online platform to complete the new hire process for employees of corporations and government agencies; and identity theft protection services. In addition, we provide software and services to employers to assist in their compliance with the Affordable Care Act.

The Work Number® is our key repository of employment and income data serving our Verification Services business unit. We rely on payroll data received from over three million organizations to regularly update the database. The updates occur as employers and other data contributors transmit data electronically to Equifax from their payroll systems. Employers provide this data to us so that we can handle verification requests on behalf of each employer. We use this data to provide automated employment and income verification services to verifiers, who are lenders, employers/background screeners and government agencies.

The fees we charge for services in these two business units are generally on a per transaction basis. We have not experienced significant turnover in the employer contributors to the database because we generally do not charge them to add their employment data to The Work Number® database, and the verification service we offer relieves them of the administrative burden and expense of responding to third-party employment verification requests while providing them with the assurance that

5

the process is automated and not subject to human interpretation. The Work Number® database held about 168 million current and 657 million total (current and historic) employment records at December 31, 2023.

Workforce Solutions has established an income and employment verification service in Canada, Australia and the U.K., known as Verification Exchange. At present, revenues from these services in all three regions mentioned are insignificant.

USIS

USIS provides consumer and commercial information solutions to businesses in the U.S. through three product and service lines, as follows:

Online Information Solutions. Online Information Solutions’ products are derived from multiple large and comprehensive databases of consumer and commercial information that we maintain about individual consumers and businesses, including credit history, current credit status, payment history, address and other identity information. Our clients utilize the information and analytical insights we provide to make decisions for a broad range of financial and business purposes, such as whether, and on what terms, to approve auto loans or credit card applications, and whether to allow a consumer or a business to open a new utility or telephone account. In addition, this information is used by our clients for cross-selling additional products to existing customers, improving their underwriting and risk management decisions, and authenticating and verifying consumer and business identities. We also sell consumer and credit information to resellers who may combine our information with other information to provide services to the financial, mortgage, fraud and identity management, and other end-user markets. Our software platforms and analytical capabilities can integrate all types of information, including third-party and client information, to enhance the insights and decisioning process to help further mitigate the risk of granting credit, predict the risk of bankruptcy, indicate the applicant’s risk potential for account delinquency, ensure the identity of the consumer and reduce exposure to fraud. Identity verification and fraud management products combine financial and non-financial identity information and activity to provide identity verification and authentication services, to assist customers in assessing the risk of loss due to account takeover, identity theft and chargebacks. These risk management services enable our clients to monitor risks and opportunities and proactively manage their portfolios.

Online Information Solutions’ clients access products through a full range of electronic distribution mechanisms, including direct real-time access, which facilitates instant decisions. We also develop and host customized applications that enhance the decision-making process for our clients. These decisioning technology applications assist with a wide variety of decisioning activities, including determining pre-approved offers, cross-selling of various products, determining deposit amounts for telephone and utility companies and verifying the identity of their customers. We have also compiled commercial databases regarding businesses in the U.S., which include loan, credit card, public records and leasing history data, trade accounts receivable performance and Secretary of State and Securities and Exchange Commission registration information. We offer scoring and analytical services that provide additional information to help mitigate the credit risk assumed by our clients.

Online Information Solutions also includes our consumer solutions product suite that gives U.S. consumers information to enable them to understand and monitor their credit and to monitor and help protect their identity. Equifax products offer monitoring features for consumers who are concerned about identity theft, including credit report monitoring from all three credit bureaus, internet scanning, bank account monitoring and lost wallet support. Products may also be available indirectly through relationships with business partners who distribute our products or provide these services to their employees or customers. We also sell consumer credit information to resellers who may combine our information with other information to provide direct-to-consumer monitoring, reports and scores.

Mortgage Solutions. Our Mortgage Solutions products, offered in the U.S., consist of specialized credit reports that combine information from the three major consumer credit reporting agencies (Equifax, Experian and TransUnion) into a single “merged” credit report in an online format, commonly referred to as a tri-merge report. Mortgage lenders use these tri-merge reports in making their mortgage underwriting decisions. Additionally, we offer services designed to alert lenders to changes in a consumer’s credit status during the underwriting period and securitized portfolio risk assessment services for evaluating inherent portfolio risk.

Financial Marketing Services. Our Financial Marketing Services products utilize consumer and commercial financial information enabling our clients to more effectively manage their marketing efforts, including targeting and segmentation, to identify and acquire new clients for their products and services; to develop portfolio strategies to minimize risk and maximize profitability; and to realize additional revenue from existing customers through more effective cross-selling of additional products and services. Our products are also utilized by customers to support digital identity verification and fraud detection and protection. These products utilize information derived from consumer and commercial information, including credit,

6

income, asset, liquidity, net worth and spending activity, which also support many of our Online Information Solutions’ products. These data assets broaden the understanding of consumer and business financial potential and opportunity, which can further drive high value decisioning and targeting solutions for our clients. We also provide account review services, which assist our clients in managing their existing customers and prescreen services that help our clients identify new opportunities with their customers. Clients for these products primarily include institutions in the banking, brokerage, retail, insurance and mortgage industries as well as companies primarily focused on digital and interactive marketing.

International

The International operating segment includes our Asia Pacific, Europe, Latin America and Canada business units. It also includes our joint ventures in Cambodia, Malaysia, Singapore and Brazil. These business units offer products that are similar to those available in the USIS operating segment, but with variations by geographic region. In some jurisdictions, data sources tend to rely more heavily on government agencies than in the U.S. We also offer specialized services that help our customers better manage risk in their consumer portfolios. This operating segment’s products and services generate revenue in Argentina, Australia, Brazil, Canada, Chile, Costa Rica, Dominican Republic, Ecuador, El Salvador, Honduras, India, Mexico, New Zealand, Paraguay, Peru, Portugal, Spain, the U.K. and Uruguay. We also maintain support operations in Chile, Costa Rica, India and Ireland. We have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and Brazil. We also provide information, technology and services to support debt collections and recovery management in Asia Pacific, Europe, Canada and Latin America.

Asia Pacific. Our Asia Pacific operation provides consumer and commercial information solutions products, marketing products, employment verification services and consumer credit protection products. We offer a full range of products, generated from credit records and other data, including credit reporting and scoring, decisioning technology, risk management, identity management, authentication and fraud detection services. Our consumer and commercial products are the primary source of revenue in each of the countries in which we operate and include credit reporting, decisioning tools and risk management services. We also provide information, technology and services to support talent management, as well as debt collections and recovery management. Additionally, we provide a variety of consumer and commercial marketing products generated from information databases, including business profile analysis, business prospect lists and database management. The countries in which we operate include Australia, New Zealand and India, as well as Cambodia, Malaysia and Singapore through joint ventures.

 Europe. Our Europe operation provides information solutions, fraud detection services, debt collection services and marketing products. Information solutions and fraud products are generated from information that we maintain and include credit reporting, monitoring and scoring, asset information, risk management, identity management and authentication services and fraud detection and modeling services. These products are sold in the U.K. and Spain. Limited marketing products are available in the U.K. and, to a lesser extent, in Spain. We also provide information, technology and services to support debt collections and recovery management in the U.K. and Spain. In the U.K., this includes a contract to provide these services to the U.K. government.

Latin America. Our Latin America operation provides consumer and commercial information solutions products, marketing products and consumer credit protection products. We offer a full range of products, generated from credit records that we maintain, including credit reporting and scoring, decisioning technology, risk management, identity management, authentication and fraud detection services. Our consumer products are the primary source of revenue in each of the countries in this region in which we operate, with the exception of Mexico where debt management services constitute the core of the business. We also offer various commercial products, which include credit reporting, decisioning tools and risk management services, in the countries we serve. We also provide information, technology and services to support debt collections and recovery management. Additionally, we provide a variety of consumer and commercial marketing products generated from our credit information databases, including business profile analysis, business prospect lists and database management. The countries in this region in which we operate include Argentina, Brazil, Chile, Costa Rica, Dominican Republic, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay. We also have an investment in a consumer credit information company through a joint venture in Brazil.

Canada. Similar to the USIS business units, our Canada operation offers products derived from the credit information that we maintain about individual consumers and businesses. We offer many products in Canada, including credit reporting, monitoring and scoring, consumer and commercial marketing, risk management, fraud detection and modeling services, identity management and authentication services, together with certain of our decisioning products that facilitate pre-approved offers of credit and automate a variety of credit decisions. We also offer commercial credit solutions, which help businesses manage financial and credit risk and gain insights on customers, markets and industry groups using our commercial data assets. We also provide data, technology and services to facilitate the search of land data and process real estate transactions in Canada.

7

Competition

The market for our products and services is highly competitive and is subject to constant change. Our competitors vary widely in size and in the nature of the products and services they offer. Sources of competition are numerous and include the following:

•Competition in the Verification Services market, for both the U.S. and key International segments of Australia, Canada and the U.K., includes employers who manage verifications in-house, lenders who obtain verifications directly from employers, and other online and offline verification companies, such as Experian, Thomas & Company and niche providers. Third parties may also seek to obtain verifications directly from employees by leveraging paper copies of information or by seeking employee credentials to access information systems. Competition in the U.S. Employer Services market is diverse and includes in-house management of such services or the outsourcing of one or more of such services to other third-party outsourced providers like Experian and Thomas & Company; human resources consulting firms such as Mercer and Towers Watson; human resources management services providers such as Workday, Oracle and SAP; payroll processors such as ADP, Paychex and Ceridian; accounting firms such as PwC and EY; and hundreds of smaller companies that provide one or multiple offerings that compete with our Employer Services business.

•Competition for our credit information solutions and direct-to-consumer solutions products varies by both application and industry, but generally includes two global consumer credit reporting companies, Experian and TransUnion, both of which offer a product suite similar to our credit information solutions. In the U.S., LifeLock is a national provider of personal identity theft protection service. Also, there are competitors offering free credit scores including Credit Karma in the U.S., Canada and the U.K., ClearScore in the U.K., and Credit Simple and Credit Savvy in Australia. There are also a large number of competitors who offer competing products in specialized areas (such as fraud prevention, risk management and application processing and decisioning solutions) and software companies offering credit modeling services or analytical tools. Our differentiators include our unique data assets, decisioning technology and the features and functionality of our analytical capabilities. We emphasize our improved decision making and product quality while remaining competitive on price. We also compete with Fair Isaac Corporation with respect to certain of our analytical tools and solutions and LexisNexis in identity and fraud and other solutions.

•Competition for our commercial solutions products primarily includes Experian, Dun & Bradstreet and Moody's, and providers of these services in the international markets we serve.

•Competition for our debt collection and recovery management software, services and analytics is spread across a number of providers. We believe that the breadth and depth of our data assets enable our clients to develop a more current and comprehensive view of consumers. In the category of platforms and analytics, we compete to some extent with entities that deploy collections platforms, account management systems or recovery solutions. 

While we believe that none of our competitors offers the same mix of products and services as we do, certain competitors may have a larger share of particular geographic or product markets or operate in geographic areas where we do not currently have a presence.

We assess the principal competitive factors affecting our markets to include: our ability to protect information and systems; product attributes such as quality, depth, coverage, adaptability, scalability, interoperability, functionality and ease of use; product price; technical performance including system response time and availability; access to unique proprietary databases; quickness of response, flexibility and client services and support; effectiveness of sales and marketing efforts; existing market penetration; proprietary technology; and new product innovation.

Technology and Intellectual Property

We rely on various intellectual property laws, confidentiality procedures and contractual provisions to protect strategic or valuable intellectual property developed in connection with our business. We register, and apply for registration of, certain intellectual property in the U.S. and several foreign countries under applicable patent laws. We also register and rely on common law rights, where applicable, to protect trademarks, service marks, logos and internet domain names in the U.S. and in many foreign countries, the most important of which include “Equifax,” “The Work Number,” “Interconnect,” “Equifax Ignite,” and variations thereof. These marks are used in connection with many of our product lines and services. Our intellectual property rights are generally important to our operations and competitive position, but no single intellectual property right or

8

group of intellectual property rights is solely responsible for protecting our businesses. Certain Company trademarks, including the “Equifax” trademark, contribute to the success of our business, and their loss could have a significant negative impact on us.

We license other companies to use certain data, software and other technology and intellectual property rights we own or control, primarily as core components of our products and services, on terms that are consistent with customary industry standards and that are designed to protect our interest in our intellectual property. Other companies license us to use certain data, technology and other intellectual property rights they own or control. For example, we license credit-scoring algorithms and the right to sell credit scores derived from those algorithms from third parties for a fee. We do not hold any franchises or concessions that are material to our business or results of operations.

Governmental Regulation

We are subject to a number of U.S. federal, state, local and foreign laws and regulations that involve matters central to our business. These laws and regulations may involve consumer reporting, privacy and consumer protection, data protection, intellectual property, competition, anti-corruption, anti-bribery, anti-money laundering, employment, health, taxation or other subjects. In particular, we are subject to U.S. federal, state, local and foreign laws regarding the collection, protection, dissemination and use of personal information we collect, process or otherwise have in our possession. Failure to satisfy those legal and regulatory requirements, or the adoption of new laws or regulations, could have a significant negative impact on our results of operations, financial condition or liquidity.

U.S. federal, state, local and foreign laws and regulations are evolving and can be subject to significant change. In addition, the application and interpretation of these laws and regulations are often uncertain. These laws are enforced by federal, state and local regulatory agencies in the jurisdictions where we operate, and in some instances also through private civil litigation. There are also a number of legislative proposals pending before the U.S. Congress, various state legislative bodies and foreign governments concerning consumer and data protection that could affect us.

Summary of U.S. Regulations Relating to Consumer and Data Protection

Our U.S. operations are subject to numerous laws and regulations that govern the collection, protection and use of consumer credit and other information and impose penalties for the misuse of such information or unauthorized access to data. Many of these laws and regulations also affect our customers’ use of consumer credit or other data that we license. Examples of the most significant U.S. laws include, but are not limited to, the following:

Federal Laws and Regulation

•FCRA. The Fair Credit Reporting Act (“FCRA”) regulates consumer reporting agencies, including many of our U.S. operations, as well as data furnishers and users of consumer reports such as banks and other companies. FCRA provisions govern the accuracy, fairness and privacy of information in the files of consumer reporting agencies (“CRAs”) that engage in the practice of assembling or evaluating certain information relating to consumers for certain specified purposes. Among other requirements, the FCRA limits the type of information that may be reported by CRAs, limits the distribution and use of consumer reports and establishes consumer rights to access, freeze and dispute information in the consumer's files. CRAs are required to follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates and if a consumer disputes the accuracy of any information in the consumer’s file, to conduct a reasonable reinvestigation. The Consumer Financial Protection Bureau (“CFPB”) is the primary regulator that enforces and provides regulatory guidance related to the FCRA in the United States. CRAs are required to comply with regulations promulgated by the CFPB and are subject to regular supervisory engagements related to a variety of FCRA requirements. Violation of the FCRA can result in civil and criminal penalties. The FCRA contains an attorney fee shifting provision to provide an incentive for consumers to bring individual or class action lawsuits against a CRA for violations of the FCRA. The United States Federal Trade Commission (“FTC”) and state attorneys general may also enforce the requirements of the FCRA.

•Dodd-Frank Act. Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) created the CFPB. The Dodd-Frank Act provides the CFPB with examination and supervisory authority over CRAs, including us. The Dodd-Frank Act prohibits unfair, deceptive or abusive acts or practices (“UDAAP”) with respect to consumer financial services practices and provides the CFPB with enforcement authority to enforce those provisions. Among other areas, the CFPB’s UDAAP authority extends to the security measures we employ to safeguard the personal data of consumers. Allegations that we failed to safeguard or handle such data in a compliant manner may subject us to CFPB enforcement action. The CFPB may pursue administrative

9

proceedings or litigation to enforce the laws and rules subject to its jurisdiction. In these proceedings, the CFPB can obtain cease and desist orders, which can include orders for restitution to consumers or rescission of contracts, as well as other types of affirmative relief and monetary penalties ranging from $5,000 per day for ordinary violations and up to $1 million per day for known violations. Also, the Dodd-Frank Act empowers state attorneys general and state regulators to bring civil actions in certain circumstances for the kind of cease and desist orders available to the CFPB (but not for civil penalties).

•FTC Act. The Federal Trade Commission Act (“FTC Act”) prohibits unfair methods of competition and unfair or deceptive acts or practices. Under the FTC Act, the FTC’s jurisdiction includes the ability to bring enforcement actions based on the security measures we employ to safeguard the personal data of consumers. Allegations that we failed to safeguard or handle such data in a reasonable manner may subject us to regulatory scrutiny or enforcement action. There is no private right of action under the FTC Act.

•GLBA. The Financial Services Modernization Act of 1999, or Gramm-Leach-Bliley Act (“GLBA”), regulates, among other things, the use of non-public personal information of consumers that is held by financial institutions, including us. We are subject to various GLBA provisions, including rules relating to the use or disclosure of the underlying data and rules relating to the physical, administrative and technological protection of non-public personal financial information. Breach of the GLBA can result in civil and/or criminal liability and sanctions by regulatory authorities. Regulatory enforcement of the GLBA is under the purview of the FTC, the CFPB, the federal prudential banking regulators, the SEC and state attorneys general, acting alone or in concert with each other.

•CROA. The Credit Repair Organizations Act (“CROA”) regulates companies that claim to be able to assist consumers in improving their credit standing. There have been efforts to apply the CROA to credit monitoring services offered by CRAs and others. The CROA allows for a private right of action. Consumers can sue to recover the greater of the amount paid or actual damages, punitive damages, costs, and attorney’s fees for violations of the CROA.

State Laws and Regulations Relating to Consumer and Data Protection

•A number of states have enacted requirements similar to the federal FCRA. Some of these state laws impose additional, or more stringent, requirements than the FCRA, especially in connection with investigations and responses to reported inaccuracies in consumer reports. The FCRA preempts some of these state laws, but the scope of preemption continues to be defined by the courts. The state of Vermont is grandfathered under the original FCRA requirements and thus we are subject to additional requirements to comply with Vermont law.

•All fifty states have adopted versions of data security breach laws that require notification to affected consumers and potentially regulators or law enforcement authorities in the event of a breach of personal information. A subset of these laws and other state laws require the implementation of data security measures as well. State attorneys general can enforce such state laws and can seek equitable as well as monetary remedies and in some cases private rights of action are permitted by such laws. 

•The New York State Department of Financial Services (“NYDFS”) has enacted extensive regulatory requirements applicable to CRAs that require registration with that agency, prohibit unfair and deceptive consumer practices and require compliance with significant portions of the NYDFS cybersecurity rules.

•We or certain of our operations are also subject to and affected by new and evolving state privacy and data security laws such as data broker registration requirements in California and Vermont, and the California Consumer Privacy Act (“CCPA”). The CCPA became effective in January 2020 and imposes additional data privacy requirements on many businesses operating in the state, including, potentially, with respect to employee data in addition to consumer data. The CCPA expansively defines “personal information” and imposes new notice requirements relating to the collection, use and sharing of personal information. It provides consumers with extensive rights, including the right to access the categories and specific pieces of personal information businesses collect, the right to request businesses delete information, and the right to opt-out of “sales” of personal information with sales being defined under the CCPA to include monetary and non-monetary valuable consideration. The CCPA also contains a private right of action in the event that a business suffers a security breach that was due to unreasonable security measures. In November 2020, California voters passed the California Privacy Rights Act (“CPRA”), which maintains the core framework but expanded the requirements of the CCPA effective January 1, 2023. We may also become subject to and affected by new and proposed state privacy laws

10

similar to the CCPA and CPRA, such as the Virginia Consumer Data Protection Act (“VCDPA”) (effective January 1, 2023), the Colorado Privacy Act (effective July 1, 2023), the Connecticut Data Privacy Act (effective July 1, 2023), and the Utah Consumer Privacy Act (effective December 31, 2023), as well as enacted laws in Delaware, Indiana, Iowa, Montana, New Jersey, Oregon, Tennessee and Texas that become effective throughout 2024, 2025 and 2026. A number of other state legislatures, including New York, Florida and Washington, have introduced comprehensive data privacy legislation modeled after, and which contain certain elements of, the CCPA, VCDPA or the European Union's General Data Protection Regulation (“GDPR”), which is an extremely broad privacy law. Additional state legislatures are expected to consider similar legislation in 2024. If enacted, such laws may contain variations and impose new compliance risks and obligations on us.

•State banking and financial services regulatory agencies have asserted either express or implied authority under applicable state laws to examine us as a third-party service provider to financial institutions, and in certain cases to bring enforcement actions against us. Generally, such examinations, and related enforcement actions, are focused on assessing our safety and soundness in support of financial institutions we serve. In 2018, we entered into a consent order with certain state banking regulators in response to their multi-state review of our information security program. This consent order obligated us to, among other things, make certain changes to our corporate governance and information security practices.

•We are also subject to federal and state laws that are generally applicable to any U.S. business with national or international operations, such as antitrust laws, the Foreign Corrupt Practices Act, the Americans with Disabilities Act, state unfair or deceptive practices acts and various employment laws. We continuously monitor legislative and regulatory activities that involve credit reporting, data privacy, security and other relevant issues to identify issues in order to remain in compliance with all applicable laws and regulations.

Consent Orders with the FTC, CFPB, MSAG Group and NYDFS

•As part of the Consumer Settlement (as defined below), we entered into consent orders with the FTC, CFPB, MSAG Group (as defined below) and NYDFS pursuant to which we agreed to implement certain business practice commitments related to consumer assistance and our information security program, including third party assessments of our program. These business practice commitments are extensive and require a significant amount of attention from management.

Summary of International Regulations Relating to Consumer and Data Protection

We are subject to various data protection, privacy and consumer credit laws and regulations in the foreign countries where we operate. Examples of the most significant of these laws include, but are not limited to, the following:

•In the U.K., we are subject to a regulatory framework that provides for regulation by the Financial Conduct Authority (the “FCA”). The FCA focuses on consumer protection, the integrity of the U.K. financial system, and effective competition in the interests of consumers. The FCA has significant powers, including the power to regulate conduct related to the marketing of financial products, to specify minimum standards and to place requirements on products, impose unlimited fines, and to investigate organizations and individuals. In addition, the FCA is able to ban financial products for up to a year while considering an indefinite ban; it has the power to instruct firms to immediately retract or modify promotions which it finds to be misleading, and to publish such decisions. Our core credit reporting and debt collections services and recovery management businesses in the U.K. are subject to FCA supervision. In addition to regulation by the FCA, we are also subject to regulation by the U.K. Information Commissioner’s Office, which focuses on upholding information rights in the public interest and the protection of data privacy for individuals.

In the U.K., we are subject to provisions that are broadly equivalent to the European Union’s General Data Protection Regulation (described below). These equivalent provisions were adopted into U.K. laws following the end of the transition period that followed the U.K.’s exit from the EU.

•In Europe, we are subject to the EU's GDPR, which is an extremely broad and sweeping privacy law. The GDPR establishes multiple privacy and data protection requirements that are more specific and comprehensive than those of the U.S. and most other countries where Equifax operates. In addition, the GDPR includes data breach notification requirements and it establishes the ability of regulators to pursue substantial penalties for non-compliance. In addition to the GDPR, each EU member state may include specific requirements regarding personal data breaches in its local data protection regulations.

11

•In Canada, federal and provincial laws govern how we collect, use or disclose personal information in the course of our commercial activities. Federally, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) governs the collection, use and disclosure of personal information by organizations in the private sector. Businesses must follow the fair information principles set forth in PIPEDA to protect personal information, including: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and compliance. It sets out specific obligations with respect to accountability and identifying purposes, consent, collection, use, disclosure, retention, accuracy, safeguards, personal data breach reporting, individual access and compliance. Alberta, British Columbia and Quebec privacy legislation sets out similar privacy laws and rules that apply to our Canadian business. The federal and provincial privacy regulators have powers of investigation and intervention, and provisions of Canadian law regarding civil liability apply in the event of unlawful processing which is prejudicial to the persons concerned. Canada also has specific credit reporting legislation that is regulated at a provincial level. At present, each province has credit reporting legislation, with the exception of the Territories (Northwest Territories, Yukon, and Nunavut). Generally speaking, the legislation regulates the contents of credit files, the length of time information can be included on a credit file, who can receive credit reports and consumer rights pertaining to the maintenance of credit reports.

•In Latin America, data protection and credit reporting laws and regulations vary considerably among Latin American countries. Some countries, such as El Salvador, Paraguay, Chile and Honduras, establish a constitutional right to privacy without general data protection standards or a data protection authority. These countries, however, have laws that govern the functioning of credit bureaus. Other countries, such as Argentina, Uruguay, Peru, Costa Rica, Mexico and most recently Brazil have enacted comprehensive data protection legislation similar to the EU's GDPR. The EU recognizes Argentina and Uruguay as having adequate levels of protection for personal data transfers and processing.

•In Australia, we are subject to regulatory oversight by various agencies. The Office of the Australian Information Commissioner (“OAIC”) is the agency with direct responsibility for administering the Australian Privacy Principles (which relate to the collection, holding, use and disclosure of personal information) and Part IIIA of the Privacy Act 1988 (which regulates credit reporting). The OAIC can investigate a complaint, conduct its own investigations, resolve/make binding determinations and seek civil penalties. Our credit reporting business, Equifax Information Services and Solutions, is a member of an external dispute resolution scheme, the Australian Financial Complaints Authority, which has been approved by the OAIC to handle privacy and credit reporting complaints and make binding determinations. The OAIC can register codes of practice under the Privacy Act 1988, and has registered the Privacy (Credit Reporting) Code 2014. The Australian Competition and Consumer Commission (“ACCC”) is the agency responsible for enforcing the Competition and Consumer Act of 2010 and related legislation concerning consumer protection and competition. The ACCC has the authority to use a range of actions to ensure compliance with the law, including investigative powers and the ability to seek penalties through litigation and other formal enforcement means. The Australian Retail Credit Association is a credit and credit reporting industry self-regulatory body, which administers principles and standards for the exchange of credit data between industry participants. Equifax Australasia Credit Ratings Pty Limited (formerly named Corporate Scorecard Pty Limited, one of our Australian subsidiaries) holds an Australia Financial Services License, which allows it to provide general advice to wholesale clients by issuing a credit rating, and has been approved in New Zealand as a rating agency by the Reserve Bank of New Zealand under section 86 of the Non-bank Deposit Takers Act of 2013 (NZ). The Australian Securities and Investments Commission regulates corporations and has authority to investigate, prosecute, ban individuals and to seek civil penalties. New federal legislation came into effect in February 2021 mandating the supply by banks of comprehensive credit information to credit reporting bodies, including Equifax, imposing certain disclosure, storage and reporting obligations on the credit reporting bodies, requiring the provision by credit reporting bodies of free credit reports to consumers up to four times per year, permitting the reporting of financial hardship information within the credit reporting system and requiring the Attorney-General to review and report on the credit reporting system before October 1, 2024.

•In New Zealand, the regulatory framework provides for primary regulation under the Privacy Act 2020. The Office of the Privacy Commissioner (“NZ OPC”) investigates complaints relating to the collection, use, holding and disclosure of personal information, both credit-related and non-credit related. The NZ OPC can make a finding that there has been an interference with privacy but cannot impose civil penalties for this. In extreme cases where there has been an interference with privacy, it can refer these cases to the Director of Human Rights for determination in the Human Rights Review Tribunal. The NZ OPC can issue practice codes under the Privacy Act 2020 and has issued and subsequently amended the Credit Reporting Privacy Code 2020. The Privacy Act 2020 contains mandatory data breach reporting. The Retail Credit Association of New Zealand is an industry

12

association which addresses reciprocity of data issues relating to comprehensive credit reporting and data standards.

•In India, various legislation including the Information Technology Act of 2000 and rules framed thereunder and the Credit Information Companies (Regulation) Act of 2005 and rules and regulations framed thereunder, establishes a federal data protection framework. Entities that collect and maintain personal data and/or credit information must ensure that it is complete, accurate and safeguarded, and must adopt certain privacy principles with respect to collecting, processing, preserving, sharing and using such data and/or credit information. India enacted a new privacy law, The Digital Personal Data Protection Act, 2023 (DPDP Act), in August 2023. The DPDP Act will become effective at a future date or dates to be determined by the Indian Central Government. The Central Government is also expected to supplement the DPDP Act with rules, which are yet to be issued. The DPDP Act provides greater protection to individuals' personal data in digital form. Our Indian business is subject to regulation by the Reserve Bank of India, which is India’s central banking institution.

Summary of Regulations Affecting our Employer Services Business

The Employer Services business unit within our Workforce Solutions business segment helps employers comply with various regulatory frameworks applicable to employers in the United States. As a result, changes to those regulatory frameworks could impact the services we provide. For instance, if the federal government or a state government mandates the use of E-Verify or changes the requirements for individuals to work in the U.S., our I-9 service may be impacted. The Unemployment Cost Management service could be impacted if a state government changes the requirements for employers to process and/or protest unemployment claims. The Tax Management Services business within our Employer Services business is potentially impacted by changes in renewal or non-renewal of U.S. federal and state tax laws or interpretations, for example, those pertaining to work opportunity tax credits and unemployment compensation claims.

Human Resources

Our People

Equifax employed approximately 14,900 employees in 22 countries as of December 31, 2023. Our global employee base consisted of approximately 3,200 employees in our Workforce Solutions business unit, 2,600 employees in our USIS business unit, 4,400 employees in our International business unit and 4,700 employees in our corporate Centers of Excellence, which include our support centers in Chile, Costa Rica, India and Ireland. In 2023, we hired approximately 1,900 new employees and promoted approximately 1,800 employees as we continue to grow and transform our businesses around the world.

Inclusion and Diversity

We continue to make positive strides in support of our inclusion and diversity strategy. Our Chief Talent and Diversity Officer occupies a key leadership position, reporting directly to our Chief Human Resources Officer, and is responsible for activating our talent strategy with a focus on furthering an inclusive and diverse workforce and culture. We are advancing this strategy through deepening our commitment to employee networks around the world, open dialogues to enhance understanding, ongoing inclusion and diversity-focused training and cultural heritage celebrations.

We have consistently improved enterprise-wide trends around representation and promotions for both women and employees of diverse ethnic backgrounds, and pride ourselves on promoting and hiring highly-qualified candidates who enhance our culture, add diverse perspectives and deliver on our business strategy. Women and leaders of diverse ethnic backgrounds make up approximately half of Equifax’s senior leadership team. Consistent with our commitment to diversity, we have expanded the requirements for diverse candidate interview slates for all professional and management roles.

Forward-Looking Statements

This report contains information that may constitute “forward-looking statements.” Generally, the words “believe,” “expect,” “intend,” “estimate,” “anticipate,” “project,” “will,” “may” and similar expressions identify forward-looking statements, which generally are not historical in nature. All statements that address future operating performance and events or developments that we expect or anticipate will occur in the future, including statements relating to future operating results, improvements in our information technology and data security infrastructure, including as a part of our cloud technology transformation, our strategy, the expected financial and operational benefits, synergies and growth from our acquisitions,

13

changes in U.S. and worldwide economic conditions, such as changes in interest rates and inflation, that materially impact consumer spending, home prices, investment values, consumer debt, unemployment rates and the demand for Equifax's products and services, our culture, our ability to innovate, the market acceptance of new products and services and similar statements about our business plans are forward-looking statements. Management believes that these forward-looking statements are reasonable as and when made. However, forward-looking statements are subject to certain risks and uncertainties that could cause actual results to differ materially from the Company’s historical experience and our present expectations or projections, including without limitation our expectations regarding the Company’s outlook, long-term organic and inorganic growth, and customer acceptance of our business solutions referenced above under “Item 1. Business” and below in “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operation — Business Overview.” These risks and uncertainties include, but are not limited to, those described below in “Item 1A. Risk Factors,” and elsewhere in this report and those described from time to time in our future reports filed with the United States Securities and Exchange Commission (“SEC”). As a result of such risks and uncertainties, we urge you not to place undue reliance on any such forward-looking statements. Forward-looking statements speak only as of the date when made. We undertake no obligation to publicly update or revise any forward-looking statements, whether as a result of new information, future events or otherwise, except as required by law.

Available Information

Detailed information about us is contained in our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, proxy statements and other reports, and amendments to those reports, that we file with, or furnish to, the SEC. These reports are available free of charge at our website, www.equifax.com, as soon as reasonably practicable after we electronically file such reports with or furnish such reports to the SEC. However, our website and any contents thereof should not be considered to be incorporated by reference into this document. We will furnish copies of such reports free of charge upon written request to Equifax Inc., Attn: Office of Corporate Secretary, P.O. Box 4081, Atlanta, Georgia, 30302. These reports are also available at www.sec.gov.

ITEM 1A. RISK FACTORS

All of the risks and uncertainties described below and the other information included in this Form 10-K should be considered and read carefully. The risks described below are not the only ones facing us. The occurrence of any of the following risks or additional risks and uncertainties not presently known to us or that we currently believe to be immaterial could materially and adversely affect our business, financial condition or results of operations. This Form 10-K also contains forward-looking statements and estimates that involve risks and uncertainties. Our actual results could differ materially from those anticipated in the forward-looking statements as a result of specific factors, including the risks and uncertainties described below.

Technology and Data Security Risks

Security breaches and other disruptions to our information technology infrastructure could compromise Company, consumer and customer information, interfere with our operations, cause us to incur significant costs for remediation and enhancement of our IT systems and expose us to legal liability, all of which could have a substantial negative impact on our business and reputation.

We are a global data, analytics and technology company. In the ordinary course of business, we collect, process, transmit and store sensitive data, including intellectual property, proprietary business information and personal information of consumers, employees and strategic partners. The secure operation of our information technology networks and systems, and of the processing and maintenance of this information, is critical to our business operations and strategy. Because our products and services involve the storage and transmission of personal information of consumers, we are routinely the target of attempted cyber and other security threats by outside third parties, including technically sophisticated and well-resourced bad actors attempting to access or steal the data we store. Additionally, we could experience service disruptions or a loss of access to critical data or systems due to ransomware or other destructive attacks. Insider or employee cyber and security threats are also a significant concern for all companies, including ours. Despite our substantial investment in physical and technological security measures, employee training and contractual precautions, our information technology networks and infrastructure (or those of our third-party vendors and other service providers) are potentially vulnerable to unauthorized access to data, loss of access to systems or breaches of confidential information due to criminal conduct, attacks by hackers, employee or insider malfeasance and/or human error.

14

The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems are constantly evolving and often are not recognized until launched against a target, or even some time after. We may be unable to anticipate these techniques, implement adequate preventative measures or remediate any intrusion on a timely or effective basis even if our security measures are appropriate, reasonable, and/or comply with applicable legal requirements. Certain efforts may be state-sponsored and supported by significant financial and technological resources, making them even more sophisticated and difficult to detect. Further, we are in the process of transforming our applications and infrastructure technologies, and this transition to cloud-based technologies may expose us to additional cyber threats as we migrate our data from our legacy systems to cloud-based solutions hosted by third parties. Although we have developed systems and processes that are designed to protect our data and customer data and to prevent data loss and other security breaches, and expect to continue to expend significant additional resources to bolster these protections, these security measures cannot provide absolute security.

We previously experienced a material cybersecurity incident in 2017 and if we experience additional breaches of our security measures, including from incidents that we fail to detect for a period of time, sensitive data may be accessed, stolen, disclosed or lost. Any such access, disclosure or other loss of information could subject us to business interruption, significant litigation, regulatory fines or penalties, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or results of operations. While we maintain cybersecurity insurance, we cannot ensure that our insurance policies in the future will be adequate to cover losses from any security breaches.

Security breaches and attacks, and the adverse publicity that may follow, can have a negative impact on our reputation and our relationship with our customers. For example, our reputation with consumers and other stakeholders and our customer relationships were damaged following the cybersecurity incident in 2017, resulting in a negative impact on our revenue for a period of time. If we experience another material cybersecurity incident or are otherwise unable to demonstrate the security of our systems and the data we maintain and retain the trust of our customers, consumers and data suppliers, we could experience a substantial negative impact on our business.

If we fail to achieve and maintain key industry or technical certifications, our customers and business partners may stop doing business with us and we may not be able to win new business, which would negatively affect our revenue.

We are required by customers and business partners to obtain various industry or technical certifications. Such certifications are critical to our business because certain of our current and potential customers and the contracts governing certain customer relationships, as well as certain of our data suppliers, require us to maintain them as a requirement of doing business. For example, as a result of a prior material cybersecurity incident, we lost certain key certifications which caused certain customers and business partners to stop or pause doing business with us and temporarily limited our ability to win new business. We had to spend significant resources on remediation activities in order to obtain these key re-certifications. If we fail to achieve or maintain key industry or technical certifications as a result of another cybersecurity incident or for other reasons, customers and business partners may stop doing business with us and we may not be able to win new business, which would negatively affect our revenue.

Strategy and Market Demand Risks

The failure to realize the anticipated benefits of our technology transformation strategy could adversely impact our business and financial results.

We expect our technology transformation strategy, including our transition to cloud-based technologies, will significantly increase our efficiency, our productivity, and the stability and functionality of our products and services, as well as decrease the cost of our overall systems infrastructure, all of which we expect will drive growth and have a positive effect on our business, competitive position and results of operations. This initiative is a major undertaking as we replace many of our previous operating systems with cloud-based systems. This complex, multifaceted and extensive initiative is expensive and has caused, and may cause in the future, unanticipated problems and expenses. If the transition causes errors or adversely impacts system processes, our new systems do not operate as expected, or the data we transition to the cloud changes in a material way, we may have to incur significant additional costs to make modifications and could lose customers and we may suffer reputational harm as a result. Moreover, we have experienced issues with customer migration, as some of our customers may not migrate to cloud-based technologies on a timely basis or at all or may choose not to utilize our products and services during and after our transition to cloud-based technologies, which could negatively impact our revenue.

We cannot assure you that our technology transformation strategy will be beneficial to the extent, or within the timeframes expected, or that the estimated efficiency, cost savings and other improvements will be realized as anticipated or at

15

all. Market acceptance of cloud-based offerings is affected by a variety of factors, including information security, reliability, performance, the sufficiency of technological infrastructure to support our products and services in certain geographies, customer and data provider concerns with entrusting a third party to store and manage its data as well as the customer’s ability to access this data once a contract has expired, and consumer concerns regarding data privacy and the enactment of laws or regulations that restrict our ability to provide such services to customers. If we are unable to correctly respond to these issues, we may experience business disruptions, damage to our reputation, negative publicity, diminished customer trust and relationships and other adverse effects on our business. Even if the anticipated benefits and savings are substantially realized, there may be consequences, internal control issues or business impacts that were not expected. Our transition and migration to cloud-based technologies may increase our risk of liability and cause us to incur significant technical, legal, regulatory or other costs.

The loss of access to credit, employment, financial and other data from external sources could harm our ability to provide our products and services.

We rely extensively upon data from external sources to maintain our proprietary and non-proprietary databases, including data received from customers, licensors, furnishers, strategic partners and various government and public record sources. This data includes the widespread and voluntary contribution of credit data from most lenders in the U.S. and many other markets as well as the contribution of data under proprietary contractual agreements, such as employers’ contribution of employment and income data to The Work Number® and telecommunications, cable and utility companies’ contribution of payment and fraud data to the National Cable, Telecommunications and Utility Exchange (NCTUE). For a variety of reasons, including concerns of data furnishers arising out of legislatively or judicially imposed restrictions on use, security breaches or competitive reasons, our data sources could withdraw, delay receipt of or increase the cost of the data they provide to us. Where we currently have exclusive use of data, the providers of the data sources could elect to make the information available to competitors. We also compete with several of our third-party data suppliers. If a substantial number of data sources or certain key data sources were to withdraw or be unable to provide their data, if we were to lose access to data due to government regulation, if we lose our right to the use of data, or if the collection, disclosure or use of data becomes uneconomical, our ability to provide products and services to our customers could be adversely affected, which could result in decreased revenue, net income and earnings per share and reputational loss. There can be no assurance that we would be able to obtain data from alternative sources if our current sources become unavailable.

Negative changes in general economic conditions, including interest rates, the level of inflation, unemployment rates, income, home prices, investment values and consumer confidence, could adversely affect us.

Our customers, and therefore our business and revenues, are sensitive to negative changes in general economic conditions, including the demand and availability of affordable credit and capital, the level and volatility of interest rates, the level of inflation, employment levels, consumer confidence and housing demand, both inside and outside the United States. Business customers use our credit information and related analytical services and data to process applications for new credit cards, automobile loans, home and equity loans and other consumer loans, and to manage their existing credit relationships. Demand for our services tends to be correlated to general levels of economic activity and to consumer credit activity, which can be impacted by changes in interest rates and the level of inflation. Banks’ and other lenders’ willingness to extend credit are adversely affected by elevated consumer delinquency and loan losses in a weak economy. Consumer demand for credit (i.e., rates of spending and levels of indebtedness) also tends to grow more slowly or decline during periods of economic contraction or slow economic growth.

Our customer base suffers when financial markets experience volatility, illiquidity and disruption, and the potential for disruptions going forward presents considerable risks to our business and revenue. High or rising rates of unemployment and interest, declines in income, home prices or investment values, lower consumer confidence and reduced access to credit adversely affect demand for many of our products and services, and consequently our revenue and results of operations, as consumers may postpone or reduce their spending and use of credit, and lenders may reduce the amount of credit offered or available.

In 2024, we expect the U.S. mortgage market, as measured by credit inquiries, to decline by approximately 16% compared to 2023. Any weakening in the U.S. mortgage market resulting in a significant reduction in mortgage originations could have a corresponding negative impact on revenue and operating profit for our business, primarily within the Workforce Solutions and USIS operating segments. To the extent inflation results in higher interest rates and has other adverse effects upon the securities markets and upon the value of financial instruments, it may adversely affect our financial position and profitability.

16

Our markets are highly competitive and new product introductions and pricing strategies being offered by our competitors could decrease our sales and market share or require us to enhance our products and services or reduce our prices in a manner that reduces our revenue and operating margins.

We operate in a number of geographic, product and service markets that are highly competitive. Competitors may develop products and services that are superior to or that achieve greater market acceptance than our products and services. New competitors may choose to enter and compete in our markets, or existing competitors may choose to introduce new products and enter markets that we serve and that they do not currently serve. The size of our competitors varies across market segments, as do the resources we have allocated to the segments we target. Therefore, some of our competitors may have significantly greater financial, technical, marketing or other resources than we do in one or more of our market segments, or overall. As a result, our competitors may be in a position to respond more quickly than we can to new or emerging technologies and changes in customer requirements, or may devote greater resources than we can to the development, enhancement, promotion, sale and support of products and services, or some of our customers may develop products of their own that replace the products they currently purchase from us, which would result in lower revenue. In addition, many of our competitors have extensive consumer relationships, including relationships with our current and potential customers. Moreover, new competitors or alliances among our competitors may emerge and potentially reduce our market share, revenue or margins.

We also license our information to competing firms, and license information from certain of our competitors, in order to sell “tri-bureau” and other products, most notably into the U.S. mortgage market. Changes in prices between competitors for this information and/or changes in the design or sale of tri-bureau versus single or dual bureau product offerings may affect our revenue or profitability.

Some of our competitors may choose to sell products that compete with ours at lower prices by accepting lower margins and profitability, or may be able to sell products competitive to ours at lower prices, individually or as a part of integrated suites, given proprietary ownership of data, technological superiority or economies of scale. Price reductions by our competitors could negatively impact our revenue and operating margins and results of operations and could also harm our ability to obtain new customers on favorable terms. Historically, certain of our key products have experienced declines in per unit pricing due to competitive factors and customer demand. Since a significant portion of our operating expenses is relatively fixed in nature due to sales, information technology and development and other costs, if we were unable to respond quickly enough to changes in competition or customer demand, we could experience further reductions in our operating margins.

If our relationships with key customers are materially diminished or terminated, our business could suffer.

We have long-standing relationships with a number of our customers, many of whom could unilaterally terminate their relationship with us or materially reduce the amount of business they conduct with us at any time. Many of our material customer agreements can be terminated by the customer for convenience on limited advance written notice, which provides our customers with the opportunity to renegotiate their contracts with us or to award more business to our competitors. There is no guarantee that we will be able to retain or renew existing agreements, maintain relationships with any of our customers or business partners on acceptable terms or at all, or collect amounts owed to us from insolvent customers or business partners. The loss of one or more of our major customers or business partners could adversely affect our business, financial condition and results of operations.

If we do not introduce successful new products, services and analytical capabilities in a timely manner, or if the market does not adopt our new services, or if new technologies are introduced by competitors that are more effective or at lower costs than ours, our competitiveness and operating results will suffer.

We generally sell our products in industries that are characterized by rapid technological changes, including the introduction of new innovative technologies, frequent new product and service introductions and changing industry standards. In addition, certain of the markets in which we operate are seasonal and cyclical. Without the timely introduction of new technologies, products, services and enhancements, our products and services will become technologically or commercially obsolete over time, in which case our revenue and operating results would suffer. The success of our new products and services will depend on several factors, including our ability to properly identify customer needs; innovate and develop new technologies, services and applications; successfully commercialize new technologies in a timely manner; produce and deliver our products in sufficient volumes on time; differentiate our offerings from competitor offerings; price our products competitively; anticipate our competitors’ development of new products, services or technological innovations; and control

17

product quality in our product development process. Our resources have to be committed to any new products and services before knowing whether the market will adopt the new offerings.

We may face risks associated with our use of certain artificial intelligence and machine learning models.

We use artificial intelligence and machine learning models in the development of some of our products. The models that we use are developed or trained using various data sets. If the models are incorrectly designed, the data we use to train them is incomplete, inadequate, or biased in some way, or if we do not have sufficient rights to use the data on which our models rely, the performance of our products and business, as well as our reputation, could suffer or we could incur liability through the violation of laws, third-party privacy, or other rights, or contracts to which we are a party. In addition, these risks include the possibility of new or enhanced governmental or regulatory scrutiny, litigation, or other legal liability, ethical concerns, negative consumer perceptions as to artificial intelligence, or other complications that could adversely affect our business, reputation, or financial results. In particular, our use of artificial intelligence in credit decisioning could lead to enhanced scrutiny. Further, our competitors or other third parties may incorporate artificial intelligence into their products more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations.

The demand for some of our products and services may be negatively impacted to the extent the availability of free or less expensive consumer information increases.

Public or commercial sources of free or relatively inexpensive consumer credit, credit score and other information have become increasingly available, and this trend is expected to continue. Free sources of consumer employment and income information, such as paystubs, have always existed and could impact demand for our products and services in the event that customers determine such data is sufficient to meet their needs. In addition, governmental agencies in particular have increased the amount of information to which they provide free public access and these or other sources of free or relatively inexpensive consumer information from competitors or other commercial sources may reduce demand for our services. Recently, there also has been an increase in companies offering free or low-cost direct-to-consumer credit services (such as credit scores, reports and monitoring) as part of alternative business models that use such services as a means to introduce consumers to other products and services. To the extent that our customers choose not to obtain services from us and instead rely on information obtained at no cost or relatively inexpensively from these other sources, our business, financial condition and results of operations may be adversely affected.

We rely, in part, on acquisitions, joint ventures and other alliances to grow our business and expand our geographic reach. The acquisition, integration or divestiture of businesses by us may not produce the expected financial or operating results or IT and data security profile we expect. In addition, if we are unable to make acquisitions or successfully develop and maintain joint ventures and other alliances, our growth may be adversely impacted.

Historically, we have relied, in part, on acquisitions, joint ventures and other alliances to grow our business. Any transaction we do complete may not be on favorable terms, may involve greater-than-expected liabilities and expenses, potential impairments of tangible and intangible assets or significant write-offs, and the expected benefits, synergies, revenue and growth from these initiatives may not materialize as planned. We may have difficulty assimilating new businesses and their products, services, technologies, IT systems and personnel into our operations. IT and data security profiles of acquired companies may not meet our technological standards and may take longer to integrate and remediate than planned. This may result in significantly greater transaction, remediation and integration costs for future acquisitions than we have experienced historically, or it could mean that we will not pursue certain acquisitions where the costs of integration and remediation are too significant. We may also have difficulty integrating and operating businesses in geographies and markets or market segments where we do not currently have a significant presence, and acquisitions of businesses having a significant presence outside of the U.S. will increase our exposure to risks of conducting operations in international markets. These difficulties could disrupt our ongoing business, distract our management and workforce, increase our expenses and adversely affect our operating results and financial condition.

Despite our past experience, opportunities to grow our business through acquisitions, joint ventures and other alliances may not be available to us in the future. In addition, our focus on data security and our technology transformation strategy, including our migration to cloud-based technologies, may limit our ability to identify and complete acquisitions as our stringent technological criteria and standards for acquisition candidates may continue to increase.

If our government contracts are terminated, if we are suspended from government work, or if our ability to compete for new contracts is adversely affected, our business could suffer.

18

We derive a portion of our revenue from direct and indirect sales to U.S. federal, state and local governments and their respective agencies. We also derive a portion of our revenue from sales to foreign governments and related agencies. Such contracts are subject to various procurement laws and regulations, and contract provisions relating to their formation, administration and performance. Failure to comply with these laws, regulations or provisions in our government contracts could result in the imposition of various civil and criminal penalties, termination of contracts, forfeiture of profits, suspension of payments or suspension of future government contracting. A number of our U.S. federal and state government contracts receive enhanced scrutiny and media attention due to the sensitive nature of the data we handle and due to the importance of the government programs we support. If we experience another material cybersecurity incident, if public or legislative scrutiny and pressure leads to reduced use of data by government agencies, or if we experience uptime issues or performance problems, our ability to maintain existing or acquire new government contracts may be substantially impacted.

If our government contracts are terminated, if we are suspended from government work, if the services we provide are no longer needed due to government program change or termination, or if our ability to compete for new contracts is adversely affected, including by our failure to achieve certain government certifications, our business could suffer.

Our business has been and may continue to be negatively impacted by health epidemics, pandemics and similar outbreaks.

We face various risks related to health epidemics, pandemics and similar outbreaks. For example, the COVID-19 pandemic and the mitigation efforts by governments to attempt to control its spread adversely impacted the global economy and led to reduced consumer spending and lending activities. Our customers, and therefore our business and revenues, are sensitive to negative changes in general economic conditions. We experienced significant revenue declines in several of our markets as a result of COVID-19 and we may experience similar revenue declines as a result of future health epidemics, pandemics and similar outbreaks.

Our reputation and/or business could be negatively impacted by ESG matters and/or our reporting of such matters.

Over the past several years, regulators, certain investors, and other stakeholders have focused on various environmental, social and governance ("ESG") matters, both in the United States and internationally. We communicate certain ESG-related initiatives, goals and commitments regarding climate, diversity, responsible sourcing and social investments, and other matters, on our website, in our filings with the SEC and elsewhere. These initiatives, goals and commitments could be difficult to achieve and costly to implement. For example, we have announced our commitments to reduce our greenhouse gas emissions, the achievement of which relies, in large part, on the accuracy of our estimates and assumptions around the availability and cost of renewable energy sources and technologies, the availability of suppliers that can meet our sustainability and other standards, and other factors. We could fail to achieve, or be perceived to fail to achieve, our greenhouse gas reduction commitments or other ESG-related initiatives, goals and commitments. In addition, we could be criticized for the timing, scope or nature of these initiatives, goals and commitments, or for any revisions to them. To the extent that our required and voluntary disclosures about ESG matters increase, we could be criticized for the accuracy, adequacy or completeness of such disclosures. Our actual or perceived failure to achieve our ESG-related initiatives, goals and commitments could negatively impact our reputation or otherwise materially harm our business.

Operational Risks

Our technology transformation strategy places a significant strain on our management, operational, financial and other resources.

As part of our technology transformation strategy, we are transitioning and migrating our data systems from traditional, on premises data centers to cloud-based platforms. This initiative places significant strain on our management, personnel, operations, systems, technical performance, financial resources, internal financial controls and reporting function. Our technology transformation strategy requires management time and resources to educate employees and implement new ways of conducting business. The dedication of resources to our technology transformation strategy and cloud-based technologies limits the resources we have available to devote to other initiatives or growth opportunities, or to invest in the maintenance of our existing internal systems. We cannot guarantee that our strategy is the right one or that investments in alternative technologies or other initiatives would not be a better use of our resources.

Additionally, as a result of our cloud migration efforts in connection with our technology transformation strategy, we may experience a loss of continuity, loss of accumulated knowledge or loss of efficiency during transitional periods. Reorganization and transition can require a significant amount of management and other employees’ time and focus, which may

19

divert attention from operating activities and growing our business. If we fail to achieve some or all of the expected benefits of these activities, it could have a material adverse effect on our competitive position, business, financial condition, results of operations and cash flows.

Our transition to cloud-based technologies could expose us to operational disruptions.

We rely on the efficient and uninterrupted operation of complex information technology systems and networks, some of which are managed internally within the Company and some of which are outsourced to third parties. As part of our technology transformation strategy, we are upgrading a significant portion of the information technology systems used to operate our business and replacing them with cloud-based solutions. This transition will continue to require substantial changes to our software and network infrastructure, which could lead to system interruptions, affect our data systems and further expose us to operational disruptions, and cause us to lose customers, all of which could have a material adverse effect on our results of operations.

Upon implementation of the new cloud-based solutions, much of our information technology systems will consist of outsourced, cloud-based infrastructure, platform and software-as-a-service solutions not under our direct management or control. Any disruption to either the outsourced systems or the communication links between us and the outsourced supplier could negatively affect our ability to operate our data systems and could impair our ability to provide services to our customers. We may incur additional costs to remedy the damages caused by these disruptions.

Our customers' decisioning may be adversely affected if we provide inaccurate or unreliable data, which could adversely affect our financial condition, cause loss of customer trust and contribute to non-compliance with certain laws and regulations.

Data accuracy is an essential component of data quality and is the foundation of our business model. Accurate data increases predictive ability and improves confidence in decisions for our customers. Inaccurate or unreliable data could adversely affect customer decisioning and poses reputational, compliance and financial risk to our company. Although we have developed internal processes and controls to maintain and continually improve data accuracy, these processes and controls cannot ensure absolute accuracy and the complexity of our technology transformation may introduce additional risk until it is completed. We have experienced data accuracy issues, including errors in connection with our technology transformation. To date, none of these issues have had a material impact on our operations or financial results. However, any future data accuracy issues arising during the technology transformation or otherwise could have a material adverse effect on our business or results of operations, including through the incurrence of additional costs or the loss of customers and harm to our reputation.

If our systems do not meet customer requirements for response time or high availability, or we experience system constraints or failures, or our customers do not migrate to the cloud or modify and/or upgrade their systems to accept new releases of our products and services, our services to our customers could be delayed or interrupted, which could result in lost revenues or customers, lower margins, service level penalties or other harm to our business and reputation.

Our customers expect high system availability and response time performance, as well as a very high degree of system resilience. We depend on reliable, stable, efficient and uninterrupted operation of our technology network, systems and data centers to provide service to our customers. Many of the services and systems upon which we rely have been outsourced to third parties. In addition, many of our revenue streams are dependent on links to third party telecommunications providers. These systems and operations, and the personnel that support, service and operate these systems, could be exposed to interruption, damage or destruction from power loss, telecommunication failures, computer viruses, denial-of-service or other cyber attacks, employee or insider malfeasance, human error, fire, natural disasters, war, terrorist acts or civil unrest. We may not have sufficient disaster recovery or redundant operations in place to cover a loss or failure of systems or telecommunications links in a timely manner, which may be exacerbated by any delays in obtaining equipment due to supply chain or other impacts.

In addition, as part of our technology transformation, we are seeking to migrate our customers from traditional data platforms to cloud-based products and services. Some of our customers may not migrate to cloud-based technologies on a timely basis or at all, or may choose not to utilize our products and services during and after our transition to cloud-based technologies. If our customers’ timelines prevent them from migrating to cloud-based technologies quickly enough, they will remain on our legacy infrastructure, which could expose them to system availability, response time and performance issues.

20

Any significant system interruption or series of minor interruptions could result in the loss of customers and/or lost revenues, lower margins, service level penalties or other significant harm to our business or reputation.

Dependence on outsourcing certain portions of our operations may adversely affect our ability to bring products to market and damage our reputation. Dependence on outsourced information technology and other administrative functions may impair our ability to operate effectively.

As part of our technology transformation, we have outsourced various components of our application development, information technology, operational support and administrative functions and will continue to evaluate additional outsourcing. If our outsourcing vendors fail to perform their obligations in a timely manner or at satisfactory quality levels including with respect to data and system security, or increase prices for their services to unreasonable levels, our ability to bring products to market and support our customers and our reputation could suffer. Any failure to perform on the part of these third-party providers could impair our ability to operate effectively and could result in lower future revenue, unrealized efficiencies and adversely impact our results of operations and our financial condition. Some of our outsourcing takes place in developing countries and, as a result, may be subject to geopolitical uncertainty.

Our business will suffer if we are not able to retain and hire key personnel.

Our future success, including our ability to implement our technology transformation strategy, depends partly on the continued service of our key development, sales, marketing, executive and administrative personnel. Increased retention risk exists in certain key areas of our operations, such as IT and data security, which require specialized skills, such as migrating legacy computer systems to the cloud, data security expertise and analytical modeling. If we fail to retain and hire a sufficient number of these personnel, we will not be able to maintain or expand our business. As part of our technology transformation strategy, we have hired or contracted with a significant number of new employees and contract workers. Hiring, on-boarding training, motivating, retaining and managing employees with the skills required is time-consuming and expensive. There is intense competition for certain highly technical specialties in geographic areas where we continue to recruit, and it may become more difficult to retain our key employees. If we are not able to hire sufficient employees to support our business, including our technology transformation, or to train, motivate, retain and manage the employees we do hire, it could have a material adverse effect on our business operations or financial results.

Global Operational Risks

Economic, political and other risks associated with international sales and operations could adversely affect our results of operations.

Sales outside the U.S. comprised 23% of our total revenue in 2023. As a result, our business is subject to various risks associated with doing business internationally and these risks may differ in each jurisdiction where we operate depending on the particular product or service we offer in the jurisdiction. In addition, many of our employees, suppliers, job functions and facilities are located outside the U.S. Accordingly, our future results could be harmed by a variety of factors including:

•changes in specific country or region political, economic or other conditions;

•trade protection measures;

•data privacy and consumer protection laws and regulations;

•antitrust and competition laws;

•difficulty in staffing and managing widespread operations;

•differing labor, intellectual property protection and technology standards and regulations;

•business licensing requirements or other requirements relating to making foreign direct investments, which could increase our cost of doing business in certain jurisdictions, prevent us from entering certain markets, increase our operating costs or lead to penalties or restrictions;

•difficulties associated with repatriating cash generated or held abroad in a tax-efficient manner;

•implementation of exchange controls;

•geopolitical instability, including terrorism and war and international conflict, including the Russia-Ukraine war and the Israel-Palestine conflict;

•foreign currency changes;

•increased travel, infrastructure, legal and compliance costs of multiple international locations;

21

•foreign laws and regulatory requirements;

•terrorist activity, natural disasters, pandemics and other catastrophic events;

•restrictions on the import and export of technologies;

•difficulties in enforcing contracts and collecting accounts receivable;

•longer payment cycles;

•failure to meet quality standards for outsourced work;

•unfavorable tax rules;

•the presence and acceptance of varying level of business corruption in international markets; and

•varying business practices in foreign countries.

We earn revenue, pay expenses, own assets and incur liabilities in countries using currencies other than the U.S. dollar, including among others the British pound, the Australian dollar, the Canadian dollar, the Argentine peso, the Chilean peso, the Euro, the New Zealand dollar, the Costa Rican colon, the Singapore dollar, the Brazilian real and the Indian rupee. Because our consolidated financial statements are presented in U.S. dollars, we must translate revenue, income and expenses, as well as assets and liabilities, into U.S. dollars at exchange rates in effect during or at the end of each reporting period. Therefore, increases or decreases in the value of the U.S. dollar against major currencies will affect our operating revenues, operating income and the value of balance sheet items denominated in foreign currencies. We generally do not mitigate the risks associated with fluctuating exchange rates, although we may from time to time through forward contracts or other derivative instruments hedge a portion of our translational foreign currency exposure or exchange rate risks associated with material transactions which are denominated in a foreign currency. The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place. Accordingly, fluctuations in foreign currency exchange rates, particularly the strengthening of the U.S. dollar against major currencies, may materially affect our consolidated financial results.

Compliance with applicable U.S. and foreign laws and regulations, such as anti-corruption laws, tax laws, foreign exchange controls and restrictions on repatriation of earnings or other similar restraints, data privacy requirements, operational resilience requirements, sustainability reporting, labor laws and anti-competition regulations increases the cost of doing business in foreign jurisdictions. Although we have implemented policies and procedures to comply with these laws and regulations, a violation by our employees, contractors or agents could nevertheless occur.

Legal and Regulatory Risks

As part of a global settlement, we entered into agreements with various parties to settle the U.S. Consumer MDL Litigation and certain federal and state government investigations arising out a material cybersecurity incident in 2017. If we are unable to comply with our obligations under these agreements, it could have a material adverse effect on our financial condition.

In July 2019, the Company entered into multiple agreements that resolve the U.S. consolidated consumer class action cases, captioned In re: Equifax, Inc. Customer Data Security Breach Litigation, MDL No. 2800 (Consumer Cases) (the “U.S. Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the Attorneys General of 48 states, the District of Columbia and Puerto Rico (the “MSAG Group”) and the NYDFS (collectively, the “Consumer Settlement”) relating to a material cybersecurity incident in 2017. The Consumer Settlement became effective on January 11, 2022.

As part of the Consumer Settlement, we agreed to implement certain business practice commitments related to consumer assistance and our information security program, including third party assessments of our program. These business practice commitments are extensive and require a significant amount of attention from management. To the extent we are unable to comply or we are viewed as not being in compliance with these business practice commitments or other requirements of a relevant order, we could face an enforcement action or contempt proceeding that could potentially result in fines, penalties and new business practice commitments, which, depending on the amount and type, could have a material adverse effect on our financial condition.

We and our customers are subject to various current laws and governmental regulations, and could be affected by new and evolving consumer privacy and cybersecurity or other data-related laws or regulations, compliance with which may cause us to incur significant expenses and change our business practices, and if we fail to maintain satisfactory compliance with certain laws and regulations, we could be subject to civil or criminal penalties.

22

We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy, cybersecurity, data and financial protection. See “Item 1. Business—Governmental Regulation” in this Form 10-K for a summary of the U.S. and foreign consumer and data protection laws and regulations to which we are subject. These regulations are complex, change frequently, have tended to become more stringent over time, and are subject to administrative interpretation and judicial construction in ways that could harm our business. In addition, new laws and regulations at the state and federal level are enacted frequently, such as amendments to the FCRA, cybersecurity and other requirements promulgated by the FTC, New York Department of Financial Services and SEC, and data privacy laws in several U.S. states.

We expect there to be a continued focus on laws and regulations related to our business, because of policy concerns in the U.S. with regard to the operation of consumer reporting agencies, the collection, use, accuracy, correction and sharing of personal information, and the use of algorithms, artificial intelligence and machine learning in business processes. For example, in September 2023, the CFPB issued an outline of proposed changes to the FCRA which would expand the application of the FCRA to certain business practices not currently subject to the FCRA and would require the removal of medical collection debt from consumer credit reports. Further, in October 2023, California passed the DELETE Act, a first-in-the-nation data broker deletion tool which creates a centralized mechanism to allow consumers to request brokers to delete their personal information, rather than submitting individual requests to brokers registered in the state.

There are a number of legislative proposals pending before the U.S. Congress, various state legislative bodies and foreign governments concerning privacy or cybersecurity that could affect us. The Canadian and Australian governments have initiated reviews of their consumer privacy laws, and several U.S. states have introduced varying comprehensive privacy laws modeled to some degree on the CCPA and/or the GDPR. In the U.S. and other countries, there have also been new legislative proposals to regulate business use and development of artificial intelligence and machine learning technologies which, if enacted, could impose new legal requirements addressing among other issues, privacy, discrimination and human rights. The specifics of such legislation and the number of jurisdictions that will introduce legislation in this area remain unclear at this time. In addition, a growing number of legislative and regulatory bodies have adopted consumer notification and other requirements in the event that consumer information is accessed or acquired by unauthorized persons and additional regulations regarding the use, access, accuracy and security of such data are possible. In the U.S., state laws provide for disparate notification regimes, all of which we are subject to. Further, any perception that our practices or products are an invasion of privacy, whether or not consistent with current or future regulations and industry practices, may subject us to public criticism, private class actions, reputational harm, or claims by regulators, which could disrupt our business and expose us to increased liability.

We devote substantial compliance, legal and operational business resources to strive for compliance with applicable regulations and requirements. In the future, we may be subject to significant additional expenses related to compliance with applicable laws and regulations, including new laws and evolving interpretations that have varying requirements and/or are difficult to predict, and to the investigation, defense or remedy of actual or alleged violations. Additionally, we cooperate with CFPB supervisory examinations and respond to other state, federal and foreign government examinations of, or inquiries into, our business practices. In particular, legislative activity in the privacy area may result in new laws that are applicable to us and that may hinder our business, for example, by restricting use or sharing of consumer data, including for marketing or advertising or limiting the use of, limiting our ability to provide certain consumer data to our customers, or otherwise regulating artificial intelligence and machine learning, including the use of algorithms and automated processing in ways that could materially affect our business, or which may lead to significant increases in the cost of compliance. Any failure by us to comply with, or remedy any violations of, applicable laws and regulations, could result in new costs for our operations, the curtailment of certain of our operations, the imposition of fines and penalties, liability to private plaintiffs as a result of individual or class action litigation, restrictions on the operation of our business and reputational harm. It is difficult to predict the impact on our business if we were subject to allegations of having violated existing laws. For example, in Europe, the GDPR, which includes extensive regulations for certain security incidents, could result in fines of up to four percent of annual worldwide “turnover” (a measure similar to revenues in the U.S.). In addition, because many of our products are regulated or sold to customers in various industries, we must comply with additional regulations in marketing our products. Moreover, our compliance with privacy laws and regulations and our reputation depend in part on suppliers’ or customers’ adherence to privacy laws and regulations and their use of our services in ways consistent with consumer expectations and regulatory requirements. Additionally, we may not succeed in adapting our products to changes in the regulatory environment in an efficient, cost effective manner. We cannot predict the ultimate impact on our business of new or proposed rules, supervisory examinations or government investigations or enforcement actions.

The CFPB has supervisory authority over our U.S. business and supporting operations and may initiate enforcement actions with regard to our compliance with federal consumer financial laws.

23

The CFPB, which was established under the Dodd-Frank Act and commenced operations in July 2011, has broad authority over our business. This includes authority to issue regulations under federal consumer financial protection laws, such as under the FCRA and other laws applicable to us and our financial customers. The CFPB is authorized to prevent “unfair, deceptive or abusive acts or practices” through its regulatory, supervisory and enforcement authority.

The CFPB conducts examinations and investigations, issues requests for information and subpoenas and brings civil actions in federal court for violations of the federal consumer financial laws, including the FCRA. In these proceedings, the CFPB can seek relief that includes: rescission or reformation of contracts, restitution, disgorgement of profits, payment of damages, limits on activities and civil money penalties of up to $1.0 million per day for known violations. The CFPB conducts periodic examinations of our business and the consumer reporting industry, which could result in new regulations or enforcement actions or proceedings. Actions by the CFPB could result in requirements to alter or cease offering affected products and services, making them less attractive and restricting our ability to offer them.

Although we have committed resources to enhancing our compliance programs, actions by the CFPB or other regulators against us could result in financial or reputational harm. Our compliance costs and legal and regulatory exposure could increase materially if the CFPB or other regulators enact new regulations, change regulations that were previously adopted, modify through supervision or enforcement past regulatory guidance, or interpret existing regulations in a manner different or stricter than have been previously interpreted.

Regulatory oversight of our contractual relationships with certain of our customers may adversely affect our business.

The federal banking agencies, including the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System and the CFPB, as well as many state banking agencies have issued guidance to insured depository institutions and other providers of financial services on assessing and managing risks associated with third-party relationships, which include all business arrangements between a financial services provider and another entity, by contract or otherwise, and generally requires banks and financial services providers to exercise comprehensive oversight throughout each phase of a bank or financial service provider’s business arrangement with third-party service providers, and instructs banks and financial service providers to adopt risk management processes commensurate with the level of risk and complexity of their third-party relationships. This guidance requires more rigorous oversight of third-party relationships that involve certain “critical activities.” In light of this guidance, our existing or potential bank and financial services customers subject to this guidance may continue to revise their third-party risk management policies and processes and the terms on which they do business with us, which may adversely affect our relationships with such customers and/or increase our expenses in servicing such customers.

We are regularly involved in claims, suits, government investigations, enforcement actions and other proceedings that may result in adverse outcomes.

We are regularly involved in claims, suits, government investigations, enforcement actions and regulatory proceedings arising from the ordinary course of our business, including actions with respect to consumer protection and data protection, including purported class action lawsuits. Such claims, suits, government investigations and proceedings are inherently uncertain and their results cannot be predicted with certainty. Regardless of their outcome, such legal proceedings can have an adverse impact on us because of legal costs, diversion of management and other personnel, and other factors. In addition, it is possible that a resolution of one or more such proceedings could result in reputational harm, liability, penalties or sanctions, as well as judgments, consent decrees or orders preventing us from offering certain features, functionalities, products or services, or requiring a change in our business practices, products or technologies, which could in the future materially and adversely affect our business, operating results, and financial condition. The FCRA contains an attorney fee shifting provision that provides an incentive for consumers to bring individual and class action lawsuits against a consumer reporting agency for violation of the FCRA, and the number of consumer lawsuits (both individual and class action) against us alleging a violation of the FCRA and our resulting costs associated with resolving these lawsuits have increased substantially over the past several years.

Third parties may claim that we are infringing on their intellectual property and we could suffer significant litigation or licensing expenses or be prevented from selling products or services.

There has been substantial litigation in the U.S. regarding intellectual property rights in the information technology industry. From time to time, third parties may make claims that one or more of our products or services infringe their intellectual property rights. We analyze and take action in response to each such claim on a case by case basis. A dispute or

24

litigation regarding patents or other intellectual property can be costly and time-consuming due to the complexity of our technology and the inherent uncertainty of intellectual property litigation, could divert our management and key personnel from our business operations, and we may not prevail. A claim of intellectual property infringement could force us to enter into a costly or restrictive license agreement, which might not be available under acceptable terms or at all, or could subject us to significant damages or to an injunction against development and sale of certain of our products or services. Our intellectual property portfolio may not be useful in asserting a counterclaim, or providing commercial leverage for negotiating a license, in response to a claim of intellectual property infringement. In certain of our businesses we rely on third-party intellectual property licenses and we cannot ensure that these licenses will be available to us in the future on favorable terms or at all. Although our policy is to obtain licenses or other rights where necessary, we cannot provide assurance that we have obtained all required licenses or rights.

Third parties may misappropriate or infringe on our intellectual property and we may suffer competitive injury or expend significant resources enforcing our rights.

Our success increasingly depends on our proprietary technology and its ability to differentiate us from our competitors. We rely on various intellectual property rights, including patents, copyrights, database rights, trademarks and trade secrets, as well as contract restrictions, confidentiality provisions and licensing arrangements, to establish and protect our proprietary rights. The extent to which such rights can be protected varies in different jurisdictions. If we do not protect and enforce our intellectual property rights successfully, our competitive position may suffer which could harm our operating results. Our pending patent and trademark applications may not be allowed or competitors may challenge the validity or scope of our intellectual property rights. In addition, our patents, copyrights, trademarks and other intellectual property rights may not provide us a significant competitive advantage.

We may need to devote significant resources to monitoring our intellectual property rights and we may or may not be able to detect misappropriation or infringement by third parties. Our competitive position may be harmed if we cannot detect misappropriation or infringement and enforce our intellectual property rights quickly or at all. In some circumstances, enforcement may not be available to us because a third party has a dominant intellectual property position or for other business reasons. In addition, competitors might avoid infringement by designing around our intellectual property rights or by developing non-infringing competing technologies. Intellectual property rights and our ability to enforce them may be unavailable or limited in some countries, which could make it easier for competitors to capture market share and could result in lost revenue.

Financial Market Risks

A downgrade in our credit ratings could increase our cost of borrowing under our credit facilities and have an adverse effect on our ability to access the capital markets.

Credit ratings reflect an independent agency’s judgment on the likelihood that a borrower will repay a debt obligation at maturity. The ratings reflect many considerations, such as the nature of the borrower’s industry and its competitive position, the size of the company, its liquidity and access to capital and the sensitivity of a company’s cash flows to changes in the economy. A security rating is not a recommendation to buy, sell or hold securities and may be changed or withdrawn at any time by the assigning rating agency.

A downgrade in our credit ratings would increase the cost of borrowings under our commercial paper program, $1.5 billion revolving credit facility and $700.0 million delayed draw term loan, and could limit or, in the case of a significant downgrade, preclude our ability to issue commercial paper. If our credit ratings were to decline to lower levels, we could experience increases in the interest cost for any new debt. In addition, the market’s demand for, and thus our ability to readily issue, new debt could become further affected by the economic and credit market environment.

Our retirement and post-retirement pension plans are subject to financial market risks that could adversely affect our future results of operations and cash flows.

We have significant retirement and post-retirement pension plan assets and obligations. The performance of the financial markets and interest rates impact our plan expenses, expected returns, and funding obligations. Significant decreases in interest rates, decreases in the fair value of plan assets and investment losses on plan assets will increase our funding obligations, and adversely impact our results of operations and cash flows.

25

ITEM 1B. UNRESOLVED STAFF COMMENTS

None. 

ITEM 1C. CYBERSECURITY

Risk Management and Strategy

We are a global data, analytics and technology company. In the ordinary course of business, we collect, process, transmit and store sensitive data, including intellectual property, proprietary business information and personal information of consumers, employees and strategic partners. The secure operation of our information technology networks and systems, and of the processing and maintenance of this information, is critical to our business operations and strategy.

Equifax has invested significantly to develop and maintain an information security program with processes, technology and controls to protect the information, systems and resources of the Company. We have a Security team operating under the leadership of our Chief Information Security Officer (“CISO”), including approximately 400 cybersecurity professionals. The key elements of our information security program, including our cybersecurity risk management strategy, are described below.

Security Controls Framework

Equifax has implemented a unified security and privacy controls framework as our primary mechanism to establish strategic priorities related to cybersecurity, assess cybersecurity risk across the enterprise, comply with regulatory requirements and enhance security program maturity. Our unified security and privacy controls framework is based upon the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) and Privacy Framework (NIST PF).

Cybersecurity Incident Detection and Response Process

Our information security program is based on five key functions as set forth in the NIST CSF: (i) identify; (ii) protect; (iii) detect; (iv) respond; and (v) recover. As part of that program, we maintain an incident detection and response process that is designed to ensure we appropriately identify, investigate, respond to, and recover from, cybersecurity incidents in order to protect our information, systems and resources. As part of our process, we maintain operational plans for incident response and recovery activities. We regularly review our incident response process and conduct multiple incident response exercises each year, including sessions with management, to test and assess our preparedness to respond to a cybersecurity incident.

As part of our incident detection and response process, we have established internal teams to investigate and escalate notification of cybersecurity incidents. Pursuant to this process, cybersecurity incidents are reported to appropriate personnel within Equifax (including the CISO and the CEO) and to the Board of Directors based on incident severity. We track incidents through resolution, conduct post-incident analysis and update our processes and procedures if areas for improvement are identified. On a monthly basis, a summary of prior period cybersecurity investigation escalations is reviewed by management, including our head of Internal Audit, our CISO, our Chief Financial Officer and our Chief Legal Officer.

To inform our incident detection and response process, our cyber intelligence operations team regularly performs exercises to simulate real threat scenarios that would be carried out by a perpetrator by utilizing the actual tools and methodologies that would be deployed in such an attack (so called “red team” activities).

Risk Management

•Cybersecurity Incorporated into Enterprise Risk Management Program. We have implemented an enterprise risk management (“ERM”) program that operates under the leadership of our Chief Privacy and Compliance Officer. Each business unit and corporate support unit has primary responsibility for assessing and mitigating risks within its respective areas of responsibility, and the ERM team is responsible for oversight and reporting to management and the Board.

Under our ERM program, we conduct an annual enterprise risk assessment, which produces an enterprise risk scorecard. Cybersecurity is one of nine primary risk categories identified within the scorecard. The cybersecurity risk rating is based on a detailed enterprise security risk assessment performed by the Security team. The enterprise risk scorecard is reviewed with management and the Board of Directors on an annual basis.

26

•Security Risk Assessment. The Security team performs an annual enterprise security risk assessment of the information security program that is provided to management, the Board of Directors and other relevant parties. The security risk assessment provides a detailed understanding of the information security program in order to inform decisions and support risk response. The security risk assessment process evaluates the program’s control domains through various analyses and testing methods to determine the overall level of risk present within the environment over the period evaluated. The risk assessment identifies risks and considers observations from multiple business process- and system-level assessments.

We leverage NIST guidance to inform our process for conducting the security risk assessment. The risk management program and processes can be described in four steps: (i) frame risk; (ii) assess risk; (iii) respond to risk; and (iv) monitor risk.

•Third Party Risk Management. We have a governance process in place to oversee our third-party vendors who have access to our network or who hold or store personal information on our behalf (“risk vendors”). Our risk vendor contracts contain provisions requiring our suppliers to maintain a program that meets our information security standards. We periodically assess risk vendor compliance with our information security program requirements. One such requirement is the obligation that our risk vendors must notify Equifax within a designated time period upon identifying certain cybersecurity events.

•M&A Due Diligence and Integration Process. Our Security team has implemented a due diligence and integration process for entities we acquire through mergers and acquisitions (“M&A”). This process is designed to protect our information systems, align acquired entities with our security controls, and comply with applicable legal and regulatory requirements, without interrupting critical business processes. Our M&A security integration status is reported regularly to management and the Technology Committee and annually to the Board of Directors.

•Employee Training and Awareness. In order to help bolster our cybersecurity defenses and mitigate the risk presented by insider or employee cyber and security threats, Equifax has incorporated employee training into our security program. On an annual basis, all employees are required to complete mandatory security training. In addition, each Equifax employee receives training customized to his or her role or function, and has visibility into his or her individual security performance. We continually measure and assess key employee behaviors, including secure browsing and sensitive data handling. In order to promote a Company-wide focus on data security and reinforce overall security program goals, Equifax includes an individual security performance measure as one of the metrics used to evaluate the performance of all bonus-eligible employees under our annual incentive compensation program.

•Cybersecurity Insurance. We maintain cybersecurity insurance under our errors and omissions/professional liability policy, which provides coverage for certain costs related to cybersecurity incidents.

Review and Assessment of Information Security Program

We conduct regular audits of our information security program, including third party assessments and review by our internal audit department.

•Third Party Assessments of Security Program Maturity. Equifax has a formal process in place to annually assess our security program maturity, which is a measure of our ability to adapt to cyber threats and manage risk over time. Under the oversight of the Technology Committee of the Board of Directors, Equifax engages a third party research and advisory firm to conduct an annual analysis of the maturity of our security program and identify potential initiatives to enhance maturity. On an annual basis, the Technology Committee reviews the results of this analysis with management, including a review of Company performance against relevant benchmarks.

•Controls Testing. Equifax has a formal process in place to periodically assess the effectiveness of controls in our security controls framework. These controls assessments are performed by the Security team. Results are regularly reported to management and the Technology Committee and annually to the Board of Directors.

•Internal Audit Review. Our internal audit department is responsible for providing the Audit and Technology Committees and management with an independent assessment and assurance regarding the design and effectiveness of the risk management framework related to cybersecurity. As part of the assessment of our cybersecurity program, the internal audit department has a “red team” that regularly performs testing to simulate real threat scenarios that would be carried out by a perpetrator. On a quarterly basis, our head of Internal Audit provides an update to management and the Audit and Technology Committees of the Board on audit activities pursuant to the IT and security portions of the

27

internal audit plan. Our head of Internal Audit reviews the IT and security audit reports issued, including a summary of IT and security audit findings by inherent risk and residual risk rating.

Cybersecurity Risks to our Business

As a global data, analytics and technology company, our products and services involve the storage and transmission of personal information of consumers. As a result, we are routinely the target of attempted cyber and other security threats presented by outside third parties, as well as security threats presented by employees and other insiders.

In 2017, we experienced a material cybersecurity incident following a criminal attack on our systems that involved the theft of personal information of U.S., Canadian and U.K. consumers. If we experience additional significant compromises of our security measures, including from incidents that we fail to detect for a period of time, sensitive data may be accessed, stolen, disclosed, altered or lost. Any such access, disclosure, alteration or other loss of information could subject us to significant litigation, regulatory fines or penalties, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or results of operations.

Cybersecurity incidents, and the adverse publicity that may follow, can have a negative impact on our reputation and our relationship with our customers. For example, our reputation with consumers and other stakeholders and our customer relationships were damaged following the cybersecurity incident in 2017, resulting in a negative impact on our revenue for a period of time. If we experience another material cybersecurity incident or are otherwise unable to demonstrate the security of our systems and the data we maintain and retain the trust of our customers, consumers and data suppliers, we could experience a substantial negative impact on our business.

For additional information related to the cybersecurity-related risks relevant to our business, see “Risk Factors—Technology and Data Security Risks—Security breaches and other disruptions to our information technology infrastructure could compromise Company, consumer and customer information, interfere with our operations, cause us to incur significant costs for remediation and enhancement of our IT systems and expose us to legal liability, all of which could have a substantial negative impact on our business and reputation” in Part I, Item 1A. of this annual report on Form 10-K.

Governance

Board Oversight of Cybersecurity

The Equifax Board of Directors monitors our “tone at the top” and risk culture and oversees principal risks facing the Company. On an annual basis, the Board reviews an enterprise risk assessment prepared by management that describes the principal risks and monitors the steps management is taking to map and mitigate these risks. The Board then sets the general level of risk appropriate for the Company through business strategy reviews. Risks are assessed throughout the business, focusing on nine primary risk categories, including cybersecurity.

In addition, the Audit and Technology Committees of the Board coordinate on risk management oversight with respect to cybersecurity, including through quarterly joint meetings that cover the following topics:

•Regular reports from the internal audit department regarding the security and technology portions of the internal audit plan

•Regular reports from our CISO and Chief Technology Officer regarding the cybersecurity control environment, including remediation updates, control posture analyses and other recurring items

•Regular reports from our Chief Privacy and Compliance Officer regarding our global privacy, risk management and compliance programs, including matters related to cybersecurity

The Technology Committee of the Board oversees our information security program, including:

•Reviewing with management our technology investments and infrastructure associated with risk management, including policies relating to information security, disaster recovery and business continuity

•Receiving quarterly reports directly from our CISO, including updates on our enterprise cybersecurity threat level

•Overseeing the engagement of outside advisors to review our cybersecurity program

•Reviewing the results of our annual information security program maturity assessment performed by a third party

•Reviewing the results of our annual security program risk assessment prepared by management

28

Management Oversight of Cybersecurity Risk

Our information security program is managed through implementation, monitoring and continuous improvement of the security program with active participation of management as described below.

•Senior Leadership Team. The Equifax senior leadership team, consisting of our CEO and his direct reports (“SLT”), sets the tone for strategic growth, effective operations and risk mitigation at the management level. The SLT supports the management of the information security program through proper resource allocation and decision-making involving high risk issues. The SLT has overall managerial responsibility for confirming that the information security program functions in a manner that meets the needs of Equifax.

•Chief Information Security Officer. Equifax has a CISO who is a member of the SLT and reports directly to our CEO. Our CISO has more than two decades of experience in cybersecurity-related roles, including serving as CISO at other large, multinational companies. Our CISO is responsible for oversight of the global Security team and the implementation and execution of the information security program. Our CISO helps ensure that the program is strategically aligned to Equifax’s business strategy and is responsible for reporting on the effectiveness of the program to the SLT and the Board of Directors.

•Global Security Team. The Equifax global Security team is responsible for supporting the CISO in the execution of the information security program to meet the program’s objectives. The Security team is directly responsible for the day to day program activities such as planning, implementation, monitoring and reporting on operational capabilities.

ITEM 2. PROPERTIES

Our executive offices are located at 1550 Peachtree Street, N.W., Atlanta, Georgia. Our other properties are geographically distributed to meet sales and operating requirements worldwide. We consider these properties to be both suitable and adequate to meet our current operating requirements. We ordinarily lease office space for conducting our business and are obligated under approximately 55 leases and other rental arrangements for our field locations. We owned 5 office buildings at December 31, 2023, including our executive offices, one campus which houses our Alpharetta, Georgia technology center, a building utilized by our Workforce Solutions operations located in St. Louis, Missouri, as well as two buildings utilized by our Latin America operations.

For additional information regarding our obligations under leases, see Note 6 and Note 12 of the Notes to Consolidated Financial Statements in Item 8 of this Form 10-K. We believe that suitable additional space will be available to accommodate our future needs.

29

ITEM 3. LEGAL PROCEEDINGS

Remaining Matters Related to 2017 Cybersecurity Incident

Canadian Class Actions. Five putative Canadian class actions, four of which are on behalf of a national class of approximately 19,000 Canadian consumers, are pending against us in Ontario, British Columbia and Alberta. Each of the proposed Canadian class actions asserts a number of common law and statutory claims seeking monetary damages and other related relief in connection with a material cybersecurity incident in 2017. In addition to seeking class certification on behalf of Canadian consumers whose personal information was allegedly impacted by the 2017 cybersecurity incident, in some cases, plaintiffs also seek class certification on behalf of a larger group of Canadian consumers who had contracts for subscription products with Equifax around the time of the incident or earlier and were not impacted by the incident. The Ontario class action has been certified in part but is otherwise at a preliminary stage. All other purported class actions are at preliminary stages or stayed.

FCA Investigation. The U.K.’s Financial Conduct Authority (“FCA”) opened an enforcement investigation against our U.K. subsidiary, Equifax Limited, in October 2017 in connection with the 2017 cybersecurity incident. We received a notice with the FCA's findings on October 13, 2023, and paid a penalty of $13.5 million to resolve the matter.

CFPB Matters

In December 2021, we received a Civil Investigative Demand (a “CID”) from the CFPB as part of its investigation into our consumer disputes process in order to determine whether we have followed the FCRA's requirements for the proper handling of consumer disputes. The CID requests the production of documents and answers to written questions. We are cooperating with the CFPB in its investigation and providing responses and information on an ongoing basis.

In January 2023, the CFPB informed us that its enforcement division will be investigating our previously-disclosed coding issue identified within a legacy server environment in the U.S. that impacted how some credit scores were calculated during a three-week period in 2022. We are cooperating with the CFPB in its investigation.

In July 2023, we received a CID from the CFPB as part of its investigation into data accuracy and dispute handling at our Workforce Solutions business unit in order to determine whether we have followed the FCRA's requirements. The CID requests the production of documents and answers to written questions. We are cooperating with the CFPB in its investigation and providing responses and information on an ongoing basis.

At this time, we are unable to predict the outcome of these CFPB investigations, including whether the investigations will result in any actions or proceedings against us.

Other

Equifax has been named as a defendant in various other legal actions, including administrative claims, regulatory matters, government investigations, class actions and other litigation arising in connection with our business. Some of the legal actions include claims for substantial compensatory or punitive damages or claims for indeterminate amounts of damages. We believe we have defenses to and, where appropriate, will contest many of these matters. Given the number of these matters, some are likely to result in adverse judgments, penalties, injunctions, fines or other relief. We may explore potential settlements before a case is taken through trial because of the uncertainty and risks inherent in the litigation process.

For information regarding our accounting for legal contingencies, see Note 6 of the Notes to Consolidated Financial Statements in Item 8 of this report.

ITEM 4. MINE SAFETY DISCLOSURES

Not applicable.

30

PART II

ITEM 5. MARKET FOR THE REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

Equifax’s common stock is traded on the New York Stock Exchange under the symbol “EFX.” As of January 31, 2024, Equifax had approximately 2,494 holders of record; however, Equifax believes the number of beneficial owners of common stock exceeds this number.

Shareholder Return Performance Graph

The graph below compares Equifax’s five-year cumulative total shareholder return with that of the Standard & Poor’s Composite Stock Index (S&P 500) and a peer group index, the S&P 500 Banks Index (Industry Group). The graph assumes that the value of the investment in our Common Stock and each index was $100 on the last trading day of 2018 and that all quarterly dividends were reinvested without commissions. Our past performance may not be indicative of future performance.

COMPARATIVE FIVE-YEAR CUMULATIVE TOTAL RETURN AMONG EQUIFAX INC., S&P 500 INDEX AND S&P 500 BANKS INDEX (INDUSTRY GROUP)

	Fiscal Year Ended December 31,
	Initial	2019	2020	2021	2022	2023
Equifax Inc.	100.00	150.46	207.07	314.39	208.70	265.53
S&P 500 Index	100.00	128.88	149.83	190.13	153.16	190.27
S&P 500 Banks Index (Industry Group)	100.00	126.77	111.79	146.34	121.83	123.96

31

The table below contains information with respect to purchases made by or on behalf of Equifax of its common stock during the fourth quarter ended December 31, 2023:

Issuer Purchases of Equity Securities

Period	Total Number of Shares Purchased (1)	Average Price Paid Per Share (2)		Total Number of Shares Purchased as Part of Publicly-Announced Plans or Programs	Maximum Number (or Approximate Dollar Value) of Shares that May Yet Be Purchased Under the Plans or Programs (3)
October 1 - October 31, 2023	914	$	—	—	$	520,168,924
November 1 - November 30, 2023	18,716	$	—	—	$	520,168,924
December 1 - December 31, 2023	8,763	$	—	—	$	520,168,924
Total	28,393	$	—	—	$	520,168,924

(1)    The total number of shares purchased includes, if applicable: (a) shares purchased pursuant to our publicly-announced share repurchase program (the "Repurchase Program"); and (b) shares surrendered, or deemed surrendered, in satisfaction of the exercise price and/or to satisfy tax withholding obligations in connection with the exercise of employee stock options and vesting of restricted stock, totaling 914 shares for the month of October 2023, 18,716 shares for the month of November 2023 and 8,763 shares for the month of December 2023.

(2)    Average price paid per share for shares purchased as part of the Repurchase Program (includes brokerage commissions).

(3)    We purchased no common shares during the twelve months ended December 31, 2023. At December 31, 2023, the amount authorized for future share repurchases under the Repurchase Program was $520.2 million.

Information relating to compensation plans under which the Company’s equity securities are authorized for issuance will be included in the section captioned “Equity Compensation Plan Information” in our 2024 Proxy Statement and is incorporated herein by reference.

ITEM 6. RESERVED

Not applicable.

32

ITEM 7.  MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

The following Management’s Discussion and Analysis (“MD&A”) is intended to help the reader understand the results of operations and financial condition of Equifax Inc. MD&A is provided as a supplement to and should be read in conjunction with our consolidated financial statements and the accompanying Notes to Financial Statements in Item 8 of this Form 10-K. This section discusses the results of our operations for the year ended December 31, 2023 compared to the year ended December 31, 2022 and the year ended December 31, 2022 compared to the year ended December 31, 2021. All percentages have been calculated using unrounded amounts for each of the periods presented.

As used herein, the terms Equifax, the Company, we, our and us refer to Equifax Inc., a Georgia corporation, and its consolidated subsidiaries as a combined entity, except where it is clear that the terms mean only Equifax Inc.

All references to earnings per share data in MD&A are to diluted earnings per share, or EPS, unless otherwise noted. Diluted EPS is calculated to reflect the potential dilution that would occur if stock options or other contracts to issue common stock were exercised and resulted in additional common shares outstanding.

BUSINESS OVERVIEW

Equifax Inc. is a global data, analytics and technology company. We provide information solutions for businesses, governments and consumers, and we provide human resources business process automation and outsourcing services for employers. We have a large and diversified group of clients, including financial institutions, corporations, government agencies and individuals. Our services are based on comprehensive databases of consumer and business information derived from numerous sources including credit, financial assets, telecommunications and utility payments, employment, income, educational history, criminal justice data, healthcare professional licensure and sanctions, demographic and marketing data. We use advanced statistical techniques, machine learning and proprietary software tools to analyze available data to create customized insights, decision-making and process automation solutions and processing services for our clients. We are a leading provider of information and solutions used in payroll-related and human resource management business process services in the U.S. as well as e-commerce fraud and charge back protection services in North America. For consumers, we provide products and services to help people understand, manage and protect their personal information and make more informed financial decisions. Additionally, we also provide information, technology and services to support debt collections and recovery management.

We currently operate in four global regions: North America (U.S. and Canada), Asia Pacific (Australia, New Zealand and India), Europe (the U.K., Spain and Portugal) and Latin America (Argentina, Brazil, Chile, Costa Rica, Dominican Republic, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay). We maintain support operations in Chile, Costa Rica, India and Ireland. We also have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and Brazil.

Recent Events and Company Outlook

As further described above, we operate in the U.S., which represented 77% of our revenue in 2023, and internationally in 20 countries. Our products and services span a wide variety of vertical markets including financial services, mortgage, talent solutions, federal, state and local governments, automotive, telecommunications, e-commerce and many others.

Demand for our services tends to be correlated to general levels of economic activity and to consumer credit and small business commercial credit decisioning and portfolio review, marketing, identity validation and fraud protection activity, employee hiring and onboarding activity, and activity in provisioning support services in the U.S. by government agencies. Demand is also enhanced by our initiatives to expand our products, capabilities and markets served.

For 2024, our planning assumes that U.S. economic activity, as measured by GDP, is expected to grow but at a slower rate of growth than experienced in 2023. Our plan assumes the U.S. mortgage market, as measured by credit inquiries, is expected to decline by about 16% in 2024 versus 2023. The U.S. mortgage market, particularly the mortgage refinance portion of the U.S. mortgage market, can be significantly impacted by U.S. interest rates which impact mortgage rates available to consumers. In the international markets in which we operate, in particular in Australia, the U.K. and Canada, our planning also assumes economic activity, as measured by GDP, to grow in 2024 but at slower rates than in 2023.

33

Segment and Geographic Information

Segments. The Workforce Solutions segment consists of the Verification Services and Employer Services business lines. Verification Services revenue is transaction-based and is derived primarily from employment and income verification, as well as criminal justice data. Employer Services revenue is derived from our provision of certain human resources business process outsourcing services that include both transaction and subscription based product offerings. These services include unemployment claims management, I-9 and onboarding services, Affordable Care Act compliance management, tax credits and incentives and other complementary employment-based transaction services. Workforce Solutions has established operations in Canada, Australia and the U.K.

The USIS segment consists of three service lines: Online Information Solutions, Mortgage Solutions, and Financial Marketing Services. Online Information Solutions and Mortgage Solutions revenue is principally transaction-based and is derived from our sales of products such as consumer and commercial credit reporting and scoring, identity management, fraud detection, modeling services and consumer credit monitoring services. USIS also markets certain decisioning software services which facilitate and automate a variety of consumer and commercial credit-oriented decisions. Online Information Solutions also includes our U.S. consumer credit monitoring solutions business. Financial Marketing Services revenue is principally project and subscription based and is derived from our sales of batch credit and consumer wealth information such as those that assist clients in acquiring new customers, cross-selling to existing customers and managing portfolio risk.

The International segment consists of Asia Pacific, Europe, Canada and Latin America. Canada’s services are similar to our USIS offerings. Asia Pacific, Europe and Latin America are made up of varying mixes of service lines that are generally consistent with those in our USIS reportable segment. We also provide information and technology services to support lenders and other creditors in the collections and recovery management process.

Geographic Information. We currently have operations in the following countries: Argentina, Australia, Brazil, Canada, Chile, Costa Rica, Dominican Republic, Ecuador, El Salvador, Honduras, India, Ireland, Mexico, New Zealand, Paraguay, Peru, Portugal, Spain, the U.K., Uruguay and the U.S. We also have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and Brazil. Approximately 77% and 78% of our revenue was generated in the U.S. during the twelve months ended December 31, 2023 and 2022, respectively.

Seasonality. We experience seasonality in certain of our revenue streams. Revenue generated by the online consumer information services component of our USIS operating segment is typically the lowest during the first quarter, when consumer lending activity is at a seasonal low. Revenue generated from the Employer Services business unit within the Workforce Solutions operating segment is generally higher in the first quarter due primarily to the provision of Form W-2 and 1095-C services that occur in the first quarter each year. Revenue generated from our financial wealth asset products and data management services in our Financial Marketing Services business is generally higher in the fourth quarter each year due to the significant portion of our annual renewals and deliveries which occur then. Mortgage related revenue is generally higher in the second and third quarters of the year due to the increase in consumer home purchasing during the summer in the U.S. Any change in the U.S. mortgage market has a corresponding impact on revenue and operating profit for our business within the Workforce Solutions and USIS operating segments.

34

Key Performance Indicators.  Management focuses on a variety of key indicators to monitor operating and financial performance. These performance indicators include measurements of operating revenue, change in operating revenue, operating income, operating margin, net income, diluted earnings per share, cash provided by operating activities and capital expenditures. The key performance indicators for the twelve months ended December 31, 2023, 2022 and 2021 were as follows:

	Key Performance Indicators Twelve Months Ended December 31,
	2023			2022			2021
	(In millions, except per share data)
Operating revenue	$	5,265.2		$	5,122.2		$	4,923.9
Operating revenue change	3		%	4		%	19		%
Operating income	$	933.6		$	1,056.0		$	1,138.0
Operating margin	17.7		%	20.6		%	23.1		%
Net income attributable to Equifax	$	545.3		$	696.2		$	744.2
Diluted earnings per share	$	4.40		$	5.65		$	6.02
Cash provided by operating activities	$	1,116.8		$	757.1		$	1,334.8
Capital expenditures*	$	(585.8)		$	(617.4)		$	(490.5)

*Amounts include accruals for capital expenditures.

RESULTS OF OPERATIONS —

TWELVE MONTHS ENDED DECEMBER 31, 2023, 2022 AND 2021

Consolidated Financial Results

Operating Revenue

	Twelve Months Ended December 31,						Change
							2023 vs. 2022				2022 vs. 2021
Operating Revenue	2023		2022		2021		$		%		$		%
	(In millions)
Workforce Solutions	$	2,315.8	$	2,325.4	$	2,035.4	$	(9.6)	—	%	$	290.0	14	%
U.S. Information Solutions	1,720.4		1,657.7		1,786.7		62.7		4	%	(129.0)		(7)	%
International	1,229.0		1,139.1		1,101.8		89.9		8	%	37.3		3	%
Consolidated operating revenue	$	5,265.2	$	5,122.2	$	4,923.9	$	143.0	3	%	$	198.3	4	%

Revenue for 2023 increased by 3% compared to 2022, due to revenue growth in International and USIS. International revenue growth was driven by growth in Latin America primarily from the Boa Vista Serviços S.A. ("BVS") acquisition, as well as growth in Canada, Europe and Asia Pacific. USIS revenue growth was primarily due to growth in online revenue, partially offset by declines in Mortgage Solutions. Workforce Solutions revenue declined slightly, as a decline in Verification Services revenue due to the impact of the decline in mortgage activity was principally offset by growth in Employer Services revenue. The effect of foreign exchange rates decreased revenue by $51.2 million, or 1%, in 2023 compared to 2022.

Revenue for 2022 increased by 4% compared to 2021. The increase was primarily due to growth in Workforce Solutions and International, partially offset by a decline in USIS. A significant decline in U.S. mortgage activity negatively impacted the growth in Workforce Solutions and caused the decline in USIS revenue. The effect of foreign exchange rates decreased revenue by $94.9 million, or 2%, in 2022 compared to 2021.

35

Operating Expenses

	Twelve Months Ended December 31,						Change
							2023 vs. 2022				2022 vs. 2021
Operating Expenses	2023		2022		2021		$		%		$		%
	(In millions)
Consolidated cost of services	$	2,335.1	$	2,177.2	$	1,980.9	$	157.9	7	%	$	196.3	10	%
Consolidated selling, general and administrative expenses	1,385.7		1,328.9		1,324.6		56.8		4	%	4.3		—	%
Consolidated depreciation and amortization expense	610.8		560.1		480.4		50.7		9	%	79.7		17	%
Consolidated operating expenses	$	4,331.6	$	4,066.2	$	3,785.9	$	265.4	7	%	$	280.3	7	%

Cost of Services.  Cost of services increased $157.9 million in 2023 compared to 2022. The increase is primarily due to higher royalty costs, people costs, third party cloud usage fees and software costs, and costs of purchased data and information. The effect of changes in foreign exchange rates decreased cost of services by $16.9 million.

Cost of services increased $196.3 million in 2022 compared to 2021. The increase is due to higher royalty costs, costs of purchased data and information, third party cloud usage fees, and people costs. The effect of changes in foreign exchange rates decreased cost of services by $50.5 million.

Selling, General and Administrative Expenses.  Selling, general and administrative expenses increased $56.8 million in 2023 compared to 2022. The increase in 2023 is primarily due to an increase in litigation expense, mainly due to a payment to the U.K. FCA for a penalty associated with resolution of the investigation of a material 2017 cybersecurity incident as well as higher people costs, partially offset by lower discretionary expenses. The increase in people costs is primarily driven by higher incentive plans, partially offset by lower temporary labor. The impact of changes in foreign currency exchange rates decreased our selling, general and administrative expenses by $16.6 million.

Selling, general and administrative expenses increased $4.3 million in 2022 compared to 2021. The increase in 2022 is primarily driven by companies acquired in 2022 and 2021, with the total increase in expenses partially offset by a decrease in incentive plan costs. The impact of changes in foreign currency exchange rates decreased our selling, general and administrative expenses by $25.6 million.

Depreciation and Amortization.  Depreciation and amortization expense for 2023 increased by $50.7 million. The increase is due to increased amortization of capitalized internal-use software and system costs from technology transformation capital spending incurred previously as well as higher amortization of purchased intangible assets related to recent acquisitions. The impact of changes in foreign currency exchange rates led to a decrease in depreciation and amortization expense of $1.5 million.

Depreciation and amortization expense increased by $79.7 million in 2022 compared to 2021. This increase was due to higher amortization of purchased intangible assets related to recent acquisitions as well as amortization of capitalized internal-use software and systems costs from technology transformation capital spending incurred previously. The impact of changes in foreign currency exchange rates led to a decrease in depreciation and amortization expense of $11.6 million.

36

Operating Income and Operating Margin

	Twelve Months Ended December 31,									Change
Operating Income and Operating Margin										2023 vs. 2022				2022 vs. 2021
	2023			2022			2021			$		%		$		%
	(In millions)
Consolidated operating revenue	$	5,265.2		$	5,122.2		$	4,923.9		$	143.0	3	%	$	198.3	4	%
Consolidated operating expenses	4,331.6			4,066.2			3,785.9			265.4		7	%	280.3		7	%
Consolidated operating income	$	933.6		$	1,056.0		$	1,138.0		$	(122.4)	(12)	%	$	(82.0)	(7)	%
Consolidated operating margin	17.7		%	20.6		%	23.1		%			(2.9)	pts			(2.5)	pts

Total company operating margin decreased by 2.9 percentage points in 2023 versus 2022 and by 2.5 percentage points in 2022 versus 2021. The margin decrease in both periods was due to the aforementioned increased operating expenses and amortization expenses during the periods, partially offset by the higher reported revenue during the periods.

Interest Expense and Other Income (Expense), net

	Twelve Months Ended December 31,									Change
										2023 vs. 2022				2022 vs. 2021
Consolidated Interest and Other Income (Expense), net	2023			2022			2021			$		%		$		%
	(In millions)
Consolidated interest expense	$	(241.4)		$	(183.0)		$	(145.6)		$	(58.4)	32	%	$	(37.4)	26	%
Consolidated other income (expense), net	25.7			56.7			(43.2)			(31.0)		(55)	%	99.9		(231)	%
Average cost of debt	4.2		%	3.2		%	3.2		%
Total consolidated debt, net, at year end	$	5,711.2		$	5,787.3		$	5,294.9		$	(76.1)	(1)	%	$	492.4	9	%

Interest expense increased in 2023, when compared to 2022, due to higher interest rates attributable to debt agreements entered into during 2022 and 2023, as well as higher weighted average debt balances in 2023 when compared to the same periods of 2022.

Interest expense increased in 2022, when compared to 2021, due to a higher weighted average outstanding amount of debt and higher interest costs attributable to debt agreements entered into during 2022.

The decrease in other income (expense), net in 2023 is due to the gains associated with the sale of equity method investments and higher fair value adjustment of our investment in BVS in 2022 that did not recur in 2023. We also incurred higher pension expense in 2023 as compared to 2022. For 2023 and 2022, we recorded a $0.1 million loss and $1.4 million gain, respectively, on the mark-to-market adjustment of our pension plan assets.

The increase in other income (expense), net in 2022 is driven by changes in our fair value adjustments of our investments, gains on the sale of multiple equity investments and mark-to-market adjustments for our pension assets. We recorded a $13.3 million gain on the fair value adjustment of our investment in BVS in 2022, compared to a $64.0 million loss in 2021. During 2022, we recorded a gain of $19.1 million as a result of the sale of multiple equity investments, including the sale of our equity method investment in Russia during the third quarter of 2022. For 2022 and 2021, we recorded a $1.4 million gain and $20.2 million loss, respectively, on the mark-to-market adjustment of our pension plan assets.

37

Income Taxes

	Twelve Months Ended December 31,									Change
										2023 vs. 2022				2022 vs. 2021
Provision for Income Taxes	2023			2022			2021			$		%		$		%
	(In millions)
Consolidated provision for income taxes	$	(166.2)		$	(229.5)		$	(200.7)		$	63.3	(28)	%	$	(28.8)	14	%
Effective income tax rate	23.2		%	24.7		%	21.2		%

Our effective tax rate was 23.2% for 2023, down from 24.7% for the same period in 2022. Our effective tax rate is lower for the year ended December 31, 2023 compared to 2022 due to the write off of a deferred tax liability related to our original investment in BVS which was no longer necessary given the acquisition of the company in the third quarter of 2023, partially offset by an increase in the foreign rate differential.

Our effective tax rate was 24.7% for 2022, up from 21.2% for the same period in 2021. Our effective tax rate was higher for the year ended December 31, 2022 compared to 2021 due to a higher foreign rate differential, primarily due to the changes in the fair value of our investment in Brazil.

Net Income

	Twelve Months Ended December 31,						Change
							2023 vs. 2022				2022 vs. 2021
Net Income	2023		2022		2021		$		%		$		%
	(In millions, except per share amounts)
Consolidated operating income	$	933.6	$	1,056.0	$	1,138.0	$	(122.4)	(12)	%	$	(82.0)	(7)	%
Consolidated interest and other income (expense), net	(215.7)		(126.3)		(188.8)		(89.4)		71	%	62.5		(33)	%
Consolidated provision for income taxes	(166.2)		(229.5)		(200.7)		63.3		(28)	%	(28.8)		14	%
Consolidated net income	551.7		700.2		748.5		(148.5)		(21)	%	(48.3)		(6)	%
Net income attributable to noncontrolling interests	(6.4)		(4.0)		(4.3)		(2.4)		60	%	0.3		(7)	%
Net income attributable to Equifax	$	545.3	$	696.2	$	744.2	$	(150.9)	(22)	%	$	(48.0)	(6)	%
Diluted earnings per share:
Net income attributable to Equifax	$	4.40	$	5.65	$	6.02	$	(1.25)	(22)	%	$	(0.37)	(6)	%
Weighted-average shares used in computing diluted earnings per share	123.9		123.3		123.6

Consolidated net income decreased by $148.5 million in 2023 compared to 2022 due to lower levels of operating income, higher interest expense, and lower levels of other income, net, partially offset by the decrease in income tax expense.

Consolidated net income decreased by $48.3 million in 2022 compared to 2021 due to a decrease in operating income and an increase in income tax expense, partially offset by the increase in other income, net.

38

Segment Financial Results

Workforce Solutions

	Twelve Months Ended December 31,									Change
										2023 vs. 2022				2022 vs. 2021
Workforce Solutions	2023			2022			2021			$		%		$		%
	(In millions)
Operating Revenue:
Verification Services	$	1,846.2		$	1,871.0		$	1,608.9		$	(24.8)	(1)	%	$	262.1	16	%
Employer Services	469.6			454.4			426.5			15.2		3	%	27.9		7	%
Total operating revenue	$	2,315.8		$	2,325.4		$	2,035.4		$	(9.6)	—	%	$	290.0	14	%
% of consolidated revenue	44		%	45		%	42		%
Total operating income	$	969.3		$	1,006.0		$	1,000.7		$	(36.7)	(4)	%	$	5.3	1	%
Operating margin	41.9		%	43.3		%	49.2		%			(1.4)	pts			(5.9) pts

Workforce Solutions revenue declined slightly in 2023 compared to 2022, which was due to a decline in Verification Services as declines in mortgage revenue were partially offset by growth in the government and talent verticals. This decline was principally offset by growth in Employer Services revenue, which was driven by revenue from recently acquired companies and growth in I-9 and onboarding services.

Workforce Solutions revenue increased by 14% in 2022 compared to 2021, due to growth in Verification Services driven by growth in government, talent and consumer finance verticals as well as revenue from acquired companies, partially offset by declines in mortgage revenue. Employer Services also grew in 2022 compared to 2021, due to revenue from acquired companies and growth in I-9 and onboarding services.

Verification Services.  Revenue decreased 1% in 2023 compared to 2022. The decrease in revenue was due to declines in the mortgage vertical, partially offset by an increase in the government and talent solutions verticals.

Revenue increased 16% in 2022 compared to 2021. The increase in revenue was due to growth in government, talent solutions and consumer finance verticals, along with growth from the full year impact of Insights, which was acquired in the fourth quarter of 2021, offset by a decline in the mortgage vertical due to significantly slower U.S. mortgage activity in 2022. Verification Services benefited across all verticals from the continued growth of employment and income records in The Work Number database.

Employer Services.  Revenue increased 3% in 2023, compared to 2022 due to revenue from recently acquired companies and I-9 and onboarding services, partially offset by lower tax credit revenue and a decrease in unemployment claims revenue.

Revenue increased 7% in 2022 compared to 2021 due to growth in employee services, partially offset by a decrease in unemployment claims management revenue as the number of unemployment claims returned to pre-COVID-19 levels in 2022 after having been significantly higher in 2021 due to the economic impact of COVID-19 on the U.S. economy. Employer Services also benefited from acquisition revenue in 2022.

Workforce Solutions Operating Margin.  Operating margin decreased to 41.9% in 2023 compared to 43.3% in 2022 due to an increase in operating expenses. The increased operating expenses were a result of increased royalty costs, costs of purchased data or information, and amortization of capitalized internal-use software and system costs from technology transformation capital spending, partially offset by a decrease in people costs and discretionary expenses. Operating margin decreased to 43.3% in 2022 compared to 49.2% in 2021 due to increased royalty costs, people costs, purchased intangible asset amortization and costs of purchased data or information, which altogether grew faster than the increase in revenue.

39

U.S. Information Solutions 

	Twelve Months Ended December 31,									Change
U.S. Information Solutions										2023 vs. 2022				2022 vs. 2021
	2023			2022			2021			$		%		$		%
	(In millions)
Operating revenue:
Online Information Solutions	$	1,375.2		$	1,295.4		$	1,349.8		$	79.8	6	%	$	(54.4)	(4)	%
Mortgage Solutions	113.7			138.3			190.4			(24.6)		(18)	%	(52.1)		(27)	%
Financial Marketing Services	231.5			224.0			246.5			7.5		3	%	(22.5)		(9)	%
Total operating revenue	$	1,720.4		$	1,657.7		$	1,786.7		$	62.7	4	%	$	(129.0)	(7)	%
% of consolidated revenue	33		%	33		%	36		%
Total operating income	$	365.0		$	402.1		$	551.8		$	(37.1)	(9)	%	$	(149.7)	(27)	%
Operating margin	21.2		%	24.3		%	30.9		%			(3.1)	pts			(6.6)	pts

U.S. Information Solutions revenue increased 4% in 2023 compared to 2022 due to growth in online revenue from non-mortgage online services and revenue from acquisitions, as well as growth in consumer services revenue. Mortgage Solutions revenue also declined in 2023 compared to 2022. The decline in Mortgage Solutions and mortgage related online revenue was due to declines in mortgage credit inquiry volumes.

U.S. Information Solutions revenue decreased 7% in 2022 compared to 2021 due to the negative impact of declining mortgage inquiry volumes on both online services and Mortgage Solutions, as well as a decline in marketing solutions, partially offset by growth in non-mortgage online services and acquisition-related revenue. The decline in mortgage related online revenue and Mortgage Solutions revenue in 2022 was due to declining mortgage credit inquiry volumes.

Online Information Solutions.  Revenue for 2023 increased 6% compared to 2022, driven by continued growth in online non-mortgage services, revenue from acquisitions, consumer services and commercial risk.

Revenue for 2022 decreased 4% compared to 2021, due to declining mortgage inquiry volumes compared to the prior year, partially offset by growth of non-mortgage online services and revenue from acquisitions.

Mortgage Solutions.  Revenue decreased 18% in 2023 compared to 2022, due to significantly lower mortgage credit inquiry volumes in 2023 compared to the prior year.

Revenue decreased 27% in 2022 compared to 2021, due to declining mortgage inquiry volumes, as compared to the prior year.

Financial Marketing Services.  Revenue increased 3% in 2023 compared to 2022, driven by growth in both credit marketing services, as well as risk and data services.

Revenue decreased 9% in 2022 compared to 2021, driven by lower fraud, risk management and other data services revenue.

U.S. Information Solutions Operating Margin.  USIS operating margin decreased to 21.2% in 2023 compared to 24.3% in 2022, due to an increase in operating expenses, partially offset by the increase in revenue. The increase in operating expenses is due to increased incentive and salary expenses, royalty expenses, third party cloud usage fees and software costs, and amortization expenses. USIS operating margin decreased to 24.3% in 2022 compared to 30.9% in 2021, due to the decrease in revenue and increases in depreciation expense related to increased capitalized software development spending and third party cloud usage fees and software costs, partially offset by lower costs of purchased data or information.

40

International 

	Twelve Months Ended December 31,									Change
										2023 vs. 2022				2022 vs. 2021
International	2023			2022			2021			$		%		$		%
	(In millions)
Operating revenue:
Asia Pacific	$	345.3		$	348.4		$	356.0		$	(3.1)	(1)	%	$	(7.6)	(2)	%
Europe	333.2			327.8			319.9			5.4		2	%	7.9		2	%
Latin America	290.9			206.8			175.9			84.1		41	%	30.9		18	%
Canada	259.6			256.1			250.0			3.5		1	%	6.1		2	%
Total operating revenue	$	1,229.0		$	1,139.1		$	1,101.8		$	89.9	8	%	$	37.3	3	%
% of consolidated revenue	23		%	22		%	22		%
Total operating income	$	167.8		$	147.0		$	141.9		$	20.8	14	%	$	5.1	4	%
Operating margin	13.7		%	12.9		%	12.9		%			0.8	pts			—	pts

International revenue increased by 8% in 2023 as compared to 2022. Local currency revenue increased 12% in 2023, driven by revenue growth in Latin America from the BVS acquisition and growth in Argentina, as well as growth in our credit reporting business across all geographies. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $51.2 million, or 4%.

International revenue increased by 3% in 2022 as compared to 2021. Local currency revenue increased 12% in 2022, driven by increases in Latin America, Europe, Canada and Asia Pacific. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $94.8 million, or 9%.

Asia Pacific. Local currency revenue increased 4% in 2023 as compared to 2022, driven by growth in Australia due to growth in commercial, identity and fraud, and credit reporting businesses. India revenue also grew due to growth in the credit reporting business primarily due to higher online volumes. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $15.7 million, or 5%. Reported revenue decreased 1% in 2023 as compared to 2022.

Local currency revenue increased 6% in 2022 as compared to 2021, driven by stronger volumes within Australia due to growth in credit reporting, commercial and identity and fraud, partially offset by consumer direct. India revenue also grew due to higher credit reporting volumes. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $29.2 million, or 8%. Reported revenue decreased 2% in 2022 as compared to 2021.

Europe.  Local currency revenue was flat in 2023 as compared to 2022, driven by growth in credit reporting businesses in Europe, offset by lower debt placements within our debt services business. Local currency fluctuations against the U.S. dollar positively impacted revenue by $4.2 million, or 2%, for 2023. Reported revenue increased 2% in 2023 as compared to 2022.

Local currency revenue increased 14% in 2022 as compared to 2021, driven principally by growth in the debt services business. The European credit reporting business grew slightly as growth in core credit decisioning and identity and fraud were partially offset by a decline in the consumer direct business. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $37.4 million, or 12%, for 2022. Reported revenue increased 2% in 2022 as compared to 2021.

Latin America. Local currency revenue increased 56% in 2023 as compared to 2022 reflecting revenue from the BVS acquisition and local currency growth in Argentina and across Central America, primarily related to growth in revenue from an acquired company in the Dominican Republic. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $31.8 million, or 15%, in 2023, primarily from Argentina. Reported revenue increased 41% in 2023 as compared to 2022.

Local currency revenue increased 29% in 2022 as compared to 2021 reflecting local currency growth across most countries driven by price increases mainly in Argentina and Chile, stronger online consumer growth, as well as growth due to acquisition revenue. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $20.3 million, or 11%, in 2022, primarily from Argentina and Chile. Reported revenue increased 18% in 2022 as compared to 2021.

41

Canada.  Local currency revenue increased 4% in 2023 as compared to 2022. Revenue in 2023 reflected increases in the consumer credit reporting business, as well as commercial and identity and fraud revenue. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $7.8 million, or 3%, in 2023. Reported revenue increased 1% in 2023 as compared to 2022.

Local currency revenue increased 6% in 2022 as compared to 2021 primarily driven by strong identity and fraud revenue and higher commercial online volumes, partially offset by declines in the consumer credit reporting business due to direct services volumes and mortgage related products due to interest rate increases. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $8.0 million, or 4%, in 2022. Reported revenue increased 2% in 2022 as compared to 2021.

International Operating Margin.  Operating margin was 13.7% in 2023 compared to 12.9% in 2022. The increase in margin is mainly due to increased revenue, partially offset by increased salary and incentive costs, increased costs of purchased data or information, higher cloud production costs, increased depreciation expense related to technology transformation project spending and higher amortization of purchased intangible assets related to recent acquisitions. Operating margin was 12.9% in both 2022 and 2021. The 2022 margin was driven by higher revenue, lower purchased intangible asset amortization costs, and lower incentives, partially offset by higher third party cloud usage fees and software costs, fees paid to third parties, and depreciation expense related to technology transformation project spending.

General Corporate Expense

	Twelve Months Ended December 31,						Change
							2023 vs. 2022				2022 vs. 2021
General Corporate Expense	2023		2022		2021		$		%		$		%
	(In millions)
General corporate expense	$	568.5	$	499.1	$	556.4	$	69.4	14	%	$	(57.3)	(10)	%

Our general corporate expenses are unallocated costs that are incurred at the corporate level and include those expenses impacted by the overall management and strategic choices of the company, including shared services overhead, technology, security, data and analytics, administrative, legal, restructuring, and the portion of management incentive compensation determined by total company-wide performance.

General corporate expense increased $69.4 million in 2023. The increase in 2023 as compared to 2022 is due to payment of a penalty associated with resolution of the investigation of a material 2017 cybersecurity incident by the U.K. FCA, as well as increased people costs, primarily incentive plans and restructuring charges.

General corporate expense decreased $57.3 million in 2022 as compared to 2021. The decrease in 2022 as compared to 2021 is due to reduced people costs, primarily incentive plans and professional fees.

42

LIQUIDITY AND FINANCIAL CONDITION

Management assesses liquidity in terms of our ability to generate cash to fund operating, investing and financing activities. We continue to generate substantial cash from operating activities, remain in a strong financial position and manage our capital structure to meet short- and long-term objectives including reinvestment in existing businesses and completing strategic acquisitions.

Funds generated by operating activities, our $1.5 billion five-year unsecured revolving credit facility (the "Revolver") and related commercial paper (“CP”) program, more fully described below, are our most significant sources of liquidity. At December 31, 2023, we had $216.8 million in cash and cash equivalents, as well as $1,303.6 million available to borrow under our Revolver.

Sources and Uses of Cash

We believe that our existing cash balance, liquidity available from our CP and Revolver, cash generated from ongoing operations and continued access to public or private debt markets will be sufficient to satisfy cash requirements over the next 12 months and beyond. While there was no significant change in our cash requirements as of December 31, 2023 compared to December 31, 2022, we have utilized existing CP and Revolver capacity, together with cash from operating activities, to meet our current obligations. During the first quarter of 2023, we borrowed $175.0 million on our Revolver to pay down CP. We subsequently repaid the Revolver in full during the second quarter of 2023.

Fund Transfer Limitations.  The ability of certain of our subsidiaries and associated companies to transfer funds to the U.S may be limited, in some cases, by certain restrictions imposed by foreign governments. These restrictions do not, individually or in the aggregate, materially limit our ability to service our indebtedness, meet our current obligations or pay dividends. As of December 31, 2023, we held $180.0 million of cash in our foreign subsidiaries.

Information about our cash flows, by category, is presented in the Consolidated Statements of Cash Flows. The following table summarizes our cash flows for the twelve months ended December 31, 2023, 2022 and 2021:

	Twelve Months Ended December 31,						Change
Net cash provided by (used in):	2023		2022		2021		2023 vs. 2022		2022 vs. 2021
	(In millions)
Operating activities	$	1,116.8	$	757.1	$	1,334.8	$	359.7	$	(577.7)
Investing activities	$	(878.2)	$	(959.5)	$	(3,398.2)	$	81.3	$	2,438.7
Financing activities	$	(306.2)	$	273.7	$	617.7	$	(579.9)	$	(344.0)

Operating Activities

Cash provided by operating activities for 2023 increased by $359.7 million compared to 2022 primarily due to the $345.0 million consumer class action settlement payment that was made in January 2022 related to the U.S. Consumer MDL Litigation settlement that became effective on January 11, 2022 that did not recur in 2023.

Cash provided by operating activities for 2022 decreased by $577.7 million compared to 2021 due to decreased net income and the $345.0 million consumer class action settlement payment that was made in January 2022 related to the U.S. Consumer MDL Litigation settlement that became effective on January 11, 2022.

Investing Activities

Capital Expenditures

	Twelve Months Ended December 31,						Change
Net cash used in:	2023		2022		2021		2023 vs. 2022		2022 vs. 2021
	(In millions)
Capital expenditures*	$	(601.3)	$	(624.5)	$	(469.0)	$	23.2	$	(155.5)

*Amounts above are total cash outflows for capital expenditures.

43

Our capital expenditures are used for developing, enhancing and deploying new and existing software in support of our expanding product set, replacing or adding equipment, updating systems for regulatory compliance, the licensing of certain software applications, investing in system reliability, security and disaster recovery enhancements, and updating or expanding our office facilities.

Capital expenditures decreased in 2023 from 2022 due to lower capitalized software costs and lower spending on technology infrastructure as compared to 2022 as we get closer to completion of our technology transformation. Capital expenditures increased in 2022 from 2021 as we continued to invest in enhanced technology systems and infrastructure as part of our technology transformation in 2022.

Acquisitions, Divestitures and Investments

	Twelve Months Ended December 31,						Change
Net cash (used in) provided by:	2023		2022		2021		2023 vs. 2022		2022 vs. 2021
	(In millions)
Acquisitions, net of cash acquired	$	(283.8)	$	(433.8)	$	(2,935.6)	$	150.0	$	2,501.8
Cash received from sale of asset	$	—	$	—	$	4.9	$	—	$	(4.9)
Cash received from divestitures	$	6.9	$	98.8	$	1.5	$	(91.9)	$	97.3

2023 Acquisitions and Investments. During 2023, we acquired The Food Industry Credit Bureau and BVS within the International operating segment. During 2023, we sold an equity investment.

2022 Acquisitions and Investments. During 2022, we acquired Efficient Hire and LawLogix within the Workforce Solutions operating segment. We acquired Midigator within the USIS operating segment. We acquired Data Crédito within the International operating segment. During 2022, we sold multiple equity investments.

2021 Acquisitions and Investments. During 2021, we acquired Appriss Insights, HIREtech, i2Verify and Health e(fx) within the Workforce Solutions operating segment. We acquired Kount and Teletrack within the USIS operating segment. We acquired AccountScore, as well as the remaining noncontrolling interest of businesses within our International segment.

For additional information about our acquisitions, see Note 3 of the Notes to Consolidated Financial Statements in Item 8 of this report.

Financing Activities

Borrowings and Credit Facility Availability

	Twelve Months Ended December 31,						Change
Net cash (used in) provided by:	2023		2022		2021		2023 vs. 2022		2022 vs. 2021
	(In millions)
Net short-term (payments) borrowings	$	(371.2)	$	242.2	$	323.4	$	(613.4)