PART IItem 1. BusinessItem 1A. Risk factorsItem 1B. Unresolved staff commentsItem 1C. CybersecurityItem 2. PropertiesItem 3. Legal proceedingsItem 4. Mine safety disclosuresInformation about our executive officers

Item 1. BusinessOverviewMastercard is a technology company in the global payments industry. We connect consumers, financial institutions, merchants, governments, digital partners, businesses and other organizations worldwide by enabling electronic payments and making those payment transactions secure, simple, smart and accessible. We make payments easier and more efficient by providing a wide range of payment solutions and services using our family of well-known and trusted brands, including our primary brand Mastercard®, as well as our Maestro® and Cirrus® brands. We operate a payments network that provides choice and flexibility for consumers, merchants and our customers. Through our unique and proprietary global payments network, we switch (authorize, clear and settle) payment transactions. We have additional payments capabilities that include automated clearing house (“ACH”) transactions (both batch and real-time account-based payments). Using these capabilities, we offer consumer and commercial payment products, capture new payment flows and provide services and solutions. These services and solutions include, among others, security solutions, consumer acquisition and engagement services, business and market insights, digital and authentication, processing and gateway and other solutions, all of which draw on our principled and responsible use of secure data. Our capabilities strengthen, reinforce and complement each other and are fundamentally interdependent. For our global payments network, our franchise model sets the standards and ground-rules that balance value and risk across (and allow for interoperability among) all stakeholders. We employ a multi-layered approach to help protect the global payments ecosystem in which we operate.For a full discussion of our business, please see page 10.Our PerformanceThe following are our key financial and operational highlights for 2025, including growth rates over the prior year: 1Non-GAAP results (including growth rates) exclude the impact of gains and losses on equity investments, Special Items and/or foreign currency. See “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Financial Results Overview” in Part II, Item 7 for the reconciliation to the most direct comparable GAAP financial measures.The following chart provides gross dollar volume (“GDV”) and number of cards featuring our brands in 2025 for select programs and solutions: [Table with ~4 rows, ~21 numbers, and 353 characters.] 1Excludes Maestro and Cirrus cards and volume generated by those cards.2Prepaid includes both consumer and commercial prepaid.For a full discussion of our results of operations, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Item II, Part 7. Our StrategyOur strategy centers on growing our core, diversifying our customers and geographies and building new areas for the future through a combination of organic and inorganic strategic initiatives. We are executing on this strategy through a focus on three priorities: •consumer payments•commercial and new payment flows•services and other solutions Our priorities strengthen, complement and reinforce each other and are fundamentally interdependent.

MASTERCARD 2025 FORM 10-K 7

Our Strategic Priorities

Consumer payments. We focus on enabling consumer payments, providing consumers with choice and flexibility to transact across multiple payment rails (including cards, real-time payments and account-based transactions), while ensuring that all payments are secure and seamless. We do so by:•Capturing the significant secular opportunity of cash displacement by increasing acceptance through advancing technology and partnering with players across the payments ecosystem, as well as by opening up closed-loop and domestic networks. We also pursue incremental volume and transactions by extending our reach across under-penetrated card verticals (such as bill pay) and real-time account-based payments•Driving brand preference through compelling consumer experiences by offering relevant value propositions to consumers (including features, benefits, events and activities), providing comprehensive digital functionality (such as Digital First and One Credential), delivering enhanced security and functionality (increasing tokenization, scaling authentication and streamlining online checkout) and driving increased approval, spend and activation rates•Investing in the future and driving market transformation by extending the reach of our network to enable the tokenization of credentials, identities, assets and data and the exchange of those items between counterparties (providing security, privacy and control). We also seek to achieve this transformation by modernizing our payment network (including enabling real-time card payments) to meet evolving needs Commercial and new payment flows. We focus on capturing opportunities in commercial payments (both point-of-sale purchases and invoiced payments) and disbursements and remittances (specifically, through Mastercard Move, our collection of money movement capabilities that provides solutions for money transfers to consumers from other consumers, businesses or governments). We do so by:•Driving brand preference and accelerating secular shift in commercial point-of-sale purchases by offering differentiated propositions across cards and platforms (both corporate and small business solutions, including expense management, reporting, reconciliation and data insights); expanding distribution of our point-of-sale offerings across financial institutions, new geographies, new channels and small businesses; and growing acceptance•Capturing commercial invoiced payments by driving engagement across buyers and suppliers to, among other things, simplify workflows, release working capital and improve data reconciliation to reduce end-to-end costs; building on our travel offerings to expand into additional select verticals (including business-to-business (“B2B”) marketplaces, trade and logistics, healthcare, consumer packaged goods and pharmaceuticals); and embedding payments into widely used platforms and workflows •Modernizing disbursements and remittances by utilizing Mastercard Move to scale use cases across senders (including consumers, businesses and governments) and recipient consumers (both domestic and cross-border) and expand money movement across our global network of financial institution partnersServices and other solutions. Our services and other solutions, which are interdependent with our payment network, drive value for our customers and the broader payments ecosystem. We offer security solutions, consumer acquisition and engagement, business and market insights, digital and authentication, processing and gateway and other solutions (including ACH batch and real-time account-based payments and solutions and open finance). We do so by:•Differentiating our payments capabilities by combining our wide range of services and solutions in various ways to meet the needs and priorities of our partners, which helps drive market wins and payments growth •Enhancing and expanding our suite of services to better serve our existing customers, including across new buying centers and new capability areas, as well as to reach new customers •Scaling distribution by using our technology platforms to enable us to switch more transactions and deliver more services per transaction, selling directly to customers through a dedicated sales force and global account teams, and embedding services with partners (such as tech platforms, system integrators, processors and other networks) to deliver those services at scale

Our priorities are fundamentally interdependent and strengthen, reinforce and complement each other.

Enabling Our Success

These priorities are supported by six enablers:People. Our success is driven by the skills, experience, integrity and mindset of our people. We attract, develop and retain top talent to deliver on Mastercard’s strategic priorities and to grow high-performing leaders. Our winning culture is guided by the “Mastercard Way”, which outlines the behaviors we expect from employees to deliver for our customers and one another. We foster an environment where everyone has the opportunity to succeed, delivering positive impact for the business and for communities across the globe.Brand. Our brands serve as a differentiator for our business, representing our values and enabling us to accelerate growth in new areas. Data and AI. We create a range of products and services for our customers using our data and artificial intelligence (“AI”) assets, technology, platforms and expertise. These products and services are designed to make commerce smarter, more secure and more personal. We follow our Data and Tech Responsibility Principles in how we design, implement and deliver those solutions. Our Privacy by Design, Data by Design and AI Governance processes are designed to ensure we embed multiple layers of privacy, data protection and information security controls in all our products and services, keeping a clear focus on protecting customers’ and individuals’ data and privacy, as well as making our AI more accurate and effective. In addition to our products and services, we use AI to enhance our operations and our employee productivity.Technology. Our technology provides resiliency, scalability and flexibility in how we serve customers. It unlocks broader reach to scale digital payment services to multiple channels. Utilizing our technology standards, services and governance model, we connect financial institutions, financial technology companies (fintechs) and others, enabling interoperability and allowing consumers, businesses, governments and merchants to engage through digital channels.Franchise. We manage an ecosystem of stakeholders who participate in our global payments network. Our franchise model creates and sustains a comprehensive series of value exchanges across our ecosystem. We provide a balanced ecosystem where all participants benefit from the availability, innovation and security of our network. Our franchise model enables the scale of our network and provides a single governance structure for its operation. Doing Well by Doing Good. We are powering economies and empowering people, with an aim toward building a sustainable economy where everyone prospers. Our impact strategy is expressed through three pillars - People, Prosperity and Planet - and the work we do is grounded in strong governance principles. We pursue these strategic goals because it is right for our business. When we bring more people, in more places, into the digital economy we grow our customers, our partnerships and our revenue. For a thriving economy where people prosper, we need a healthy environment, which is why our efforts to preserve the planet play an important role. For more information, please reference our most recently published Impact Report located on our website.

Our Strategic Priorities

Our priorities are fundamentally interdependent and strengthen, reinforce and complement each other.

Enabling Our Success

MASTERCARD 2025 FORM 10-K 9

Our Business

Our Payments Capabilities

We enable a wide variety of payments capabilities (including products, services and solutions) over our network among account holders, merchants, financial institutions, businesses, governments and others, offering our customers one partner for their payment needs.

Payment Network

Our payment network links issuers and acquirers around the globe to facilitate the switching of transactions, permitting account holders to use our products at hundreds of millions of acceptance locations and digital access points worldwide. This network facilitates an efficient and secure means for making and receiving payments, a convenient, quick and secure payment method for consumers to access their funds and a channel for the delivery of value-added data insights to our customers. We enable transactions for our customers through our payment network in more than 150 currencies and in more than 220 countries and territories. Payment Network Transactions. Our payment network supports what is often referred to as a “four-party” payments network and includes the following participants: account holder (a person or entity who holds a card or uses another device enabled for payment), issuer (the account holder’s financial institution), merchant and acquirer (the merchant’s financial institution). We do not issue cards, extend credit, determine or receive revenue from interest rates or other fees charged to account holders by issuers, nor do we establish the rates charged by acquirers in connection with merchants’ acceptance of our products. In most cases, account holder relationships belong to, and are managed by, our customers. The following graphic depicts a typical transaction on our payment network and our role in that transaction, which includes services and other solutions and payments ecosystem security: In a typical transaction, an account holder purchases goods or services from a merchant using one of our payment products. After the transaction is authorized by the issuer, the issuer pays the acquirer an amount equal to the value of the transaction, minus the interchange fee (described below) and other applicable fees, and then posts the transaction to the account holder’s account. The acquirer pays the amount of the purchase, net of a discount (referred to as the “merchant discount” rate), to the merchant.•Interchange Fees. Interchange fees reflect the value merchants receive from accepting our products and play a key role in balancing the costs and benefits that consumers and merchants derive. Generally, interchange fees are collected from acquirers and paid to issuers to reimburse the issuers for a portion of the costs incurred. These costs are incurred by issuers in providing services that benefit all participants in the system, including acquirers and merchants, whose participation in the network enables increased sales to their existing and new customers, efficiencies in the delivery of existing and new products, guaranteed payments and improved customer experience. We (or, alternatively, financial institutions) establish “default interchange fees” that apply when there are no other established settlement terms in place between an issuer and an acquirer. We administer the collection and remittance of interchange fees through the settlement process.•Additional Four-Party System Fees. The merchant discount rate is established by the acquirer to cover its costs of both participating in the four-party system and providing services to merchants. The rate takes into consideration the amount of the interchange fee which the acquirer generally pays to the issuer. Additionally, acquirers may charge merchants processing and related fees in addition to the merchant discount rate. Issuers may also charge account holders fees for the transaction, including, for example, fees for extending revolving credit.

Switched Transactions

•Authorization, Clearing and Settlement. Through our payment network, we enable the routing of a transaction to the issuer for its approval, facilitate the exchange of financial transaction information between issuer and acquirer after a successfully conducted transaction, and settle the transaction by facilitating the exchange of funds between parties via settlement banks chosen by us and our customers.•Cross-Border and Domestic. Our payment network switches transactions throughout the world when the merchant country and country of issuance are different (“cross-border transactions”), providing account holders with the ability to use, and merchants to accept, our products and services across country borders. We also provide switched transaction services to customers where the merchant country and the country of issuance are the same (“domestic transactions”). We switch more than 70% of all transactions for Mastercard and Maestro-branded cards, including nearly all cross-border transactions.We guarantee the settlement of many of the transactions from issuers to acquirers to help ensure the integrity of our payment network. We refer to the amount of this guarantee as our settlement exposure. We do not, however, guarantee payments to merchants by their acquirers or the availability of unspent prepaid account holder account balances.Payment Network Architecture. Our payment network features a globally integrated structure that provides scale for our issuers, enabling them to expand into regional and global markets. It is based largely on a distributed (peer-to-peer) architecture that enables the network to adapt to the needs of each transaction. The network accomplishes this by performing intelligent routing and applying multiple services (such as fraud scoring, tokenization services, etc.) to appropriate transactions in real time. This architecture enables us to connect all parties regardless of where or how the transaction is occurring. It has 24-hour a day availability and world-class response time.

Account-Based Payments Capabilities

We offer ACH batch and real-time account-based payments capabilities, enabling payments for ACH transactions between bank accounts in real-time. Our real-time account-based payments capabilities provide consumers and businesses the ability to make instant (faster) payments while providing enhanced data and messaging capabilities. We build, implement, enhance and operate real-time clearing and settlement infrastructure, payment platforms and direct debit systems for jurisdictions globally. We operate real-time payments infrastructure in several countries around the world. We also use our real-time account-based payments capabilities to enable consumers, businesses, governments and merchants to send and receive money directly from account to account. We discuss below under “Our Payment Products and Applications” the ways in which we apply our real-time account-based payments capabilities to capture new payment flows.

Security and Franchise

Payments Ecosystem Security. We employ a multi-layered approach to help protect the global payments ecosystem, including a robust program designed to protect our network from cyber and information security threats. Our network and platforms incorporate multiple layers of protection, providing greater resiliency and security protection. Our programs are assessed by third parties and incorporate benchmarking and other data from peer companies and consultants. We engage in many efforts to mitigate information security challenges, including maintaining an information security program, an enterprise resilience program and insurance coverage, as well as regularly testing our systems to address potential vulnerabilities. We work with experts across the organization (as well as through other sources such as public-private partnerships) to monitor and respond quickly to a range of cyber and physical threats, including threats and incidents associated with the use of services provided by third-party providers.Our multi-layered approach also includes our work with issuers, acquirers, merchants, governments and payments industry associations to develop and put in place technical standards for secure transactions, and we provide solutions and products that are designed to help provide security for the global payments ecosystem. Our approach includes supporting small businesses by sharing best practices and providing access to free utilities and services, benefiting both them and the entire payments ecosystem. We discuss specific security solutions that we offer to our customers below under “Services and Other Solutions”.

Our Payments Capabilities

Payment Network

Switched Transactions

Account-Based Payments Capabilities

Security and Franchise

MASTERCARD 2025 FORM 10-K 11

Our Franchise. We manage an ecosystem of stakeholders that participate in our global payments network, setting standards and rules for (and aiming to ensure interoperability among) all participants while balancing risk and value across all stakeholders. Our franchise model achieves this by creating and sustaining a comprehensive series of value exchanges across our ecosystem. Through our franchise model, we work to ensure a balanced ecosystem where all participants may benefit from the availability, innovation and security of our network. We achieve this goal through the following key activities: •Participant Onboarding. We determine that each new customer meets the necessary prerequisites to use and contribute to our network by defining clear ecosystem roles and responsibilities for their operations•Operating Standards. We define the technical, operational and financial standards that all network participants are required to uphold•Security. We establish central principles, including safeguarding consumer protections and integrity, so participants feel confident to transact on the network •Responsible Stewardship. We set performance standards to support ecosystem optimization and growth and use proactive monitoring designed to both ensure participant adherence to operating standards and protect the integrity of the ecosystem•Issue Resolution. We operate a framework to address disputes between our network participants

Our Payment Products and Applications

Consumer Payments

We provide a wide variety of products and services that support payment products that customers can offer to consumers and merchants to enable purchase transactions, cash withdrawals and cash advances. These offerings facilitate transactions across our payment network and platforms among account holders, merchants, financial institutions, digital partners, businesses, governments and other organizations in markets globally. Consumer Credit. We offer products that enable issuers to provide consumers with credit, allowing them to defer payment. These programs are designed to meet the needs of our customers around the world and address standard, premium and affluent consumer segments.Consumer Debit. We support a range of payment products and solutions that allow our customers to provide consumers with convenient access to funds in deposit and other accounts. Our debit and deposit access programs can be used to make purchases and to obtain cash from bank branches, at ATMs and, in some cases, at the point of sale. Our branded debit programs consist of Mastercard (including standard, premium and affluent offerings), Maestro (our PIN-based solution that operates globally) and Cirrus (our primary global cash access solution).Key 2025 DevelopmentsIn 2025, we launched products aimed at driving top-of-wallet behavior by consumers (including offerings aimed at affluent consumers) such as:•The Mastercard Collection™, a comprehensive set of premium benefits•World Legend™ Mastercard, our most prestigious consumer card that is available to issuers globally•Mastercard One Credential™, which provides consumers greater control and choice of their preferred funding option across a wide range of our payments solutionsPrepaid. Prepaid accounts are a type of electronic payment that enables consumers to pay from pre-funded accounts whether or not they previously had a bank account or a credit history. These accounts can be tailored to meet specific program, customer or consumer needs, such as paying bills, sending person-to-person payments or withdrawing cash from an ATM. Our focus ranges from digital accounts (such as fintech and gig economy platforms) to business programs such as employee payroll, health savings accounts and solutions for small business owners. Our prepaid programs also offer opportunities in the private and public sectors to drive financial inclusion of previously unbanked individuals through social security payments, unemployment benefits and salary cards.Consumer Bill Payments. Our solutions enable consumers and small businesses to pay their billers in a seamless and secure way, providing an experience that offers flexibility and benefits consumers, financial institutions and billers. Utilizing our merchant acceptance network (which includes many billers), we offer consumers the choice of paying their bills in a convenient and secure manner using credit, debit or prepaid as well as account-based payments methods. We also offer applications and services to enable bill payments for consumers, businesses and governments in select jurisdictions.

Commercial and New Payment Flows

We offer platforms, products and applications that apply our payments capabilities to capture commercial and new payment flows, enabling us to serve the needs of a significant addressable market.CommercialWe offer commercial credit, debit and prepaid payment products and solutions that meet the payment needs of large corporations, midsize companies, small businesses and government entities at the point of sale. Our point-of-sale solutions streamline procurement and payment processes, manage information and expenses (such as travel and entertainment) and reduce administrative costs. Our point-of-sale offerings include: •Small business cards (credit, debit and prepaid) tailored to small and medium businessesKey 2025 Developments•As of the end of 2025, we had embedded our virtual card technology in more than 10 global B2B and travel and expense platforms (more than double the number of platforms in 2024), increasing the opportunity for financial institutions and businesses to integrate card payments into their existing corporate invoice payment workflows.•Commercial travel and entertainment, procurement and fleet cards, consisting mostly of credit cards and associated platforms for corporations to manage travel and expense, procurement and fleet expenses. Our Mastercard Smart Data™ platform provides expense management and reporting capabilities.We also offer solutions designed to enable businesses or governments to make invoiced payments to businesses with whom they have a trusted relationship for goods and services. As part of our solutions, we offer a platform to optimize supplier payment enablement campaigns for financial institutions.Across both point-of-sale and invoiced payments, we offer a Virtual Card Number (VCN) solution, which is generated dynamically from an existing account and leverages the existing funds and/or credit limit of that funding account. Our VCN solution may include the use of Mastercard In Control™, our virtual card platform that allows buyers to pay suppliers using a one-time use card number that can be set with transaction level controls, providing configurability, flexibility and control over spending.

Disbursements and Remittances

Through our Mastercard Move platform, we enable consumers, businesses, governments and merchants to send and receive money domestically and across borders to consumers with greater speed and ease, with a payout reach of more than 17 billion endpoints globally across multiple channels, and in more than 60 originating countries and 155 receiving countries: •We partner with digital messaging and payment platforms to enable consumers to send money directly within applications to other consumers. •We partner with central banks, fintechs and financial institutions to more efficiently enable, as applicable, distribution of social and economic assistance and business-to-consumer (“B2C”) disbursements across various use cases (such as wallet funding, cash payouts, gig worker payouts and insurance claims).•We enable a wide range of cross-border payment flows and use cases to customers (including trade payments, remittances and disbursements). These flows are enabled via a distribution network with a single point of access that allows financial institutions, fintechs and digital partners to send and receive money globally through multiple channels, including bank accounts, mobile wallets, cards and cash payouts.

Our Payment Products and Applications

Consumer Payments

Commercial and New Payment Flows

Disbursements and Remittances

MASTERCARD 2025 FORM 10-K 13

Benefiting and Innovating the Payments Ecosystem

We provide functionality and technology to help our customers provide benefits and experiences for consumers, merchants, businesses and others. •Delivering digital functionality and consumer experiences. We use our technologies and security protocols to develop solutions to make digital shopping and selling experiences, such as on smartphones and other connected devices (both online and in person), simpler, faster and more secure for consumers, businesses and merchants. We also offer products that make it easier for merchants to accept payments and expand their customer base.◦Our contactless payment solutions help deliver a simple and intuitive way to pay. Solutions such as SmartPOS and SoftPOS reduce the barrier to entry for merchants (including small businesses). Our Tap on Phone acceptance technology enables businesses of all sizes to accept payments from any contactless card or mobile wallet directly from their device, providing a turnkey and cost-effective solution without any additional hardware required. We extend our contactless payment solutions to a wide set of commerce use-cases, including instant provisioning of a card into a mobile wallet, verification of a transaction and sending money to family and friends or between businesses.Key 2025 Developments•We launched Mastercard Agent Pay™, a new framework designed to enable secure, scalable and trusted payments in agentic commerce. The solution enables AI-assisted and fully automated agent-based payments across Mastercard's acceptance network. The solution builds upon our existing tokenization capabilities (including Agentic Tokens) and dispute management capabilities. In 2025, we enabled all U.S.-based Mastercard cardholders to participate in this program, with a global launch scheduled for early 2026. Merchants are currently able to participate without the need for significant development or integration. •In 2025, we continued our efforts to support stablecoin across our network by: ◦Enabling the spending of crypto and stablecoin assets across Mastercard's acceptance network through approximately 130 crypto co-brand card programs◦Embedding stablecoins into our Mastercard Move platform, which allows customers to send and receive stablecoin flows seamlessly•In 2025, approximately 40% of all Mastercard transactions are now tokenized◦Our Mastercard Digital First™ program enables our issuing customers to offer their cardholders a fully digital payment experience with an optional physical card, meeting cardholder expectations of immediacy, security and convenience during card application, authentication and instant card access, securing purchases (whether contactless, in-store, in-app or online) and managing alerts, controls and benefits.◦Our Click to Pay checkout experience is designed to provide consumers convenience and security in a digital environment, make it easier for merchants to implement secure digital payments and provide issuers with improved fraud detection and prevention capabilities. This experience enables a faster, more secure checkout experience across internet and mobile sites, mobile apps and connected devices. •Enhancing security and effectiveness of transactions. We focus on securing transactions by replacing card numbers with secure tokens, scaling Mastercard Authentication (including enabling device-based biometrics, such as fingerprints or facial scans, through Mastercard Payment Passkey Service) and streamlining online checkout by eliminating manual entry (through Click to Pay and Secure Card on File). We aim to improve the effectiveness of those transactions by increasing the number of transactions we switch through our differentiated services, increasing approval rates by utilizing inputs from our network and lifting spend and activation rates through personalized campaigns and data-driven strategies.•Creating solutions to unlock new blockchain-based business models. We continue to expand our capabilities to support emerging blockchain‑based payment models through a controlled and risk‑managed framework, applying robust due‑diligence and monitoring standards for partners operating in the digital asset ecosystem. Our solutions enable consumers to use our cards to purchase digital assets and spend those balances across our acceptance network using crypto co-brand cards. Additionally, we support the settlement of stablecoins over our network. •Simplifying access to, and integration of, our digital assets. Our Mastercard Developers platform makes it easy for customers and partners to leverage our many digital assets and services. By providing a single access point with tools and capabilities to find APIs across a broad range of Mastercard services, we enable easy integration of our services into new and existing solutions.•Identifying and experimenting with future technologies, start-ups and trends. Through Mastercard Foundry, we continue to provide customers and partners access to thought leadership, innovation methodologies, new technologies and relevant early-stage fintech players.

Our Services and Other Solutions

•Detection solutions designed to both spot and take action to stop fraudulent behavior and cyber-attacks. Our offerings include fraud scoring technology that scans billions of data points across millions of transactions each day while increasing approvals and reducing false declines, alerts when accounts are exposed to data breaches or security incidents, and network-level monitoring on a global scale to help detect the occurrence of widespread fraud attacks when a customer may be unable to detect or defend against them.•Remediation solutions designed to facilitate the flow of information to ensure consumers have transparency of their transaction data, as well as solutions designed to communicate and remediate disputes related to either fraud or failures in delivery of services to consumers.•Business continuity solutions designed to enable uninterrupted commerce, fostering trust and reliability for both merchants and consumers. These solutions include Mastercard’s Stand-In processing, which is designed to ensure transaction continuity when a card issuer’s systems are unavailable. This solution provides a backup mechanism to authorize transactions on behalf of the issuer based on predefined rules and risk parameters. To deliver effective security solutions, we harness our proprietary data assets, combined with our AI, data analytics and cyber risk assessment capabilities.At the core of our security solutions suite is a focus on delivering an exceptional payments experience. Our solutions are designed to ensure that approvals of legitimate transactions are boosted and transactions flow more smoothly. Our solutions are also designed so that the consumer bears no responsibility (or “zero liability”) for counterfeit or lost card losses in the event of fraud, increasing consumer confidence. In addition, our solutions further enhance the consumer experience by providing effective dispute resolution, subscription controls and transparency through digital receipts.

Benefiting and Innovating the Payments Ecosystem

Our Services and Other Solutions

MASTERCARD 2025 FORM 10-K 15

Consumer Acquisition and Engagement Services

We offer solutions that drive customer acquisition, increase activation, deepen engagement and build loyalty, including: •Marketing services, which drive business growth and profitability through end-to-end, data- and technology-driven marketing. We advance our customers’ growth by helping them to acquire new customers, as well as increase engagement with existing customers, through a curated set of direct marketing solutions and strategies. We focus on business outcomes and combine our proprietary data and insights with our marketing expertise to create innovative solutions that span the entire customer lifecycle, from brand design and product adoption to customer retention and portfolio optimization. Our end-to-end approach is built on collaboration with our customers and partners to constantly optimize marketing performance and deliver results.•Personalization services, which leverage AI to help businesses provide personalized digital experiences for their customers. Our personalization platform and decision engine delivers product recommendations, offers and content to consumers across digital channels. •Issuer and merchant loyalty services, which blend strategy, services, data and technology to deliver loyalty solutions designed to drive consumer engagement with measurable results for our customers. We enable a loyalty ecosystem (deeply integrated within our global payments network) that benefits merchants, financial institutions and consumers via personalized offers, rewards and redemptions, empowering our customers to create experiences unique to their brand and consumers and achieve long-lasting loyalty.

Business and Market Insights

We offer solutions that provide data insights, analytics and advisory services, all of which are designed to help our customers operate with agility, optimize performance and profitability, and innovate for future growth. Offerings within this area include:•Business and operational intelligence solutions consisting of real-time business insights, industry research, economic intelligence and expert-driven recommendations designed to support informed decision-making, monitor performance and respond to macro trends. •Advanced analytics and AI solutions consisting of proprietary and privacy-first data solutions, AI models and analytics software designed to power strategy optimization, business experimentation and transformation, as well as risk management to address complex business challenges and unlock new value.•Consulting and agentic solutions consisting of strategic advisory, rapid prototyping, technical implementation and hands-on support across the payments ecosystem (including agentic solutions), designed to accelerate transformation and scale innovation through global expertise and localized execution. •Payments and portfolio optimization solutions consisting of expertise and technology designed to enhance payment processes, customer engagement and portfolio performance through targeted strategies and data-driven recommendations.

Digital and Authentication

We offer global digital enablement and authentication capabilities that operate across all digital channels including in-store environments, e-commerce platforms and agentic interfaces. These capabilities include:•Digital enablement and checkout services that allow issuers, acquirers, merchants, digital wallets and channel partners (such as payment service providers, gateways, payment facilitators, independent software vendors and payment orchestrators) to provision, access and use tokenized payment credentials that help make commerce more seamless and more secure •Authentication services that help customers grow digital commerce by enabling the verification of cardholder accounts and transactions for issuers and merchants. These services combine sophisticated risk signals, biometrics and other authentication technologies to help reduce fraud, increase approval rates and build trust at scale, while also supporting applicable regulatory and industry standards

Processing and Gateway

We extend our processing capabilities in the payments value chain in various regions with an expanded suite of offerings, including:•Issuer solutions designed to provide customers with a complete processing solution to help them create differentiated products and services and allow quick deployment of payments portfolios across banking channels.•Payment gateways that offer a single interface to enable e-commerce merchants to process secure online and in-app payments and offer other solutions, including outsourced electronic payments, fraud prevention and alternative payment options.

Our People

As of December 31, 2025, we employed approximately 39,800 persons globally, of which approximately 70% were employed outside of the U.S. in more than 90 countries. Our employee base is predominantly full-time. To supplement our employee base, we also had approximately 6,000 contingent workers in order to meet specific needs. Our voluntary workforce turnover (rolling 12-month attrition) was approximately 6% as of December 31, 2025. The total cost of our workforce for the year ended December 31, 2025 was $7.3 billion, which primarily consists of compensation, benefits and other personnel-related costs.Management reviews our people strategy and culture, as well as related risks, with our Human Resources and Compensation Committee on a quarterly basis, and annually with our Board of Directors. Additionally, our Board and Board committees are tasked with overseeing other human capital management matters on a regular basis, such as ensuring processes are in place for maintaining an ethical corporate culture; overseeing key initiatives, policies and practices focused on providing everyone the opportunity to succeed; and monitoring governance trends in areas such as human rights. To enable our business strategy effectively, our aim is to: •attract and retain talent with the key skills and capabilities needed to achieve short-term and long-term goals •develop an agile workforce to collaborate and compete in a fast-paced, innovative environment•build and sustain an inclusive and high-performing culture

Attract talent.

•We continuously recruit talent by leveraging the strength of our brand and utilizing a variety of sources, channels and initiatives in order to support our growth across sectors, markets and emerging industries•Our acquisition activity has also provided a strong source of talent with differentiated skills

Consumer Acquisition and Engagement Services

Business and Market Insights

Digital and Authentication

Processing and Gateway

Our People

Attract talent.

MASTERCARD 2025 FORM 10-K 17

Develop and retain talent. We develop and retain our employees, with a focus on staying competitive and being responsive to changing market dynamics. We also continue to build and promote the behaviors that underpin our culture. Our programs and practices include: •An annual cycle that focuses on objective setting, performance assessment aligned with the Mastercard Way behaviors, skills development and career progression opportunities•Succession planning for key roles as well as leadership development programming across various career levels, including personalized coaching •Learning resources and courses for all employeesThe Mastercard WayThe Mastercard Way is the statement of our culture. It consists of three principles:•Create value•Grow together•Move fastThese principles address where we are going as an organization, how we work together and how we deliver for our customers and each other.•A competitive compensation approach (subject to periodic reviews) under which eligible employees across multiple job levels can receive long-term incentive equity awards•Contributions to employees’ financial well-being as they plan for retirement through our “Investing in You” initiative, which sets a global minimum standard of 10% of base pay toward retirement•Continued expansion and prioritization of well-being offerings for employees, focused on supporting their minds, bodies and financial and social well-being, as well as embracing flexibility •Flexibility policies and programs to support employees, including a four-week ”work from elsewhere” policy, meeting-free days and a hybrid work approach with an average of at least three days in the office per week•Supporting employees in giving back to their communities, including providing matching gifts for charitable donations that they make, donating to eligible charities of their choice for every applicable hour that they volunteer, and providing five paid days per year for full-time employees to engage in eligible volunteer work•Experience surveys that we periodically run to assess our overall employee engagement areas (with occasional focus on more targeted topics) and prioritize how we address emerging opportunity areas•A culture of high ethical business practices and compliance standards, grounded in honesty, decency, trust and personal accountability. It is driven by “tone at the top,” reinforced with regular training, fostered in a speak-up environment, and measured by our periodic employee surveys and other metrics that enable our Board to maintain a pulse on areas of strength and opportunities for improvementEnvironment. We strive to create an environment where everyone feels valued and empowered to do their best work. This helps build a healthy culture, attract talent and drive long-term value for stockholders. We are continuously evolving our approach, guided by the following priorities:•We customize our global community and belonging strategy by region. This customized strategy, implemented and executed by local leadership, is designed to ensure we reflect the viewpoints of appropriate stakeholders and consider cultural nuances as part of our work toward providing everyone the opportunity to succeed•We remain dedicated to practices designed to ensure there is equal pay for equal work. We have established a framework for examining pay practices annually, supported by third-party analysis and benchmarked to the external market. We assess compensation decisions for potential pay disparities

Brand

Our brand plays an important role in building preference for our products and services, from the primary Mastercard brand to Maestro and Cirrus. We manage our brands across all aspects of our strategic priorities – consumer payments, commercial and new payment flows, and services and other solutions – to reinforce the connectivity and value of our offerings across our broad customer base. We bring our brand to life through a range of activities, including advertising, promotions and sponsorships, customer events, digital marketing, mobile marketing and social media initiatives. Over the course of nearly 30 years, “Priceless®” has evolved from an advertising campaign in more than 120 countries worldwide to a broader platform that reinforces special memories, passions and experiences in people’s personal and business lives. In all of its forms, the brand delivers a consistent, recognizable message that supports and promotes the benefits, acceptance and usage of our products and services around the globe.Key 2025 Developments•In 2025, Mastercard announced it would become the official naming partner of the McLaren Formula 1 Team, starting with the 2026 season.

Data and AI

We create a range of products and services for our customers that use our data and AI assets, technology, platforms and expertise. These products and services are designed to make commerce smarter, more secure and more personal. Our data comes from an increasing variety of sources, such as transaction data (including from gateway, card and real-time payments), open finance, digital identities, buyer/supplier payment preferences, device attributes, digital threat assessments, rewards redemptions and unstructured data (such as our manuals and publications). This data also helps power our operations to drive efficiency and clarity in solutions for our employees and customers. We continually invest in data cleansing, structuring and modeling and robust governance to help make this data accurate and available for use in AI to be deployed at scale. We utilize our data using traditional analytical methodologies and an ever-increasing range of AI, including machine learning, natural-language processing, neural networks and generative AI. We aim to help power economies and empower people through AI-driven initiatives that enhance security, data insights, personalization and efficiency. We do all this while following our Data and Tech Responsibility Principles in how we design, implement and deliver those solutions. Our Privacy by Design, Data by Design and AI Governance processes are designed to ensure we embed multiple layers of privacy, data protection and information security controls in all our products and services, keeping a clear focus on protecting customers’ and individuals’ data. We seek to do this in a number of ways: •Implementing accountability. We practice robust data and AI governance aimed at ensuring that we have appropriate controls and oversight over the use of our data and technology•Practicing data minimization. We practice collecting and retaining only the personal information that is needed for a given product or service, and limiting the amount and type of personal information shared with third parties•Being transparent and providing control. We explain how we use personal information and AI and give individuals access and control over how their data is used and shared•Working with trusted partners. Our processes are designed to ensure we select partners and service providers who implement high standards similar to ours for protecting data and using AI•Addressing fairness in our data and AI. We are implementing governance and processes to help test and mitigate for bias when we use advanced analytics, including AI and machine learning, to create fair and inclusive solutions that reflect individual, group and societal interests•Fostering inclusion and advancing positive social impact. Where possible, we utilize our data sets and analytics capabilities to create innovative solutions to societal challenges, benefit society and promote inclusive financial, social, climate, health and education growth

Brand

Data and AI

MASTERCARD 2025 FORM 10-K 19

Technology

We utilize our technology to help grow our core, diversify into new customers and geographies and build new areas for the future, while also enhancing our operational strength and enabling our employees to deliver effectively for our customers. Our technology enables the scale of our network and accelerates our growth in payments, data and services, across the following key areas:

Creating value for customers around the world:

•Standardizing and simplifying how we connect with customers, starting at the edge of our network, to provide them with the tools to manage and expand their Mastercard relationship•Deploying our cloud-native technology infrastructure to adapt to evolving market conditions and further enhance speed, resiliency and scalability

Enabling our full range of products and services:

•Enhancing payment rails and expanding them across payments and services, including providing seamless customer adoption across new services and solutions•Further evolving our data infrastructure and utilizing AI to unlock incremental value and differentiated offerings, and ensure ongoing compliance with evolving data laws and regulations

Empowering our employees:

•Improving the speed in which we deliver for our customers through a combination of AI-enabled tools and customer-centric practices •Attracting, developing and retaining top technology talent, as well as strengthening our employees’ technology acumen

How We Help Consumers, Businesses and Governments

Through our unique set of products and services, as well as the power of our technology, innovation and network, we work with our customers to provide benefits to consumers, businesses and governments around the globe.

We benefit consumers by:

•making electronic payments more convenient, secure and efficient•delivering better, seamless consumer experiences•providing consumers choice, empowering them to make and receive payments in the ways that best meet their daily needs•protecting consumers and all other participants in a transaction, as well as consumer data•enabling loyalty rewards and benefits

We benefit businesses by:

•enabling our merchant partners to accept secure and reliable payments for both in-store and online purchases, as well as helping to protect them from fraud before it occurs•delivering technology that helps to support digital identity and verification of participants in a transaction, especially when a pre-existing relationship does not exist•providing them access to data analytics platforms and actionable insights to help them better understand their business as well as their co-brand portfolio performance (as applicable)•helping small businesses obtain the digital, security and financial tools necessary to help enable future growth •supporting community financial institutions (including local banks, minority depository institutions and credit unions) to make it easier for small and underserved businesses to get the funding they need•offering free and effective cyber tools to help small businesses take immediate action to reduce the risk of cyberattacks•connecting small businesses (via local and national partnerships) with expert organizations to help them develop new skills and grow their capabilities

We benefit governments by:

•offering technologies to help drive efficiencies and deliver more inclusive and sustainable economic development•supporting their efforts to disburse public funds seamlessly, digitize revenue collections and simplify procurement at a lower cost•providing aggregated and anonymized data insights to help assess and tailor their policies•enabling their efforts to digitize and modernize their public infrastructure while reducing costs, delivering more seamless services and improving citizen satisfaction•empowering them to deliver effective emergency response in times of need (as well as drive financial inclusion) through combined welfare and disbursement programs•offering cybersecurity solutions that help them safeguard their platforms, digital transactions and ecosystem against fraudulent activityRevenue Sources Mastercard is a payments network service provider that generates revenue from a wide range of payments solutions we provide to our customers. We classify our net revenues, which include the impact of rebates and incentives, from contracts with customers into two categories: (i) payment network and (ii) value-added services and solutions. Within our payment network, revenue is primarily generated from charging fees to our customers based on GDV (which includes both domestic and cross-border volume) on the cards that carry our brands and for providing switching and other network-related services. Within our value-added services and solutions, we generate revenue primarily related to the following: •Security solutions•Consumer acquisition and engagement services•Business and market insights•Digital and authentication solutions•Processing and gateway•Other solutions (including ACH batch and real-time account-based payments and solutions, bill payments, cross-border services and open finance)See “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Revenue” in Part II, Item 7 and Note 3 (Revenue) to the consolidated financial statements included in Part II, Item 8 for more detail about our revenue.Intellectual PropertyWe own a number of valuable trademarks that are essential to our business, including Mastercard, Maestro and Cirrus, through one or more affiliates. We also own numerous other trademarks covering various brands, programs and services offered by us to support our payment programs. Trademark and service mark registrations are generally valid indefinitely as long as they are used and/or properly maintained. Through license agreements with our customers, we authorize the use of our trademarks on a royalty-free basis in connection with our customers’ issuing and merchant acquiring businesses. In addition, we own a number of patents and patent applications relating to payment solutions, transaction processing, smart cards, contactless, mobile, biometrics, AI, security systems, blockchain and other technologies, which are important to our business operations. These patents expire at varying times depending on the jurisdiction and filing date.CompetitionWe face a number of competitors both within and outside of the global payments industry. We compete in all categories of payments (including paper-based payments and all forms of electronic payments) as well as in all categories in which we provide services and solutions:•General Purpose Payments Networks. We compete worldwide with payments networks such as Visa, American Express, JCB, China UnionPay and Discover, among others. These competitors tend to offer a range of card-based payment products. Some competitors have more market share than we do in certain jurisdictions. Some also have different business models that may provide an advantage in pricing, technology, regulatory compliance burdens or otherwise. Globally, financial institutions may issue both Mastercard-branded and competitor payment products, and we compete for business on the basis of individual portfolios or programs. In addition, a number of our customers issue American Express-, China UnionPay- and/or Discover-branded payment cards in a manner consistent with a four-party system. We continue to face intense competitive pressure on

Technology

Creating value for customers around the world:

Enabling our full range of products and services:

Empowering our employees:

How We Help Consumers, Businesses and Governments

We benefit consumers by:

We benefit businesses by:

We benefit governments by:

MASTERCARD 2025 FORM 10-K 21

the prices we charge our issuers and acquirers, and we seek to enter into business agreements with them through which we offer incentives and other support to issue and promote our payment products. •Debit and Local Networks. We compete with ATM and point-of-sale debit networks. In various countries, local debit brands serve as the main domestic brands, while our brands are used mostly to enable cross-border transactions (typically representing a small portion of overall transaction volume). In addition, several governments are promoting, or considering promoting, local networks for domestic switching. See “Risk Factors” in Part I, Item 1A for a more detailed discussion of the risks related to payments system regulation and government actions that may prevent us from competing effectively.•Real-time Account-based Payments Systems. We face competition in the ACH and real-time account-based payments space from providers of infrastructure, applications and services. As these real-time account-based propositions mature, we face a possible increase in competition for our existing domestic person-to-merchant (“P2M”) and person-to-person (“P2P”) transaction market share. Similarly, as interlinking of these infrastructures is further explored, they could disrupt our existing cross-border P2M and P2P market share. Also, several industry initiatives are experimenting with the concept of account-based global schemes, which could lead to a disruption of the clearing and settlement options utilized in various currencies.•Digital Wallets and other Fintechs. As the global payments industry becomes more complex, we face increasing competition from fintechs and other emerging payments providers, both for customers and data. Many of these providers have developed payments systems focused on online activity in e-commerce and mobile channels (in some cases, expanding to other channels), and may process payments using in-house account transfers, real-time account-based payments networks or global or local networks, in addition to card. Examples include digital wallet providers, point-of-sale financing/buy-now-pay-later providers, mobile operator services, mobile phone-based money transfer and microfinancing services, device manufacturers, B2B accounts payable and accounts receivable providers. •Digital Public Infrastructure and Other Government-Backed Solutions. Governments have been focused on creating and expanding local digital payments structures. Increasingly, these structures include digital public infrastructure (DPI), which is owned by governments and often supported by third parties, and aim to provide payments services as a public good. Government- and central bank-backed structures (such as the Brazilian Instant Payment System-PIX, FedNow in the U.S. and United Payments Interface (UPI) in India), are increasingly being considered as alternatives to traditional domestic payment solutions and schemes such as ours. In addition to local and regional networks, national governments continue to explore the use of central bank digital currencies (“CBDCs”), which may be launched with their own networks to transfer money between participants.•Digital Currencies. Stablecoins and cryptocurrencies may become more popular as they potentially become more regulated around the globe (through laws such as the GENIUS Act, which in 2025 became the first major crypto legislation in the U.S.) and are increasingly perceived to provide immediacy, 24/7 accessibility, immutability and efficiency. Some players, including payment service providers and payment facilitators, have started to enable merchant acceptance of such currencies in P2M, while some banks have started experimenting with blockchain B2B payments. Digital currencies and emerging players (such as crypto natives) have the ability to disrupt traditional financial markets. The increased prominence of digital currencies creates an opportunity for us, but could also compete with our products and services. •Services and Solutions Providers. We face competition from companies that provide alternatives to our services and solutions. These companies include information services and consulting firms that provide consulting services and insights to financial institutions, merchants and governments, technology companies that provide cyber and fraud solutions (including AI-based solutions), and companies that compete against us as providers of loyalty and program management solutions. We also face competition from companies that provide alternatives to our other solutions, including open finance. Regulatory initiatives could also lead to increased competition in this space.We play a valuable role as a trusted intermediary in a complex system, creating value for individual stakeholders and the payments ecosystem overall. Our competitive advantages include: Collectively, the capabilities that we have created organically, and those that we have obtained through acquisitions, support and build upon each other to enhance the total proposition we offer our customers. They enable us to partner with many participants in the broader payments ecosystem and provide choice, security and services to improve the value we provide to our customers.

MASTERCARD 2025 FORM 10-K 23

Government RegulationAs a technology company in the global payments industry, we are subject to government regulation that impacts key aspects of our business. In particular, we are subject to the laws and regulations that affect the payments industry in the many countries in which our products and services are used. We are committed to complying with all applicable laws and regulations and implementing policies, procedures and programs designed to promote compliance. We monitor and coordinate globally while acting locally and establish relationships to assess and manage the effects of regulation on us. See “Risk Factors” in Part I, Item 1A for more detail and examples of the regulation to which we are subject. Payments Oversight and Regulation. Central banks and other regulators around the world either have established, or are seeking to establish, formal oversight over participants in the payments industry, as well as authority to regulate payments systems in their countries. Such authority has resulted in certain of these entities regulating Mastercard as financial market infrastructure, as well as establishing oversight related to various aspects of our business (including areas such as consumer protections and cybersecurity). In the European Union (the “EU”), Mastercard has been designated as a systemically important payment system (SIPS) and is subject to systemic importance regulation, which includes various requirements we must meet, including obligations related to governance and risk management. In the U.K., the Bank of England designated Vocalink™, our real-time account-based payments network platform, as a “specified service provider”, and Mastercard as a “recognized payment system”, which includes supervisions and examination requirements. We have also been designated by certain jurisdictions as “critical infrastructure”, which includes cyber and physical security resilience requirements and related reporting obligations. In addition, EU legislation requires us to separate our scheme activities (brand, products, franchise and licensing) from our switching activities and other processing in terms of how we go to market, make decisions and organize our structure. Examples of other markets where Mastercard is formally overseen include Australia, Brazil, India, Mexico, South Africa and Canada. Additionally, certain of our subsidiaries are also regulated as payments institutions and payment service providers, including as money transmitters. This regulation subjects us to licensing obligations, regulatory supervision and examinations, as well as various business conduct and risk management requirements.Interchange Fees. Interchange fees that support the function and value of four-party payments systems like ours are subject to regulation in some jurisdictions. Examples include statutes in the U.S. that cap debit interchange for certain regulated activities, proposed legislation in the U.S. to extend routing mandates to credit and the EU regulation capping consumer credit and debit interchange fees. Interchange fees are also periodically subject to litigation. For more detail, see “Risk Factors - Other Regulation” in Part I, Item 1A and Note 19 (Legal and Regulatory Proceedings) to the consolidated financial statements included in Part II, Item 8.Key 2025 Developments•In July 2025, the EU introduced its revised systemic importance regulation, covering companies such as ours that have been designated as systemically important. The revision introduces a framework for cyber resilience and detailed rules for managing outsourcing risks. It also amended the definition of a SIPS operator in such a way as to extend to more companies in the payments ecosystem. •In November 2025, the Central Bank of Brazil established a new regulation for all Payment Scheme Operators (PSOs) in Brazil (including Mastercard and Visa), enhancing governance, risk management and transparency standards across the payments ecosystem. The new regulation reinforces the PSOs’ accountability for the financial and settlement integrity of payments to merchants (including in cases of default, operational failure or insolvency of any of their scheme participants) and, in particular, requires payment networks to extend their settlement guarantees to previously non-guaranteed transactions (such as merchant installment transactions). Although the regulation has already been enacted, its full implementation remains subject to the development and formal submission by PSOs of their corresponding governance and risk management frameworks, as well as to the Central Bank’s review and approval of these frameworks. The conclusion of this process is expected to occur by November 2026.•In August and September of 2025, two separate Federal district courts issued conflicting decisions regarding the validity of the interchange cap set by the Federal Reserve in Regulation II (related to the Durbin Amendment to the Dodd-Frank Wall Street Reform and Consumer Protection Act). One court vacated the interchange cap while the other upheld it. The interchange cap remains in effect while the litigation continues.•The New Zealand Commerce Commission approved the implementation of caps on cross-border interchange for most types of card transactions, effective May 2026. Preferential or Protective Government Actions. Some governments have taken action to provide resources, preferential treatment or other protection to selected domestic payments and processing providers, as well as to create their own national providers. For example, governments in some countries (such as South Africa) mandate switching of domestic payments either entirely in that country or by only domestic companies. Some jurisdictions are currently considering adopting or have adopted data localization requirements, which mandate the collection, storage, and/or other processing of data within their borders. This is the case, for instance, in India, China and Saudi Arabia. Various forms of data localization requirements or data transfer restrictions are also under consideration in other countries and jurisdictions, including the EU. Anti-Money Laundering, Countering the Financing of Terrorism, Economic Sanctions and Anti-Corruption. We are subject to anti-money laundering (“AML”) and countering the financing of terrorism (“CFT”) laws and regulations globally, including the U.S. Bank Secrecy Act and the USA PATRIOT Act, as well as the various economic sanctions programs, including those imposed and administered by the U.S. Office of Foreign Assets Control (“OFAC”) and the European Union. We have implemented a comprehensive AML/CFT program, comprised of policies, procedures and internal controls, including the designation of a compliance officer, which is designed to prevent our payment network from being used to facilitate money laundering and other illicit activity and to address these legal and regulatory requirements and assist in managing money laundering and terrorist financing risks. The economic sanctions programs administered by OFAC restrict financial transactions and other dealings with certain countries and geographies (specifically Crimea, the Donetsk People’s Republic and Luhansk People’s Republic regions of Ukraine, Cuba, Iran and North Korea) and with persons and entities included in OFAC sanctions lists including its list of Specially Designated Nationals and Blocked Persons (the “SDN List”). We take measures to prevent transactions that do not comply with OFAC and other applicable sanctions, including establishing a risk-based compliance program that has policies, procedures and controls designed to prevent us from having unlawful business dealings with prohibited countries, regions, individuals or entities. As part of this program, we obligate issuers and acquirers to comply with their local sanctions obligations and U.S. and EU sanctions programs. In the U.S., these obligations include requiring the screening of account holders and merchants against OFAC sanctions lists (including the SDN List). Iran and Syria have been identified by the U.S. State Department as terrorist-sponsoring states. We do not maintain operations, assets or licensed customers in Iran. While we currently have no operations in Syria, we are evaluating market entry in strict accordance with applicable laws and restrictions. We are also subject to anti-corruption laws and regulations globally, including the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act, which, among other things, generally prohibit giving or offering payments or anything of value for the purpose of improperly influencing a business decision or to gain an unfair business advantage. We have implemented policies, procedures and internal controls to proactively manage corruption risk.Issuer and Acquirer Practices Legislation and Regulation. Our issuers and acquirers are subject to numerous regulations and investigations applicable to banks, financial institutions and other licensed entities, which can indirectly impact us. Additionally, regulations such as the EU’s Payment Services Directive in the EEA require financial institutions to provide third-party payment processors access to consumer payment accounts, enabling them to route transactions away from Mastercard products and provide payment initiation and account information services directly to consumers who use our products. Regulation of Internet and High-Risk Merchant Categories. Various jurisdictions have enacted regulation related to internet transactions (such as laws surrounding gambling, including fantasy sports), which impacts both us and our customers. We are also impacted by evolving laws surrounding certain legally permissible but high-risk merchant categories, such as adult content, firearms, alcohol and tobacco. Privacy, Data, AI and Information Security. Aspects of our operations or business are subject to increasingly complex, fragmented, overlapping and/or divergent privacy, data, AI and information security laws and regulations in the U.S., the EU and elsewhere around the world. For example, in the U.S., we and our customers are respectively subject to, among other laws and regulations, Federal Trade Commission and federal banking agency information safeguarding requirements under the Gramm-Leach-Bliley Act (GLBA) that require, among other things, the maintenance of a written, comprehensive information security program and, increasingly, a number of state data and privacy laws. We and our customers may also be subject (where applicable) to evolving U.S. federal and/or state AI and data laws and regulations, including those related to national security. With respect to information security, we are subject to new and evolving cyber notification regimes, including data protection authorities, cyber authorities and law-enforcement. We are also subject to public disclosure requirements related to cyber incidents, such as the U.S. Securities and Exchange Commission (the SEC) disclosure rules that require, among other things, disclosing material cybersecurity incidents in a Current Report on Form 8-K, generally within four business days of determining an incident is material. In the EU, we are subject to the General Data Protection Regulation (the GDPR) and its equivalent in the U.K., which requires, among other things, a comprehensive privacy, data protection and information security program to protect the personal and sensitive data of EEA residents. Several regulators and policymakers around the globe use the GDPR as a reference to adopt new or updated privacy, data and information security laws and regulations, although divergences have occurred. Laws and regulations in this area are constantly evolving due to several factors, including increasing data collection and data flows, numerous data breaches and security incidents, more sensitive data categories, and emerging technologies such as AI (which is now subject to regulation in the EU as well as other

MASTERCARD 2025 FORM 10-K 25

places). In addition, the interpretation and application of these privacy, data, AI and information security laws and regulations are often uncertain and in a state of flux, thus requiring constant monitoring and governance.Additional Regulatory Developments. Various regulatory agencies around the world continue to examine a wide variety of issues that could impact us, including evolving laws and guidance surrounding buy-now-pay-later, open finance, credit reporting, digital currencies (including stablecoins), marijuana, prepaid payroll cards, identity theft, account management guidelines, disclosure rules, marketing and operational resilience. Additionally, various jurisdictions have adopted or are increasingly considering adopting laws, regulations and oversight expectations requiring disclosure on environmental, social and governance matters. The focus of such efforts includes climate-related matters, as well as social matters, such as human rights, the treatment of employees and other workforce-related matters.Additional InformationMastercard Incorporated was incorporated as a Delaware corporation in May 2001. We conduct our business principally through our principal operating subsidiary, Mastercard International Incorporated, a Delaware non-stock (or membership) corporation that was formed in November 1966. For more information about our capital structure, including our Class A common stock (our voting stock) and Class B common stock (our non-voting stock), see Note 14 (Stockholders' Equity) to the consolidated financial statements included in Part II, Item 8.Website and SEC ReportsOur internet address is www.mastercard.com. From time to time, we may use our corporate website as a channel of distribution of material company information. Financial and other material information is routinely posted and accessible on the investor relations section of our corporate website. You can also visit “Investor Alerts” in the investor relations section to enroll your email address to automatically receive email alerts and other information about Mastercard.Our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to those reports are available for review, without charge, on the investor relations section of our corporate website as soon as reasonably practicable after they are filed with, or furnished to, the SEC. The information contained on our corporate website, including, but not limited to, our Impact Report and our U.S. Consolidated EEO-1 Report, is not incorporated by reference into this Report. Our filings are also available electronically from the SEC at www.sec.gov.Item 1A. Risk factors

RISK HIGHLIGHTSLegal and RegulatoryBusiness and OperationsPayments Industry RegulationCompetition and TechnologyBrand, Reputational Impact and Environmental, Social and GovernancePreferential or Protective Government ActionsInformation Security and Operational ResilienceTalent and CulturePrivacy, Data, AI and Information SecurityStakeholder RelationshipsAcquisitions and Strategic InvestmentsOther RegulationGlobal Economic and Political EnvironmentSettlement and Third-Party ObligationsLitigationClass A Common Stock and Governance Structure

Legal and Regulatory

Payments Industry Regulation

Global regulatory and legislative activity related to the payments industry may have a material adverse impact on our overall business and results of operations.

Central banks and similar regulatory bodies have increasingly established or further expanded their authority over certain aspects of payments systems such as ours, including obligations or restrictions with respect to the types of products and services that we may offer, the countries in which our products and services may be used, the way we structure and operate our business and the types of consumers and merchants who can obtain or accept our products or services. Similarly, jurisdictions that regulate a particular product may consider extending their jurisdiction to other products. For example, debit regulations could lead to regulation of credit products. Moreover, several jurisdictions are demonstrating increased interest about the network fees we charge to our customers (in some cases as part of broader market reviews of retail payments), which could in the future lead to regulation relating to our network fees. In several jurisdictions, we have been designated as a “systemically important payment system”, with other regulators considering similar designations. This type of regulation and oversight is related to switching activities, and includes policies, procedures and requirements related to risk management, collateral, participant default, timely switching of financial transactions, and capital and financial resources. Parts of our business have also been deemed as a “specified service provider” or considered “critical infrastructure”. The impact to our business created by any new law, regulation or designation is magnified by the potential it has to be replicated in, or conflict with, other jurisdictions, or involve other products within any particular jurisdiction.Our strategic expansion of our products and services has also created the need for us to obtain new types and increasing numbers of regulatory licenses, resulting in increased supervision and additional compliance burdens distinct from those imposed on our payment network activities. For example, certain of our subsidiaries maintain money transfer licenses that typically impose supervisory and examination requirements, as well as capital, safeguarding, risk management and other business obligations. Increased regulation and oversight of payments systems, as well as increased exposure to regulation resulting from changes to our products and services, have resulted and may continue to result in significant compliance and governance burdens or otherwise increase our costs. As a result, customers could be less willing to participate in our payments system and/or use our other products or services, reduce the benefits offered in connection with the use of our products (making our products less desirable to consumers), reduce the volume of domestic and cross-border transactions or other operational metrics, disintermediate us, impact our profitability and/or limit our ability to innovate or offer differentiated products and services, all of which could materially and adversely impact our financial performance. In addition, any regulation that is enacted related to the type and level of network fees we charge our customers could also materially and adversely impact our results of operations. Regulators could also require us to obtain prior approval for changes to our system rules, procedures or operations, or could require customization with regard to such

MASTERCARD 2025 FORM 10-K 27

changes, which could negatively impact us. Moreover, failure to comply with the laws and regulations to which we are subject could result in fines, sanctions, civil damages or other penalties, which could materially and adversely affect our overall business and results of operations, as well as have an impact on our brand and reputation.

Increased activity with respect to interchange rates could have an adverse impact on our business.

Interchange rates are a significant component of the costs that merchants pay in connection with the acceptance of products associated with our payment network. Although we do not earn revenues from interchange, interchange rates can impact the volume of transactions we see on our payment products. If interchange rates are too high, merchants may stop accepting our products or route transactions away from our network. If interchange rates are too low, issuers may stop promoting our products and services, eliminate or reduce loyalty rewards programs or other account holder benefits (e.g., free checking or low interest rates on balances), or charge fees to account holders (e.g., annual fees or late payment fees).Governments and merchant groups in a number of countries have implemented or are seeking interchange rate reductions through legislation, regulation and litigation. See “Business - Government Regulation” in Part I, Item 1 and Note 19 (Legal and Regulatory Proceedings) to the consolidated financial statements included in Part II, Item 8 for more details.If issuers cannot collect or we are required to reduce interchange rates, issuers may be less willing to participate in our four-party payments system. Alternatively, they may reduce the benefits associated with our products, choose to charge higher fees to consumers to attempt to recoup a portion of the costs incurred for their services, or seek a fee reduction from us to decrease the expense of their payment programs (particularly if regulation has a disproportionate impact on us as compared to our competitors in terms of the fees we can charge). These and other impacts could make our products less desirable to consumers, limit our ability to innovate or offer differentiated products, and/or make proprietary three-party networks or other forms of payment more attractive, ultimately reducing the volume of transactions over our network and our profitability.We are devoting substantial resources to defending our right to establish interchange rates in regulatory proceedings, litigation and legislative activity. The potential outcome of any of these activities could have a more positive or negative impact on us relative to our competitors. If we are ultimately unsuccessful in defending our ability to establish interchange rates, any resulting legislation, regulation and/or litigation may have a material adverse impact on our overall business and results of operations. In addition, regulatory proceedings and litigation could result (and in some cases has resulted) in us being fined and/or having to pay civil damages, the amount of which could be material.

Limitations on our ability to restrict merchant surcharging could materially and adversely impact our results of operations.

We have historically implemented policies, referred to as no-surcharge rules, in certain jurisdictions, including the U.S. and Canada, that prohibit merchants from charging higher prices to consumers who pay using our products instead of other means. Authorities in several jurisdictions have acted to end or limit the application of these no-surcharge rules (or indicated interest in doing so). Additionally, our no-surcharge rules now permit U.S. and Canadian merchants to surcharge credit cards (subject to certain limitations). If, over time, an increased number of merchants choose to surcharge as permitted, this could result in consumers viewing our products less favorably and/or using alternative means of payment. These responses could result in a decrease in our overall transaction volumes, which in turn could materially and adversely impact our results of operations.

Preferential or Protective Government Actions

Preferential or protective government actions related to domestic payment services could adversely affect our ability to maintain or increase our revenues.

Governments in some countries have acted, or in the future may act, to provide resources, preferential treatment or other protection to selected national or domestic payment and switching providers, or have created, or may in the future create, their own national provider. These actions may displace us from, prevent us from entering into, or substantially restrict us from participating in, particular geographies, and may prevent us from competing effectively against those providers. For example:•Governments in some countries have implemented, or may implement, regulatory requirements that mandate switching of domestic payments either entirely in that country or by only domestic companies. •Some jurisdictions have implemented, or are considering implementing, requirements to collect, store and/or process data within their borders, as well as prohibitions on the transfer of data abroad, leading to technological and operational implications as well as increased compliance burdens and other costs. •Geopolitical events and any resulting OFAC sanctions, adverse trade policies, enforcement of U.S. laws related to countering the financing of terrorism, economic sanctions and anti-corruption, or other types of government actions could lead affected or other jurisdictions to take actions in response that could adversely affect our business. Moreover, because of various concerns jurisdictions may have with respect to our business, including any decisions we may make relating to entering or exiting a particular market, such jurisdictions may decide to begin to or increase their focus on growing local payment networks and other solutions. •Regional groups of countries are considering, or may consider, efforts to restrict our switching of regional transactions.•Governments have been increasingly creating and expanding local payments structures, which are increasingly being considered as alternatives to traditional domestic payment solutions and schemes such as ours. Such developments prevent us from utilizing our global switching capabilities for domestic or regional customers. In addition, to the extent a jurisdiction determines us not to be in compliance with regulatory requirements (including those related to data localization), we have been, and may again in the future be, subject to resource and time pressures in order to come back into compliance. Our inability to effect change in, or work with, these jurisdictions could adversely affect our ability to maintain or increase our revenues and extend our global brand. Additionally, some jurisdictions have implemented, or may implement, foreign ownership restrictions, which could potentially have the effect of forcing or inducing the transfer of our technology and proprietary information as a condition of access to their markets. Such restrictions could adversely impact our ability to compete in these markets.

Privacy, Data, AI and Information Security

Regulation and enforcement of privacy, data, AI, information security and the digital economy could increase our costs and lead to legal claims and fines, as well as negatively impact our growth and reputation.

We are subject to increasingly complex, fragmented, overlapping and/or divergent laws and regulations related to privacy and data protection, data use and governance, AI and information security (including with respect to cybersecurity and cyber-risk) in the jurisdictions in which we do business. New or updated laws and regulations have led, and may continue to lead, to similar, stricter or at times conflicting requirements, creating an uncertain regulatory environment. For example, some jurisdictions have implemented or are otherwise considering requirements to collect, store and/or process data within their borders, as well as prohibitions on the transfer of and access to data abroad, leading to technological and operational implications. Other jurisdictions have adopted or are otherwise considering adopting sector-specific regulations for the payments industry and other industries in which we participate, including forced data sharing requirements or additional verification requirements. With respect to information security, any single breach could require parallel notifications to data protection authorities, cyber authorities and/or law-enforcement, often requiring different thresholds, reporting deadlines and formats. In addition, laws and regulations on AI, data governance and credit decisioning may overlap or conflict with, or diverge from, general privacy rules. Overall, these myriad laws and regulations may require us to modify or limit our data processing practices and policies, incur substantial compliance-related costs and expenses, and otherwise suffer adverse impacts on our business. Failure to comply with any of these laws, regulations and requirements (including as a result of conflicting regulations) could result in fines, sanctions or other enforcement actions or penalties (both civil and criminal), which could materially and adversely affect our results of operations and overall business, as well as have an impact on our reputation.As a user and deployer of AI technology, we are also subject to increasing and evolving laws and regulations related to AI governance, including the EU AI Act, and new applications of existing laws and regulations to AI. How our use and deployment of AI will be regulated is still developing as policymakers around the world consider how to regulate AI, and uncertainty remains as to how AI technology or its application (such as in agentic commerce) will continue to advance. In addition, the use of AI creates or amplifies risks that are challenging to fully prevent or mitigate. In particular, AI algorithms may generate inaccurate, unintended, unfair, biased or discriminatory outcomes (which may not be easily detectable or explainable) and may inadvertently disclose confidential information and/or breach intellectual property, privacy or other rights. Our implementation of robust AI governance and risk management frameworks, designed to ensure our responsible use of AI and help us to comply with emerging laws and regulations, may not be sufficient protection against these emerging risks. Further, as we acquire new companies and develop integrated and personalized products and services to meet the needs of a changing marketplace, we have expanded and may further expand our data profile through additional data types and sources, across multiple channels, and involving new partners. This expansion has amplified and may continue to amplify the impact of these various laws and regulations on our business or subject us to new laws and regulations. For example, as a provider of global threat intelligence services through Recorded Future, we are subject to increased exposure to certain laws and regulations, including global cybercrime and other laws and regulations in various jurisdictions. As a result, we are required to constantly monitor our data practices and potentially change them when necessary or appropriate. We also need to provide increased care in our data management, governance, quality and accuracy practices, particularly as it relates to the use of data in products leveraging AI.New requirements and rules, or changing interpretations of existing requirements in these areas, or the development of new regulatory schemes related to the digital economy in general, may also increase our costs and/or restrict our ability to leverage data or use AI for innovation. This could impact the products and services we offer and other aspects of our business, such as fraud

MASTERCARD 2025 FORM 10-K 29

monitoring, the need for improved data management, governance, quality and accuracy practices, the development of information-based products and solutions, and technology operations. In addition, these requirements may increase the costs to our customers of issuing payment products or using information products, which may, in turn, decrease the number of our products that they offer. While we intend to comply with all regulatory requirements, innovate responsibly and deploy Privacy by Design, Data by Design and AI Governance approaches to all of our product development, the speed and pace of changes in laws (as well as stakeholder interests) may not allow us to meet rapidly evolving regulatory and stakeholder expectations. Any of these developments could materially and adversely affect our overall business and results of operations.

Other Regulation

Regulations that directly or indirectly apply to Mastercard as a result of our participation in the global payments industry may materially and adversely affect our overall business and results of operations.

We are subject to regulations that affect the payments industry in the many jurisdictions in which our products and services are used. Many of our customers are also subject to regulations applicable to banks and other financial institutions that, at times, consequently affect us. Such regulation has increased significantly in the last several years (as described in “Business - Government Regulation” in Part I, Item 1). Examples include:•Anti-Money Laundering, Countering the Financing of Terrorism, Economic Sanctions and Anti-Corruption. We are subject to AML and CFT laws and regulations globally. Economic sanctions programs administered by OFAC restrict financial transactions and other dealings with certain countries and geographies, and persons and entities. We are also subject to anti-corruption laws and regulations globally, which, among other things, generally prohibit giving or offering payments or anything of value for the purpose of improperly influencing a business decision or to gain an unfair business advantage. •Account-based Payments Systems. In the U.K., aspects of our Vocalink business are subject to the U.K. payment system oversight regime and are directly overseen by the Bank of England.•Issuer and Acquirer Practices Legislation and Regulation. Certain regulations or legislation that do or could impact our issuers and acquirers (such as caps on issuer interest rates) may impact various aspects of our business. Additionally, strong authentication requirements within the EU’s Payment Services Directive in the EEA could increase the number of transactions consumers abandon if we are unable to secure a frictionless authentication experience under these standards. Such an increase could adversely impact our volumes or other operational metrics.Increased regulatory focus on us has resulted and may continue to result in significant compliance and governance burdens or otherwise increase our costs. Similarly, increased regulatory focus on our customers and other stakeholders may cause them to reduce the volume of transactions processed through our systems, or may otherwise impact the competitiveness of our products. Actions by regulators could influence other organizations around the world to enact or consider adopting similar measures, amplifying any potential compliance burden. Additionally, our compliance with new economic sanctions and related laws with respect to particular jurisdictions or customers could result in a loss of business, which could be significant. Moreover, while our risk-based compliance program obligates issuers and acquirers to comply with U.S., EU and local sanctions programs (among other obligations), the failure of those issuers and acquirers to identify potential non-compliance issues either during or after their customer onboarding processes could ultimately impact our compliance with economic sanctions and related laws. Finally, failure to comply with the laws and regulations discussed above to which we are subject could result in fines, sanctions or other penalties. In particular, a violation and subsequent judgment or settlement against us, or those with whom we may be associated, under economic sanctions and AML, CFT, and anti-corruption laws could subject us to substantial monetary penalties, damages, and/or have a significant reputational impact. Each instance may individually or collectively materially and adversely affect our financial performance and/or our overall business and results of operations, as well as have an impact on our reputation.

We could be subject to adverse changes in tax laws, regulations and interpretations or challenges to our tax positions.

We are subject to tax laws and regulations of the U.S. federal, state and local governments as well as various non-U.S. jurisdictions. Current and potential future changes in existing tax laws, including regulatory guidance, are continuously being considered and have been or may be enacted (such as guidelines issued by the Organization for Economic Co-operation and Development (OECD) which impact how multinational enterprises are taxed on their global profits). These changes have and in the future may continue to have an impact on our effective income tax rate and tax payments. Similarly, changes in tax laws and regulations that impact our customers and counterparties, or the economy generally, have impacted and may continue to impact us. In addition, tax laws and regulations are complex and subject to varying interpretations, and any significant failure to comply with applicable tax laws and regulations in all relevant jurisdictions could give rise to substantial penalties and liabilities. Jurisdictions around the globe have also increased tax-related audits, which require time and resources to resolve.Any changes in enacted tax laws, rules, regulatory or judicial interpretations or guidance; any adverse outcome in connection with tax audits in any jurisdiction; or any changes in the pronouncements relating to accounting for income taxes could materially and adversely impact our effective income tax rate, tax payments, financial condition and results of operations.

Litigation

Liabilities or business limitations resulting from litigation could materially and adversely affect our results of operations.

We are a defendant in a number of civil litigations and regulatory proceedings and investigations, including among others, those alleging violations of competition and antitrust law and those involving intellectual property claims (as described in Note 19 (Legal and Regulatory Proceedings) to the consolidated financial statements included in Part II, Item 8). In the event we are found liable in any material litigations or proceedings (particularly in a large class-action lawsuit or on the basis of an antitrust claim entitling the plaintiff to treble damages or under which we were jointly and severally liable), we could be subject to significant damages, which could have a material adverse impact on our overall business and results of operations.Certain limitations have been placed on our business because of litigation and litigation settlements, such as changes to our no-surcharge rule in the U.S. and Canada. Any future limitations resulting from the outcomes of any litigation and litigation settlements (such as the Rules Relief Class settlement as described in Note 19 (Legal and Regulatory Proceedings) to the consolidated financial statements included in Part II, Item 8) or regulatory proceeding, including any changes to our rules or business practices, could impact our relationships with our customers, including reducing the volume of business that we do with them, which may materially and adversely affect our overall business and results of operations.Business and Operations

Competition and Technology

Substantial and intense competition worldwide in the global payments industry may materially and adversely affect our overall business and results of operations.

The global payments industry is highly competitive. Our payment programs compete against competitors both within and outside of the global payments industry and compete in all payment categories, including paper-based payments and all forms of electronic payments. We compete against general purpose payments networks, debit and local networks, ACH and real-time account-based payments systems, digital wallets and other fintechs (focused on online activity across various channels and processing payments using in-house capabilities), digital public infrastructure and other government-backed solutions and digital currencies. We also face competition from companies that provide alternatives to our services and other solutions. Our traditional competitors may have substantially greater financial and other resources than we have, may offer a wider range of programs, services, and payment capabilities than we offer or may use more effective advertising and marketing strategies to achieve broader brand recognition and merchant acceptance than we have. They may also introduce their own innovative programs, services and capabilities that adversely impact our growth. Certain of our competitors to our payment network operate three-party payments systems with direct connections to both merchants and consumers, potentially providing competitive advantages. If we continue to attract more regulatory scrutiny than these competitors because we operate a four-party system, or we are regulated because of the system we operate in a way in which our competitors are not, we could lose business to these competitors. See “Business - Competition” in Part I, Item 1.Certain of our competitors have developed alternative, e-commerce and/or mobile device payments systems, as well as physical store locations. A number of these competitors rely principally on technology to support their services that provides cost advantages, and as a result may benefit from lower costs than we do. Many of these competitors are also able to use existing payment networks without being subject to many of the associated costs. Moreover, these competitors also occupy various roles in the payments ecosystem that enable them to influence payment choice of other participants. With respect to government-backed solutions, including those involving DPI, government participation in structures could prevent us from entering into, or substantially restrict us from participating in, particular geographies. Any of these factors could put us at a competitive disadvantage. Our ability to compete may also be affected by regulatory and legislative initiatives, as well as the outcomes of litigation, competition-related regulatory proceedings and both central bank and legislative activity. If we are not able to differentiate ourselves from our competitors, drive value for our customers and/or effectively align our resources with our goals and objectives, we may not be able to compete effectively against these threats. Our failure to compete effectively against any of the foregoing threats could materially and adversely affect our overall business and results of operations.

MASTERCARD 2025 FORM 10-K 31

Disintermediation from stakeholders both within and outside of the payments value chain could harm our business.

As the payments industry continues to develop and change, we face disintermediation and related risks, including the following:•Parties that process our transactions in certain countries (such as merchants and third-party payment processors) may try to eliminate our position as an intermediary in the payment process by switching transactions directly with issuers or processing transactions directly between issuers and acquirers.•Payments industry participants may develop their own products and services to support our switched transaction and payments offerings, forcing us to change our pricing or practices for our own offerings in order to compete. Participants may also withhold rights to data we use to power our solutions in order to support their own potential future solutions, potentially impacting the effectiveness of our solutions. In addition, governments may promote their own national or international payments platforms, potentially putting us at a competitive disadvantage in those markets, or requiring us to compete differently. Moreover, as central banks experiment with CBDCs, policies and design considerations that governments adopt could impact the extent of our role in facilitating CBDC-based payment transactions, potentially impacting the transactions that we may process over our network.•Payments industry participants continue to invest in and develop alternative capabilities, such as account-based payments, which could facilitate P2M transactions that compete with both our payment network and our additional payments capabilities. •Fintechs and technology companies could develop platforms or networks that disintermediate us from digital payments as well as develop products or services that compete with our customers and could diminish demand for our products and services. In addition, we face a heightened risk that data we share with these companies as part of our products and services could be used in a way that could put us at a competitive disadvantage.•Payments industry participants may merge, create joint ventures or form other business combinations that may strengthen their existing business services, leverage other business models to create a competitive edge over us or create new payment products and services that compete with our products and services.•Regulation may disintermediate issuers by enabling third-party providers opportunities to route payment transactions toward their own forms of payment by offering account information or payment initiation services directly to our product users. Such regulation may also provide these processors with the opportunity to commoditize the data that are included in the transactions they are servicing. Disintermediation of our customers’ business could diminish demand for our products and services.Our failure to compete effectively against any of the foregoing competitive threats could materially and adversely affect our overall business and results of operations.

Continued intense pricing pressure may materially and adversely affect our overall business and results of operations.

In order to increase transaction volumes, enter new markets and expand our products and services, we seek to enter into business agreements with customers through which we offer incentives, pricing discounts and other support that promote our products. In order to stay competitive, we may have to increase the amount of these incentives and pricing discounts so as to meet customer demand for better pricing arrangements and greater rebates and incentives. As a result, we may not be able to grow our volume and/or services to the extent necessary to compensate for the additional costs related to these increased incentives and pricing discounts. In addition, increased pressure on prices increases the importance of cost containment and productivity initiatives in areas other than those relating to customer incentives.In the future, we may not be able to enter into agreements with our customers if they require terms that we are unable or unwilling to offer, and we may be required to modify existing agreements in order to maintain relationships and compete with others in the industry. Some of our competitors are larger with greater financial resources and accordingly may be able to charge lower prices. In addition, to the extent that we offer discounts or incentives under such agreements, we will need to further increase transaction volumes or the amount of services provided in order to benefit from such agreements and to increase revenue and profit, and we may not be successful in doing so, particularly in the current regulatory environment. Our customers also may implement cost reduction initiatives that reduce or eliminate payment product marketing or increase requests for greater incentives or greater cost stability. In addition to decisions made by competitors and customers, we also face pressure from pricing regulation and litigation. Additionally, we face pricing pressure related to real-time account-based payment schemes. These pressures impact both domestic pricing (such as the increased use of schemes that offer increasingly lower or subsidized P2M pricing) and cross-border pricing (including from both competing schemes and global initiatives to lower the cost of cross-border payments to end users). Any of these factors could have a material adverse impact on our overall business and results of operations.

Rapid and significant technological developments and changes could negatively impact our overall business and results of operations or limit our future growth.

The payments industry is subject to rapid and significant technological changes, including new technologies and changes to existing technologies (such as digital assets and blockchain, AI, machine learning, privacy enhancement and cybersecurity). These changes could result in new technologies that may be superior to, or render obsolete, the technologies we currently use in our programs and services. They may also result in new and innovative payment methods, products and services. Additionally, there are a number of factors relating to technology change that could impact us. These include: the inability of third parties on which we rely for the development of and access to new technologies to keep pace with technological changes (including with regard to AI); potential action from third-party patent holders, including notices or inquiries threatening litigation against us or our customers for alleged patent infringement or demanding significant license fees; the scope of, as well as customer and merchant resistance to, industry-wide solutions and standards (such as those related to tokenization or other security technologies); any difficulty we may experience in attracting and retaining employees with technology expertise; and the need to invest resources for new technologies, which could lead to further additional expenses. Any of these developments could impact our ability to develop and adopt new technologies, as well as improve and keep pace with current technologies and reflect such technology in our payments offerings. Moreover, regulatory or government requirements could continue to require us to host and deliver certain products and services on-soil in certain markets. As a result, we may need to alter our technology and delivery model, potentially resulting in additional expenses and/or other operational impacts. Our future success will depend, in part, on our ability to anticipate, develop or adapt to technological changes and evolving industry standards. If we fail to sufficiently develop and adopt new technologies, or improve and keep pace with current technologies and reflect such technology in our payments offerings, our payments offerings could be negatively impacted and/or we could be put at a competitive disadvantage. This could impact our ability to compete with new technologies and products, as well as encourage customers that use our technology to enhance and deliver their payment-related products and services (including fintechs and technology companies) to use their own technology to compete against us. These developments could lead to a decline in the use of our technology, products and services, which could have a material adverse impact on our overall business and results of operations.

Operating a real-time account-based payments network presents risks that could materially affect our business.

U.K. regulators have designated Vocalink, our real-time account-based payments network platform, to be a “specified service provider” and regulators in other countries may in the future expand their regulatory oversight of real-time account-based payments systems in similar ways. Any prolonged service outage on this network could result in quickly escalating impacts, including potential intervention by the Bank of England and significant reputational risk to Vocalink and us. For a discussion of related regulatory risks, see our risk factor in “Risk Factors - Payments Industry Regulation” in this Part I, Item 1A. Furthermore, the complexity of this payment technology requires careful management to address information security vulnerabilities that are different from those faced on our payment network. Operational difficulties, such as the temporary unavailability of our services or products, or information security breaches on our real-time account-based payments network could cause a loss of business for these products and services, result in potential liability for us and adversely affect our reputation.

Working with new customers and end users as we continue to expand our products and services can present operational and onboarding challenges, be costly and result in reputational damage if the new products or services do not perform as intended.

The payments markets in which we compete are characterized by rapid technological change, new product introductions, evolving industry standards and changing customer and consumer needs. In order to remain competitive and meet the needs of the payments markets, we are continually involved in developing and implementing complex multi-rail solutions and diversifying our products and services. These efforts carry the risks associated with any diversification initiative, including cost overruns, delays in delivery and performance problems. These projects also carry risks associated with working with different types of customers (such as corporations that are not financial institutions, non-governmental organizations (NGOs) and new end users). These differences may present new operational challenges, such as enhanced infrastructure and monitoring for less regulated customers.Our failure to effectively design and deliver these products and services could make our other offerings less desirable to these customers, or put us at a competitive disadvantage. In addition, if there is a delay in the implementation of our products or services (which could include compliance obligations, such as AML and CFT, and licensing requirements for applicable products and services), if our products or services do not perform as anticipated, or we are unable to otherwise adequately anticipate risks related to new types of customers, we could face additional regulatory scrutiny, fines, sanctions or other penalties, which could materially and adversely affect our overall business and results of operations, as well as negatively impact our brand and reputation.

MASTERCARD 2025 FORM 10-K 33

Information Security and Operational Resilience

Information security incidents or account data compromise events could disrupt our business, damage our reputation, increase our costs and cause losses.

Information security risks for payments and technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies (including AI), the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, “hacktivists”, terrorists, nation-states, state-sponsored actors and other external parties. These threats may derive from fraud or malice on the part of our employees or third parties, or may result from human error, software bugs, server malfunctions, software or hardware failure or other technological failure. These threats include cyber-attacks such as computer viruses, denial-of-service attacks, malicious code (including ransomware), social-engineering attacks (including phishing attacks) or information security breaches and could lead to the misappropriation or loss of consumer account and other information and identity theft. These types of threats have risen significantly due to a significant portion of our workforce working in a hybrid environment. The widespread use of AI, and its increasing capabilities, is enhancing the frequency and effectiveness of threat actors.Our operations rely on the secure transmission, storage and other processing of confidential, proprietary, sensitive and personal information and technology in our computer systems and networks, as well as the systems of our third-party providers. Our customers and other parties in the payments value chain, as well as account holders, rely on our digital technologies, computer systems, software and networks to conduct their operations. In addition, to access our products and services, our customers and account holders increasingly use personal smartphones, tablet PCs and other mobile devices that may be beyond our control. We, like other financial technology organizations, routinely are subject to cyber-threats and our technologies, systems and networks, as well as the systems of our third-party providers, have been subject to attempted cyber-attacks. Because of our position in the payments value chain, we believe that we are likely to continue to be a target of such threats and attacks. Geopolitical events and resulting government activity could also lead to information security threats and attacks by affected or sympathizing jurisdictions or other actors, which could put our information and assets at risk, as well as result in network disruption. In addition, the current or future listing of Recorded Future as an “undesirable” or “unreliable” entity by certain jurisdictions could further increase our risks in this area.To date, we have not experienced any material impact relating to cyber-attacks or other information security breaches. However, future attacks or breaches could lead to security breaches of the networks, systems (including third-party provider systems) or devices that our customers use to access our products and services, which in turn could result in the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary, sensitive and personal information (including account data information) or data security compromises. Such attacks or breaches could also cause service interruptions, malfunctions or other failures in the physical infrastructure, networks or operations systems that support our business and customers (such as the lack of availability of our services), as well as the operations of our customers or other third parties. In addition, they could lead to damage to our reputation with our customers, other stakeholders and the broader payments ecosystem, additional costs to us (such as repairing systems, adding new personnel or protection technologies or compliance costs), regulatory penalties, financial losses to both us and our customers and partners and the loss of customers and business opportunities. These consequences could be further pronounced in jurisdictions in which we are deemed critical national infrastructure. If such attacks are not detected immediately, or disclosed as required by law, their effect could be compounded.In addition to information security risks for our systems and networks, we also routinely encounter account data compromise events involving merchants and third-party payment processors that process, store or transmit payment transaction data, which affect millions of Mastercard, Visa, Discover, American Express and other types of account holders. Further events of this type may subject us to reputational damage and/or lawsuits involving payment products carrying our brands. Damage to our reputation or brands resulting from an account data breach of our systems and networks or those of our customers, merchants and other third parties could decrease the use and acceptance of our products and services. Such events could also slow or reverse the trend toward electronic payments. In addition to reputational concerns, the cumulative impact of multiple account data compromise events could increase the impact of the fraud resulting from such events by, among other things, making it more difficult to identify consumers. Moreover, while most of the lawsuits resulting from account data breaches do not involve direct claims against us and while we have releases from many issuers and acquirers, we could still face damage claims, which, if upheld, could materially and adversely affect our results of operations. While we offer security solutions that are designed to prevent, detect and respond to fraud and cyber-attacks, there can be no assurance that such security solutions will perform as expected or address all possible security threats. Real or perceived defects, failures, errors or vulnerabilities in our security solutions could adversely impact our reputation, customer confidence in our solutions and our business and may subject us to litigation, governmental audits and investigation or other liabilities. Such events could have a material adverse impact on our transaction volumes, results of operations and prospects for future growth, or increase our costs by leading to additional regulatory burdens being imposed on us.In addition, companies have generally experienced in recent years an increase in fraudulent activity and cyber-attacks, which has been further exacerbated by the increased use of AI. Criminals are using increasingly sophisticated methods to capture consumer personal information to engage in illegal activities such as counterfeiting or other fraud and may see their effectiveness enhanced by the use of AI. As outsourcing and specialization become common in the payments industry, there are more third parties involved in processing transactions using our payment products. We continue to take measures to make card and digital payments more secure. However, increased fraud levels and cyber-attacks involving our products, services and/or network, or misconduct or negligence by third parties switching or otherwise servicing our products and services could damage our reputation and reduce the use and acceptance of our products and services and/or increase our compliance costs. Further, such occurrences have resulted in and could further result in legislative or regulatory intervention, which could lead to enhanced security requirements and liabilities. See “Risk Factors - Privacy, Data, AI and Information Security” in this Part I, Item 1A for more detail concerning related legal risks and obligations. Despite various mitigation efforts that we undertake, there can be no assurance that we, or third parties with which we work, will not suffer material breaches and resulting losses in the future. While we maintain insurance coverage, such coverage may not be adequate to protect us from such losses as well as any liabilities or damages with respect to claims alleging compromises of our confidential, proprietary, sensitive or personal information or our technologies, systems or networks. In addition, we cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or at all, or that our insurers will not deny coverage as to any future claim. Our risk and exposure to these matters remain heightened due to, among other things, the evolving nature of these threats, our prominent role in the global payments ecosystem, our continued implementation of our strategic priorities, our extensive use of third-party vendors and potential vulnerabilities from previous and future acquisitions, strategic investments or related opportunities. As a result, we remain focused on the continued development and enhancement of our controls, processes and practices designed to protect our computer systems, software, data and networks from attack, damage or unauthorized access. As cyber-threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Any of the risks described above could materially adversely affect our overall business and results of operations.

Service disruptions that cause us to be unable to process transactions or service our customers could reduce our operational resilience and materially affect our overall business and results of operations.

Our transaction switching systems and other offerings may experience interruptions as a result of technology malfunctions, network degradation, updates and migrations to new technology and platforms, supply-chain attacks, fire, floods, earthquakes, weather events, power outages, telecommunications disruptions, terrorism, workplace violence, accidents or other catastrophic events (including those related to climate change). We have experienced in limited instances, and may continue to experience, some types of these interruptions. Our visibility in the global payments industry may also put us at greater risk of attack by terrorists, activists, or hackers who intend to disrupt our facilities, networks and/or systems. Inadequate infrastructure in lesser-developed markets could also result in service disruptions, which could impact our ability to do business in those markets. Additionally, we rely on third-party service providers for the timely transmission of information across our global data network. If one of our service providers fails to provide the communications capacity or services we require, as a result of natural disasters, operational disruptions, cybersecurity-related disruptions or failures, terrorism, hacking or any other reason, the failure could interrupt our services. Although we maintain an enterprise resiliency program to analyze risk, assess potential impacts, and develop effective response strategies, we cannot ensure that our business would be immune to these risks. Due to the intrinsic importance of our switching systems to our business, any interruption or degradation could adversely affect the perception of the reliability of products carrying our brands and materially adversely affect our overall business and our results of operations.

Stakeholder Relationships

Losing a significant portion of business from one or more of our largest customers could lead to significant revenue decreases in the longer term, which could have a material adverse impact on our business and our results of operations.

Many of our customer relationships are not exclusive. Our customers can reassess their future commitments to us subject to the terms of our contracts, and they separately may develop their own services that compete with ours. Our business agreements with these customers may not ultimately reduce the risk (inherent in our business) that customers may terminate their relationships with us in favor of relationships with our competitors, or for other reasons, or might not meet their contractual obligations to us.In addition, a significant portion of our revenue is concentrated among our five largest customers. Loss of business from any of our large customers could have a material adverse impact on our overall business and results of operations.

MASTERCARD 2025 FORM 10-K 35

Exclusive/near exclusive relationships certain customers have with our competitors may have a material adverse impact on our business.

While we have exclusive, or nearly-exclusive, relationships with certain of our customers to issue payment products, other customers have similar exclusive, or nearly-exclusive, relationships with our competitors. These relationships may make it difficult or cost-prohibitive for us to do significant amounts of business with these customers to increase our revenues. In addition, these customers may be more successful and may grow faster than the customers that primarily issue our payment products, which could put us at a competitive disadvantage. Furthermore, we earn substantial revenue from customers with nearly-exclusive relationships with our competitors. Such relationships could provide advantages to the customers to shift business from us to the competitors with which they are principally aligned. A significant loss of our existing revenue or transaction volumes from these customers could have a material adverse impact on our business.

Consolidation amongst our customers could materially and adversely affect our overall business and results of operations.

The industries in which our customers participate have undergone substantial, accelerated consolidation in the past. These consolidations have included customers with a substantial Mastercard portfolio being acquired by institutions with a strong relationship with a competitor. Potential future consolidation could occur as a result of bank failures, similar to those that occurred in recent years. If significant consolidation among customers were to continue, it could result in the substantial loss of business for us, which could have a material adverse impact on our business and prospects. In addition, one or more of our customers could seek to merge with, or acquire, one of our competitors, and any such transaction could also have a material adverse impact on our overall business. Consolidation could also produce a smaller number of large customers, which could increase their bargaining power and lead to lower prices and/or more favorable terms for our customers. These developments could materially and adversely affect our results of operations.

Our business significantly depends on the continued success and competitiveness of our issuing and acquiring customers and, in many jurisdictions, their ability to effectively manage or help manage our brands.

While we work directly with many stakeholders in the payments system (including merchants, governments, fintechs and large digital companies and other technology companies), we are, and will continue to be, significantly dependent on our relationships with our issuers and acquirers and their respective relationships with account holders and merchants to support our programs and services. Furthermore, we depend on our issuing partners and acquirers to continue to innovate to maintain competitiveness in the market. We do not issue cards or other payment devices, extend credit to account holders or determine the interest rates or other fees charged to account holders. Each issuer determines these and most other competitive payment program features. In addition, we do not establish the discount rate that merchants are charged for acceptance, which is the responsibility of our acquiring customers. As a result, our business significantly depends on the continued success and competitiveness of our issuing and acquiring customers and the strength of our relationships with them. In turn, our customers’ success depends on a variety of factors over which we have little or no influence, including economic conditions in global financial markets or their disintermediation by competitors or emerging technologies, as well as regulation. If our customers become financially unstable, we may lose revenue or we may be exposed to settlement risk. See “Risk Factors - Settlement and Third-Party Obligations” in this Part I, Item 1A with respect to how we guarantee certain third-party obligations.We switch a high percentage of domestic (or in-country) transactions conducted using cards with our brands. However, there are several jurisdictions in which domestic transactions are switched by our customers or other processors. Because we do not provide domestic switching services in these countries or have direct relationships with account holders, we depend on our close working relationships with our customers to effectively manage our brands, and the perception of our payments system, among consumers in these countries. We also rely on these customers to help manage our brands and perception among regulators and merchants in these countries, alongside our own relationships with them. From time to time, our customers may take actions that we do not believe to be in the best interests of our payments system overall, which may materially and adversely impact our business.

Merchants’ continued focus on acceptance costs may lead to additional litigation and regulatory proceedings and/or increase our incentive program costs, which could materially and adversely affect our profitability.

Merchants are important constituents in our payments system. We rely on both our relationships with them, as well as their relationships with our issuer and acquirer customers, to continue to expand the acceptance of our products and services. We also work with merchants to help them enable new sales channels, create better purchase experiences, improve efficiencies, increase revenues and fight fraud. In the retail industry, we believe a set of larger merchants with increasingly global scope and influence are having a significant impact on all participants in the global payments industry, including Mastercard. Some large merchants have supported the legal, regulatory and legislative challenges to interchange fees that Mastercard has been defending, including the U.S. merchant litigations. Some merchants are increasingly asking regulators to review and potentially regulate our own network fees, in addition to interchange. See “Risk Factors – Payments Industry Regulation” in this Part I, Item 1A. The continued focus of merchants on the costs of accepting various forms of payment (including digital) may lead to additional litigation and regulatory proceedings.Certain larger merchants are also able to negotiate incentives from us and pricing concessions from our issuer and acquirer customers as a condition of accepting our products. We also make payments to certain merchants to incentivize them to create co-branded payment programs with us. As merchants consolidate and become even larger, we may have to increase the amount of incentives that we provide to certain merchants, which could materially and adversely affect our results of operations. Competitive and regulatory pressures on pricing could make it difficult to offset the costs of these incentives. Additionally, if the rate of merchant acceptance growth slows, our business could suffer.

Our work with governments exposes us to risks that could have a material impact on our business and results of operations.

As we increase our work with national, state and local governments (both indirectly through financial institutions, system integrators and other third party partners and with them directly as our customers), we may face various risks inherent in associating or contracting directly with governments. These risks include, but are not limited to, the following:•Governmental entities typically fund projects through appropriated monies. Changes in governmental priorities or other political developments, including disruptions in governmental operations, could impact approved funding and result in scope changes or termination of the arrangements or contracts we or financial institutions enter into with respect to our products and services.•Our work with governments is heavily regulated, subjecting us to additional potential exposure under U.S. and international anti-corruption laws (including the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act), as well as compliance with various procurement and other laws, regulations, standards and contract terms. Any violation and subsequent judgment or settlement related to the above could subject us to substantial monetary penalties and damages and have a significant reputational impact. Moreover, as a government contractor, we are subject to a government’s right to conduct audits and investigations into both our contract performance and our compliance with applicable laws, regulations and contract terms. Any adverse finding could subject us to civil or criminal penalties, sanctions, or suspension or disbarment. •Working or contracting with governments (either directly or via our financial institution customers, system integrators or other third party partners) can subject us to heightened reputational risks, including extensive scrutiny and publicity, as well as a potential association with the policies of those governments. Any negative publicity or negative association with a government entity, regardless of its accuracy, may adversely affect our reputation. In addition, threat intelligence gathering services provided to governments through our acquisition of Recorded Future could negatively impact how we are viewed by other jurisdictions. Any of the above issues could have a material or adverse impact to our overall business and/or results of operations.

Global Economic and Political Environment

Global economic, political, financial and societal events or conditions could result in a material and adverse impact on our overall business and results of operations.

Adverse economic trends. Adverse economic trends in key countries in which we operate may adversely affect our financial performance. Such impact may include, but is not limited to, the following:•Customers mitigating their economic exposure by limiting the issuance of new Mastercard products and requesting greater incentive or greater cost stability from us •Consumers and businesses reducing spending, which could impact domestic and cross-border spend•Debt limit and budgetary discussions in the U.S. have affected, and could further affect, the U.S. credit rating, impacting consumer confidence and spending•Uncertain global trade policies and related government actions (including those related to tariffs), which could have an adverse impact on our business (including with respect to consumer and business spending) and relationships with stakeholders•Government intervention (including the effect of laws, regulations and/or government investments on or in our financial institution customers), as well as uncertainty due to changing political regimes in executive, legislative and/or judicial branches of government, that may have potential negative effects on our business and our relationships with customers or otherwise alter their strategic direction away from our products•Tightening of credit availability that could impact the ability of participating financial institutions to lend to us under the terms of our credit facilityCross-border transactions. We switch substantially all cross-border transactions using Mastercard, Maestro and Cirrus-branded cards and generate a significant amount of revenue from cross-border volume fees and fees related to switched transactions. Revenue from switching cross-border and currency conversion transactions for our customers fluctuates with the levels and destinations of cross-border travel and our customers’ need for transactions to be converted into their base currency. Cross-border activity has been, and may continue to be, adversely affected by world geopolitical, economic, health, weather and other conditions. These include or have included:

MASTERCARD 2025 FORM 10-K 37

•Global pandemics (and related post-pandemic global economic impacts) and potential separate outbreaks of flu, viruses and other diseases (any of which could result in future epidemics or pandemics) •Current and potential future geopolitical conflicts, as well as expansion into regional or global conflicts, and the resulting impacts to our business•The threat of terrorism and major environmental and extreme weather events (including those related to climate change) The impact of and uncertainty that could result from any of these events or factors could ultimately decrease cross-border activity. Additionally, any regulation of interregional interchange fees could also negatively impact our cross-border activity (for example, the targets announced by the G20 Financial Stability Board related to cross-border payments). In each case, decreased cross-border activity could decrease the revenue we receive. Russia’s invasion of Ukraine. In addition to the cross-border impacts described above, our compliance with sanctions and our decision to suspend our business operations in Russia has led, and could further lead, to other legal ramifications and operational challenges, including fines, the nationalization of our subsidiary and any resulting impacts, and/or lawsuits.Standards. Our operations as a global payments network rely in part on global interoperable standards to help facilitate payments. To the extent geopolitical events or government intervention result in jurisdictions no longer participating in the creation or adoption of these standards, or the creation of competing standards, our products and services could be negatively impacted.Any of these developments potentially could have a material adverse impact on our overall business and results of operations.

Adverse currency fluctuations and foreign exchange controls could negatively impact our results of operations.

During 2025, approximately 71% of our revenue was generated from activities outside the U.S., which could be transacted in a non-functional currency. Impacts from currency fluctuations are included in our net income. Our risk management activities provide protection with respect to adverse changes in the value of only a limited number of currencies and are based on estimates of exposures to these currencies. In addition, the revenue we generate in entities with non-U.S. dollar functional currencies is subject to unpredictable currency fluctuations, including where the values of other currencies change relative to the U.S. dollar. If the U.S. dollar strengthens compared to currencies in which we generate revenue, this revenue may be translated at a materially lower amount than expected. Furthermore, we may become subject to exchange control regulations that might restrict or prohibit the conversion into U.S. dollars of our other revenue currencies and financial assets.The occurrence of currency fluctuations or exchange controls could have a material adverse impact on our results of operations.

Brand, Reputational Impact and Environmental, Social and Governance

Negative brand perception may materially and adversely affect our overall business.

Our brands and their attributes are key assets of our business. The ability to attract consumers to our branded products and retain them depends upon the external perception of us and our industry:•Our business may be affected by actions taken by our customers, merchants or other organizations that impact the perception of our brands or the payments industry in general. From time to time, our customers may take actions that we do not believe to be in the best interests of our brands, such as creditor practices that may be viewed as “predatory”. Moreover, adverse developments with respect to our industry or the industries of our customers or other companies and organizations that use our products and services (including certain legally permissible but high-risk merchant categories, such as adult content, firearms, alcohol and tobacco) may also, by association, impair our reputation, or result in greater public, regulatory or legislative scrutiny, as well as potential litigation. Additionally, we or our customers could take (or be perceived to take) actions related to these industries, which could be viewed negatively and result in threats or other retaliatory actions. We may also face similar scrutiny to the extent that we are unable to detect and/or prevent illegal activities using our payment products or otherwise occurring over our network. •Under some circumstances, our use of social media, or the use of social media by others as a channel for criticism or other purposes, could also cause rapid, widespread reputational harm to our brands by disseminating rapidly and globally actual or perceived damaging information about us, our products or merchants or other end users who utilize our products. •We are headquartered in the U.S. As such, a negative perception of the U.S. could impact the perception of our company, which could adversely affect our business. Any of the above issues could have a material and adverse effect on our overall business.

Lack of visibility of our brand in our products and services, or in the products and services of our partners who use our technology, may materially and adversely affect our business.

As more players enter the global payments ecosystem, the layers between our brand and consumers and merchants increase. We often partner with other consumer brands on payment solutions, including large digital companies and other technology companies who are our customers and use our networks to build their own acceptance brands. In some cases, our brand may not be featured in the payment solution or may be secondary to other brands. Additionally, as part of our relationships with some issuers, our payment brand is only included on the back of the card. As a result, our brand may either be invisible to consumers or may not be the primary brand with which consumers associate the payment experience. This brand invisibility, or any consumer confusion as to our role in the consumer payment experience, could decrease the value of our brand, which could adversely affect our business.

Environmental, social and governance matters and related stakeholder reaction may impact our reputation, increase legal exposure and/or have other business impacts, which could adversely affect our overall business and/or results of operations.

Our brand and reputation are associated with the ways in which we impact environmental, social and governance matters. These matters include initiatives to reduce greenhouse gas emissions, help everyone participate in the digital economy and create a workplace where everyone has the opportunity to succeed. Consumers, investors, employees and other stakeholders are increasingly focused on these impacts. To the extent any of our disclosures, public statements and metrics about these matters are subsequently viewed as inaccurate or unlawful, or we are unable to execute on these initiatives, we may be viewed negatively by stakeholders concerned about these matters. Moreover, in recent years, we have received negative feedback from stakeholders on the adequacy of our environmental, social and governance initiatives. We have also increasingly been receiving negative feedback from anti-environmental, social and governance stakeholders in opposition to such initiatives. Stakeholders from both sides of this issue may continue to view us negatively and take public action against us to the extent that we do not satisfy their conflicting views or expectations.In addition, various jurisdictions are increasingly adopting or considering laws, regulations and oversight expectations that have or would impact us pertaining to environmental, social and governance matters, including required corporate reporting and disclosures. These requirements have resulted in, and are likely to continue to result in, increased compliance costs for our business and supply chain, which may increase our operating costs. Moreover, as governments, investors and other stakeholders face pressure to address climate change and other environmental, social and governance matters, these stakeholders may express new expectations and focus investments in ways that could cause significant shifts in commerce and consumption behaviors. The impact of and uncertainty that could result from such shifts could ultimately impact our business. Any of the above issues could have a material or adverse impact to our overall business and/or results of operations.

Talent and Culture

We may not be able to attract and retain a highly qualified workforce, or maintain our corporate culture, which could harm our overall business and results of operations.

Our performance largely depends on the skills, capabilities and motivation of our employees (including our people leaders), as well as the environment we create for them to enable them to perform their jobs effectively. The market for specialized skill-sets remains highly competitive, particularly in emerging technologies. To the extent we are unable to differentiate our value proposition in the market, effectively develop leaders and build robust succession pipelines, it could impact our ability to deliver for our customers. Failure to attract, hire, develop, motivate and retain highly qualified talent could leave us vulnerable to not identifying and/or acting on emerging customer or market opportunities. In addition, broader trends such as escalations in global conflict and a rise in mental health needs are impacting the well-being of our people. To the extent we are unable to communicate effectively on these issues and provide support to our employees, we could experience a significant impact on our business, reputation and culture. Further, changes in and enforcement of immigration and work permit laws and visa regulations have made it difficult for employees to work in, or transfer among, jurisdictions where we operate, potentially impairing our ability to attract and retain talent. We also face increasing regulation with respect to new pay and benefits transparency requirements, which could subject us to liability or reputational harm if we do not adhere to these requirements in a timely manner.As our workforce composition continues to change, our employees may have different expectations with respect to flexibility and well-being support. Additionally, employees may require different levels of support as to re-skilling and upskilling in order to adapt to advancements in our industry and changes in technology. Further, certain current and prospective employees may have expectations as to positions we take on environmental, social and governance matters. To the extent we are unable to effectively meet and/or balance these different expectations and needs, we could experience a negative impact to the quality of our corporate culture, the productivity of our workforce and our ability to attract and retain talent.

MASTERCARD 2025 FORM 10-K 39

We rely on our people leaders to display integrity and decency, as role models for the Mastercard Way. To the extent our leaders behave in a manner that is not consistent with these values, we could experience significant impact to our brand and reputation, as well as to our corporate culture.Any one or more of the above could harm our overall business and results of operations.

Acquisitions and Strategic Investments

Our efforts to enter into acquisitions, strategic investments or new businesses could be impacted or prevented by regulatory scrutiny and could otherwise result in issues that could disrupt our business and harm our results of operations or reputation.

We continue to evaluate our strategic acquisitions of, and investments in, complementary businesses, products or technologies. As we do so, we face increasing regulatory scrutiny with respect to antitrust, national security and other considerations that could impact these efforts. We also face competition for acquisition targets due to the nature of the market for technology companies. As a result, we could be prevented from successfully completing such acquisitions in the future. If we are not successful in these efforts, we could lose strategic opportunities that are dependent, in part, on inorganic growth. To the extent we do make these acquisitions, we may not be able to successfully partner with or integrate them, despite original intentions and focused efforts. Such an integration also may divert management’s time and resources from our core business and disrupt our operations. Moreover, we have spent, and may continue to spend, time and money on acquisitions or projects that do not sufficiently meet our expectations (either strategically or financially), which has resulted (and may in the future result) in divesting from or otherwise exiting these investments or businesses. Additionally, to the extent we pay the purchase price of any acquisition in cash, it would reduce our cash reserves available to us for other uses, and to the extent the purchase price is paid with our stock, it could be dilutive to our stockholders. Furthermore, we have inherited and may in the future inherit litigation risk which has or may increase our post-acquisition costs of operations.Any acquisition, investment or entry into a new business could subject us to new regulations or legal requirements, both directly as a result of the new business as well as in the other existing parts of our business, with which we would need to comply. This compliance could increase our costs, and we could be subject to liability or reputational harm to the extent we cannot meet any such compliance requirements. Additionally, targets that we acquire have had, and may in the future have, data practices that do not initially conform to our privacy, data protection and information security standards and data governance model, which could lead to regulatory scrutiny and reputational harm. These targets also have resulted in, and may in the future lead to, information security vulnerabilities for us.

Settlement and Third-Party Obligations

Our role as guarantor, as well as other contractual obligations and discretionary actions, expose us to risk of loss or illiquidity.

We are a guarantor of certain third-party obligations, including those of certain of our customers and service providers. In this capacity, we are exposed to credit and liquidity risks. We may incur significant losses in connection with transaction settlements if a customer fails to fund its daily settlement obligations due to technical problems, liquidity shortfalls, insolvency or other reasons. The occurrence of bank failures, such as those seen in recent years, could increase the potential for such losses. Concurrent settlement failures of more than one of our larger customers or of several smaller customers either on a given day or over a condensed period of time may exceed our available resources. In addition, Brazil recently enacted regulation requiring PSOs in Brazil (including Mastercard and Visa) to extend their responsibility for the financial and settlement integrity of payments to merchants. As we continue to be subject to increased regulation across the globe, more jurisdictions may enact similar approaches from time to time. Any such changes could increase complexity and may impact our cost of operations and financial condition. Certain non-guaranteed transactions, as well as chargebacks to acquirers in the event of acquirer default, could result in elevated brand risk and the potential for financial loss. We have significant contractual indemnification obligations with certain customers, which could be triggered depending on the circumstances.Any of the above issues or events could have a material or adverse impact to our overall business and/or results of operations.Class A Common Stock and Governance Structure

Provisions in our organizational documents and Delaware law could be considered anti-takeover provisions and have an impact on change-in-control.

Provisions contained in our amended and restated certificate of incorporation and bylaws and Delaware law could be considered anti-takeover provisions, including provisions that could delay or prevent entirely a merger or acquisition that our stockholders consider favorable. These provisions may also discourage acquisition proposals or have the effect of delaying or preventing entirely a change in control, which could harm our stock price. For example, subject to limited exceptions, our amended and restated certificate of incorporation prohibits any person from beneficially owning more than 15% of any of the Class A common stock or any other class or series of our stock with general voting power, or more than 15% of our total voting power. In addition:•our stockholders are not entitled to the right to cumulate votes in the election of directors•our stockholders are not entitled to act by written consent•any representative of a Mastercard or Mastercard Foundation competitor is disqualified from service on our board of directors

Mastercard Foundation’s substantial stock ownership, and restrictions on its sales, may impact corporate actions or acquisition proposals favorable to, or favored by, the other public stockholders.

Mastercard Foundation owns shares of our Class A common stock representing greater than 5% of our general voting power. Historically, Mastercard Foundation had been restricted from selling or otherwise transferring its shares of Class A common stock prior to May 1, 2027, except to the extent necessary to satisfy its charitable disbursement requirements, for which purpose earlier sales were permitted and had occurred. In July 2023, pursuant to an application in consultation with Mastercard, Mastercard Foundation received court approval to advance that date to January 1, 2024. As a result, Mastercard Foundation is now permitted to sell all or part of its remaining shares, subject to certain conditions. In March 2024, Mastercard Foundation began selling shares pursuant to an orderly and structured plan to diversify its Mastercard shares over a seven-year period, while committing to remain a long-term Mastercard stockholder and retaining a significant holding of Mastercard shares in its portfolio. The directors of Mastercard Foundation are required to be independent of us and our customers. The ownership of Class A common stock by Mastercard Foundation, together with the seven-year diversification plan, could discourage or make more difficult acquisition proposals favored by other holders of the Class A common stock. In addition, because Mastercard Foundation intends to sell its shares over an extended period of time, it may not have the same interest in short or medium-term movements in our stock price as, or incentive to approve a corporate action that may be favorable to, our other stockholders. Item 1B. Unresolved staff commentsNot applicable.Item 1C. Cybersecurity

Cybersecurity program

As a technology company in the global payments industry entrusted with the safeguarding of sensitive information (including personal information), cybersecurity risk management is an integral part of our overall enterprise risk management program. A robust program to protect our network from cyber and information security threats is critical to managing risk effectively. Our network and platforms incorporate multiple layers of protection, providing greater resiliency and security protection. Our programs are assessed by third parties and incorporate benchmarking and other data from peer companies and consultants. We engage in many efforts to mitigate information security challenges, including maintaining an information security program, an enterprise resilience program and insurance coverage, as well as regularly testing our systems to address potential vulnerabilities. We work with experts across the organization (as well as through other sources such as public-private partnerships) to monitor and respond quickly to a range of cyber and physical threats, including threats and incidents associated with the use of services provided by third-party providers. Our cybersecurity program provides (among other things) a framework for handling cybersecurity threats and incidents, which includes steps for identifying the nature of a cybersecurity threat (including whether the threat is associated with a third-party provider), assessing the severity of a cybersecurity threat (including advancing to key members of management where appropriate for determination of potential materiality) and implementing cybersecurity processes and procedures.

MASTERCARD 2025 FORM 10-K 41