FIS

MKT CAP $18.8BP/E 5.6DIV YIELD 6.81%FCF YIELD 15.03%REV TTM $12.2B +18.3%NET INCOME $3.4B +2910.7%NET DEBT $16.2B52W 32.44 – 67.88NEXT EARNINGS Nov 3SEC XBRL · TTM TO Invalid Date

How FIS rewrote its risk factors

10-K ITEM 1A · FY2024 → FY2025

Text kept

67%

of sentences unchanged

Added

new sentences

Dropped

sentences removed

Length

+1,049

words, now 12,889

New in FY2025

Risks Related to Our Business and Operations Security breaches, privacy breaches, cyberattacks, unintentional disclosures of confidential information, breaches of third party service providers, service outages, or a failure to comply with information security laws or regulations, contractual provisions, or industry security requirements by us, our vendors, clients, or technology partners could harm our business by disrupting delivery of services, exposing sensitive or confidential information, or damaging our reputation, any of which could result in a breach of one or more client contracts or regulatory investigations, enforcement actions, fines or litigation.
Our information systems and networks are dependent upon hardware, software, communication infrastructure and other technological components and services that are developed and managed by us or provided by third parties.
These components require regular monitoring, patches, updates, or remediation of known or potential vulnerabilities.
Our information systems are also vulnerable to human error, including employees sending information to inadvertent recipients as well as employees inappropriately using AI tools, as well as malicious insider threats.
Finally, the systems we rely on, which include hardware and software manufactured, developed or operated by third-party vendors and service providers, have in the past been subject to, and may in the future be subject to, cyberattacks or other security incidents due to employee error or malfeasance, software bugs, hardware malfunctions or other security vulnerabilities.
The uninterrupted trustworthy operation of information systems operated by us, our vendors and service providers, and other third parties, as well as the confidentiality of the customer or consumer information that resides on such systems, is critical to the successful operation of our Company.
For that reason, compromises to the confidentiality, integrity or availability of our information systems or information are some of the principal operational risks we face as a provider of services to financial institutions and businesses.
If we fail to maintain an adequate security infrastructure, adapt to emerging security threats (such as the use of AI by threat actors in furtherance of cyberattacks), the targeting of vendors who serve large numbers of customers for supply chain attacks, and business email compromises seeking fraudulent wire transfers regularly identify security vulnerabilities, prevent unauthorized access, identity theft or other cybersecurity risks (e.g., distributed denial of service, ransomware, and other cyberattacks), manage vendor or supply chain cybersecurity risks, adequately train users of our information systems, or implement sufficient security standards and technology to protect against security or privacy breaches, then the confidentiality, integrity or availability of the information we secure could be compromised.
FIS provides a number of systemically critical services, including the settlement of funds for financial institutions, other businesses and consumers and receives funds from clients, card issuers, payment networks and consumers on a daily basis for a variety of transaction types.
Transactions facilitated by us include debit card, credit card, electronic bill payment, banking payments and check clearing that support consumers, financial institutions and other businesses.
Attempted or successful targeting of these systems by attackers may result in interruption of services, misuse of account information, or unauthorized transfer of funds.
This environment imposes comprehensive data privacy compliance obligations in relation to our collection and use of data relating to an identifiable living individual or "personal data," including a principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit, as well as regulating cross-border transfers of personal data.
A material privacy or security incident would trigger SEC disclosure obligations and could trigger other applicable disclosure requirements under state-level or non-U.S. laws or regulations, or be disclosed publicly, even if there is no legally required disclosure.
If we are unable, or appear to be unable, to prevent cybersecurity or privacy breaches, we risk reputational damage.
The markets for our solutions are characterized by constant technological changes, frequent introductions of new solutions and evolving industry expectations.
Any change in economic factors, including a sustained deterioration in general economic conditions or consumer confidence, particularly in the U.S., or inflation and increases in interest rates in key countries in which we operate may adversely affect consumer spending, consumer debt levels and payment card usage, and as a result, adversely affect our financial performance by reducing the number or average purchase amount of transactions that we service.
In addition, the direct and indirect effects of geopolitical conflicts, such as the Russia-Ukraine war and conflicts in the Middle East, have adversely affected global economic activity and transaction processing volumes.
Additionally, credit card issuers may reduce credit limits and become more selective in their card issuance practices, which would lower purchase volumes.
Our business, financial condition or results of operations could be adversely affected by business interruptions, errors or failures in connection with our or third-party information technology and communication systems and other software and hardware used in connection with our business, or by design errors in the software solutions we offer, or more generally, by the unavailability of third-party services that we need to operate our business effectively.
There has been, and may continue to be, consolidation activity in the banking and financial services industry.
The Consumer Financial Protection Bureau ("CFPB") continues to update and enforce rules and regulations for regulating financial and non-financial institutions and providers to those institutions to ensure adequate protection of consumer privacy and to ensure consumers are not impacted by deceptive business practices, as well as to provide examination and supervisory authority over consumer reporting agencies, including ChexSystems.
Portions of FIS' European operations are in scope for regulatory oversight by European Supervisory Agencies (ESAs) as defined by DORA.
FIS' designation as a Critical Third-Party Provider under DORA subjects us to additional and new regulatory oversight processes in the E.U.
These changes could result in increased costs to compliance.
Other countries are also developing regulatory frameworks that govern critical third-party providers to the financial services sector, which may result in increased costs of compliance.
For example, in the U.K., HM Treasury has powers to designate critical third-party providers to the financial services sector, subjecting them to additional regulatory oversight and obligations regarding reporting, incident management and testing.
The regulatory environment for crypto assets, stablecoins, and digital currencies is rapidly evolving, with increased oversight from U.S. agencies such as the SEC, CFTC, and FinCEN, as well as global counterparts.
Recent developments, including the European Union’s Markets in Crypto-Assets (MiCA) regulation, U.S. legislation such as the GENIUS Act, and other legislative initiatives, signal a trend toward increased oversight, more robust compliance obligations, and a move toward harmonized global standards.
FIS closely monitors regulatory changes, to ensure any existing or new business models, product offerings, and risk and compliance programs adapt to new regulatory requirements.
Further, our business may be constrained by current and future laws and regulations governing the development, use and deployment of AI (including machine learning) technologies.
Additionally, in some markets in which we operate, our clients require us to support them in achieving compliance with increasingly complex and prescriptive regulatory requirements relating to digital operational resilience.
For example, under DORA, our E.U. financial entity clients require us, as a designated Critical Third-Party Provider of information and communication technology services, to contract with and manage our relationships with such clients (and, where applicable, our relationships with other critical third-party technology vendors in our supply chain) in accordance with the requirements of DORA.
Failure to comply with applicable data protection laws, as well as new and evolving laws and regulations in these areas, could result in significant penalties, damage to our reputation, and loss of business.
Additionally, a breach of applicable data protection laws may result in regulatory investigations, reputational damage, orders to cease or change our data processing activities, enforcement notices, assessment notices (for a compulsory audit) and/or civil claims (including class actions).
We have incurred, and will continue to incur, costs to comply with these evolving laws and regulations.
There are several additional laws being considered by state legislatures, the U.S.
As a result, we expect that a more substantial effort to comply with varying regimes in different jurisdictions will continue to be necessary in the future, which has the potential to further increase the cost and complexity of our business.
Since we are subject to the supervision of relevant data protection authorities under multiple legal regimes, we could be fined under those regimes independently in respect of the same breach.
For example, through requirements established under DORA and Network and Information Security Directive 2, Directive (EU) 2022/2555, (NIS2), E.U. regulators are increasingly seeking to mitigate cyber threats and enhance digital resilience within the financial and technological ecosystem through new regulations targeting the provision of critical third-party technology services.
BRICS countries are working to reduce their reliance on the U.S. dollar and Western financial infrastructure due to sanctions, wars, and tariffs.

and 41 more.

Gone since FY2024

Risks Related to Our Business and Operations Security breaches, privacy breaches, cyberattacks, unintentional disclosures of confidential information, third-party breaches, service outages, or a failure to comply with information security laws or regulations, contractual provisions, or industry security requirements by us, our vendors, clients, or technology partners could harm our business by disrupting delivery of services, exposing sensitive or confidential information, or damaging our reputation, any of which could result in a breach of one or more client contracts or regulatory investigations, enforcement actions, fines or litigation.
Our information systems and networks are dependent upon hardware, software, communication infrastructure and other technological components that are both developed by us and provided by third parties.
These components sometimes require patches, updates, or remediation of known or potential vulnerabilities.
Our information systems are also vulnerable to human error as well as malicious insider threats.
Finally, the systems we rely on, which include hardware and software manufactured, developed or operated by third-party vendors and service providers, have in the past been subject to, and may in the future be subject to, cyber attacks or security incidents due to employee error or malfeasance, software bugs, hardware malfunctions or other security vulnerabilities.
The uninterrupted operation of information systems operated by us, our vendors and service providers, and other third parties, as well as the confidentiality of the customer or consumer information that resides on such systems, is critical to the successful operation of our Company.
For that reason, security or privacy breaches are some of the principal operational risks we face as a provider of services to financial institutions and businesses.
If we fail to maintain an adequate security infrastructure, adapt to emerging security threats (such as the use of artificial intelligence by threat actors in furtherance of cyber attacks), regularly identify security vulnerabilities, prevent unauthorized access, identity theft or other cybersecurity risks (e.g., distributed denial of service, ransomware, and other cyber attacks), manage vendor or supply chain cybersecurity risks, adequately train users of our information systems, or implement sufficient security standards and technology to protect against security or privacy breaches, then the confidentiality, integrity or availability of the information we secure could be compromised.
A material privacy or security incident would trigger SEC disclosure obligations and could trigger other applicable disclosure requirements, or be disclosed publicly, even if there is no legally required disclosure.
If we are unable, or appears to be unable, to prevent cybersecurity or privacy breaches, we risk reputational damage.
The markets for our solutions are characterized by constant technological changes, frequent introductions of new solutions and evolving industry standards.
Any change in economic factors, including a sustained deterioration in general economic conditions or consumer confidence, particularly in the U.S., or inflation and increases in interest rates in key countries in which we operate may adversely affect consumer spending, consumer debt levels and credit and debit card usage, and as a result, adversely affect our financial performance by reducing the number or average purchase amount of transactions that we service.
In addition, the direct and indirect effects of geopolitical conflicts, such as the Russia-Ukraine war and conflicts in the Middle East, have adversely affected global economic activity and transaction processing volumes (particularly in our former Merchant segment).
Our business, financial condition or results of operations could be adversely affected by business interruptions, errors or failures in connection with our or third-party information technology and communication systems and other software and hardware used in connection with our business, or by design errors in the software solutions we offer, or more generally, by the unavailability of third-party vendors' services that we need to operate our business effectively.
There has been, and may continue to be, substantial consolidation activity in the banking and financial services industry.
The Consumer Financial Protection Bureau ("CFPB") continues to establish rules and regulations for regulating financial and non-financial institutions and providers to those institutions to ensure adequate protection of consumer privacy and to ensure consumers are not impacted by deceptive business practices, as well as to provide examination and supervisory authority over consumer reporting agencies, including ChexSystems.
Further, our business may be constrained by current and future laws and regulations governing the development, use and deployment of artificial intelligence (including machine learning) ("AI") technologies.
Additionally, in some markets in which we operate, our clients will require us to support them in achieving compliance with increasingly complex and prescriptive regulatory requirements relating to digital operational resilience.
For example, under DORA, our E.U. financial entity clients will require us, as a third-party provider of information and communication technology services, to contract with and manage our relationships with such clients (and, where applicable, our relationships with critical third-party technology vendors in our supply chain) in accordance with the requirements of DORA.
Failure to comply with new and evolving laws and regulations in these areas could result in significant penalties, damage to our reputation, and loss of business.
We have incurred, and will continue to incur, costs to comply with these new laws and regulations.
There are also several additional laws being considered by state legislatures, the U.S.
As a result, we expect that a more substantial compliance effort with varying regimes in different jurisdictions will continue to be necessary in the future, which has the potential to further increase the cost and complexity of our business.
For example, under DORA, E.U. regulators are increasingly seeking to mitigate cyber threats and enhance digital resilience within the financial system through new regulations targeting the provision of critical third-party technology services.
AI Act imposes a number of requirements (some of which take effect in August 2025, August 2026 and August 2027) that differ depending on the type and use of a particular AI system, but which will at a minimum include extensive documentation and transparency requirements.
A compromise of our continuity of operations, integrity of processing, or ability to detect or prevent fraudulent payments could result in a financial loss to us.
Our international operations represented approximately 22% of our total 2024 revenue and are largely conducted in currencies other than the U.S.
Dollar, including the British Pound Sterling, Euro, Brazilian Real, Australian Dollar, Swedish Krona, Swiss Franc and Indian Rupee.
Detecting, investigating and resolving actual or alleged violations can be an extensive process and require a significant diversion of time, resources and attention from senior management.
Our global operations are susceptible to global events, including threats or acts of war, such as the Russia-Ukraine war and the Israel-Hamas conflict, threats or acts of terrorism, international conflicts, political instability, natural disasters, and power or communications failures.
We are also susceptible to a widespread outbreak of an illness or other health issue, such as the COVID-19 pandemic.
We may be subject to increased costs, regulations, reporting or other requirements, standards or expectations regarding sustainability and climate change-driven impacts on our business.
Changing market dynamics, global policy developments, heightened focus from governmental, media, community, industry and investor stakeholders, and increasing frequency and impact of extreme weather events all have the potential to disrupt our business or the businesses of our customers, vendors and technology partners.
In addition, if we fail to comply with applicable legal requirements and maintain practices that meet our stakeholders' evolving expectations, it could harm our reputation, adversely affect our ability to attract and retain clients and expose us to increased scrutiny from investors and regulatory authorities.
We are involved in various litigation matters, including in some instances class-action cases and patent infringement litigation.
On December 15, 2022, the EU Member States formally adopted the EU’s Pillar Two Directive, which generally provides for a minimum effective tax rate of 15%, as established by the Organization for Economic Co-operation and Development Pillar Two Framework that was supported by over 130 countries worldwide.
Risks Related to Business Combinations and Ventures We may not achieve the anticipated benefits of our recently completed Worldpay Sale, and we may also be exposed to new risks following the sale.
We may not achieve the anticipated benefits of our Worldpay Sale, which we completed in January 2024.
The anticipated strategic, financial, and operational gains may not materialize, and costs or revenue dis-synergies could exceed expectations.
Additionally, we have entered into ongoing arrangements with Worldpay for transition services which have required, and are expected to continue to require, significant resources and could offset the impact of our cost-saving initiatives.

and 16 more.

Sentence-level comparison of Item 1A in the two most recent 10-Ks (FY2024 ↗, FY2025 ↗). A reworded sentence counts as one dropped and one added, so heavy edits read as low “kept”. Headings and page furniture are stripped; nothing is summarised by a model.

Watch FIS. Know when insiders buy.

One email the day a filing lands. Free.