Equifax. 2022. "annual-report"

2022 Annual Report

Mark W. Begor

Chief Executive Ocer

Mark L. Feidler

Independent Chairman

of the Board of Directors

2022 was a strong year for the New Equifax. We are truly

a diversied data, analytics and technology company that is

shifting into our Next Gear and extending well beyond a

traditional credit bureau in the markets we serve worldwide.

We are driving innovation to meet the evolving needs of global

consumers and customers while delivering strong nancial

results for our shareholders.

To Our Shareholders:

Letter to Shareholders

Equifax

Overall Revenue

Workforce Solutions

Workforce Solutions, our fastest

growing, highest margin, and

most valuable business, delivered

annual revenue of $2.3 billion –

growth of 14% over 2021.

Importantly, Workforce Solutions

non-mortgage revenue, which

represents 67% of revenue,

was up a very strong 42%. This

business unit has more than

doubled in size over the past

several years and has grown from

about 25% of our total revenue

four years ago to almost 50% in

2022. It will likely exceed more

than half of Equifax revenue in

the coming years!

U.S. Information Solutions

U.S. Information Solutions (USIS)

delivered annual revenue of $1.7 billion,

a decline of 7% from 2021 due to the

declining 2022 mortgage market,

which was partially oset by strong

6% business-to-business (B2B)

non-mortgage growth and B2B

Online non-mortgage revenue

growth of 11.5%. In March 2023,

we announced the appointment of

Todd Horvath as President of USIS

eective March 31, 2023. Horvath

will drive our USIS growth strategy –

leveraging the company’s dierentiated

data assets, Equifax Cloud-based

technology and deep analytics

expertise to create innovative solutions

that drive nancial opportunity for

businesses and consumers. He joins

Equifax from Fiserv, where he most

recently served as the Co-Head of the

Fiserv Banking organization.

International

International, for the second

year in a row, achieved

more than a billion dollars

in revenue and double digit

local currency growth, to

$1.1 billion, up 12% in local

currency. We are seeing

broad-based execution from

our International businesses,

with strong double digit local

currency revenue growth in

our Latin America (LATAM)

and Europe regions.

$2.3B

$5.1B

$1.7B

$1.1B

Equifax achieved record 2022 annual revenue of $5.122 billion,

up 4% over 2021 despite an unprecedented estimated 56% decline in U.S.

mortgage originations and a softening of the global macroeconomic environment.

The power of the Equifax business model and our execution against our EFX2025

strategic priorities is reected in our eight consecutive quarters of strong, double

digit core revenue growth – and strong 17% non-mortgage growth in 2022. Our

non-mortgage businesses comprised 77% of Equifax and delivered growth in 2022

well above our 8-12% long-term growth framework.

In 2022, we harnessed the power of our new Equifax Cloud™ capabilities and

dierentiated data to deliver more than 100 new products for a record setting

Vitality Index (dened as revenue from new products introduced in the last

three years) of 13%, which is well above our 10% long term vitality target for

new products and 400 basis points above 2021. North American revenue from

products delivered from an application running in the new Equifax Cloud reached

a record of approximately 70%, up from 50% in 2021. We also continued to invest in

strategic, bolt-on acquisitions to strengthen our company and drive future growth

and have signed or completed 14 transactions for consideration totaling $4.1 billion

since the beginning of 2021. We continue to set ourselves apart in the industry with

innovative solutions and dierentiated data assets that ‘Only Equifax’ can provide.

At the Business Unit Level in 2022

Up 4%, delivering strong

17% non-mortgage growth

in an unprecedented

mortgage market decline

2022 Annual Report

Strong Financial Performance

Our strong nancial performance was supported by the signicant strides we have made

to complete our Equifax Cloud transformation. This new Cloud infrastructure is delivering

always-on capabilities and faster New Product Innovation, with integrated data assets,

faster data delivery and industry leading enterprise security. Approximately 70% of our

North American revenue is now being delivered from the Equifax Cloud and in 2023 we

are focused on completing our North American cloud transformation to become the only

cloud native data and analytics company.

The strength of the New Equifax worldwide is supported by our nearly 14,000 Equifax

employees in 24 countries who have helped our customers adapt to a challenging post-

COVID economic landscape, enabling them to support rapidly evolving consumer needs.

A few of our 2022 highlights include:

We delivered more than 100 new products for

the third year in a row with a Vitality Index of 13%,

a new record for Equifax. New product revenue

in 2022 was $650 million, up over 50% from about

$420 million in 2021.

U.S. Information Solutions is leading the industry

with a new mortgage credit report that includes 15

telecommunications, pay TV and utilities attributes to

help streamline the mortgage underwriting process

and support loans within the secondary mortgage

market. Equifax is the rst and only in the industry

to provide these dierentiated insights, which were

made available to Equifax customers in the rst

quarter of 2023 and can help create greater home

ownership opportunities for more than 191 million

U.S. consumers, 80% of whom have traditional credit

les, but may benet from additional insights into their

nancial prole that can make mortgage underwriting

faster and easier.

Workforce Solutions introduced the TotalVerify™

data hub, a single source for obtaining the data insights

that social service agencies, lenders, background

screeners and employers leverage to build trust, enable

safety, verify information and assess risk. TotalVerify

is the culmination of years of Equifax development,

augmented by the acquisition of Appriss Insights in

2021. This secure, multi-faceted data and analytics

hub is anchored by The Work Number

database and

data is driving a Vitality Index approximately two times

the company average.

Our International business continues to execute well,

with particular strength in our LATAM New Product

Innovation. With a regional Vitality Index well above

our 10% long term target, the International team is

creating solutions that t each of the 11 countries in

the LATAM region to expand and accelerate growth.

The uniqueness and value of The Work Number

database was clear again in 2022. New partnerships

along with growth in existing partner records and

new direct contributors, drove growth – with current

records in The Work Number database reaching

152 million active records, an increase of 12%,

or 16 million records, from 2021. This includes 114

million unique individuals and represents 70% of

U.S. non-farm payroll and approximately 55% of

working Americans.

Workforce Solutions continues to accelerate

international expansion in the U.K., Canada and

Australia with access to over 20 million active and

historical payroll records outside of the U.S., as well

as over 40 million active and historical alternative

income records such as pension data and tax returns.

We have reinvested our strong performance by

signing or completing 14 strategic and accretive

bolt-on acquisitions totaling more than $4.1 billion

since the beginning of 2021. In 2022, we enhanced our

robust Workforce Solutions suite of employer services

with the acquisition of Ecient Hire and LawLogix.

We expanded our international presence with the

acquisition of Data-Crédito, the largest consumer credit

reporting agency in the Dominican Republic, and have

signed a denitive agreement to acquire Boa Vista

Serviços (BOAS3: SAO), the second-largest credit bureau

in Brazil. We also continued to expand our digital

identity network with the combination of the Kount

business and our 2022 acquisition of Midigator.

Security has become a point of strength and a

competitive advantage for Equifax. In 2022, the

maturity level of our cybersecurity program

exceeded all major industry benchmarks for the third

consecutive year, with a posture that ranks in the top

1% of Technology companies and top 3% of Financial

Services companies analyzed.

Letter to Shareholders

Consumer Impact: Helping People Live Their Financial Best

Our company purpose is to help people live their nancial best and Equifax strives to

support economically healthy individuals and nancially inclusive communities in each

of the 24 countries where we do business. This purpose-driven focus was recognized in

2022 with a Google Customer Award for Diversity, Equity and Inclusion.

Financial inclusion is at our core and Equifax is committed to helping people and

small businesses access useful and aordable nancial products and services that

meet their needs – including payments, savings, credit, insurance and government

benets – delivered in a responsible and sustainable way. Every nancial rst –

whether it’s a rst job, a college education, a bank account, credit card, car loan,

apartment lease, small business loan, government benet or mortgage – can spur

positive economic change.

While credit reports remain a strong indicator of credit

history and past nancial reliability, we believe that Fair

Credit Reporting Act (FCRA) compliant information that

is not included in traditional credit report data has the

potential to help responsibly expand consumer access to

credit and support a more inclusive economy. Equifax is a

leader in alternative data that supports nancial inclusion

and access to credit.

In 2022, we publicly announced plans to become the rst

in the industry to provide certain telecommunications,

pay TV and utilities attributes to the mortgage industry to

help streamline the mortgage underwriting process and

support loans within the secondary mortgage market.

Eective Q1 2023, these telecommunications, pay TV

and utilities attributes are now available to the mortgage

industry to provide a fuller picture of consumers’ nancial

proles. The majority of American adults have at least one

utility or cell phone bill in their name. Delivering certain

telecommunications, pay TV and utilities attributes to

mortgage lenders alongside traditional credit reports can

help create greater home ownership opportunities for

more than 191 million U.S. consumers, 80% of whom have

traditional credit les, but may benet from additional

insights into their nancial prole that can make mortgage

underwriting faster and easier. The use of these expanded

data insights can also provide visibility to millions of credit

invisible consumers – those without traditional credit les –

and enhance the nancial proles of younger, thin-le, and

unscorable consumers as they complete rst mortgage

applications – helping to expand access to credit.

Equifax plays an important role in the nancial lives of

consumers and we take that responsibility seriously. As

we strive to become the most consumer-friendly credit

bureau, our company purpose drives our business actions.

Equifax internal data shows that leveraging

alternative data could move 20M more U.S.

consumers into scorable credit bands

21%

of credit thin

or invisible

consumers

could become

scorable

18%

could qualify

for prime/near

prime oers

could qualify

for subprime

oers

Positive economic change starts with a single nancial opportunity.

Employment

Gov’t

Benets

New to

Country

Fair

Chance Hiring

Education

Victims

Services

Rent/Lease

Mortgage

Auto

Small

Business

Fraud

Prevention

Equifax

Foundation

2022 Annual Report

ESG Priorities

Data, analytics and technology is a powerful force in addressing pressing issues facing

the world around us and Equifax has committed to reaching net-zero greenhouse gas

emissions by 2040, an important sustainability commitment enabled by our Equifax

Cloud. As we move from physical, on-premise data centers to cloud-based technology,

we are working to increase system reliability and reduce operating expenses while also

transitioning to more renewable energy sources, consuming energy more eciently and

reducing our carbon footprint. These strategic business actions also have the potential to

help reduce greenhouse gas emissions.

For Equifax in 2022, data centers made up approximately 50% of the company’s total scope

1 and 2 emissions, net of renewable energy. As a part of our Equifax Cloud transformation

we have decommissioned 19 data centers to date, including seven decommissions in 2022.

As we complete our North American Cloud transformation in 2023, we expect to close

about 15 additional data centers, consolidate development centers, and continue to reduce

our software application footprint. In 2022, we accelerated our plan to purchase renewable

energy associated with our oces and data centers, which will continue to have a positive

impact on our sustainability commitments.

Equifax makes quantitative Environmental, Social and Governance (ESG) diversity

disclosures available annually in accordance with the Sustainability Accounting Standards

Board (SASB) framework, and we were one of the rst in our industry to publicly disclose

our Equal Employment Opportunity (EEO-1) and SASB diversity reports. We are committed

to nurturing a culture where everyone feels welcomed, valued and respected. Within our

senior leadership team, nearly 60% identify as female or as having a diverse racial or ethnic

background, and 45% of the Equifax global workforce identify as female.

In support of our commitment to inclusion and diversity and the creation of an

environment where all team members can ourish, we also developed and launched

the Equifax Inclusive Leader Framework in 2022 to articulate the habits and behaviors

expected of leaders across Equifax. And all members of our Global Leadership Team had

an ESG goal as part of their performance objectives last year.

In January 2023, Equifax appointed Karen Fichuk, former Chief Executive Ocer of

Randstad North America, as an independent director. Fichuk’s election is part of the

board’s regular succession planning process in connection with the scheduled retirement

of independent director Bob Selander in May 2023. Forty percent of our director nominees

for election at the 2023 Annual Meeting identify as female.

Current Equifax Workforce Diversity

Nearly 60% of our

senior leadership team

identify as female or as

having a diverse racial

or ethnic background

45% of our

global workforce

identify as female

Board of Directors Diversity

40% of our director

nominees for election

at the 2023 Annual Meeting

identify as female

Letter to Shareholders

EFX2025 Strategic Priorities

EFX2025: Our Growth Strategy for the Future

We move into 2023 with signicant momentum in the underlying growth of our businesses

and in the execution of our EFX2025 strategic priorities. Our Equifax team around the world

delivered against every component of our EFX2025 growth strategy in 2022 as we worked

to rapidly build the New Equifax and shift into our Next Gear of operations.

Equifax truly accelerated New Product Innovation in

2022 with over 100 new products for the third year in a

row, and a record full year Vitality Index of over 13% with

over 90% of new product revenue from non-mortgage

products. This 13% Vitality Index is an all-time high since

our Vitality Index program’s inception in 2007, and is

greater than 400 basis points above our strong 2021

results and more than 300 basis points higher than our

long-term growth framework.

As we complete the new Equifax Cloud, we are positioned

to bring exciting new products to market that leverage our

diversied assets and unique capabilities to unlock growth

opportunities for our customers. A majority of our New

Product Innovations, about 75% in total, leverage global

capabilities from our Equifax Cloud platform, which drives

both scale and eciency. Our time to market is averaging

77 days from start to launch, which is just a third of the

time needed only three years ago. Revenue driven from

new products reached the highest level in our history at

$650 million in 2022.

Workforce Solutions continues to lead Equifax in New

Product Innovation with oerings like the TotalVerify data

hub, delivering a business unit Vitality Index at more than

twice our long-term 10% Vitality Index target. Workforce

Solutions is the rst Equifax business to be substantially

complete with their Equifax Cloud transformation and

the growth of the Workforce Solutions Vitality Index from

the low single digits in 2019 to its record levels in 2022 is

a testament to the power of the Equifax Cloud to drive

innovation and new products today and in the future.

Innovation and development across all regions is

increasingly powered by our investment in the Equifax

Cloud. It enables us to scale and replicate our innovations

across the globe – and we have grown our multi-market

launches as a percentage of total New Product Innovation

from 2% in 2018 to over 20% in 2022 and growing. The

LATAM region leads Equifax with this approach. With a

regional Vitality Index well above our 10% long term target,

the International team is creating solutions that t each

of the 11 countries in the Equifax LATAM region to expand

and accelerate growth.

As we complete the Equifax Cloud,

we are positioned to bring exciting

new products to market.

As we move into 2023, our Equifax Cloud-based data

fabric capabilities will further accelerate our New Product

Innovation-based revenue growth worldwide. We are in the

early days of leveraging these new capabilities but remain

condent that they will dierentiate us commercially,

expand our New Product Innovation capabilities, and

accelerate our top line growth.

Accelerate

Innovation

and New

Products

Leverage

Equifax

Cloud

Capabilities

Expand

Dierentiated

Assets

Put

Customers

and

Consumers

First

Execute

Bolt-on

M&A

Continue

Leadership

in Security

Act as

One Team,

One Equifax

Accelerate Innovation and New Products

2022 Annual Report

Leverage Equifax Cloud Capabilities

We are entering 2023 in the nal chapter of completing our

Equifax Cloud data and technology transformation that we

started almost ve years ago. This massive, over $1.5 billion

multi-year investment in the Equifax Cloud is central to our

dierentiation and to our competitive advantage today and in

the years to come. We have created an agile new foundation

for the enterprise to develop solutions that are faster, more

reliable, more powerful, and more secure than ever before.

In 2022, North American revenue from

the Equifax Cloud reached a record

of about 70%, up from 50% in 2021.

In 2022, North American revenue from the Equifax Cloud

reached a record of about 70%, up from 50% in 2021. We

made the strategic decision in 2022 to increase capital

spending by approximately $175 million to $625 million

for the year to accelerate the completion of our North

American Cloud transformation. The progress made in

2022 will enable substantial completion of the North

American transformation and customer migrations in

2023, including the ability to decommission applications

and major North American data centers. Our International

transformation also continues to progress towards our goal

of being principally complete by the end of 2024 and we

are on track to reach our goal of 80% of our global revenue

being delivered from the Equifax Cloud in the near future.

Other highlights of our work to complete the Equifax Cloud

in 2022 include:

• We decommissioned seven data centers, bringing our total

to 19, which serves to help increase our system reliability

and reduce our operating expenses while reducing our

carbon footprint and fueling our commitment to reach

Net Zero greenhouse gas (GHG) emissions by 2040.

• We deployed a Global Network Security Stack

to enable a standard, secure and scalable Cloud

infrastructure globally. This drives substantially

decreased latency and increased security protection

and encryption, translating to faster application

onboarding and customer response time.

• Workforce Solutions accelerated growth with the Equifax

Cloud, moving The Work Number database to our Data

Fabric – scaling employer records to more than 2.6 million

U.S. employers – and transforming Verication Services.

• Equifax completed 53,000 customer migrations

globally in 2022, an increase from the 30,000 customer

migrations completed in 2021.

• We strengthened our competitive edge in 2022 with the

launch of a unied global keying and linking platform

in our enterprise Data Fabric that will soon allow us to

replace 10 disparate systems.

• Our rst consumer credit product, Automated Data

View, moved to the Equifax Cloud, enabling 1,500 U.S.

Information Solutions customers to access our Core

Credit exchange on the Data Fabric for faster insights.

• Canada began to transform their Consumer Exchange

with almost 50% of online consumer transaction

volume migrated. This is the rst location outside of

the U.S. to begin this shift.

• Kount Identity Verication, our global Identity

Verication and Adaptive Authentication platform,

went live in the U.K. replacing a legacy system and

unlocking Equifax Cloud savings.

• Latin America completed more than 20,000 of our total

customer migrations in 2022, while also delivering more

than 30 new Equifax Cloud-based products and a regional

Vitality Index well above our 10% long term target.

• Australia and New Zealand successfully loaded 100%

of their historical consumer data into the Data Fabric.

• India made substantial transformation progress, deploying

the International Work Number to the Equifax Cloud.

As we focus on completing our North America Cloud

transformation in 2023, we will pivot to leveraging our

dierentiated data assets and new Cloud infrastructure to

drive new product roll-outs and top-line growth. Workforce

Solutions will accelerate its focus on leveraging their

new Equifax Cloud capabilities and USIS and Canada will

complete their consumer credit, alternative data and Identity

& Fraud Solutions transformations. These are milestones

that Equifax has been building towards for nearly ve years.

We are energized to be pivoting from building the cloud

to leveraging our new Equifax Cloud technology to drive

innovation, new products, growth, and margin expansion.

We decommissioned seven data

centers, bringing our total to 19.

Letter to Shareholders

Expand Dierentiated Data Assets

Dierentiated data and analytics that Only Equifax can

provide continue to be at the heart of our business.

Unlocking deeper decision intelligence to help our

customers deliver better outcomes for consumers at scale

is a primary focus of our Equifax Cloud transformation.

This requires exceptional data stewardship, including

strong processes to ensure the accuracy of our

dierentiated data, and providing the highest level of

regulated services in support of our goal to become the

most consumer-friendly credit bureau.

Unlocking deeper decision

intelligence to help our customers

deliver better outcomes for

consumers at scale is a primary focus

of our Equifax Cloud transformation.

In 2021, we united our Technology, Product and Data &

Analytics teams under the leadership of Bryson Koehler

to create heightened connectivity and positive synergies

across these critical teams. In 2022, we announced the

appointment of Harald Schneider as Chief Data & Analytics

ocer, reporting to Koehler. Schneider brings more than

two decades of multinational experience to the role of

Chief Data & Analytics Ocer. In this role, he will champion

global data innovation, maximizing the benets of Equifax

dierentiated data assets, leading analytics capabilities

and single data fabric within the Equifax Cloud to drive

new products and growth while overseeing our data

acquisition strategy and data quality management.

Strengthening our data assets and connecting them

to drive unique, real-time insights for our customers is

central to the Next Gear of our operations. In 2022, the

dierentiated data that Only Equifax can provide included:

• The Work Number Database: 152 million active

employment records and 604 million total employment

records for verications of employment and income

from 2.6 million dierent US employers

• Core Credit: More than 1.6 billion tradelines with

information on 240 million+ consumers

• Insights: 180 million incarceration records

and 600 million court records

• Partnership with National Student Clearinghouse:

Access to 130 million degrees from 2,700 colleges

and universities

• DataX and Teletrack: Access to 80 million unbanked,

underbanked and credit rebuilding consumers –

enabling greater access to credit

• Partnerships for cash ow data: Information on

balances, deposits and withdrawals from more than

7,700 participating U.S. nancial institutions – allowing

access to 99% of the U.S. population

• IXI: Wealth information with $24 trillion in anonymized

assets and investments

• Kount: 56 billion consumer identity interactions

• Commercial Financial Network powered with

acquisitions of PayNet and Ansonia: 180 million

tradelines across 155 million businesses

We will continue to maximize

our dierentiated data assets to

drive new products and solutions

leveraging alternative data assets

to provide a fuller nancial

picture of consumers to lenders

and service providers.

The bottom line goal of our Equifax Cloud innovation

and investment is to help our customers deliver better

outcomes for consumers and businesses at scale and in

2023 we will continue to maximize our dierentiated data

assets to drive new products and solutions leveraging

alternative data assets to provide a fuller nancial picture

of consumers to lenders and service providers.

The Work Number

service fullled

over 45M

verications in support of government

assistance programs in the U.S.

Equifax helped

8.2M

people secure a

loan to further their

education in the U.S.

*Based on actual and estimated results from January-December 2022; Sources: Data and analytics captured by Equifax business units (U.S. Information Solutions, Workforce Solutions, and International)

2022 Annual Report

Put Customers and Consumers First

Migrating our products and solutions to the Cloud gives

customers access to the most up-to-date data, which

forms the most comprehensive proles for consumers

and businesses – helping to propel them forward. We are

also driving more powerful consumer experiences through

product innovation and improved services.

Our goal of becoming the most consumer-friendly

Consumer Reporting Agency guides our actions:

• In 2022, we supported victims of crime with more than

24 million notications through the VINE network.

VINE, acquired in our purchase of Appriss Insights in

2021, is the leading victim notication network in the U.S.

It allows survivors, victims of crime, and other concerned

citizens to access timely and reliable information about

oenders or criminal cases in U.S. jails and prisons.

• Our onboarding solutions helped one in 10 U.S.

employees start their new jobs, and we provided

consumers with access to 23 million tax forms to help

them complete their tax returns.

• We enhanced the consumer experience on The Work

Number portal in 2022, making it even simpler for

individuals to view, understand and control their

employment data. The fully refreshed site now includes

a mobile-friendly design with enhanced accessibility

and new educational tools.

• The experience of our U.S. myEquifax consumer

portal, which surpassed 17 million users, 5.9 million

Core Credit™ subscribers, and 626,000 paid product

subscribers in 2022, has evolved over the last year to

include access to new oers and services, helping to

simplify processes like nding auto loans on behalf of

the consumers we serve.

Along with TransUnion and Experian,

we announced signicant changes

to medical collection debt reporting

to support consumers faced with

unexpected medical bills.

• And, along with TransUnion and Experian, we

announced signicant changes to medical collection

debt reporting to support consumers faced with

unexpected medical bills. These joint measures will

remove nearly 70% of medical collection debt

tradelines from consumer credit reports. We also

jointly announced the extension of free weekly credit

reports to U.S. consumers through the end of 2023 to

help consumers manage their nancial health during

a period of economic uncertainty.

Equifax plays an important role in the nancial lives of

consumers and we take that responsibility seriously.

Ensuring the accuracy of our dierentiated data and of

consumer credit reports is our most important job and

as we work to complete our transformation in 2023, we

are examining our business processes and technology

platforms as we work to improve them.

Our onboarding solutions helped

one in 10 U.S. employees start

their new jobs.

*Based on actual and estimated results from January-December 2022; Sources: Data and analytics captured by Equifax business units (U.S. Information Solutions, Workforce Solutions, and International)

Nearly

88M

Oender and defendant

searches were performed

Over

24M

VINE notications provided

to U.S. survivors in 2022

Equifax delivered

over 2.9B

consumer credit les to U.S. lenders

Equifax completed

15.2M

know-your-customer

verication checks for

customers in Canada

Letter to Shareholders

Execute Bolt-on M&A

Equifax continues to re-invest our strong performance in

strategic, bolt-on acquisitions to strengthen our company

and drive future non-mortgage growth. We have signed

or completed 14 transactions totaling $4.1 billion since the

beginning of 2021.

In 2022, we completed four

acquisitions totaling $450 million

that will contribute approximately

$90 million in annualized revenue.

In 2022, we completed four acquisitions totaling $450

million that will contribute approximately $90 million in

annualized revenue. The accretive acquisitions of Data-

Crédito, Ecient Hire, LawLogix and Midigator not only

grow our core revenue, but strengthen our business with

new data assets, capabilities and talented team members.

• Data-Crédito expands the Equifax International

business into new geographies. As the largest consumer

credit reporting agency in the Dominican Republic,

Data-Crédito is a bridge to the Caribbean that will allow

Equifax to connect and stay close to strategic regional

clients and to better serve consumers. By bringing the

power of the Equifax Cloud to credit reporting and

scoring in the Dominican Republic, Equifax will enable

nancial institutions to gain new insights into consumers’

nancial proles as part of the lending process, helping

them to responsibly open up new mainstream nancial

services opportunities to underbanked individuals.

• Ecient Hire expands The Work Number database with

more than 500,000 active payroll records and strengthens

the Workforce Solutions suite of employer services with

solutions specically tailored to meet the needs of hourly

employers, with an emphasis on helping rms in the

restaurant, stang, building services, senior care and

hospitality industries, to help them eciently scale their

workforces. Employee acquisition and retention in these

industries continue to impact consumer experiences in

a hiring environment that has been challenged since the

beginning of the COVID pandemic.

• LawLogix Software-as-a-Service solutions further

expand our Workforce Solutions employer services by

providing the capability to digitize and streamline labor-

intensive I-9 and immigration processes while helping

thousands of organizations, including several of the

largest businesses and most recognized immigration

law rms in the United States comply with complicated

regulatory frameworks.

• Midigator post-transaction fraud mitigation solutions

expand our USIS business and complement the Equifax

Kount Identity Trust Global Network acquired in 2021.

With global omnichannel digital payments expected to

grow from 2.6 billion users in 2020 to over 4.4 billion in

2025, dispute and chargeback rates present growing

problems for businesses around the world. Midigator

oers a technology platform designed to not only

automate the dispute response process, but to provide

the real-time data businesses need to know why

chargebacks are occurring in the rst place and better

understand their customers.

Non-mortgage revenue growth is a key priority for Equifax

and a critical driver of our M&A priorities. The acquisitions we

completed in 2022 are expected to deliver growth synergies in

2023 and 2024 as we complete their technology and product

integrations into the Equifax Cloud – enabling us to create

new products and drive new capabilities for our customers.

In 2021, we completed the strategic acquisitions of Kount

and Appriss Insights. In 4Q 2022, Equifax expanded

Kount business operations in the United Kingdom and

made Kount digital identity trust and fraud prevention

solutions available in Latin America and Australia. And,

the Workforce Solutions talent solutions and government

verticals are beneting from the addition of new Insights

data at the Federal, State, and Local level.

We continued to reinvest free cash

ow in strategic acquisitions in the

rst part of 2023, signing a denitive

agreement to acquire Boa Vista

Serviços, the second largest credit

bureau in Brazil.

Building on that success, we continued to reinvest free

cash ow in strategic acquisitions in the rst part of

2023, signing a denitive agreement to acquire Boa Vista

Serviços, the second largest credit bureau in Brazil. The

transaction is subject to Boa Vista Serviços’ shareholder

approval and other customary closing conditions and is

expected to be completed in mid-2023, at which time the

company will become a part of our International business.

We also announced the acquisition of The Food Industry

Credit Bureau, the leading provider of credit information

for the food industry in Canada, from Montreal-based

Prole Credit in January.

2022 Annual Report

Security has become a point of strength and a competitive

advantage for Equifax. We’ve built one of the world’s

most advanced and eective cybersecurity programs,

with a maturity level that has exceeded all major industry

benchmarks for three consecutive years and a posture

that ranks in the top 1% of Technology companies and

top 3% of Financial Services companies analyzed.

We’ve built one of the world’s

most advanced and eective

cybersecurity programs, with a

maturity level that has exceeded

all major industry benchmarks

for three consecutive years.

Since 2018, we have built a culture where security

is part of our global team’s DNA. Every employee

receives customized training and has visibility into

their own security performance. In 2022, we expanded

our customized training to include contract workers

and introduced new, targeted measurement of key

behaviors, including secure browsing and sensitive data

handling. These performance measures are included in

the calculation of annual incentive compensation for all

bonus-eligible employees.

From our technology infrastructure, data fabric and

product development, to our merger and acquisition

strategies, security is embedded in everything we do.

Over the last year, the security team has enhanced our

acquisition processes by establishing tiered control

priority, a subset of key controls, and risk-based

reporting – critical in supporting our acquisition goals.

To ensure that newly-acquired businesses align with

our rigorous cybersecurity standards, we completed

controls alignment for 15 acquisitions, including the

four transactions completed in 2022.

As part of our commitment to delivering solutions

that benet the security community, customers

and consumers, Equifax developed and introduced

CloudControl, a dashboard that brings greater

transparency and improved security to digital supply

chains for organizations using Equifax products and

solutions. Through the CloudControl dashboard, Equifax

customers are provided with deep insights into control

eectiveness, empowering them with the information

they need to make informed risk decisions.

In our third Annual Security Report, released in the rst

quarter of 2023, we noted our continued optimization

of security systems over the last year, driving additional

cloud security and augmenting our security toolset for

better governance, reduced risk, and less friction for the

business. We worked in partnership with other technology

providers to co-design solutions that are now available

to the market at large, strengthening security across

the broader business ecosystem. As part of these co-

innovation eorts, we were recognized by Ping Identity

with their Cloud Identity Champion award for “work that

pushes our industry forward.”

We also continue to actively engage

with customers, policymakers,

and other organizations regarding

the challenges and opportunities

in cybersecurity.

We also continue to actively engage with customers,

policymakers, and other organizations regarding the

challenges and opportunities in cybersecurity. As

part of this engagement, Equifax Chief Information

Security Ocer Jamil Farshchi has expanded on his

Equifax responsibilities by taking on the role of Strategic

Engagement Advisor to the Federal Bureau of Investigation

(FBI). In this capacity, Farshchi supports the FBI’s eorts

to strengthen their relationship with the private sector

to address the range of cyber threats facing businesses

across America.

Continue Leadership in Security

Equifax received

over 16M

identity theft queries, helping

to prevent possible identity

theft every day in Chile

Equifax assessed

10.2M

credit applications for potential

fraud, helping to stop $676M in

potential losses in Australia

*Based on actual and estimated results from January-December 2022; Sources: Data and analytics captured by Equifax business units (U.S. Information Solutions, Workforce Solutions, and International)

Letter to Shareholders

Our greatest competitive advantage and asset is our

people. Nurturing a team environment that fosters cross-

functional collaboration and innovation and working as

One Equifax is core to our success.

Critical to that collaboration is face-to-face interaction.

In 2022, we implemented a 3/2 + 2 return to oce

framework– open to any employee who can perform

work outside of the oce and whose role does not require

routine weekly travel, such as our sales associates. As part

of this framework, Tuesday, Wednesday and Thursday are

standard “in oce days,” and employees have the option

to work from home on Mondays and Fridays, if desired.

Our “+2” policy enables employees to work remotely for

two full weeks of their choosing each year.

Our teams operated very well throughout the COVID-19

pandemic and have come together in new ways as we have

returned to our oce environment. In our 2022 Employee

Engagement Survey, Equifax attained an engagement

score of 78%, signaling high levels of engagement across

the enterprise. Equifax continues to make a number of

internal and external training opportunities available

to our team worldwide, with our global employees

completing more than 140,000 hours of training and

professional development, including more than 14,000

hours of leadership and management development,

and almost 45,000 hours of technical training in 2022.

Equifax is a place where our employees can grow and

develop their careers, with an internal ll rate for open

positions reaching 40% in 2022.

An important part of supporting our people is supporting

the areas where they live and work. The Equifax

Foundation partners with organizations in Atlanta and

St. Louis to help low-to-moderate income communities

achieve the credit strength needed to live their nancial

best. In 2022, the Equifax Foundation put our purpose

into action by making more than $1.9 million in direct

charitable grants to our Community partners. Building

nancial capability is a critical step to establishing

individual nancial health and generational wealth that

can change the trajectory and livelihood of families and

communities. Additionally, through our Equifax Gives

program, we matched a record $1.1 million in employee

gifts for more than $4 million in total community impact.

Shifting Into Our Next Gear

We are energized by both our delivery against our EFX2025 strategic priorities and our

8 consecutive quarters of strong, double digit core revenue growth – but even more

energized about the future of the New Equifax in 2023 and beyond. Our Equifax Cloud based

technology, dierentiated data assets in our new single data fabric, new product roll-outs,

strategic bolt-on M&A and our market leading businesses will enable us to shift into our

Next Gear to deliver higher growth, expanded margins and free cash ow in the future.

In 2023, we expect to deliver revenue growth at a midpoint of 4% in total with non-mortgage

growth of over 8%, despite continuing challenges in the mortgage market and more uncertain

broader economic outlook. Looking forward, we remain focused on growing the company

to $7 billion in revenue and 39% EBITDA margins by 2025. Our strong top-line growth and

expanding margins will expand our excess free cash ow substantially. We are moving into

2023 on oense and focused on completing the Equifax Cloud, bolstered by underlying

business growth and taking proactive measures to ensure we execute and outperform.

On behalf of the Equifax board, leadership team, and nearly 14,000 team members around

the world, we thank you for your ongoing support and condence in our business. We are

energized by our continued strong performance in 2022, and are shifting into our Next Gear

to deliver on the power of the New Equifax in the future.

Thanks for your support,

Mark W. Begor Mark L. Feidler

Chief Executive Ocer and Director Independent Chairman of the Board of Directors

Act as One Team, One Equifax

This page intentionally left blank

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

____________________________________

FORM 10-K

☒

ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2022

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from to

Commission File Number 001-06605

____________________________________

EQUIFAX INC.

(Exact name of registrant as specified in its charter)

Georgia 58-0401110

(State or other jurisdiction of incorporation or organization) (I.R.S. Employer Identification No.)

1550 Peachtree Street N.W. Atlanta Georgia 30309

(Address of principal executive offices) (Zip Code)

Registrant’s telephone number, including area code: 404-885-8000

Securities registered pursuant to Section 12(b) of the

Act:

Title of each class Trading Symbol Name of each exchange on which registered

Common Stock, $1.25 par value per share EFX

New York Stock Exchange

Securities registered pursuant to Section 12(g) of the Act: None.

____________________________________

Indicate by check mark if Registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Exchange Act (“Act”).

☒ Yes ☐ No

Indicate by check mark if Registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. ☐ Yes ☒ No

Indicate by check mark whether Registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange

Act of 1934 during the preceding 12 months (or for such shorter period that the Registrant was required to file such reports), and (2) has been subject

to such filing requirements for the past 90 days. ☒ Yes ☐ No

Indicate by check mark whether the Registrant has submitted electronically every Interactive Data File required to be submitted pursuant to

Rule 405 of Regulation S-T during the preceding 12 months (or for such shorter period that the Registrant was required to submit such files).

Yes ☒ No ☐

Indicate by check mark whether the Registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting

company, or an emerging growth company. See definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company” and

“emerging growth company” in Rule 12b-2 of the Exchange Act. (Check one):

☒

Large accelerated filer

☐

Accelerated filer

☐

Non-accelerated filer

☐

Smaller reporting

company

☐

Emerging growth

company

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying

with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its

internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm

that prepared or issued its audit report. ☒

Indicate by check mark whether the Registrant is a shell company (as defined in Rule 12b-2 of the Act). ☐ Yes ☒ No

As of June 30, 2022, the aggregate market value of Registrant’s common stock held by non-affiliates of Registrant was approximately

$22,372,025,247 based on the closing sale price as reported on the New York Stock Exchange. At January 31, 2023, there were 122,488,001 shares

of Registrant’s common stock outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of Registrant’s definitive proxy statement for its 2023 annual meeting of shareholders are incorporated by reference in Part III of

this Form 10-K.

This page intentionally left blank

TABLE OF CONTENTS

Page

PART I

Item 1. Business

Item 1A. Risk Factors

Item 1B. Unresolved Staff Comments

Item 2. Properties

Item 3. Legal Proceedings

Item 4. Mine Safety Disclosures

PART II

Item 5. Market for the Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of

Equity Securities

Item 6. Reserved

Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations

Item 7A. Quantitative and Qualitative Disclosures About Market Risk

Item 8. Financial Statements and Supplementary Data

Item 9. Changes in and Disagreements with Accountants on Accounting and Financial Disclosure

Item 9A. Controls and Procedures

Item 9B. Other Information

PART III

Item 10. Directors, Executive Officers and Corporate Governance

100

Item 11. Executive Compensation

101

Item 12. Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters

101

Item 13. Certain Relationships and Related Transactions, and Director Independence

101

Item 14. Principal Accountant Fees and Services

101

PART IV.

Item 15. Exhibits and Financial Statement Schedules

102

Item 16. Form 10-K Summary

105

Signatures

106

PART I

ITEM 1. BUSINESS

Overview

Equifax Inc. is a global data, analytics and technology company. We provide information solutions for businesses,

governments and consumers, and we provide human resources business process automation and outsourcing services for

employers. We have a large and diversified group of clients, including financial institutions, corporations, government agencies

and individuals. Our services are based on comprehensive databases of consumer and business information derived from

numerous sources including credit, financial assets, telecommunications and utility payments, employment, income, educational

history, criminal history, healthcare professional licensure and sanctions, demographic and marketing data. We use advanced

statistical techniques, machine learning and proprietary software tools to analyze available data to create customized insights,

decision-making and process automation solutions and processing services for our clients. We are a leading provider of e-

commerce fraud and charge back protection services in North America as well as information and solutions used in payroll-

related and human resource management business process services in the United States of America (“U.S.”). For consumers, we

provide products and services to help people understand, manage and protect their personal information and make more

informed financial decisions. Additionally, we also provide information, technology and services to support debt collections

and recovery management.

We currently operate in four global regions: North America (U.S. and Canada), Asia Pacific (Australia, New Zealand

and India), Europe (the United Kingdom (“U.K.”), Spain and Portugal) and Latin America (Argentina, Chile, Costa Rica,

Dominican Republic, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay). We maintain support operations

in the Republic of Ireland, Chile, Costa Rica and India. We also have investments in consumer and/or commercial credit

information companies through joint ventures in Cambodia, Malaysia and Singapore and have an investment in a consumer and

commercial credit information company in Brazil. We previously had a joint venture in Russia that offered consumer credit

services; however, during the third quarter of 2022, we completed the sale of this equity method investment.

Equifax was originally incorporated under the laws of the State of Georgia in 1913, and its predecessor company dates

back to 1899. As used herein, the terms Equifax, the Company, we, our and us refer to Equifax Inc., a Georgia corporation, and

its consolidated subsidiaries as a combined entity, except where it is clear that the terms mean only Equifax Inc.

We are organized and report our business results in three operating segments, as follows:

• Workforce Solutions — provides services enabling customers to verify income, employment, educational history,

criminal justice data, healthcare professional licensure and sanctions of people in the U.S. (Verification Services),

as well as providing our employer customers with services that assist them in complying with and automating

certain payroll-related and human resource management processes throughout the entire cycle of the employment

relationship, including unemployment cost management, employee screening, employee onboarding, tax credits

and incentives, I-9 management and compliance, immigration case management, tax form management services

and Affordable Care Act management services (Employer Services). Workforce Solutions has established

operations in Canada, Australia and most recently in the U.K.

• U.S. Information Solutions (“USIS”) — provides consumer and commercial information solutions to businesses

in the U.S. including online information, decisioning technology solutions, identity management services,

analytical services, e-commerce fraud and charge back protection services, portfolio management services,

mortgage reporting and marketing services. We provide products to consumers in the U.S. to enable them to

understand and monitor their credit and help protect their identity. We also sell consumer credit information to

resellers who may combine our information with other information to provide direct-to-consumer monitoring,

reports and scores.

• International — provides products and services similar to those available in the USIS operating segment but with

variations by geographic region. We also provide information, technology and services to support debt collections

and recovery management. In addition, we provide products to consumers in Canada, the U.K. and Australia to

enable them to understand and monitor their credit and help protect their identity. This operating segment is

comprised of our Asia Pacific, Europe, Latin America and Canada business units. It also includes our joint

ventures in Cambodia, Malaysia and Singapore and investment in a consumer and commercial credit information

company in Brazil.

Our Business Strategy

Our vision is to be a trusted global leader in data, analytics and technology that creates innovative solutions and

insights for our customers. Our business strategy is driven by the following imperatives:

• Leverage our Equifax cloud capabilities and technology investment to accelerate innovation, new products

and growth. We are executing a cloud data and technology transformation that is rebuilding our technology

infrastructure, including a migration to a public cloud environment that employs virtual private cloud deployment

techniques. We are rationalizing and rebuilding our application portfolio using cloud-native services. Our move to

cloud-native technology is enabling the creation of our single data fabric and implementation of best-in-class

cloud-based tools and capabilities. Our growth strategy is to leverage our cloud data and technology

transformation to accelerate innovation and new product development; deliver market-leading capabilities to our

customers; facilitate customer and partner implementation and integration; improve ease of consumer access to

and interaction with Equifax; and strengthen system resiliency and uptime.

• Leverage and expand our differentiated portfolio of data assets. We use proprietary advanced analytical

platforms, including capabilities in machine learning, artificial intelligence and advanced visualization tools, to

leverage our unique data to develop leading analytical insights that enhance the precision of our customers’

decisioning activities. Based on our cloud native data and technology transformation, we are investing to simplify

our customers’ access to our leading analytical and decisioning platforms, in order to speed the development of

unique insights and the conversion of these insights into innovative new products and services consumable by our

customers through our delivery platforms. We strive to advance these capabilities and bring our customers multi-

data solutions at scale by expanding our unique and differentiated data assets and analytics through organic

growth, business acquisitions and partnerships.

• Foster a culture of customer centricity. We are focused on maintaining a culture in which the customer is at the

center of our decision processes and we exceed customer expectations by delivering solutions with speed,

flexibility, stability and performance. We prioritize engagement with our customers and strive to accelerate

innovation through our expanded customer focus and collaboration. We seek to leverage our cloud native

technology and unique data assets and capabilities, as well as customer expertise and customer data and

technology assets, to drive the development of high-value analytical products and services targeted at a broader

range of customer needs. Our focus on customer centricity enables us to be more proactive in solving problems

better and faster for customers while delivering enhanced operational readiness to provide a better customer

experience.

• Execute strategic acquisitions that expand our data portfolio and capabilities and drive revenue growth. A

critical lever of our strategy is inorganic growth through accretive and strategic acquisitions that drive incremental

annual revenue growth. Our acquisition priorities are clear and focused on re-investing in bolt-on acquisitions that

expand our unique differentiated data assets and solutions to strengthen and grow our core businesses. We

continue to invest, including through acquisitions and partnerships, to expand our addressable markets and the

data and capabilities we offer to solve customer challenges across the services we provide and to expand our

access to differentiated data including across identity authentication, fraud mitigation and risk management. We

believe there are opportunities to continue to expand in the U.S. and internationally, across the existing financial,

mortgage, telecommunications, automotive, insurance, talent management, human resource services, government

and other markets that we serve, as well as in new and emerging market segments.

• Continue our leadership in data security. We are committed to being an industry leader in security. We have

built an Equifax culture that prioritizes security, and we consider data and technology security, and more broadly

risk management, as a primary requirement in all decisions. We make extensive use of advanced data and

technology security tools, techniques, services and processes in order to enhance our ability to protect the

information with which we are entrusted. We are committed to working openly with our peers, customers, and

partners to tackle emerging security challenges, document best practices, provide vital data security thought

leadership and work together to deliver solutions that benefit both the security community and consumers.

• Build a world-class Equifax team by investing in talent to drive our strategy and promote a culture of

innovation. At Equifax, we are committed to nurturing a culture where diverse talent thrives. We are focused on

providing meaningful opportunities for career advancement and development, fostering an inclusive work

environment, and promoting employee engagement and recognition. We leverage our enterprise-wide talent

initiatives to develop, retain and attract a highly-qualified workforce in order to promote our culture of innovation,

add diverse perspectives and deliver on our business strategy.

We seek to enhance shareholder value through the disciplined execution of these imperatives and by positioning our

Company as a global data, analytics and technology leader with industry-leading security.

Markets and Clients

Our products and services serve clients across a wide range of verticals, including mortgage, financial services,

employers, government (state, federal and local), automotive, commercial, identity and fraud, consumer, resellers, healthcare,

telecommunications, retail and insurance. We also serve consumers directly. Our revenue streams are highly diversified with

our largest client providing approximately 2% of total revenue. The following table summarizes the various end-user markets

we serve:

Percentage of 2022 Consolidated Revenue

24%

19%

16%

Mortgage

Financial

Employers

Government

Automotive

Commercial

Identity & Fraud

Consumer

Resellers (1)

Healthcare

Telecommunications

Retail

Insurance

Other (2)

0 5 10 15 20 25 30

Predominantly sold to companies who serve the direct-to-consumer market and includes other small end user markets.

Mortgage and auto resellers are excluded from this category as they are included within their respective categories

above.

Other includes revenue from other miscellaneous end-user markets.

We market our products and services primarily through our own direct sales organization that is structured around

sales teams that focus on client segments typically aligned by vertical markets and geography. In the U.S., the vertical market

sales teams for the Mortgage, Financial, Government and Automotive markets sell products from both the USIS and Workforce

Solutions business units. Sales groups are based in field offices located throughout the U.S., including our headquarters in

Atlanta, Georgia, and in the countries where we have operations. We also market our products and services through indirect

channels, including alliance partners, joint ventures and other resellers. In addition, we market our products directly to

consumers through e-commerce channels.

Revenue from international clients, including end users and resellers, amounted to 22% of our total revenue in 2022,

22% of our total revenue in 2021 and 23% of our total revenue in 2020.

Products and Services

Our products and services help our clients make more informed decisions with higher levels of confidence by

leveraging a broad array of data assets. Analytics are used to derive insights from the data that are most relevant for the client’s

decisioning needs. The data and insights are then processed through proprietary software and generally transmitted to the

client’s operating system to execute the decision.

The following chart summarizes the key products and services offered by each of the business units within our

segments:

Workforce Solutions USIS International

Verification

Services

Employer

Services

Online

Information

Solutions

Financial

Marketing

Services Europe Asia Pacific

Latin

America Canada

Online data X X X X X X

Portfolio management services X X X X X X X

Analytical services X X X X X X X X

Technology services X X X X X

Identity verification services X X X X X X X

Fraud management services X X X X X X X

Marketing services X X X X X

Direct-to-consumer credit monitoring X X X X X

Employment and income verification services X X X

Talent management X X

Business process outsourcing (BPO) X X X

Debt collection software, services and analytics X X X X

Each of our operating segments is described more fully below. For the operating revenue, operating income and total

assets for each segment, see Note 13 of the Notes to the Consolidated Financial Statements in Item 8 of this report.

Workforce Solutions

Workforce Solutions operates in the U.S. through two business units:

Verification Services. Verification Services include employment, income, educational history, criminal history,

healthcare professional licensure and sanctions verification services. Our online verification services enable third-party verifiers

including various governmental agencies, mortgage originators, credit card and automotive lenders and pre-employment

screeners to verify the employee’s employment status and income information. We also offer an offline manual verification

service, which expands employment verification to locate data outside our existing automated database. We also offer various

government direct data services, where we process tax forms on behalf of our customers with the applicable government

agency. In addition, Verification Services administers a comprehensive source of incarceration, justice and people-based risk

intelligence data.

Employer Services. These services are aimed at reducing the cost of the human resources function of businesses

through a broad suite of services, including assisting with employment tax matters designed to reduce the cost of

unemployment claims through effective claims representation and management and efficient processing to better manage the

tax rate that employers are assessed for unemployment taxes; comprehensive services designed to research the availability of

employment-related tax credits (e.g., federal work opportunity tax credits and employee retention credits), and to process the

necessary filings and assist the client in obtaining the tax credit; tax form management services (which include initial

distribution, reissuance and correction of W-2 and 1095-C forms); paperless pay services that enable employees to

electronically receive pay statement information as well as review and change direct deposit account or W-4 information; I-9

management services designed to help clients electronically comply with the immigration laws that require employers to

complete an I-9 form for each new hire; immigration case management services; onboarding services using an online platform

to complete the new hire process for employees of corporations and government agencies; and identity theft protection

services. In addition, we provide software and services to employers to assist in their compliance with the Affordable Care Act.

The Work Number

is our key repository of employment and income data serving our Verification Services business

unit. We rely on payroll data received from over two million organizations to regularly update the database. The updates occur

as employers and other data contributors transmit data electronically to Equifax from their payroll systems. Employers provide

this data to us so that we can handle verification requests on behalf of each employer. We use this data to provide automated

employment and income verification services to verifiers, who are lenders, employers/background screeners, and government

agencies.

The fees we charge for services in these two business units are generally on a per transaction basis. We have not

experienced significant turnover in the employer contributors to the database because we generally do not charge them to add

their employment data to The Work Number

database, and the verification service we offer relieves them of the administrative

burden and expense of responding to third-party employment verification requests while providing them with the assurance that

the process is automated and not subject to human interpretation. The Work Number

database held over 600 million current

and historic employment records at December 31, 2022.

Workforce Solutions has established an income and employment verification service in Canada, Australia, and the

U.K., known as Verification Exchange. At present, revenues from these services in all three regions mentioned are

insignificant.

USIS

USIS provides consumer and commercial information solutions to businesses in the U.S. through three product and

service lines, as follows:

Online Information Solutions. Online Information Solutions’ products are derived from multiple large and

comprehensive databases of consumer and commercial information that we maintain about individual consumers and

businesses, including credit history, current credit status, payment history, address and other identity information. Our clients

utilize the information and analytical insights we provide to make decisions for a broad range of financial and business

purposes, such as whether, and on what terms, to approve auto loans or credit card applications, and whether to allow a

consumer or a business to open a new utility or telephone account. In addition, this information is used by our clients for cross-

selling additional products to existing customers, improving their underwriting and risk management decisions, and

authenticating and verifying consumer and business identities. We also sell consumer and credit information to resellers who

may combine our information with other information to provide services to the financial, mortgage, fraud and identity

management, and other end-user markets. Our software platforms and analytical capabilities can integrate all types of

information, including third-party and client information, to enhance the insights and decisioning process to help further

mitigate the risk of granting credit, predict the risk of bankruptcy, indicate the applicant’s risk potential for account

delinquency, ensure the identity of the consumer and reduce exposure to fraud. Identity verification and fraud management

products combine financial and non-financial identity information and activity to provide identity verification and

authentication services, to assist customers in assessing the risk of loss due to account takeover, identity theft and chargebacks.

These risk management services enable our clients to monitor risks and opportunities and proactively manage their portfolios.

Online Information Solutions’ clients access products through a full range of electronic distribution mechanisms,

including direct real-time access, which facilitates instant decisions. We also develop and host customized applications that

enhance the decision-making process for our clients. These decisioning technology applications assist with a wide variety of

decisioning activities, including determining pre-approved offers, cross-selling of various products, determining deposit

amounts for telephone and utility companies and verifying the identity of their customers. We have also compiled commercial

databases regarding businesses in the U.S., which include loan, credit card, public records and leasing history data, trade

accounts receivable performance and Secretary of State and Securities and Exchange Commission registration information. We

offer scoring and analytical services that provide additional information to help mitigate the credit risk assumed by our clients.

Online Information Solutions also includes our consumer solutions product suite that give U.S. consumers information

to enable them to understand and monitor their credit to monitor and help protect their identity. Equifax products offer

monitoring features for consumers who are concerned about identity theft, including credit report monitoring from all three

credit bureaus, internet scanning, bank account monitoring and lost wallet support. Products may also be available indirectly

through relationships with business partners who distribute our products or provide these services to their employees or

customers. We also sell consumer credit information to resellers who may combine our information with other information to

provide direct-to-consumer monitoring, reports and scores.

Mortgage Solutions. Our Mortgage Solutions products, offered in the U.S., consist of specialized credit reports that

combine information from the three major consumer credit reporting agencies (Equifax, Experian and TransUnion) into a single

“merged” credit report in an online format, commonly referred to as a tri-merge report. Mortgage lenders use these tri-merge

reports in making their mortgage underwriting decisions. Additionally, we offer services designed to alert lenders to changes in

a consumer’s credit status during the underwriting period and securitized portfolio risk assessment services for evaluating

inherent portfolio risk.

Financial Marketing Services. Our Financial Marketing Services products utilize consumer and commercial financial

information enabling our clients to more effectively manage their marketing efforts, including targeting and segmentation, to

identify and acquire new clients for their products and services; to develop portfolio strategies to minimize risk and maximize

profitability; and to realize additional revenue from existing customers through more effective cross-selling of additional

products and services. Our products are also utilized by customers to support digital identity verification and fraud detection

and protection. These products utilize information derived from consumer and commercial information, including credit,

income, asset, liquidity, net worth and spending activity, which also support many of our Online Information Solutions’

products. These data assets broaden the understanding of consumer and business financial potential and opportunity, which can

further drive high value decisioning and targeting solutions for our clients. We also provide account review services, which

assist our clients in managing their existing customers and prescreen services that help our clients identify new opportunities

with their customers. Clients for these products primarily include institutions in the banking, brokerage, retail, insurance and

mortgage industries as well as companies primarily focused on digital and interactive marketing.

International

The International operating segment includes our Asia Pacific, Europe, Latin America and Canada business units. It

also includes our joint ventures in Cambodia, Malaysia and Singapore and investment in a consumer and commercial credit

information company in Brazil. These business units offer products that are similar to those available in the USIS operating

segment, but with variations by geographic region. In some jurisdictions, data sources tend to rely more heavily on government

agencies than in the U.S. We also offer specialized services that help our customers better manage risk in their consumer

portfolios. This operating segment’s products and services generate revenue in Argentina, Australia, Canada, Chile, Costa Rica,

Ecuador, El Salvador, Honduras, Dominican Republic, India, Mexico, New Zealand, Paraguay, Peru, Portugal, Spain, the U.K.

and Uruguay. We also maintain support operations in the Republic of Ireland, Chile, Costa Rica, and India. We have

investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia and

Singapore and have an investment in a consumer and commercial credit information company in Brazil. We also provide

information, technology and services to support debt collections and recovery management in Asia Pacific, Europe, Canada and

Latin America.

Asia Pacific. Our Asia Pacific operation provides consumer and commercial information solutions products,

marketing products, workforce solutions, and consumer credit protection products. We offer a full range of products, generated

from credit records and other data, including credit reporting and scoring, decisioning technology, risk management, identity

management, authentication and fraud detection services. Our consumer and commercial products are the primary source of

revenue in each of the countries in which we operate and include credit reporting, decisioning tools and risk management

services. We also provide information, technology and services to support debt collections and recovery management.

Additionally, we provide a variety of consumer and commercial marketing products generated from information databases,

including business profile analysis, business prospect lists and database management. The countries in which we operate

include Australia, New Zealand and India, as well as Cambodia, Malaysia and Singapore through joint ventures.

Europe. Our Europe operation provides information solutions, fraud detection services, debt collection services and

marketing products. Information solutions and fraud products are generated from information that we maintain and include

credit reporting and scoring, asset information, risk management, identity management and authentication services and fraud

detection and modeling services. These products are sold in the U.K. and Spain. Limited marketing products are available in the

U.K. and, to a lesser extent, in Spain. We also provide information, technology and services to support debt collections and

recovery management in the U.K. and Spain. In the U.K., this includes a contract to provide these services to the U.K.

government.

Latin America. Our Latin America operation provides consumer and commercial information solutions products,

marketing products and consumer credit protection products. We offer a full range of products, generated from credit records

that we maintain, including credit reporting and scoring, decisioning technology, risk management, identity management,

authentication and fraud detection services. Our consumer products are the primary source of revenue in each of the countries in

this region in which we operate, with the exception of Mexico where debt management services constitute the core of the

business. We also offer various commercial products, which include credit reporting, decisioning tools and risk management

services, in the countries we serve. We also provide information, technology and services to support debt collections and

recovery management. Additionally, we provide a variety of consumer and commercial marketing products generated from our

credit information databases, including business profile analysis, business prospect lists and database management. The

countries in this region in which we operate include Argentina, Chile, Costa Rica, Dominican Republic, Ecuador, El Salvador,

Honduras, Mexico, Paraguay, Peru and Uruguay. We also have an investment in a consumer and commercial credit information

company in Brazil.

Canada. Similar to the USIS business units, our Canada operation offers products derived from the credit information

that we maintain about individual consumers and businesses. We offer many products in Canada, including credit reporting and

scoring, consumer and commercial marketing, risk management, fraud detection and modeling services, identity management

and authentication services, together with certain of our decisioning products that facilitate pre-approved offers of credit and

automate a variety of credit decisions. We also provide information, technology and services to support debt collections and

recovery management, as well as data, technology and services to facilitate the search of land data and process real estate

transactions in Canada.

Competition

The market for our products and services is highly competitive and is subject to constant change. Our competitors vary

widely in size and in the nature of the products and services they offer. Sources of competition are numerous and include the

following:

• Competition in the Verification Services market, for both the U.S. and key International segments of Australia,

Canada and the U.K., includes employers who manage verifications in-house, lenders who obtain verifications

directly from employers, and other online and offline verification companies, such as Experian, Thomas &

Company and niche providers. Third parties may also seek to obtain verifications directly from employees by

leveraging paper copies of information or by seeking employee credentials to access information systems.

Competition in the U.S. Employer Services market is diverse and includes in-house management of such services

or the outsourcing of one or more of such services to other third-party outsourced providers like Experian and

Thomas & Company; human resources consulting firms such as Mercer and Towers Watson; human resources

management services providers such as Workday, Oracle and SAP; payroll processors such as ADP, Paychex and

Ceridian; accounting firms such as PwC and EY; and hundreds of smaller companies that provide one or multiple

offerings that compete with our Employer Services business.

• Competition for our credit information solutions and direct-to-consumer solutions products varies by both

application and industry, but generally includes two global consumer credit reporting companies, Experian and

TransUnion, both of which offer a product suite similar to our credit information solutions. In the U.S., LifeLock

is a national provider of personal identity theft protection service. Also, there are competitors offering free credit

scores including Credit Karma in the U.S., Canada and the U.K., ClearScore in the U.K., and Credit Simple and

Credit Savvy in Australia. There are also a large number of competitors who offer competing products in

specialized areas (such as fraud prevention, risk management and application processing and decisioning

solutions) and software companies offering credit modeling services or analytical tools. Our differentiators include

our unique data assets, decisioning technology and the features and functionality of our analytical capabilities. We

emphasize our improved decision making and product quality while remaining competitive on price. We also

compete with Fair Isaac Corporation with respect to certain of our analytical tools and solutions and LexisNexis in

identity and fraud and other solutions.

• Competition for our commercial solutions products primarily includes Experian, Dun & Bradstreet and Moody's,

and providers of these services in the international markets we serve.

• Competition for our debt collection and recovery management software, services and analytics is spread across a

number of providers. We believe that the breadth and depth of our data assets enable our clients to develop a more

current and comprehensive view of consumers. In the category of platforms and analytics, we compete to some

extent with entities that deploy collections platforms, account management systems or recovery solutions.

While we believe that none of our competitors offers the same mix of products and services as we do, certain

competitors may have a larger share of particular geographic or product markets or operate in geographic areas where we do not

currently have a presence.

We assess the principal competitive factors affecting our markets to include: our ability to protect information and

systems; product attributes such as quality, depth, coverage, adaptability, scalability, interoperability, functionality and ease of

use; product price; technical performance including system response time and availability; access to unique proprietary

databases; quickness of response, flexibility and client services and support; effectiveness of sales and marketing efforts;

existing market penetration; proprietary technology; and new product innovation.

Technology and Intellectual Property

We rely on various intellectual property laws, confidentiality procedures and contractual provisions to protect strategic

or valuable intellectual property developed in connection with our business. We register, and apply for registration of, certain

intellectual property in the U.S. and several foreign countries under applicable patent laws. We also have registered and

common law trademarks, service marks, logos and internet domain names in the U.S. and in many foreign countries, the most

important of which include “Equifax,” “The Work Number,” “Interconnect,” “Equifax Ignite,” and variations thereof. These

marks are used in connection with many of our product lines and services. Our intellectual property rights are generally

important to our operations and competitive position, but no single intellectual property right or group of intellectual property

rights is solely responsible for protecting our businesses. Certain Company trademarks, including the “Equifax” trademark,

which contribute to our brand identity and the recognition of our products and services, are more important to our business, and

their loss could have a significant negative impact on us.

We license other companies to use certain data, software and other technology and intellectual property rights we own

or control, primarily as core components of our products and services, on terms that are consistent with customary industry

standards and that are designed to protect our interest in our intellectual property. Other companies license us to use certain

data, technology and other intellectual property rights they own or control. For example, we license credit-scoring algorithms

and the right to sell credit scores derived from those algorithms from third parties for a fee. We do not hold any franchises or

concessions that are material to our business or results of operations.

Governmental Regulation

We are subject to a number of U.S. federal, state, local and foreign laws and regulations that involve matters central to

our business. These laws and regulations may involve consumer reporting, privacy, data protection, intellectual property,

competition, consumer protection, anti-corruption, anti-bribery, anti-money laundering, employment, health, taxation or other

subjects. In particular, we are subject to U.S. federal, state, local and foreign laws regarding the collection, protection,

dissemination and use of personal information we collect, process or otherwise have in our possession. Failure to satisfy those

legal and regulatory requirements, or the adoption of new laws or regulations, could have a significant negative impact on our

results of operations, financial condition or liquidity.

U.S. federal, state, local and foreign laws and regulations are evolving and can be subject to significant change. In

addition, the application and interpretation of these laws and regulations are often uncertain. These laws are enforced by federal,

state and local regulatory agencies in the jurisdictions where we operate, and in some instances also through private civil

litigation. There are also a number of legislative proposals pending before the U.S. Congress, various state legislative bodies

and foreign governments concerning consumer and data protection that could particularly affect us.

Summary of U.S. Regulations Relating to Consumer and Data Protection

Our U.S. operations are subject to numerous laws and regulations governing the collection, protection and use of

consumer credit and other information, and imposing sanctions for the misuse of such information or unauthorized access to

data. Many of these provisions also affect our customers’ use of consumer credit or other data we furnish. Examples of the most

significant U.S. laws include, but are not limited to, the following:

Federal Laws and Regulation

• FCRA. The Fair Credit Reporting Act (“FCRA”) regulates consumer reporting agencies, including many of our

U.S. operations, as well as data furnishers and users of consumer reports such as banks and other companies.

FCRA provisions govern the accuracy, fairness and privacy of information in the files of consumer reporting

agencies (“CRAs”) that engage in the practice of assembling or evaluating certain information relating to

consumers for certain specified purposes. Among other requirements, the FCRA limits the type of information

that may be reported by CRAs, limits the distribution and use of consumer reports and establishes consumer rights

to access, freeze and dispute information in the consumer's files. CRAs are required to follow reasonable

procedures to assure maximum possible accuracy of the information concerning the individual about whom the

report relates and if a consumer disputes the accuracy of any information in the consumer’s file, to conduct a

reasonable reinvestigation. The Consumer Financial Protection Bureau (“CFPB”) is the primary regulator that

enforces and provides regulatory guidance related to the FCRA in the United States. CRAs are required to comply

with regulations promulgated by the CFPB and are subject to regular supervisory engagements related to a variety

of FCRA requirements. Violation of the FCRA can result in civil and criminal penalties. The FCRA contains an

attorney fee shifting provision to provide an incentive for consumers to bring individual or class action lawsuits

against a CRA for violations of the FCRA. The United States Federal Trade Commission (“FTC”) and state

attorneys general may also enforce the requirements of the FCRA.

• Dodd-Frank Act. Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank

Act”) created the CFPB. The Dodd-Frank Act provides the CFPB with examination and supervisory authority

over CRAs, including us. The Dodd-Frank Act prohibits unfair, deceptive or abusive acts or practices (“UDAAP”)

with respect to consumer financial services practices and provides the CFPB with enforcement authority to

enforce those provisions. Among other areas, the CFPB’s UDAAP authority extends to the security measures we

employ to safeguard the personal data of consumers. Allegations that we failed to safeguard or handle such data in

a compliant manner may subject us to CFPB enforcement action. The CFPB may pursue administrative

proceedings or litigation to enforce the laws and rules subject to its jurisdiction. In these proceedings, the CFPB

can obtain cease and desist orders, which can include orders for restitution to consumers or rescission of contracts,

as well as other types of affirmative relief and monetary penalties ranging from $5,000 per day for ordinary

violations and up to $1 million per day for known violations. Also, the Dodd-Frank Act empowers state attorneys

general and state regulators to bring civil actions in certain circumstances for the kind of cease and desist orders

available to the CFPB (but not for civil penalties).

• FTC Act. The Federal Trade Commission Act (“FTC Act”) prohibits unfair methods of competition and unfair or

deceptive acts or practices. Under the FTC Act, the FTC’s jurisdiction includes the ability to bring enforcement

actions based on the security measures we employ to safeguard the personal data of consumers. Allegations that

we failed to safeguard or handle such data in a reasonable manner may subject us to regulatory scrutiny or

enforcement action. There is no private right of action under the FTC Act.

• GLBA. The Financial Services Modernization Act of 1999, or Gramm-Leach-Bliley Act (“GLBA”), regulates,

among other things, the use of non-public personal information of consumers that is held by financial institutions,

including us. We are subject to various GLBA provisions, including rules relating to the use or disclosure of the

underlying data and rules relating to the physical, administrative and technological protection of non-public

personal financial information. Breach of the GLBA can result in civil and/or criminal liability and sanctions by

regulatory authorities. Regulatory enforcement of the GLBA is under the purview of the FTC, the CFPB, the

federal prudential banking regulators, the SEC and state attorneys general, acting alone or in concert with each

other.

• CROA. The Credit Repair Organizations Act (“CROA”) regulates companies that claim to be able to assist

consumers in improving their credit standing. There have been efforts to apply the CROA to credit monitoring

services offered by CRAs and others. The CROA allows for a private right of action. Consumers can sue to

recover the greater of the amount paid or actual damages, punitive damages, costs, and attorney’s fees for

violations of the CROA.

State Laws and Regulations Relating to Consumer and Data Protection

• A number of states have enacted requirements similar to the federal FCRA. Some of these state laws impose

additional, or more stringent, requirements than the FCRA, especially in connection with investigations and

responses to reported inaccuracies in consumer reports. The FCRA preempts some of these state laws, but the

scope of preemption continues to be defined by the courts. The state of Vermont is grandfathered under the

original FCRA requirements and thus we are subject to additional requirements to comply with Vermont law.

• All fifty states have adopted versions of data security breach laws that require notification to affected consumers

and potentially regulators or law enforcement authorities in the event of a breach of personal information. A

subset of these laws and other state laws require the implementation of data security measures as well. State

attorneys general can enforce such state laws and can seek equitable as well as monetary remedies and in some

cases private rights of action are permitted by such laws.

• The New York State Department of Financial Services (“NYDFS”) has enacted extensive regulatory requirements

applicable to CRAs that require registration with that agency, prohibit unfair and deceptive consumer practices

and require compliance with significant portions of the NYDFS cybersecurity rules.

• We or certain of our operations are also subject to and affected by new and evolving state privacy and data

security laws such as data broker registration requirements in California and Vermont, and the California

Consumer Privacy Act (“CCPA”). The CCPA became effective January 1, 2020 and imposes additional data

privacy requirements on many businesses operating in the state, including, potentially, with respect to employee

data in addition to consumer data. The CCPA expansively defines “personal information” and imposes new notice

requirements relating to the collection, use and sharing of personal information. It provides consumers with

extensive rights, including the right to access the categories and specific pieces of personal information businesses

collect, the right to request businesses delete information, and the right to opt-out of “sales” of personal

information with sales being defined under the CCPA to include monetary and non-monetary valuable

consideration. The CCPA also contains a private right of action in the event that a business suffers a security

breach that was due to unreasonable security measures. In November 2020, California voters passed the California

Privacy Rights Act (“CPRA”), which maintains the core framework but expanded the requirements of the CCPA

effective January 1, 2023. We may also become subject to and affected by new and proposed state privacy laws

similar to the CCPA and CPRA, such as the Virginia Consumer Data Protection Act (“VCDPA”) which became

effective January 1, 2023, and the Colorado Privacy Act (“CPA”) which becomes effective July 1, 2023. A

number of other state legislatures, including New York, Florida and Washington, have introduced comprehensive

data privacy legislation modeled after, and which contain certain elements of, the CCPA, VCDPA or the European

Union's General Data Protection Regulation (“GDPR”), which is an extremely broad privacy law. Additional state

legislatures are expected to consider similar legislation in 2023. If enacted, such laws may contain variations and

impose new compliance risks and obligations on us.

• State banking and financial services regulatory agencies have asserted either express or implied authority under

applicable state laws to examine us as a third-party service provider to financial institutions, and in certain cases to

bring enforcement actions against us. Generally, such examinations, and related enforcement actions, are focused

on assessing our safety and soundness in support of financial institutions we serve. In 2018, we entered into a

consent order with certain state banking regulators in response to their multi-state review of our information

security program. This consent order obligated us to, among other things, make certain changes to our corporate

governance and information security practices.

• We are also subject to federal and state laws that are generally applicable to any U.S. business with national or

international operations, such as antitrust laws, the Foreign Corrupt Practices Act, the Americans with Disabilities

Act, state unfair or deceptive practices acts and various employment laws. We continuously monitor legislative

and regulatory activities that involve credit reporting, data privacy, security and other relevant issues to identify

issues in order to remain in compliance with all applicable laws and regulations.

Consent Orders with the FTC, CFPB, MSAG Group and NYDFS

• As part of the Consumer Settlement (as defined below), we entered into consent orders with the FTC, CFPB,

MSAG Group (as defined below) and NYDFS pursuant to which we agreed to implement certain business practice

commitments related to consumer assistance and our information security program, including third party

assessments of our program. These business practice commitments are extensive and require a significant amount

of attention from management.

Summary of International Regulations Relating to Consumer and Data Protection

We are subject to various data protection, privacy and consumer credit laws and regulations in the foreign countries

where we operate. Examples of the most significant of these laws include, but are not limited to, the following:

• In the U.K., we are subject to a regulatory framework that provides for regulation by the Financial Conduct

Authority (the “FCA”). The FCA focuses on consumer protection, the integrity of the U.K. financial system, and

effective competition in the interests of consumers. The FCA has significant powers, including the power to

regulate conduct related to the marketing of financial products, to specify minimum standards and to place

requirements on products, impose unlimited fines, and to investigate organizations and individuals. In addition,

the FCA is able to ban financial products for up to a year while considering an indefinite ban; it has the power to

instruct firms to immediately retract or modify promotions which it finds to be misleading, and to publish such

decisions. Our core credit reporting and debt collections services and recovery management businesses in the U.K.

are subject to FCA supervision. In July 2022, the FCA set out final rules and guidance for a new Consumer Duty

that will set higher expectations for the standard of care firms give consumers. In addition to regulation by the

FCA, we are also subject to regulation by the U.K. Information Commissioner’s Office, which focuses on

upholding information rights in the public interest and the protection of data privacy for individuals.

In the U.K., we are subject to provisions that are broadly equivalent to the European Union’s General Data

Protection Regulation (described below). These equivalent provisions were adopted into U.K. laws following the

end of the transition period that followed the U.K.’s exit from the EU.

• In Europe, we are subject to the EU's GDPR, which is an extremely broad and sweeping privacy law. The GDPR

establishes multiple privacy and data protection requirements that are more specific and comprehensive than those

of the U.S. and most other countries where Equifax operates. In addition, the GDPR includes data breach

notification requirements and it establishes the ability of regulators to pursue substantial penalties for non-

compliance. In addition to the GDPR, each EU member state may include specific requirements regarding

personal data breaches in its local data protection regulations.

• In Canada, federal and provincial laws govern how we collect, use or disclose personal information in the course

of our commercial activities. Federally, the Personal Information Protection and Electronic Documents Act

(“PIPEDA”) governs the collection, use and disclosure of personal information by organizations in the private

sector. Businesses must follow the fair information principles set forth in PIPEDA to protect personal information,

including: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention,

accuracy, safeguards, openness, individual access and compliance. It sets out specific obligations with respect to

accountability and identifying purposes, consent, collection, use, disclosure, retention, accuracy, safeguards,

personal data breach reporting, individual access and compliance. Alberta, British Columbia and Quebec privacy

legislation sets out similar privacy laws and rules that apply to our Canadian business. The federal and provincial

privacy regulators have powers of investigation and intervention, and provisions of Canadian law regarding civil

liability apply in the event of unlawful processing which is prejudicial to the persons concerned. Canada also has

specific credit reporting legislation that is regulated at a provincial level. At present, each province has credit

reporting legislation, with the exception of the Territories (Northwest Territories, Yukon, and Nunavut). Generally

speaking, the legislation regulates the contents of credit files, the length of time information can be included on a

credit file, who can receive credit reports and consumer rights pertaining to the maintenance of credit reports.

• In Latin America, data protection and credit reporting laws and regulations vary considerably among Latin

American countries. Some countries, such as El Salvador, Paraguay, Chile and Honduras, establish a

constitutional right to privacy without general data protection standards or a data protection authority. These

countries, however, have laws that govern the functioning of credit bureaus. Other countries, such as Argentina,

Uruguay, Peru, Costa Rica, Mexico and most recently Brazil have enacted comprehensive data protection

legislation similar to the EU's GDPR. The EU recognizes Argentina and Uruguay as having adequate levels of

protection for personal data transfers and processing.

• In Australia, we are subject to regulatory oversight by various agencies. The Office of the Australian Information

Commissioner (“OAIC”) is the agency with direct responsibility for administering the Australian Privacy

Principles (which relate to the collection, holding, use and disclosure of personal information) and Part IIIA of the

Privacy Act 1988 (which regulates credit reporting). The OAIC can investigate a complaint, conduct its own

investigations, resolve/make binding determinations and seek civil penalties. Our credit reporting business,

Equifax Information Services and Solutions, is a member of an external dispute resolution scheme, the Australian

Financial Complaints Authority, which has been approved by the OAIC to handle privacy and credit reporting

complaints and make binding determinations. The OAIC can register codes of practice under the Privacy Act

1988, and has registered the Privacy (Credit Reporting) Code 2014. The Australian Competition and Consumer

Commission (“ACCC”) is the agency responsible for enforcing the Competition and Consumer Act of 2010 and

related legislation concerning consumer protection and competition. The ACCC has the authority to use a range of

actions to ensure compliance with the law, including investigative powers and the ability to seek penalties through

litigation and other formal enforcement means. The Australian Retail Credit Association is a credit and credit

reporting industry self-regulatory body, which administers principles and standards for the exchange of credit data

between industry participants. Equifax Australasia Credit Ratings Pty Limited (formerly named Corporate

Scorecard Pty Limited, one of our Australian subsidiaries) holds an Australia Financial Services License, which

allows it to provide general advice to wholesale clients by issuing a credit rating, and has been approved in New

Zealand as a rating agency by the Reserve Bank of New Zealand under section 86 of the Non-bank Deposit Takers

Act of 2013 (NZ). The Australian Securities and Investments Commission regulates corporations and has

authority to investigate, prosecute, ban individuals and to seek civil penalties. New federal legislation came into

effect in February 2021 mandating the supply by banks of comprehensive credit information to credit reporting

bodies, including Equifax, imposing certain disclosure, storage and reporting obligations on the credit reporting

bodies, requiring the provision by credit reporting bodies of free credit reports to consumers up to four times per

year, permitting the reporting of financial hardship information within the credit reporting system and requiring

the Attorney-General to review and report on the credit reporting system before October 1, 2024.

• In New Zealand, the regulatory framework provides for primary regulation under the Privacy Act 2020. The

Office of the Privacy Commissioner (“NZ OPC”) investigates complaints relating to the collection, use, holding

and disclosure of personal information, both credit-related and non-credit related. The NZ OPC can make a

finding that there has been an interference with privacy but cannot impose civil penalties for this. In extreme cases

where there has been an interference with privacy, it can refer these cases to the Director of Human Rights for

determination in the Human Rights Review Tribunal. The NZ OPC can issue practice codes under the Privacy Act

2020 and has issued and subsequently amended the Credit Reporting Privacy Code 2020. The Privacy Act 2020

contains mandatory data breach reporting. The Retail Credit Association of New Zealand is an industry

association which addresses reciprocity of data issues relating to comprehensive credit reporting and data

standards.

• In India, various legislation including the Information Technology Act of 2000 and rules framed thereunder and

the Credit Information Companies (Regulation) Act of 2005 and rules and regulations framed thereunder,

establishes a federal data protection framework. Entities that collect and maintain personal data and/or credit

information must ensure that it is complete, accurate and safeguarded, and must adopt certain privacy principles

with respect to collecting, processing, preserving, sharing and using such data and/or credit information. The

Indian parliament is expected to pass legislation that provides greater protection to individuals' personal data. To

this end, in November 2022, Indian legislators introduced the Digital Personal Data Protection Bill (2022). The

Digital Personal Data Protection Bill (2022) is expected to be considered in 2023 with amendments. This bill is

expected to be enacted and eventually to impose additional privacy and data security requirements. Our Indian

business is subject to regulation by the Reserve Bank of India, which is India’s central banking institution.

Summary of Regulations Affecting our Employer Services Business

The Employer Services business unit within our Workforce Solutions business segment helps employers comply with

various regulatory frameworks applicable to employers in the United States. As a result, changes to those regulatory

frameworks could impact the services we provide. For instance, if the federal government or a state government mandates the

use of E-Verify, our I-9 service may be impacted if the federal government changes the requirements for individuals to work in

the U.S. The Unemployment Cost Management service could be impacted if a state government changes the requirements for

employers to process and/or protest unemployment claims. The Tax Management Services business within our Employer

Services business is potentially impacted by changes in renewal or non-renewal of U.S. federal and state tax laws or

interpretations, for example, those pertaining to work opportunity tax credits and unemployment compensation claims.

Human Resources

Our People

Equifax employed approximately 14,000 employees in 24 countries as of December 31, 2022. Our global employee

base consisted of approximately 3,900 employees in our Workforce Solutions business unit, 2,500 employees in our USIS

business unit, 4,500 employees in our International business unit and 3,100 employees in our corporate Centers of Excellence.

In 2022, we hired approximately 4,100 new employees and promoted approximately 2,500 employees as we continue to grow

and transform our businesses around the world.

Inclusion and Diversity

We continue to make positive strides in support of our inclusion and diversity strategy. Our Chief Talent and Diversity

Officer occupies a key leadership position, reporting directly to our Chief Human Resources Officer, and is responsible for

activating our talent strategy with a focus on furthering an inclusive and diverse workforce and culture. We are advancing this

strategy through deepening our commitment to employee networks around the world, open dialogues to enhance understanding,

ongoing inclusion and diversity-focused training and cultural heritage celebrations.

We have consistently improved enterprise-wide trends around representation and promotions for both women and

employees of diverse ethnic backgrounds, and pride ourselves on promoting and hiring highly-qualified candidates who

enhance our culture, add diverse perspectives and deliver on our business strategy. Women and leaders of diverse ethnic

backgrounds make up approximately half of Equifax’s senior leadership team. Consistent with our commitment to diversity, we

have expanded the requirements for diverse candidate interview slates for all professional and management roles.

Forward-Looking Statements

This report contains information that may constitute “forward-looking statements.” Generally, the words “believe,”

“expect,” “intend,” “estimate,” “anticipate,” “project,” “will,” “may” and similar expressions identify forward-looking

statements, which generally are not historical in nature. All statements that address future operating performance and events or

developments that we expect or anticipate will occur in the future, including statements relating to future operating results,

improvements in our information technology and data security infrastructure, including as a part of our cloud data and

technology transformation, our strategy, the expected financial and operational benefits, synergies and growth from our

acquisitions, changes in U.S. and worldwide economic conditions, such as rising interest rates and inflation, that materially

impact consumer spending, consumer debt and employment and the demand for Equifax's products and services, our culture,

our ability to innovate, the market acceptance of new products and services and similar statements about our business plans are

forward-looking statements. Management believes that these forward-looking statements are reasonable as and when made.

However, forward-looking statements are subject to certain risks and uncertainties that could cause actual results to differ

materially from the Company’s historical experience and our present expectations or projections, including without limitation

our expectations regarding the Company’s outlook, long-term organic and inorganic growth, and customer acceptance of our

business solutions referenced above under “Item 1. Business” and below in “Item 7. Management’s Discussion and Analysis of

Financial Condition and Results of Operation — Business Overview.” These risks and uncertainties include, but are not limited

to, those described below in “Item 1A. Risk Factors,” and elsewhere in this report and those described from time to time in our

future reports filed with the United States Securities and Exchange Commission (“SEC”). As a result of such risks and

uncertainties, we urge you not to place undue reliance on any such forward-looking statements. Forward-looking statements

speak only as of the date when made. We undertake no obligation to publicly update or revise any forward-looking statements,

whether as a result of new information, future events or otherwise, except as required by law.

Available Information

Detailed information about us is contained in our annual reports on Form 10-K, quarterly reports on Form 10-Q,

current reports on Form 8-K, proxy statements and other reports, and amendments to those reports, that we file with, or furnish

to, the SEC. These reports are available free of charge at our website, www.equifax.com, as soon as reasonably practicable after

we electronically file such reports with or furnish such reports to the SEC. However, our website and any contents thereof

should not be considered to be incorporated by reference into this document. We will furnish copies of such reports free of

charge upon written request to Equifax Inc., Attn: Office of Corporate Secretary, P.O. Box 4081, Atlanta, Georgia, 30302.

These reports are also available at www.sec.gov.

ITEM 1A. RISK FACTORS

All of the risks and uncertainties described below and the other information included in this Form 10-K should be

considered and read carefully. The risks described below are not the only ones facing us. The occurrence of any of the

following risks or additional risks and uncertainties not presently known to us or that we currently believe to be immaterial

could materially and adversely affect our business, financial condition or results of operations. This Form 10-K also contains

forward-looking statements and estimates that involve risks and uncertainties. Our actual results could differ materially from

those anticipated in the forward-looking statements as a result of specific factors, including the risks and uncertainties described

below.

Technology and Data Security Risks

Security breaches and other disruptions to our information technology infrastructure could compromise Company,

consumer and customer information, interfere with our operations, cause us to incur significant costs for remediation and

enhancement of our IT systems and expose us to legal liability, all of which could have a substantial negative impact on our

business and reputation.

We are a global data, analytics and technology company. In the ordinary course of business, we collect, process,

transmit and store sensitive data, including intellectual property, proprietary business information and personal information of

consumers, employees and strategic partners. The secure operation of our information technology networks and systems, and of

the processing and maintenance of this information, is critical to our business operations and strategy. Because our products and

services involve the storage and transmission of personal information of consumers, we are routinely the target of attempted

cyber and other security threats by outside third parties, including technically sophisticated and well-resourced bad actors

attempting to access or steal the data we store. Additionally, we could experience service disruptions or a loss of access to

critical data or systems due to ransomware or other destructive attacks. Insider or employee cyber and security threats are also a

significant concern for all companies, including ours. Despite our substantial investment in physical and technological security

measures, employee training and contractual precautions, our information technology networks and infrastructure (or those of

our third-party vendors and other service providers) are potentially vulnerable to unauthorized access to data, loss of access to

systems or breaches of confidential information due to criminal conduct, attacks by hackers, employee or insider malfeasance

and/or human error.

The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems are constantly

evolving and often are not recognized until launched against a target, or even some time after. We may be unable to anticipate

these techniques, implement adequate preventative measures or remediate any intrusion on a timely or effective basis even if

our security measures are appropriate, reasonable, and/or comply with applicable legal requirements. Certain efforts may be

state-sponsored and supported by significant financial and technological resources, making them even more sophisticated and

difficult to detect. Further, we are in the process of transforming our applications and infrastructure technologies, and this

transition to cloud-based technologies may expose us to additional cyber threats as we migrate our data from our legacy

systems to cloud-based solutions hosted by third parties. Although we have developed systems and processes that are designed

to protect our data and customer data and to prevent data loss and other security breaches, and expect to continue to expend

significant additional resources to bolster these protections, these security measures cannot provide absolute security.

In 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of

personal information of U.S., Canadian and U.K. consumers. If we experience additional significant breaches of our security

measures, including from incidents that we fail to detect for a period of time, sensitive data may be accessed, stolen, disclosed

or lost. Any such access, disclosure or other loss of information could subject us to significant litigation, regulatory fines or

penalties, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or

results of operations. We cannot ensure that our insurance policies in the future will be adequate to cover losses from any

security breaches.

Security breaches and attacks, and the adverse publicity that may follow, can have a negative impact on our reputation

and our relationship with our customers. For example, our reputation with consumers and other stakeholders and our customer

relationships were damaged following the 2017 cybersecurity incident, resulting in a negative impact on our revenue for a

period of time. If we experience another material cybersecurity incident or are otherwise unable to demonstrate the security of

our systems and the data we maintain and retain the trust of our customers, consumers and data suppliers, we could experience

a substantial negative impact on our business.

If we fail to achieve and maintain key industry or technical certifications, our customers and business partners may stop

doing business with us and we may not be able to win new business, which would negatively affect our revenue.

We are required by customers and business partners to obtain various industry or technical certifications. Such

certifications are critical to our business because certain of our current and potential customers and the contracts governing

certain customer relationships, as well as certain of our data suppliers, require us to maintain them as a requirement of doing

business. For example, as a result of the 2017 cybersecurity incident, we lost certain key certifications which caused certain

customers and business partners to stop or pause doing business with us and temporarily limited our ability to win new

business. We had to spend significant resources on remediation activities in order to obtain these key re-certifications. If we fail

to achieve or maintain key industry or technical certifications as a result of another cybersecurity incident or for other reasons,

customers and business partners may stop doing business with us and we may not be able to win new business, which would

negatively affect our revenue.

Strategy and Market Demand Risks

The failure to realize the anticipated benefits of our technology transformation strategy could adversely impact our business

and financial results.

We expect our technology transformation strategy, including our transition to cloud-based technologies, will

significantly increase our efficiency, our productivity, and the stability and functionality of our products and services, as well as

decrease the cost of our overall systems infrastructure, all of which we expect will drive growth and have a positive effect on

our business, competitive position and results of operations. This initiative is a major undertaking as we replace many of our

previous operating systems with cloud-based systems. This complex, multifaceted and extensive initiative is expensive and has

caused, and may cause in the future, unanticipated problems and expenses. If the transition causes errors or adversely impacts

system processes, our new systems do not operate as expected, or the data we transition to the cloud changes in a material way,

we may have to incur significant additional costs to make modifications and could lose customers and we may suffer

reputational harm as a result. Moreover, we may experience issues with customer migration, as many of our customers may not

migrate to cloud-based technologies on a timely basis or at all or may choose not to utilize our products and services during and

after our transition to cloud-based technologies, which could negatively impact our revenue.

We cannot assure you that our technology transformation strategy will be beneficial to the extent, or within the

timeframes expected, or that the estimated efficiency, cost savings and other improvements will be realized as anticipated or at

all. Market acceptance of cloud-based offerings is affected by a variety of factors, including information security, reliability,

performance, the sufficiency of technological infrastructure to support our products and services in certain geographies,

customer and data provider concerns with entrusting a third party to store and manage its data as well as the customer’s ability

to access this data once a contract has expired, and consumer concerns regarding data privacy and the enactment of laws or

regulations that restrict our ability to provide such services to customers. If we are unable to correctly respond to these issues,

we may experience business disruptions, damage to our reputation, negative publicity, diminished customer trust and

relationships and other adverse effects on our business. Even if the anticipated benefits and savings are substantially realized,

there may be consequences, internal control issues or business impacts that were not expected. Our transition and migration to

cloud-based technologies may increase our risk of liability and cause us to incur significant technical, legal, regulatory or other

costs.

The loss of access to credit, employment, financial and other data from external sources could harm our ability to provide

our products and services.

We rely extensively upon data from external sources to maintain our proprietary and non-proprietary databases,

including data received from customers, licensors, furnishers, strategic partners and various government and public record

sources. This data includes the widespread and voluntary contribution of credit data from most lenders in the U.S. and many

other markets as well as the contribution of data under proprietary contractual agreements, such as employers’ contribution of

employment and income data to The Work Number

and telecommunications, cable and utility companies’ contribution of

payment and fraud data to the National Cable, Telecommunications and Utility Exchange. For a variety of reasons, including

concerns of data furnishers arising out of legislatively or judicially imposed restrictions on use, security breaches or competitive

reasons, our data sources could withdraw, delay receipt of or increase the cost of the data they provide to us. Where we

currently have exclusive use of data, the providers of the data sources could elect to make the information available to

competitors. We also compete with several of our third-party data suppliers. If a substantial number of data sources or certain

key data sources were to withdraw or be unable to provide their data, if we were to lose access to data due to government

regulation, if we lose exclusive right to the use of data, or if the collection, disclosure or use of data becomes uneconomical, our

ability to provide products and services to our customers could be adversely affected, which could result in decreased revenue,

net income and earnings per share and reputational loss. There can be no assurance that we would be able to obtain data from

alternative sources if our current sources become unavailable.

Negative changes in general economic conditions, including interest rates, the level of inflation, unemployment rates,

income, home prices, investment values and consumer confidence, could adversely affect us.

Our customers, and therefore our business and revenues, are sensitive to negative changes in general economic

conditions, including the demand and availability of affordable credit and capital, the level and volatility of interest rates, the

level of inflation, employment levels, consumer confidence and housing demand, both inside and outside the United States.

Business customers use our credit information and related analytical services and data to process applications for new credit

cards, automobile loans, home and equity loans and other consumer loans, and to manage their existing credit relationships.

Demand for our services tends to be correlated to general levels of economic activity and to consumer credit activity, which can

be impacted by changes in interest rates and the level of inflation. Banks’ and other lenders’ willingness to extend credit are

adversely affected by elevated consumer delinquency and loan losses in a weak economy. Consumer demand for credit (i.e.,

rates of spending and levels of indebtedness) also tends to grow more slowly or decline during periods of economic contraction

or slow economic growth.

Our customer base suffers when financial markets experience volatility, illiquidity and disruption, and the potential for

increased and continuing disruptions going forward presents considerable risks to our business and revenue. High or rising rates

of unemployment and interest, declines in income, home prices or investment values, lower consumer confidence and reduced

access to credit adversely affect demand for many of our products and services, and consequently our revenue and results of

operations, as consumers may postpone or reduce their spending and use of credit, and lenders may reduce the amount of credit

offered or available.

In 2023, we expect U.S. mortgage market originations to decline by approximately 30% compared to 2022. Any

weakening in the U.S. mortgage market resulting in a significant reduction in mortgage originations could have a corresponding

negative impact on revenue and operating profit for our business, primarily within the Workforce Solutions and USIS operating

segments. To the extent inflation results in rising interest rates and has other adverse effects upon the securities markets and

upon the value of financial instruments, it may adversely affect our financial position and profitability.

Our markets are highly competitive and new product introductions and pricing strategies being offered by our competitors

could decrease our sales and market share or require us to enhance our products and services or reduce our prices in a

manner that reduces our revenue and operating margins.

We operate in a number of geographic, product and service markets that are highly competitive. Competitors may

develop products and services that are superior to or that achieve greater market acceptance than our products and services.

New competitors may choose to enter and compete in our markets, or existing competitors may choose to introduce new

products and enter markets that we serve and that they do not currently serve. The size of our competitors varies across market

segments, as do the resources we have allocated to the segments we target. Therefore, some of our competitors may have

significantly greater financial, technical, marketing or other resources than we do in one or more of our market segments, or

overall. As a result, our competitors may be in a position to respond more quickly than we can to new or emerging technologies

and changes in customer requirements, or may devote greater resources than we can to the development, enhancement,

promotion, sale and support of products and services, or some of our customers may develop products of their own that replace

the products they currently purchase from us, which would result in lower revenue. In addition, many of our competitors have

extensive consumer relationships, including relationships with our current and potential customers. Moreover, new competitors

or alliances among our competitors may emerge and potentially reduce our market share, revenue or margins.

We also sell our information to competing firms, and buy information from certain of our competitors, in order to sell

“tri-bureau” and other products, most notably into the U.S. mortgage market. Changes in prices between competitors for this

information and/or changes in the design or sale of tri-bureau versus single or dual bureau product offerings may affect our

revenue or profitability.

Some of our competitors may choose to sell products that compete with ours at lower prices by accepting lower

margins and profitability, or may be able to sell products competitive to ours at lower prices, individually or as a part of

integrated suites, given proprietary ownership of data, technological superiority or economies of scale. Price reductions by our

competitors could negatively impact our revenue and operating margins and results of operations and could also harm our

ability to obtain new customers on favorable terms. Historically, certain of our key products have experienced declines in per

unit pricing due to competitive factors and customer demand. Since a significant portion of our operating expenses is relatively

fixed in nature due to sales, information technology and development and other costs, if we were unable to respond quickly

enough to changes in competition or customer demand, we could experience further reductions in our operating margins.

If our relationships with key customers are materially diminished or terminated, our business could suffer.

We have long-standing relationships with a number of our customers, many of whom could unilaterally terminate their

relationship with us or materially reduce the amount of business they conduct with us at any time. Many of our material

customer agreements can be terminated by the customer for convenience on limited advance written notice, which provides our

customers with the opportunity to renegotiate their contracts with us or to award more business to our competitors. There is no

guarantee that we will be able to retain or renew existing agreements, maintain relationships with any of our customers or

business partners on acceptable terms or at all, or collect amounts owed to us from insolvent customers or business partners.

The loss of one or more of our major customers or business partners could adversely affect our business, financial condition and

results of operations.

If we do not introduce successful new products, services and analytical capabilities in a timely manner, or if the market does

not adopt our new services, or if new technologies are introduced by competitors that are more effective or at lower costs

than ours, our competitiveness and operating results will suffer.

We generally sell our products in industries that are characterized by rapid technological changes, including the

introduction of new innovative technologies, frequent new product and service introductions and changing industry standards.

In addition, certain of the markets in which we operate are seasonal and cyclical. Without the timely introduction of new

technologies, products, services and enhancements, our products and services will become technologically or commercially

obsolete over time, in which case our revenue and operating results would suffer. The success of our new products and services

will depend on several factors, including our ability to properly identify customer needs; innovate and develop new

technologies, services and applications; successfully commercialize new technologies in a timely manner; produce and deliver

our products in sufficient volumes on time; differentiate our offerings from competitor offerings; price our products

competitively; anticipate our competitors’ development of new products, services or technological innovations; and control

product quality in our product development process. Our resources have to be committed to any new products and services

before knowing whether the market will adopt the new offerings.

The demand for some of our products and services may be negatively impacted to the extent the availability of free or less

expensive consumer information increases.

Public or commercial sources of free or relatively inexpensive consumer credit, credit score and other information

have become increasingly available, particularly through the internet, and this trend is expected to continue. In addition,

governmental agencies in particular have increased the amount of information to which they provide free public access and

these or other sources of free or relatively inexpensive consumer information from competitors or other commercial sources

may reduce demand for our services. Recently, there also has been an increase in companies offering free or low-cost direct-to-

consumer credit services (such as credit scores, reports and monitoring) as part of alternative business models that use such

services as a means to introduce consumers to other products and services. To the extent that our customers choose not to obtain

services from us and instead rely on information obtained at no cost or relatively inexpensively from these other sources, our

business, financial condition and results of operations may be adversely affected.

We rely, in part, on acquisitions, joint ventures and other alliances to grow our business and expand our geographic reach.

The acquisition, integration or divestiture of businesses by us may not produce the expected financial or operating results or

IT and data security profile we expect. In addition, if we are unable to make acquisitions or successfully develop and

maintain joint ventures and other alliances, our growth may be adversely impacted.

Historically, we have relied, in part, on acquisitions, joint ventures and other alliances to grow our business. Any

transaction we do complete may not be on favorable terms, may involve greater-than-expected liabilities and expenses,

potential impairments of tangible and intangible assets or significant write-offs and the expected benefits, synergies, revenue

and growth from these initiatives may not materialize as planned. We may have difficulty assimilating new businesses and their

products, services, technologies, IT systems and personnel into our operations. IT and data security profiles of acquired

companies may not meet our technological standards and may take longer to integrate and remediate than planned. This may

result in significantly greater transaction, remediation and integration costs for future acquisitions than we have experienced

historically, or it could mean that we will not pursue certain acquisitions where the costs of integration and remediation are too

significant. We may also have difficulty integrating and operating businesses in geographies and markets or market segments

where we do not currently have a significant presence, and acquisitions of businesses having a significant presence outside of

the U.S. will increase our exposure to risks of conducting operations in international markets. These difficulties could disrupt

our ongoing business, distract our management and workforce, increase our expenses and adversely affect our operating results

and financial condition.

Despite our past experience, opportunities to grow our business through acquisitions, joint ventures and other alliances

may not be available to us in the future. In addition, our focus on data security and our technology transformation strategy,

including our migration to cloud-based technologies, may limit our ability to identify and complete acquisitions as our stringent

technological criteria and standards for acquisition candidates may continue to increase.

If our government contracts are terminated, if we are suspended from government work, or if our ability to compete for new

contracts is adversely affected, our business could suffer.

We derive a portion of our revenue from direct and indirect sales to U.S. federal, state and local governments and their

respective agencies. We also derive a portion of our revenue from sales to foreign governments and related agencies. Such

contracts are subject to various procurement laws and regulations, and contract provisions relating to their formation,

administration and performance. Failure to comply with these laws, regulations or provisions in our government contracts could

result in the imposition of various civil and criminal penalties, termination of contracts, forfeiture of profits, suspension of

payments or suspension of future government contracting. A number of our federal government contracts have received

enhanced scrutiny and media attention due to the sensitive nature of the data we handle and due to the importance of the

government programs we support. If we experience another material cybersecurity incident, if public or legislative scrutiny and

pressure related to government services we support turns negative or if we experience uptime issues or performance problems,

our ability to maintain existing or acquire new government contracts may be substantially impacted.

If our government contracts are terminated, if we are suspended from government work, if the services we provide are

no longer needed due to government program change or termination, or if our ability to compete for new contracts is adversely

affected, including by our failure to achieve certain government certifications, our business could suffer.

Our business has been and may continue to be negatively impacted by health epidemics, pandemics and similar outbreaks,

including the COVID-19 pandemic.

We face various risks related to health epidemics, pandemics and similar outbreaks. For example, the COVID-19

pandemic and the mitigation efforts by governments to attempt to control its spread adversely impacted the global economy,

leading to reduced consumer spending and lending activities. Our customers, and therefore our business and revenues, are

sensitive to negative changes in general economic conditions. We experienced significant revenue declines in several of our

markets as a result of COVID-19 and we may experience similar revenue declines as a result of future health epidemics,

pandemics and similar outbreaks.

Our reputation and/or business could be negatively impacted by ESG matters and/or our reporting of such matters.

There is an increasing focus from regulators, certain investors, and other stakeholders concerning environmental,

social and governance ("ESG") matters, both in the United States and internationally. We communicate certain ESG-related

initiatives, goals, and/or commitments regarding environmental matters, diversity, responsible sourcing and social investments,

and other matters, on our website, in our filings with the SEC, and elsewhere. These initiatives, goals, or commitments could be

difficult to achieve and costly to implement. For example, in 2021, we announced our commitment to reach net-zero

greenhouse gas emissions by 2040, the achievement of which relies, in large part, on the accuracy of our estimates and

assumptions around the availability and cost of low- or non-carbon based energy sources and technologies, the availability of

suppliers that can meet our sustainability and other standards, and other factors. We could fail to achieve, or be perceived to fail

to achieve, our net zero 2040 commitment or other ESG-related initiatives, goals or commitments. In addition, we could be

criticized for the timing, scope or nature of these initiatives, goals or commitments, or for any revisions to them. To the extent

that our required and voluntary disclosures about ESG matters increase, we could be criticized for the accuracy, adequacy or

completeness of such disclosures. Our actual or perceived failure to achieve our ESG-related initiatives, goals or commitments

could negatively impact our reputation or otherwise materially harm our business.

Operational Risks

Our technology transformation strategy places a significant strain on our management, operational, financial and other

limited resources.

As part of our technology transformation strategy, we are transitioning and migrating our data systems from

traditional, on premises data centers to cloud-based platforms. This initiative places significant strain on our management,

personnel, operations, systems, technical performance, financial resources, internal financial controls and reporting function. In

addition, many of our existing personnel have limited experience with native cloud-based technologies. This effort has been,

and will continue to be, time consuming and costly. Our technology transformation strategy requires management time and

resources to educate employees and implement new ways of conducting business. The dedication of resources to our

technology transformation strategy and cloud-based technologies limits the resources we have available to devote to other

initiatives or growth opportunities, or to invest in the maintenance of our existing internal systems. We cannot guarantee that

our strategy is the right one or that investments in alternative technologies or other initiatives would not be a better use of our

limited resources.

Additionally, as a result of our cloud migration efforts in connection with our technology transformation strategy, we

may experience a loss of continuity, loss of accumulated knowledge or loss of efficiency during transitional periods.

Reorganization and transition can require a significant amount of management and other employees’ time and focus, which may

divert attention from operating activities and growing our business. If we fail to achieve some or all of the expected benefits of

these activities, it could have a material adverse effect on our competitive position, business, financial condition, results of

operations and cash flows.

Our transition to cloud-based technologies could expose us to operational disruptions.

We rely on the efficient and uninterrupted operation of complex information technology systems and networks, some

of which are managed internally within the Company and some of which are outsourced to third parties. As part of our

technology transformation strategy, we are upgrading a significant portion of the information technology systems used to

operate our business and replacing them with cloud-based solutions. This transition will continue to require substantial changes

to our software and network infrastructure, which could lead to system interruptions, affect our data systems and further expose

us to operational disruptions, and cause us to lose customers, all of which could have a material adverse effect on our results of

operations.

Upon implementation of the new cloud-based solutions, much of our information technology systems will consist of

outsourced, cloud-based infrastructure, platform and software-as-a-service solutions not under our direct management or

control. Any disruption to either the outsourced systems or the communication links between us and the outsourced supplier

could negatively affect our ability to operate our data systems and could impair our ability to provide services to our customers.

We may incur additional costs to remedy the damages caused by these disruptions.

Our customers' decisioning may be adversely affected if we provide inaccurate or unreliable data, which could adversely

affect our financial condition, cause loss of customer trust and contribute to non-compliance with certain laws and

regulations.

Data accuracy is an essential component of data quality and is the foundation of our business model. Accurate data

increases predictive ability and improves confidence in decisions for our customers. Inaccurate or unreliable data could

adversely affect customer decisioning and poses reputational, compliance and financial risk to our company. Although we have

developed internal processes and controls to maintain and continually improve data accuracy, these processes and controls

cannot ensure absolute accuracy and the complexity of our technology transformation may introduce additional risk until it is

completed. We have experienced data accuracy issues, including errors in connection with our technology transformation. To

date, none of these issues have had a material impact on our operations or financial results. However, any future data accuracy

issues arising during the technology transformation or otherwise could have a material adverse effect on our business or results

of operations, including through the incurrence of additional costs or the loss of customers and harm to our reputation.

If our systems do not meet customer requirements for response time or high availability, or we experience system constraints

or failures, or our customers do not migrate to the cloud or modify and/or upgrade their systems to accept new releases of

our products and services, our services to our customers could be delayed or interrupted, which could result in lost revenues

or customers, lower margins, service level penalties or other harm to our business and reputation.

Our customers expect high system availability and response time performance, as well as a very high degree of system

resilience. We depend on reliable, stable, efficient and uninterrupted operation of our technology network, systems, and data

centers to provide service to our customers. Many of the services and systems upon which we rely have been outsourced to

third parties. In addition, many of our revenue streams are dependent on links to third party telecommunications providers.

These systems and operations, and the personnel that support, service and operate these systems, could be exposed to

interruption, damage or destruction from power loss, telecommunication failures, computer viruses, denial-of-service or other

cyber attacks, employee or insider malfeasance, human error, fire, natural disasters, war, terrorist acts or civil unrest. We may

not have sufficient disaster recovery or redundant operations in place to cover a loss or failure of systems or

telecommunications links in a timely manner, which may be exacerbated by any delays in obtaining equipment due to supply

chain or other impacts.

In addition, as part of our technology transformation, we are seeking to migrate our customers from traditional data

platforms to cloud-based products and services. Many of our customers may not migrate to cloud-based technologies on a

timely basis or at all, or may choose not to utilize our products and services during and after our transition to cloud-based

technologies. If our customers’ timelines prevent them from migrating to cloud-based technologies quickly enough, they will

remain on our legacy infrastructure, which could expose them to system availability, response time and performance issues.

Any significant system interruption or series of minor interruptions could result in the loss of customers and/or lost

revenues, lower margins, service level penalties or other significant harm to our business or reputation.

Dependence on outsourcing certain portions of our operations may adversely affect our ability to bring products to market

and damage our reputation. Dependence on outsourced information technology and other administrative functions may

impair our ability to operate effectively.

As part of our technology transformation, we have outsourced various components of our application development,

information technology, operational support and administrative functions and will continue to evaluate additional outsourcing.

If our outsourcing vendors fail to perform their obligations in a timely manner or at satisfactory quality levels including with

respect to data and system security, or increase prices for their services to unreasonable levels, our ability to bring products to

market and support our customers and our reputation could suffer. Any failure to perform on the part of these third-party

providers could impair our ability to operate effectively and could result in lower future revenue, unrealized efficiencies and

adversely impact our results of operations and our financial condition. Some of our outsourcing takes place in developing

countries and, as a result, may be subject to geopolitical uncertainty.

Our business will suffer if we are not able to retain and hire key personnel.

Our future success, including our ability to implement our technology transformation strategy, depends partly on the

continued service of our key development, sales, marketing, executive and administrative personnel. Increased retention risk

exists in certain key areas of our operations, such as IT and data security, which require specialized skills, such as migrating

legacy computer systems to the cloud, data security expertise and analytical modeling. Additionally, the worker shortage that

emerged following the outbreak of COVID-19 has presented increased challenges to our ability to develop, retain and attract

qualified personnel. If we fail to retain and hire a sufficient number of these personnel, we will not be able to maintain or

expand our business. As part of our technology transformation strategy, we have hired or contracted with a significant number

of new employees and contract workers. Hiring, on-boarding training, motivating, retaining and managing employees with the

skills required is time-consuming and expensive. There is intense competition for certain highly technical specialties in

geographic areas where we continue to recruit, and it may become more difficult to retain our key employees. If we are not able

to hire sufficient employees to support our business, including our technology transformation, or to train, motivate, retain and

manage the employees we do hire, it could have a material adverse effect on our business operations or financial results.

Global Operational Risks

Economic, political and other risks associated with international sales and operations could adversely affect our results of

operations.

Sales outside the U.S. comprised 22% of our total revenue in 2022. As a result, our business is subject to various risks

associated with doing business internationally and these risks may differ in each jurisdiction where we operate depending on

the particular product or service we offer in the jurisdiction. In addition, many of our employees, suppliers, job functions and

facilities are located outside the U.S. Accordingly, our future results could be harmed by a variety of factors including:

• changes in specific country or region political, economic or other conditions;

• trade protection measures;

• data privacy and consumer protection laws and regulations;

• difficulty in staffing and managing widespread operations;

• differing labor, intellectual property protection and technology standards and regulations;

• business licensing requirements or other requirements relating to making foreign direct investments, which could

increase our cost of doing business in certain jurisdictions, prevent us from entering certain markets, increase our

operating costs or lead to penalties or restrictions;

• difficulties associated with repatriating cash generated or held abroad in a tax-efficient manner;

• implementation of exchange controls;

• geopolitical instability, including terrorism and war, including the Russia-Ukraine war;

• foreign currency changes;

• increased travel, infrastructure, legal and compliance costs of multiple international locations;

• foreign laws and regulatory requirements;

• terrorist activity, natural disasters, pandemics and other catastrophic events;

• restrictions on the import and export of technologies;

• difficulties in enforcing contracts and collecting accounts receivable;

• longer payment cycles;

• failure to meet quality standards for outsourced work;

• unfavorable tax rules;

• the presence and acceptance of varying level of business corruption in international markets; and

• varying business practices in foreign countries.

We earn revenue, pay expenses, own assets and incur liabilities in countries using currencies other than the U.S. dollar,

inc

luding among others the British pound, the Australian dollar, the Canadian dollar, the Argentine peso, the Chilean peso, the

Euro, the New Zealand dollar, the Costa Rican colon, the Singapore dollar, the Brazilian real and the Indian rupee. Because our

consolidated financial statements are presented in U.S. dollars, we must translate revenue, income and expenses, as well as

assets and liabilities, into U.S. dollars at exchange rates in effect during or at the end of each reporting period. Therefore,

increases or decreases in the value of the U.S. dollar against major currencies will affect our operating revenues, operating

income and the value of balance sheet items denominated in foreign currencies. We generally do not mitigate the risks

associated with fluctuating exchange rates, although we may from time to time through forward contracts or other derivative

instruments hedge a portion of our translational foreign currency exposure or exchange rate risks associated with material

transactions which are denominated in a foreign currency. The use of such hedging activities may not offset any or more than a

portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are

in place. Accordingly, fluctuations in foreign currency exchange rates, particularly the strengthening of the U.S. dollar against

major currencies, may materially affect our consolidated financial results.

Compliance with applicable U.S. and foreign laws and regulations, such as anti-corruption laws, tax laws, foreign

exchange controls and restrictions on repatriation of earnings or other similar restraints, data privacy requirements, labor laws

and anti-competition regulations increases the cost of doing business in foreign jurisdictions. Although we have implemented

policies and procedures to comply with these laws and regulations, a violation by our employees, contractors or agents could

nevertheless occur.

Legal and Regulatory Risks

As part of a global settlement, we entered into agreements with various parties to settle the U.S. Consumer MDL Litigation

and certain federal and state government investigations arising out of the 2017 cybersecurity incident. If we are unable to

comply with our obligations under these agreements, it could have a material adverse effect on our financial condition.

In July 2019, the Company entered into multiple agreements that resolve the U.S. consolidated consumer class action

cases, captioned In re: Equifax, Inc. Customer Data Security Breach Litigation, MDL No. 2800 (Consumer Cases) (the “U.S.

Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the Attorneys General of 48 states, the District of

Columbia and Puerto Rico (the “MSAG Group”) and the NYDFS (collectively, the “Consumer Settlement”) relating to the

2017 cybersecurity incident. The Consumer Settlement became effective on January 11, 2022.

As part of the Consumer Settlement, we agreed to implement certain business practice commitments related to

consumer assistance and our information security program, including third party assessments of our program. These business

practice commitments are extensive and require a significant amount of attention from management. To the extent we are

unable to comply or we are viewed as not being in compliance with these business practice commitments or other requirements

of a relevant order, we could face an enforcement action or contempt proceeding that could potentially result in fines, penalties

and new business practice commitments, which, depending on the amount and type, could have a material adverse effect on our

financial condition.

In addition, we may be required to deposit additional amounts in the consumer settlement fund under certain

circumstances if the fund is insufficient to cover claims and certain expenses. While we do not believe that we will be required

to deposit additional amounts into the consumer settlement fund based on our claims experience to date, we could be obligated

to fund up to an additional $125 million if our claims experience changes and the consumer fund is exhausted.

We and our customers are subject to various current laws and governmental regulations, and could be affected by new and

evolving consumer privacy and cybersecurity or other data-related laws or regulations, compliance with which may cause us

to incur significant expenses and change our business practices, and if we fail to maintain satisfactory compliance with

certain laws and regulations, we could be subject to civil or criminal penalties.

We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy,

cybersecurity, data and financial protection. See “Item 1. Business—Governmental Regulation” in this Form 10-K for a

summary of the U.S. and foreign consumer and data protection laws and regulations to which we are subject. These regulations

are complex, change frequently, have tended to become more stringent over time, and are subject to administrative

interpretation and judicial construction in ways that could harm our business. In addition, new laws and regulations at the state

and federal level are enacted or considered frequently. Examples of such new and evolving laws and regulations include

amendments to the FCRA, cybersecurity and other requirements promulgated by the FTC and New York Department of

Financial Services, the CCPA which took effect on January 1, 2020, and amendments to which took effect on January 1, 2023,

the California data broker registration requirements that took effect on January 31, 2020, the CPRA taking effect on January 1,

2023 and privacy laws in Virginia, Colorado, Connecticut and Utah which have taken, or will take effect, in 2023. Furthermore,

we expect there to be an increased focus on laws and regulations related to our business, including by the current U.S.

presidential administration and the U.S. Congress, because of the growing policy concerns in the U.S. with regard to the

operation of credit reporting agencies, the collection, use, accuracy, correction and sharing of personal information, and the use

of algorithms, artificial intelligence and machine learning in business processes.

There are a number of legislative proposals pending before the U.S. Congress, various state legislative bodies and

foreign governments concerning privacy or cybersecurity that could affect us. The Canadian government has initiated a review

of consumer privacy laws, and several U.S. states have introduced varying comprehensive privacy laws modeled to some

degree on the CCPA and/or the GDPR. Compliance with multiple state laws containing varying requirements could be

complicated and costly. In Europe, although the GDPR already includes certain provisions relating to the automated processing

of personal data, there has also been discussion of new legislative proposals to regulate business use of artificial intelligence

and machine learning technologies which, if enacted, could impose new legal requirements addressing among other issues,

privacy, discrimination and human rights. The specifics of such legislation and the number of jurisdictions that will introduce

legislation in this area remain unclear at this time. In addition, a growing number of legislative and regulatory bodies have

adopted consumer notification and other requirements in the event that consumer information is accessed or acquired by

unauthorized persons and additional regulations regarding the use, access, accuracy and security of such data are possible. In

the U.S., state laws provide for disparate notification regimes, all of which we are subject to. Further, any perception that our

practices or products are an invasion of privacy, whether or not consistent with current or future regulations and industry

practices, may subject us to public criticism, private class actions, reputational harm, or claims by regulators, which could

disrupt our business and expose us to increased liability.

We devote substantial compliance, legal and operational business resources to strive for compliance with applicable

regulations and requirements. In the future, we may be subject to significant additional expenses related to compliance with

applicable laws and regulations, including new laws and evolving interpretations that are difficult to predict, and to the

investigation, defense or remedy of actual or alleged violations. Additionally, we cooperate with CFPB supervisory

examinations and respond to other state, federal and foreign government examinations of or inquiries into our business

practices. The enactment of new laws and how they are interpreted could impact our business. In particular, legislative activity

in the privacy area may result in new laws that are applicable to us and that may hinder our business, for example, by restricting

use or sharing of consumer data, including for marketing or advertising or limiting the use of, limiting our ability to provide

certain consumer data to our customers, or otherwise regulating artificial intelligence and machine learning, including the use of

algorithms and automated processing in ways that could materially affect our business, or which may lead to significant

increases in the cost of compliance. Any failure by us to comply with, or remedy any violations of, applicable laws and

regulations, could result in new costs for our operations, the curtailment of certain of our operations, the imposition of fines and

penalties, liability to private plaintiffs as a result of individual or class action litigation, restrictions on the operation of our

business and reputational harm. It is difficult to predict the impact on our business if we were subject to allegations of having

violated existing laws. For example, in Europe, the GDPR, which includes extensive regulations for certain security incidents,

could result in fines of up to four percent of annual worldwide “turnover” (a measure similar to revenues in the U.S.). In

addition, because many of our products are regulated or sold to customers in various industries, we must comply with additional

regulations in marketing our products. Moreover, our compliance with privacy laws and regulations and our reputation depend

in part on customers’ adherence to privacy laws and regulations and their use of our services in ways consistent with consumer

expectations and regulatory requirements. We cannot predict the ultimate impact on our business of new or proposed rules,

supervisory examinations or government investigations or enforcement actions.

The following legal and regulatory developments also could have a substantial negative impact on our business,

financial condition or results of operations:

• amendment, enactment or interpretation of laws and regulations that restrict the access, sharing and use of

personal information and reduce the availability or effectiveness of our solutions or the supply of data available to

customers;

• changes in cultural and consumer attitudes in favor of further restrictions on information collection and sharing,

which may lead to regulations that prevent full utilization of our solutions;

• failure of data suppliers or customers to comply with laws or regulations, where mutual compliance is required;

• failure of our solutions to comply with current laws and regulations; and

• failure of our solutions to adapt to changes in the regulatory environment in an efficient, cost effective manner.

These laws and regulations (as well as actions that may be taken by legislatures and regulatory bodies in other

countries) and the consequences of any violation could limit our ability to pursue business opportunities we might otherwise

consider engaging in, impose additional costs on us, result in significant loss of revenue, result in significant restitution and

fines, impact the value of assets we hold, or otherwise adversely affect our business.

The CFPB has supervisory and examination authority over our business and may initiate enforcement actions with regard

to our compliance with federal consumer financial laws.

The CFPB, which was established under the Dodd-Frank Act and commenced operations in July 2011, has broad

authority over our business. This includes authority to issue regulations under federal consumer financial protection laws, such

as under the FCRA and other laws applicable to us and our financial customers. The CFPB is authorized to prevent “unfair,

deceptive or abusive acts or practices” through its regulatory, supervisory and enforcement authority.

The CFPB conducts examinations and investigations, issues requests for information and subpoenas and brings civil

actions in federal court for violations of the federal consumer financial laws, including the FCRA. In these proceedings, the

CFPB can seek relief that includes: rescission or reformation of contracts, restitution, disgorgement of profits, payment of

damages, limits on activities and civil money penalties of up to $1.0 million per day for known violations. The CFPB conducts

periodic examinations of us and the consumer credit reporting industry, which could result in new regulations or enforcement

actions or proceedings. Actions by the CFPB could result in requirements to alter or cease offering affected products and

services, making them less attractive and restricting our ability to offer them.

Although we have committed resources to enhancing our compliance programs, actions by the CFPB or other

regulators against us could result in financial or reputational harm. Our compliance costs and legal and regulatory exposure

could increase materially if the CFPB or other regulators enact new regulations, change regulations that were previously

adopted, modify through supervision or enforcement past regulatory guidance, or interpret existing regulations in a manner

different or stricter than have been previously interpreted.

Regulatory oversight of our contractual relationships with certain of our customers may adversely affect our business.

The federal banking agencies, including the Office of the Comptroller of the Currency, the Federal Deposit Insurance

Corporation, the Board of Governors of the Federal Reserve System and the CFPB, as well as many state banking agencies

have issued guidance to insured depository institutions and other providers of financial services on assessing and managing

risks associated with third-party relationships, which include all business arrangements between a financial services provider

and another entity, by contract or otherwise, and generally requires banks and financial services providers to exercise

comprehensive oversight throughout each phase of a bank or financial service provider’s business arrangement with third-party

service providers, and instructs banks and financial service providers to adopt risk management processes commensurate with

the level of risk and complexity of their third-party relationships. This guidance requires more rigorous oversight of third-party

relationships that involve certain “critical activities.” In light of this guidance, our existing or potential bank and financial

services customers subject to this guidance may continue to revise their third-party risk management policies and processes and

the terms on which they do business with us, which may adversely affect our relationships with such customers and/or increase

our expenses in servicing such customers.

We are regularly involved in claims, suits, government investigations, supervisory examinations and other proceedings that

may result in adverse outcomes.

We are regularly involved in claims, suits, government investigations, supervisory examinations and regulatory

proceedings arising from the ordinary course of our business, including actions with respect to consumer protection and data

protection, including purported class action lawsuits. Such claims, suits, government investigations and proceedings are

inherently uncertain and their results cannot be predicted with certainty. Regardless of their outcome, such legal proceedings

can have an adverse impact on us because of legal costs, diversion of management and other personnel, and other factors. In

addition, it is possible that a resolution of one or more such proceedings could result in reputational harm, liability, penalties or

sanctions, as well as judgments, consent decrees or orders preventing us from offering certain features, functionalities, products

or services, or requiring a change in our business practices, products or technologies, which could in the future materially and

adversely affect our business, operating results, and financial condition. The FCRA contains an attorney fee shifting provision

that provides an incentive for consumers to bring individual and class action lawsuits against a credit reporting agency for

violation of the FCRA, and the number of consumer lawsuits (both individual and class action) against us alleging a violation of

the FCRA and our resulting costs associated with resolving these lawsuits have increased substantially over the past several

years.

Third parties may claim that we are infringing on their intellectual property and we could suffer significant litigation or

licensing expenses or be prevented from selling products or services.

There has been substantial litigation in the U.S. regarding intellectual property rights in the information technology

industry. From time to time, third parties may make claims that one or more of our products or services infringe their

intellectual property rights. We analyze and take action in response to each such claim on a case by case basis. A dispute or

litigation regarding patents or other intellectual property can be costly and time-consuming due to the complexity of our

technology and the inherent uncertainty of intellectual property litigation, could divert our management and key personnel from

our business operations, and we may not prevail. A claim of intellectual property infringement could force us to enter into a

costly or restrictive license agreement, which might not be available under acceptable terms or at all, or could subject us to

significant damages or to an injunction against development and sale of certain of our products or services. Our intellectual

property portfolio may not be useful in asserting a counterclaim, or providing commercial leverage for negotiating a license, in

response to a claim of intellectual property infringement. In certain of our businesses we rely on third-party intellectual property

licenses and we cannot ensure that these licenses will be available to us in the future on favorable terms or at all. Although our

policy is to obtain licenses or other rights where necessary, we cannot provide assurance that we have obtained all required

licenses or rights.

Third parties may misappropriate or infringe on our intellectual property and we may suffer competitive injury or expend

significant resources enforcing our rights.

Our success increasingly depends on our proprietary technology and its ability to differentiate us from our competitors.

We rely on various intellectual property rights, including patents, copyrights, database rights, trademarks and trade secrets, as

well as contract restrictions, confidentiality provisions and licensing arrangements, to establish and protect our proprietary

rights. The extent to which such rights can be protected varies in different jurisdictions. If we do not protect and enforce our

intellectual property rights successfully, our competitive position may suffer which could harm our operating results. Our

pending patent and trademark applications may not be allowed or competitors may challenge the validity or scope of our

intellectual property rights. In addition, our patents, copyrights, trademarks and other intellectual property rights may not

provide us a significant competitive advantage.

We may need to devote significant resources to monitoring our intellectual property rights and we may or may not be

able to detect misappropriation or infringement by third parties. Our competitive position may be harmed if we cannot detect

misappropriation or infringement and enforce our intellectual property rights quickly or at all. In some circumstances,

enforcement may not be available to us because a third party has a dominant intellectual property position or for other business

reasons. In addition, competitors might avoid infringement by designing around our intellectual property rights or by

developing non-infringing competing technologies. Intellectual property rights and our ability to enforce them may be

unavailable or limited in some countries, which could make it easier for competitors to capture market share and could result in

lost revenue.

Financial Market Risks

A downgrade in our credit ratings could increase our cost of borrowing under our credit facilities and have an adverse effect

on our ability to access the capital markets.

Credit ratings reflect an independent agency’s judgment on the likelihood that a borrower will repay a debt obligation

at maturity. The ratings reflect many considerations, such as the nature of the borrower’s industry and its competitive position,

the size of the company, its liquidity and access to capital and the sensitivity of a company’s cash flows to changes in the

economy. A security rating is not a recommendation to buy, sell or hold securities and may be changed or withdrawn at any

time by the assigning rating agency.

A downgrade in our credit ratings would increase the cost of borrowings under our commercial paper program,

$1.5 billion revolving credit facility and $700.0 million delayed draw term loan, and could limit or, in the case of a significant

downgrade, preclude our ability to issue commercial paper. If our credit ratings were to decline to lower levels, we could

experience increases in the interest cost for any new debt. In addition, the market’s demand for, and thus our ability to readily

issue, new debt could become further affected by the economic and credit market environment.

Our retirement and post-retirement pension plans are subject to financial market risks that could adversely affect our future

results of operations and cash flows.

We have significant retirement and post-retirement pension plan assets and obligations. The performance of the

financial markets and interest rates impact our plan expenses, expected returns, and funding obligations. Significant decreases

in interest rates, decreases in the fair value of plan assets and investment losses on plan assets will increase our funding

obligations, and adversely impact our results of operations and cash flows.

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

ITEM 2. PROPERTIES

Our executive offices are located at 1550 Peachtree Street, N.W., Atlanta, Georgia. Our other properties are

geographically distributed to meet sales and operating requirements worldwide. We consider these properties to be both suitable

and adequate to meet our current operating requirements. We ordinarily lease office space for conducting our business and are

obligated under approximately 60 leases and other rental arrangements for our field locations. We owned 6 office buildings at

December 31, 2022, including our executive offices, one campus which houses our Alpharetta, Georgia technology center, a

building utilized by our Workforce Solutions operations located in St. Louis, Missouri, as well as two buildings utilized by our

Latin America operations.

For additional information regarding our obligations under leases, see Note 6 and Note 12 of the Notes to Consolidated

Financial Statements in Item 8 of this Form 10-K. We believe that suitable additional space will be available to accommodate

our future needs.

ITEM 3. LEGAL PROCEEDINGS

Canadian Class Actions

In 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of

personal information of consumers. Five putative Canadian class actions, four of which are on behalf of a national class of

approximately 19,000 Canadian consumers, are pending against us in Ontario, British Columbia and Alberta. Each of the

proposed Canadian class actions asserts a number of common law and statutory claims seeking monetary damages and other

related relief in connection with the 2017 cybersecurity incident. In addition to seeking class certification on behalf of Canadian

consumers whose personal information was allegedly impacted by the 2017 cybersecurity incident, in some cases, plaintiffs

also seek class certification on behalf of a larger group of Canadian consumers who had contracts for subscription products with

Equifax around the time of the incident or earlier and were not impacted by the incident.

On December 13, 2019, the court in Ontario granted certification of a nationwide class that includes all impacted

Canadians as well as Canadians who had subscription products with Equifax between March 7, 2017 and July 30, 2017 who

were not impacted by the incident. We appealed one of the claims on which a class was certified and on June 9, 2021, our

appeal was granted by the Ontario Divisional Court. The plaintiff filed a notice of further appeal with the Ontario Court of

Appeal, and on November 25, 2022, the Ontario Court of Appeal dismissed the plaintiff’s appeal and upheld the Divisional

Court’s ruling in our favor. On January 24, 2023, the plaintiff appealed this decision to the Supreme Court of Canada. All

remaining purported class actions are at preliminary stages or stayed.

FCA Investigation

The U.K.’s Financial Conduct Authority (“FCA”) opened an enforcement investigation against our U.K. subsidiary,

Equifax Limited, in October 2017 in connection with the 2017 cybersecurity incident. The investigation by the FCA has

involved a number of information requirements and interviews. We have responded to the information requirements and

continue to cooperate with the investigation. At this time, we are unable to predict the outcome of this FCA investigation,

including whether the investigation will result in any action or proceeding against us.

CFPB Matters

In December 2021, we received a Civil Investigative Demand (a “CID”) from the CFPB as part of its investigation into

our consumer disputes process in order to determine whether we have followed the FCRA's requirements for the proper

handling of consumer disputes. The CID requests the production of documents and answers to written questions. We are

cooperating with the CFPB in its investigation and are in discussions with the CFPB regarding our response to the CID. In

addition, in January 2023, the CFPB informed us that its enforcement division will be investigating our previously-disclosed

coding issue identified within a legacy server environment in the U.S. slated to be migrated to the new Equifax cloud

infrastructure which impacted how some credit scores were calculated during a three-week period in 2022. We are cooperating

with the CFPB in its investigation. At this time, we are unable to predict the outcome of these CFPB investigations, including

whether the investigations will result in any actions or proceedings against us.

Other

Equifax has been named as a defendant in various other legal actions, including administrative claims, regulatory

matters, government investigations, class actions and other litigation arising in connection with our business. Some of the legal

actions include claims for substantial compensatory or punitive damages or claims for indeterminate amounts of damages. We

believe we have defenses to and, where appropriate, will contest many of these matters. Given the number of these matters,

some are likely to result in adverse judgments, penalties, injunctions, fines or other relief. We may explore potential settlements

before a case is taken through trial because of the uncertainty and risks inherent in the litigation process.

For information regarding our accounting for legal contingencies, see Note 6 of the Notes to Consolidated Financial

Statements in Item 8 of this report.

ITEM 4. MINE SAFETY DISCLOSURES

Not applicable.

PART II

ITEM 5. MARKET FOR THE REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND

ISSUER PURCHASES OF EQUITY SECURITIES

Equifax’s common stock is traded on the New York Stock Exchange under the symbol “EFX.” As of January 31,

2023, Equifax had approximately 2,625 holders of record; however, Equifax believes the number of beneficial owners of

common stock exceeds this number.

Shareholder Return Performance Graph

The graph below compares Equifax’s five-year cumulative total shareholder return with that of the Standard & Poor’s

Composite Stock Index (S&P 500) and a peer group index, the S&P 500 Banks Index (Industry Group). The graph assumes that

the value of the investment in our Common Stock and each index was $100 on the last trading day of 2018 and that all quarterly

dividends were reinvested without commissions. Our past performance may not be indicative of future performance.

COMPARATIVE FIVE-YEAR CUMULATIVE TOTAL RETURN AMONG EQUIFAX INC., S&P 500 INDEX AND

S&P 500 BANKS INDEX (INDUSTRY GROUP)

DOLLARS

COMPARISON OF FIVE-YEAR CUMULATIVE TOTAL RETURNS

VALUE OF $100 INVESTED AS OF JANUARY 1, 2018

Equifax Inc. S&P 500 Index S&P 500 Banks Index (Industry Group)

Initial 2018 2019 2020 2021 2022

0.00

100.00

200.00

300.00

400.00

Fiscal Year Ended December 31,

Initial 2018 2019 2020 2021 2022

Equifax Inc. 100.00 75.54 115.06 159.93 244.44 163.56

S&P 500 Index 100.00 90.44 118.91 140.79 181.21 148.39

S&P 500 Banks Index (Industry Group) 100.00 74.44 94.37 83.22 108.94 90.69

The table below contains information with respect to purchases made by or on behalf of Equifax of its common stock

during the fourth quarter ended December 31, 2022:

Issuer Purchases of Equity Securities

Period

Total

Number

of Shares

Purchased

(1)

Average

Price Paid

Per Share

(2)

Total Number

of Shares Purchased

as Part of Publicly-

Announced

Plans or Programs

Maximum Number

(or Approximate

Dollar Value)

of Shares that May

Yet Be Purchased

Under the Plans or

Programs

(3)

October 1 - October 31, 2022 930 $ — — $ 520,168,924

November 1 - November 30, 2022 3,641 $ — — $ 520,168,924

December 1 - December 31, 2022 369 $ — — $ 520,168,924

Total 4,940 $ — — $ 520,168,924

(1) The total number of shares purchased includes, if applicable: (a) shares purchased pursuant to our publicly-announced

share repurchase program, or Program; and (b) shares surrendered, or deemed surrendered, in satisfaction of the

exercise price and/or to satisfy tax withholding obligations in connection with the exercise of employee stock options

and vesting of restricted stock, totaling 930 shares for the month of October 2022, 3,641 shares for the month of

November 2022 and 369 shares for the month of December 2022.

(2) Average price paid per share for shares purchased as part of our Program (includes brokerage commissions).

(3) We purchased no common shares during the twelve months ended December 31, 2022. At December 31, 2022, the

amount authorized for future share repurchases under the Program was $520.2 million.

Information relating to compensation plans under which the Company’s equity securities are authorized for issuance

will be included in the section captioned “Equity Compensation Plan Information” in our 2023 Proxy Statement and is

incorporated herein by reference.

ITEM 6. RESERVED

Not applicable.

ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF

OPERATIONS

The following Management’s Discussion and Analysis (“MD&A”) is intended to help the reader understand the results

of operations and financial condition of Equifax Inc. MD&A is provided as a supplement to and should be read in conjunction

with our consolidated financial statements and the accompanying Notes to Financial Statements in Item 8 of this Form 10-K.

This section discusses the results of our operations for the year ended December 31, 2022 compared to the year ended

December 31, 2021 and the year ended December 31, 2021 compared to the year ended December 31, 2020. All percentages

have been calculated using unrounded amounts for each of the periods presented.

As used herein, the terms Equifax, the Company, we, our and us refer to Equifax Inc., a Georgia corporation, and its

consolidated subsidiaries as a combined entity, except where it is clear that the terms mean only Equifax Inc.

All references to earnings per share data in MD&A are to diluted earnings per share, or EPS, unless otherwise noted.

Diluted EPS is calculated to reflect the potential dilution that would occur if stock options or other contracts to issue common

stock were exercised and resulted in additional common shares outstanding.

BUSINESS OVERVIEW