Equifax Inc: Form 10-K for the period ended Dec 31, 2019

Overview

Equifax Inc. is a global data, analytics and technology company. We provide information solutions for businesses, governments and consumers, and we provide human resources business process outsourcing services for employers. We have a large and diversified group of clients, including financial institutions, corporations, government agencies and individuals. Our services are based on comprehensive databases of consumer and business information derived from numerous sources including credit, financial assets, telecommunications and utility payments, employment, income, demographic and marketing data. We use advanced statistical techniques, machine learning and proprietary software tools to analyze available data to create customized insights, decision-making solutions and processing services for our clients. We also provide information, technology and services to support debt collections and recovery management. Additionally, we are a leading provider of payroll-related and human resource management business process outsourcing services in the United States of America (“U.S.”). For consumers, we provide products and services to help people understand, manage and protect their personal information and make more informed financial decisions.

We currently operate in four global regions: North America (U.S. and Canada), Asia Pacific (Australia, New Zealand and India), Europe (the United Kingdom (“U.K.”), Spain and Portugal) and Latin America (Argentina, Chile, Costa Rica, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay). We maintain support operations in the Republic of Ireland, Chile, Costa Rica and India. We also offer Equifax branded credit services in Russia through a joint venture, have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and the United Arab Emirates, have an investment in a consumer and commercial credit information company in Brazil and have an investment in an identity authentication company in Canada.

Equifax was originally incorporated under the laws of the State of Georgia in 1913, and its predecessor company dates back to 1899. As used herein, the terms Equifax, the Company, we, our and us refer to Equifax Inc., a Georgia corporation, and its consolidated subsidiaries as a combined entity, except where it is clear that the terms mean only Equifax Inc.

We are organized and report our business results in four operating segments, as follows:

• U.S. Information Solutions (“USIS”) — provides consumer and commercial information solutions to businesses in the U.S. including online information, decisioning technology solutions, fraud and identity management services, analytical services, portfolio management services, mortgage reporting and marketing services.
• Workforce Solutions — provides services enabling customers to verify income and employment (Verification Services) of people in the U.S., as well as providing our employer customers with services that assist them in complying with and automating certain payroll-related and human resource management processes throughout the entire cycle of the employment relationship, including unemployment cost management, employee onboarding, tax credits and incentives, I-9 management and compliance, tax form management services and Affordable Care Act management services (Employer Services). Workforce Solutions has recently established Verifications Service operations in Canada and is working toward a similar operation in Australia.
• International — provides products and services similar to those available in the USIS operating segment but with variations by geographic region. We also provide information, technology and services to support debt collections and recovery management. This operating segment is comprised of our Canada, Europe, Latin America and Asia Pacific business units.
• Global Consumer Solutions — provides products to consumers in the U.S., Canada and the U.K., enabling them to understand and monitor their credit and monitor and help protect their identity. We also sell consumer credit information to resellers who may combine our information with other information to provide direct-to-consumer monitoring, reports and scores.

2017 Cybersecurity Incident

In 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of certain personally identifiable information of U.S., Canadian and U.K. consumers. Criminals exploited a software vulnerability in a U.S. website application to gain unauthorized access to our network. In March 2017, the U.S. Department of Homeland

Security distributed a notice concerning the software vulnerability. We undertook efforts to identify and remediate vulnerable systems; however, the vulnerability in the website application that was exploited was not identified by our security processes. We discovered unusual network activity in late-July 2017 and upon discovery promptly investigated the activity. Once the activity was identified as potential unauthorized access, we acted to stop the intrusion and engaged a leading, independent cybersecurity firm to conduct a forensic investigation to determine the scope of the unauthorized access, including the specific information impacted. Based on our forensic investigation, the unauthorized access occurred from mid-May 2017 through July 2017. No evidence was found that the Company’s core consumer, employment and income, or commercial reporting databases were accessed. We continue to cooperate with law enforcement in connection with the criminal investigation into the actors responsible for the 2017 cybersecurity incident. On February 10, 2020, the U.S. Department of Justice announced that four members of the Chinese People’s Liberation Army were indicted on criminal charges for their involvement in the 2017 cybersecurity incident.

The Company has taken actions to provide consumers with tools to protect their credit data. Immediately following the announcement of the 2017 cybersecurity incident, the Company devoted substantial resources to notify people of the incident and to provide free services to assist people in monitoring their credit and identity information. Since then, the Company has been focused on implementing significant improvements to its data security systems, technology platforms and risk management processes, in an effort to underpin its business strategy.

Our Business Strategy

Our vision is to be a trusted global leader in data, advanced analytics and technology that creates innovative solutions and insights for our customers. Our business strategy is driven by the following imperatives:

• Lead our industry in data security. We are focused on becoming a leader in our industry in the effectiveness of our data and technology security practices. This includes building an Equifax culture that considers data and technology security, and more broadly risk management, as a primary requirement in all decisions. This also includes the extensive use of advanced data and technology security tools, techniques, services and processes in order to enhance our ability to protect the information with which we are entrusted from fraudulent access.
• Transform our technology. We are rebuilding our technology infrastructure, accelerating our migration to a public cloud environment, employing virtual private cloud deployment techniques, and rationalizing and rebuilding our application portfolio using cloud-native services. This technology transformation is a significant part of our goal of leading our industry in data and technology security capability. Our goal is to deliver market-leading capabilities to our customers in terms of speed of bringing new products and services to market; ease of customer and partner implementation and integration; ease of consumer access to and interaction with Equifax; system resiliency and uptime; and ultimately cost to serve. We are undergoing a multi-year technology transformation which is already broadly impacting our internal and external information technology systems.
• Lead in data and analytics, to develop unparalleled analytical insights leveraging Equifax’s unique data. We use proprietary advanced analytical platforms, including capabilities in machine learning and advanced visualization tools, to leverage our unique data to develop leading analytical insights that enhance the precision of our customers’ decisioning activities. We strive to continue to advance these capabilities through ongoing data monetization activities, the acquisition of distinctive and differentiated assets, and continued advancement of capabilities in artificial intelligence and machine learning. As part of our technology transformation, we are investing to simplify our customers’ access to our leading analytical platforms, in order to speed the development of unique insights and the conversion of these insights into new products and services consumable by our customers through our delivery platforms.

We offer a wide array of products, ranging from custom products for large clients, to software-as-a-service-based decisioning and data access technology platforms that are cost-effective for clients of all sizes. We also develop predictive scores and analytics, some of which leverage multiple data assets, to help clients acquire new customers and manage their existing customer relationships. We develop a broad array of industry, risk management, cross-sell and account acquisition models to enhance the precision of our clients’ decisioning activities. We also develop custom and generic solutions that enable customers to effectively manage their debt collection and recovery portfolios.

• Improve the consumer user experience. Equifax understands the importance of providing consumers with user-friendly capabilities to see, understand and question their consumer credit file and information. As part of our

technology transformation, we are rebuilding our digital and call center technology infrastructure to provide an experience focused on making consumers’ interactions with Equifax as effective and efficient as possible.

• Foster a culture of customer centricity. We are focused on building a culture in which the customer is at the center of our decision processes and we exceed customer expectations by delivering solutions with speed, flexibility, stability and performance. Our focus on customer centricity will enable us to be more proactive in solving problems better and faster for customers while delivering enhanced operational readiness to provide a better customer experience.
• Deliver growth while enhancing profitability and shareholder returns. We strive to accelerate innovation through expanded customer focus and collaboration. We intend to leverage our unique data assets and capabilities, as well as customer expertise and customer data and technology assets, to help us jointly create high-value analytical products and services targeted at a broader range of customer needs. We seek to expand partnerships in order to further broaden the key customer domains and verticals that our products and services are able to serve.

We seek to increase our share of clients’ spend on information-related services through these new products and services, price our products and services in accordance with the value they represent to our customers, increase the range of current products and services utilized by our clients, and improve the quality and effectiveness of our support for both customers and consumers.

We believe there are opportunities to continue to expand in the U.S. and internationally, across the existing financial, mortgage, telecommunications, automotive, insurance, healthcare, government and other markets that we serve, as well as in new and emerging market segments. We continue to invest, including through acquisitions and partnerships, to expand our addressable markets and the data and capabilities we offer to solve customer challenges ranging from identity authentication to risk management.

We seek to enhance shareholder value through the disciplined execution of these imperatives and by positioning ourselves as a premier and trusted provider of high value information solutions.

• Build a world-class Equifax team by investing in talent to drive our strategy and promote a culture of innovation. We attract top talent by providing opportunities to grow and lead within our company. We regularly undertake talent initiatives to engage, develop and retain our top talent.

Markets and Clients

Our products and services serve clients across a wide range of verticals, including financial services, mortgage, state and federal government, employers, consumer, commercial, telecommunications, retail, automotive, utilities, brokerage, healthcare and insurance industries. We also serve consumers directly. Our revenue streams are highly diversified with our largest client providing less than 3% of total revenue. The following table summarizes the various end-user markets we serve:

(1) Predominantly sold to companies who serve the direct-to-consumer market and includes other small end user markets. Mortgage and auto resellers are excluded from this category as they are included within their respective categories above.

(2) Other includes revenue from other miscellaneous end-user markets.

We market our products and services primarily through our own direct sales organization that is structured around sales teams that focus on client segments typically aligned by vertical markets and geography. Sales groups are based in field offices located throughout the U.S., including our headquarters in Atlanta, Georgia, and in the countries where we have operations. We also market our products and services through indirect channels, including alliance partners, joint ventures and other resellers. In addition, we sell through direct mail and the internet.

Revenue from international clients, including end users and resellers, amounted to 27% of our total revenue in 2019, 29% of our total revenue in 2018 and 29% of our total revenue in 2017.

Products and Services

Our products and services help our clients make more informed decisions with higher levels of confidence by leveraging a broad array of data assets. Analytics are used to derive insights from the data that are most relevant for the client’s decisioning needs. The data and insights are then processed through proprietary software and generally transmitted to the client’s operating system to execute the decision.

The following chart summarizes the key products and services offered by each of the business units within our segments:

Each of our operating segments is described more fully below. For the operating revenue, operating income and total assets for each segment see Note 13 of the Notes to the Consolidated Financial Statements in this report.

USIS

USIS provides consumer and commercial information solutions to businesses in the U.S. through three product and service lines, as follows:

Online Information Solutions. Online Information Solutions’ products are derived from multiple large and comprehensive databases of consumer and commercial information that we maintain about individual consumers and businesses, including credit history, current credit status, payment history and address information. Our clients utilize the information and analytical insights we provide to make decisions for a broad range of financial and business purposes, such as whether, and on what terms, to approve auto loans or credit card applications, and whether to allow a consumer or a business to open a new utility or telephone account. In addition, this information is used by our clients for cross-selling additional products to existing customers, improving their underwriting and risk management decisions, and authenticating and verifying consumer and business identities. We also sell consumer and credit information to resellers who may combine our information with other information to provide services to the financial, mortgage, fraud and identity management, and other end-user markets. Our software platforms and analytical capabilities can integrate all types of information, including third-party and client information, to enhance the insights and decisioning process to help further mitigate the risk of granting credit, predict the risk of bankruptcy, indicate the applicant’s risk potential for account delinquency, ensure the identity of the consumer, and reduce exposure to fraud. These risk management services enable our clients to monitor risks and opportunities and proactively manage their portfolios.

Online Information Solutions’ clients access products through a full range of electronic distribution mechanisms, including direct real-time access which facilitates instant decisions. We also develop and host customized applications that enhance the decision-making process for our clients. These decisioning technology applications assist with a wide variety of decisioning activities, including determining pre-approved offers, cross-selling of various products, determining deposit amounts for telephone and utility companies, and verifying the identity of their customers. We have also compiled commercial databases regarding businesses in the U.S., which include loan, credit card, public records and leasing history data, trade accounts receivable performance, and Secretary of State and Securities and Exchange Commission registration information. We offer scoring and analytical services that provide additional information to help mitigate the credit risk assumed by our clients.

Mortgage Solutions. Our Mortgage Solutions products, offered in the U.S., consist of specialized credit reports that combine information from the three major consumer credit reporting agencies (Equifax, Experian and TransUnion) into a single “merged” credit report in an online format, commonly referred to as a tri-merge report. Mortgage lenders use these tri-merge reports in making their mortgage underwriting decisions. Additionally, we offer services designed to alert lenders to changes in a consumer’s credit status during the underwriting period and securitized portfolio risk assessment services for evaluating inherent portfolio risk.

Financial Marketing Services. Our Financial Marketing Services products utilize consumer and commercial financial information enabling our clients to more effectively manage their marketing efforts, including targeting and segmentation, to identify and acquire new clients for their products and services; to develop portfolio strategies to minimize risk and maximize profitability; and to realize additional revenue from existing customers through more effective cross-selling of additional products and services. These products utilize information derived from consumer and commercial information, including credit, income, asset, liquidity, net worth and spending activity, which also support many of our Online Information Solutions’ products. These data assets broaden the understanding of consumer and business financial potential and opportunity which can further drive high value decisioning and targeting solutions for our clients. We also provide account review services, which assist our clients in managing their existing customers and prescreen services that help our clients identify new opportunities with their customers. Clients for these products primarily include institutions in the banking, brokerage, retail, insurance and mortgage industries as well as companies primarily focused on digital and interactive marketing.

Workforce Solutions

Workforce Solutions operates in the U.S. through two business units:

Verification Services. Verification Services include employment and income verification services. Our online verification services enable third-party verifiers including various governmental agencies, mortgage originators, credit card and automotive lenders and pre-employment screeners to verify the employee’s employment status and income information. We also offer an offline manual verification service, which expands employment verification to locate data outside our existing automated database. We also offer various government direct data services, where we process tax forms on behalf of our customers with the applicable government agency.

Employer Services. These services are aimed at reducing the cost of the human resources function of businesses through a broad suite of services including assisting with employment tax matters designed to reduce the cost of unemployment claims through effective claims representation and management and efficient processing and to better manage the tax rate that employers are assessed for unemployment taxes; comprehensive services designed to research the availability of employment-related tax credits (e.g., federal work opportunity tax credits), and to process the necessary filings and assist the client in obtaining the tax credit; tax form management services (which include initial distribution, reissuance and correction of W-2 and 1095-C forms); paperless pay services that enable employees to electronically receive pay statement information as well as review and change direct deposit account or W-4 information; I-9 management services designed to help clients electronically comply with the immigration laws that require employers to complete an I-9 form for each new hire; and onboarding services using an online platform to complete the new hire process for employees of corporations and government agencies. In addition, we provide software and services to employers to assist in their compliance with the Affordable Care Act.

The Work Number®. The Work Number® is our key repository of employment and income data serving our Verification Services and Employer Services business units. We rely on payroll data received from tens of thousands of organizations to regularly update the database. The updates occur as employers and other data contributors transmit data electronically to Equifax from their payroll systems. Employers provide this data to us so that we can handle verification requests on behalf of each employer. We use this data to provide automated employment and income verification services to verifiers, who are lenders, employers/background screeners, and government agencies.

The fees we charge for services in these two business units are generally on a per transaction basis. We have not experienced significant turnover in the employer contributors to the database because we generally do not charge them to add their employment data to The Work Number® database and the verification service we offer relieves them of the administrative burden and expense of responding to third-party employment verification requests while providing them with the assurance that the process is automated and not subject to human interpretation. The Work Number® database is approaching 380 million current and historic employment records at December 31, 2019.

Workforce Solutions has established an income and employment verification service in Canada, known as Verification Exchange. Workforce Solutions is in the process of building a similar income and employment verification service business in Australia. At present, revenues from these services in Canada and Australia are insignificant.

International

The International operating segment includes our Asia Pacific, Europe, Latin America and Canada business units. These business units offer products that are similar to those available in the USIS operating segment, but with variations by geographic region. In some jurisdictions, data sources tend to rely more heavily on government agencies than in the U.S. We also offer specialized services that help our customers better manage risk in their consumer portfolios. This operating segment’s products and services generate revenue in Argentina, Australia, Canada, Chile, Costa Rica, Ecuador, El Salvador, Honduras, India, Mexico, New Zealand, Paraguay, Peru, Portugal, Spain, the U.K. and Uruguay. We also maintain support operations in the Republic of Ireland, Chile, Costa Rica, and India. We offer consumer credit services in Russia through an investment in a joint venture, have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and the United Arab Emirates, and have an investment in a consumer and commercial credit information company in Brazil. We also provide information, technology and services to support debt collections and recovery management in Asia Pacific, Europe, Canada and Latin America.

Europe. Our Europe operation provides information solutions, fraud detection services, debt collection services and marketing products. Information solutions and fraud products are generated from information that we maintain and include credit reporting and scoring, asset information, risk management, identity management and authentication services and fraud detection and modeling services. These products are sold in the U.K. and Spain. Marketing products, which are similar to those offered in our Financial Marketing Services business unit in the U.S., are primarily available in the U.K. and, to a lesser extent, in Spain. We also provide information, technology and services to support debt collections and recovery management in the U.K. and Spain. In the U.K., this includes a contract to provide these services to the U.K. government.

Asia Pacific. Our Asia Pacific operation provides consumer and commercial information solutions products, marketing products, workforce solutions, and personal solutions products. We offer a full range of products, generated from credit records and other data, including credit reporting and scoring, decisioning technology, risk management, identity management, authentication and fraud detection services. Our consumer and commercial products are the primary source of revenue in each of the countries in which we operate and include credit reporting, decisioning tools and risk management services. We also provide information, technology and services to support debt collections and recovery management. Additionally, we provide a variety of consumer and commercial marketing products generated from information databases, including business profile analysis, business prospect lists and database management. The countries in which we operate include Australia, New Zealand and India, as well as through joint ventures in Russia, Cambodia, Malaysia, Singapore and the United Arab Emirates.

Latin America. Our Latin America operation provides consumer and commercial information solutions products, marketing products and personal solutions products. We offer a full range of products, generated from credit records that we maintain, including credit reporting and scoring, decisioning technology, risk management, identity management, authentication and fraud detection services. Our consumer products are the primary source of revenue in each of the countries in this region in which we operate. We also offer various commercial products, which include credit reporting, decisioning tools and risk management services, in the countries we serve. We also provide information, technology and services to support debt collections and recovery management. Additionally, we provide a variety of consumer and commercial marketing products generated from our credit information databases, including business profile analysis, business prospect lists and database management. The countries in this region in which we operate include Argentina, Chile, Costa Rica, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay. We also have an investment in a consumer and commercial credit information company in Brazil.

Canada. Similar to the USIS business units, our Canada operation offers products derived from the credit information that we maintain about individual consumers and businesses. We offer many products in Canada, including credit reporting and scoring, consumer and commercial marketing, risk management, fraud detection and modeling services, identity management and authentication services, together with certain of our decisioning products that facilitate pre-approved offers of credit and automate a variety of credit decisions. We also provide information, technology and services to support debt collections and recovery management in Canada.

Global Consumer Solutions

Our Global Consumer Solutions (“GCS”) products give consumers information to enable them to understand and monitor their credit and monitor and help protect their identity. Equifax products offer monitoring features for consumers who are concerned about identity theft, including credit report monitoring from all three credit bureaus, internet scanning, bank account monitoring and lost wallet support. Country specific versions of our products are available to consumers in the U.S., Canada, and the U.K. primarily over the internet. Products may also be available indirectly through relationships with business partners who distribute our products or provide these services to their employees or customers. We also sell consumer credit information to resellers who may combine our information with other information to provide direct-to-consumer monitoring, reports and scores.

Seasonality

We experience seasonality in certain of our revenue streams. Revenue generated by the online consumer information services component of our USIS operating segment is typically the lowest during the first quarter, when consumer lending activity is at a seasonal low. Revenue generated from the Employer Services business unit within the Workforce Solutions operating segment is generally higher in the first quarter due primarily to the provision of Form W-2 preparation services which occur in the first quarter each year. Revenue generated from our financial wealth asset products and data management services in our Financial Marketing Services business is generally higher in the fourth quarter each year due to the significant portion of our annual renewals and deliveries which occur in the fourth quarter of each year. Mortgage related revenue is generally higher in the second and third quarters of the year due to the increase in consumer home purchasing during the summer in the U.S.

Competition

The market for our products and services is highly competitive and is subject to constant change. Our competitors vary widely in size and in the nature of the products and services they offer. Sources of competition are numerous and include the following:

• Competition for our credit information solutions and direct-to-consumer solutions products varies by both application and industry, but generally includes two global consumer credit reporting companies, Experian and TransUnion, both of which offer a product suite similar to our credit information solutions. In the U.S., LifeLock is a national provider of personal identity theft protection service. Also, there are competitors offering free credit scores including Credit Karma in the U.S., Canada and the U.K., ClearScore in the U.K., and Credit Simple and Credit Savvy in Australia. There are also a large number of competitors who offer competing products in specialized areas (such as fraud prevention, risk management and application processing and decisioning solutions) and software companies offering credit modeling services or analytical tools. Our differentiators include our unique data assets, decisioning technology and the features and functionality of our analytical capabilities. We emphasize our improved decision making and product quality while remaining competitive on price. Our marketing services products also compete with the foregoing companies and others who offer demographic information products, including Acxiom, Harte-Hanks and Infogroup. We also compete with Fair Isaac Corporation with respect to certain of our analytical tools and solutions.
• Competition for our commercial solutions products primarily includes Experian, Dun & Bradstreet and Cortera, and providers of these services in the international markets we serve.
• Competition in the Verification Services market includes employers who manage verifications in-house, lenders who obtain verifications directly from employers, and other online and offline verification companies, such as CCC Verify, Thomas & Company and First Advantage. Competition in the Employer Services market is diverse and includes in-house management of such services or the outsourcing of one or more of such services to other third-party outsourced providers like Corporate Cost Control and Thomas & Company; human resources consulting firms such as Mercer and Towers Watson; human resources management services providers such as Oracle and Silk Road; payroll processors such as ADP and Ceridian; accounting firms such as PwC and EY; and hundreds of smaller companies that provide one or multiple offerings that compete with our Employer Services business.
• Competition for our debt collection and recovery management software, services and analytics is similar to the competition for our consumer credit information solutions. We believe that the breadth and depth of our data assets enable our clients to develop a more current and comprehensive view of consumers. In the category of platforms and analytics, we compete to some extent with entities that deploy collections platforms, account management systems or recovery solutions.

While we believe that none of our competitors offers the same mix of products and services as we do, certain competitors may have a larger share of particular geographic or product markets or operate in geographic areas where we do not currently have a presence.

We assess the principal competitive factors affecting our markets to include: our ability to protect information and systems; product attributes such as quality, depth, coverage, adaptability, scalability, interoperability, functionality and ease of use; product price; technical performance including system response time and availability; access to unique proprietary databases; quickness of response, flexibility and client services and support; effectiveness of sales and marketing efforts; existing market penetration; and new product innovation.

Technology and Intellectual Property

We generally seek protection under U.S. federal, state and foreign laws for strategic or financially important intellectual property developed in connection with our business. Certain intellectual property, where appropriate, is protected by registration under applicable trademark laws or by prosecution of patent applications. We own a number of patents registered in the U.S. and several in foreign countries. We also have certain registered trademarks, service marks, logos and internet domain names in the U.S. and in many foreign countries, the most important of which are “Equifax,” “The Work Number,” “Interconnect,” “Equifax Ignite,” and variations thereof. These marks are used in connection with many of our product lines and services. We believe that, in the aggregate, the rights under our patents and trademarks are generally important to our operations and competitive position, but we do not regard any of our businesses as being dependent upon any single patent or group of patents. However, certain Company trademarks, which contribute to our identity and the recognition of our products and services, including but not limited to the “Equifax” trademark, are an integral part of our business, and their loss could have a significant negative impact on us. We also protect certain of our confidential intellectual property and technology in compliance with trade secret laws and through the use of nondisclosure agreements and other means of protecting and limiting access to such information.

We license other companies to use certain data, software, and other technology and intellectual property rights we own or control, primarily as core components of our products and services, on terms that are consistent with customary industry standards and that are designed to protect our interest in our intellectual property. Other companies license us to use certain data, technology and other intellectual property rights they own or control. For example, we license credit-scoring algorithms and the right to sell credit scores derived from those algorithms from third parties for a fee. We do not hold any franchises or concessions that are material to our business or results of operations.

Governmental Regulation

We are subject to a number of U.S. federal, state, local and foreign laws and regulations that involve matters central to our business. These laws and regulations may involve consumer reporting, privacy, data protection, intellectual property, competition, consumer protection, anti-corruption, anti-bribery, anti-money laundering, employment, health, taxation or other subjects. In particular, we are subject to U.S. federal, state, local and foreign laws regarding the collection, protection, dissemination and use of personal information we have in our possession. Failure to satisfy those legal and regulatory requirements, or the adoption of new laws or regulations, could have a significant negative impact on our results of operations, financial condition or liquidity.

U.S. federal, state, local and foreign laws and regulations are evolving and can be subject to significant change. In addition, the application and interpretation of these laws and regulations are often uncertain. These laws are enforced by federal, state and local regulatory agencies in the jurisdictions where we operate, and in some instances also through private civil litigation. There are also a number of legislative proposals pending before the U.S. Congress, various state legislative bodies, and foreign governments concerning consumer and data protection that could particularly affect us.

Summary of U.S. Regulation Relating to Consumer and Data Protection

Our U.S. operations are subject to numerous laws and regulations governing the collection, protection and use of consumer credit and other information, and imposing sanctions for the misuse of such information or unauthorized access to data. Many of these provisions also affect our customers’ use of consumer credit or other data we furnish.

Examples of the most significant of these laws include, but are not limited to, the following:

Federal Laws and Regulation

• FCRA - The Fair Credit Reporting Act (“FCRA”) regulates consumer reporting agencies, including us, as well as data furnishers and users of consumer reports such as banks and other companies. FCRA provisions govern the accuracy, fairness and privacy of information in the files of consumer reporting agencies (“CRAs”) that engage in the practice of assembling or evaluating certain information relating to consumers for certain specified purposes. The FCRA limits the type of information that may be reported by CRAs, limits the distribution and use of consumer reports and establishes consumer rights to access, freeze and dispute information in their credit files. CRAs are required to follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates and if a consumer disputes the accuracy of any information in the consumer’s file, to conduct a reasonable reinvestigation. CRAs are required to make available to consumers a free annual credit report and free credit freezes. The FCRA imposes many other requirements on

CRAs, data furnishers and users of consumer report information. Violation of the FCRA can result in civil and criminal penalties. The FCRA contains an attorney fee shifting provision to provide an incentive for consumers to bring individual or class action lawsuits against a CRA for violations of the FCRA. Regulatory enforcement of the FCRA is under the purview of the United States Federal Trade Commission (“FTC”), the Consumer Financial Protection Bureau (“CFPB”), and state attorneys general, acting alone or in concert with one another.

• The Dodd-Frank Act - Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) created the CFPB. The Dodd-Frank Act provides the CFPB with examination and supervisory authority over CRAs, including us. The Dodd-Frank Act prohibits unfair, deceptive or abusive acts or practices (“UDAAP”) with respect to consumer financial services practices and provides the CFPB with enforcement authority to enforce those provisions. Among other areas, the CFPB’s UDAAP authority extends to the security measures we employ to safeguard the personal data of consumers. Allegations that we failed to safeguard or handle such data in a compliant manner may subject us to CFPB enforcement action. The CFPB may pursue administrative proceedings or litigation to enforce the laws and rules subject to its jurisdiction. In these proceedings, the CFPB can obtain cease and desist orders, which can include orders for restitution to consumers or rescission of contracts, as well as other types of affirmative relief, and monetary penalties ranging from $5,000 per day for ordinary violations and up to $1 million per day for known violations. Also, the Dodd-Frank Act empowers state attorneys general and state regulators to bring civil actions in certain circumstances for the kind of cease and desist orders available to the CFPB (but not for civil penalties).
• FTC Act - The Federal Trade Commission Act (“FTC Act”) prohibits unfair methods of competition and unfair or deceptive acts or practices. Under the FTC Act, the FTC’s jurisdiction includes the ability to bring enforcement actions based on the security measures we employ to safeguard the personal data of consumers. Allegations that we failed to safeguard or handle such data in a reasonable manner may subject us to regulatory scrutiny or enforcement action. There is no private right of action under the FTC Act.
• GLBA - The Financial Services Modernization Act of 1999, or Gramm-Leach-Bliley Act (“GLBA”), regulates, among other things, the use of non-public personal information of consumers that is held by financial institutions, including us. We are subject to various GLBA provisions, including rules relating to the use or disclosure of the underlying data and rules relating to the physical, administrative and technological protection of non-public personal financial information. Breach of the GLBA can result in civil and/or criminal liability and sanctions by regulatory authorities. Regulatory enforcement of the GLBA is under the purview of the FTC, the CFPB, the federal prudential banking regulators, the SEC and state attorneys general, acting alone or in concert with each other.
• CROA - The Credit Repair Organizations Act (“CROA”) regulates companies that claim to be able to assist consumers in improving their credit standing. There have been efforts to apply the CROA to credit monitoring services offered by CRAs and others. The CROA allows for a private right of action. Consumers can sue to recover the greater of the amount paid or actual damages, punitive damages, costs, and attorney’s fees for violations of the CROA.

State Laws and Regulation Relating to Consumer and Data Protection

• A number of states have enacted requirements similar to the federal FCRA. Some of these state laws impose additional, or more stringent, requirements than the FCRA, especially in connection with investigations and responses to reported inaccuracies in consumer reports. The FCRA preempts some of these state laws, but the scope of preemption continues to be defined by the courts. The state of Vermont is grandfathered under the original FCRA requirements and thus we are subject to additional requirements to comply with Vermont law.
• All fifty states have adopted versions of data security breach laws that require notification to affected consumers and potentially regulators or law enforcement authorities in the event of a breach of personal information. A subset of these laws and other state laws require the implementation of data security measures as well. State attorneys general can enforce such state laws and can seek equitable as well as monetary remedies and in some cases private rights of action are permitted by such laws.
• The New York State Department of Financial Services (“NYDFS”) has enacted extensive regulatory requirements applicable to CRAs that require registration with that agency, prohibit unfair and deceptive consumer practices and require compliance with significant portions of the NYDFS cybersecurity rules.
• We or certain of our operations are also subject to and affected by new state privacy and data security laws such as new data broker registration requirements in California and Vermont, and the recently implemented California Consumer Privacy Act (“CCPA”). The CCPA became effective January 1, 2020 and imposes additional data privacy requirements on many businesses operating in the state, including, potentially, with respect to employee data in addition to consumer data. The CCPA expansively defines “personal information” and imposes new notice requirements relating to the collection, use and sharing of personal information. It provides consumers with extensive rights, including the right to access the categories and specific pieces of personal information businesses collect, the right to request businesses delete information, and the right to opt-out of “sales” of personal information with sales being defined under the CCPA to include monetary and non-monetary valuable consideration. The CCPA also contains a private right of action in the event that a business suffers a security breach that was due to unreasonable security measures. We may also become subject to and affected by new and proposed state privacy laws similar to the CCPA. A number of other states, such as Florida, Illinois, Nebraska, New Hampshire, New York, Virginia and Washington, have introduced comprehensive data privacy legislation modeled after, and which contain certain elements of, the CCPA or the European General Data Protection Regulation. More states are expected to introduce similar legislation in 2020 and if enacted it is expected that such laws would contain variations and impose new compliance risks and obligations on the Company.
• State banking and financial services regulatory agencies have asserted either express or implied authority under applicable state laws to examine us as a third-party service provider to financial institutions, and in certain cases to bring enforcement actions against us. Generally, such examinations, and related enforcement actions, are focused on assessing our safety and soundness in support of financial institutions we serve.
• We are also subject to federal and state laws that are generally applicable to any U.S. business with national or international operations, such as antitrust laws, the Foreign Corrupt Practices Act, the Americans with Disabilities Act, state unfair or deceptive practices acts and various employment laws. We continuously monitor legislative and regulatory activities that involve credit reporting, data privacy, security and other relevant issues to identify issues in order to remain in compliance with all applicable laws and regulations.

Summary of International Regulation Relating to Consumer and Data Protection

We are subject to various data protection, privacy and consumer credit laws and regulations in the foreign countries where we operate. Examples of the most significant of these laws include, but are not limited to, the following:

• In the U.K., we are subject to a regulatory framework which provides for primary regulation by the Financial Conduct Authority (the “FCA”). The FCA focuses on consumer protection, the integrity of the U.K. financial system, and effective competition in the interests of consumers. The FCA has significant powers, including the power to regulate conduct related to the marketing of financial products, to specify minimum standards and to place requirements on products, impose unlimited fines, and to investigate organizations and individuals. In addition, the FCA is able to ban financial products for up to a year while considering an indefinite ban; it has the power to instruct firms to immediately retract or modify promotions which it finds to be misleading, and to publish such decisions. Effective December 2019, the FCA framework under which we operate has included the “senior managers and certification regime” which among other things will allow the FCA to bring an enforcement action directly against designated personnel who do not take reasonable steps to avoid non-compliance. Our core credit reporting and debt collections services and recovery management businesses in the U.K. are subject to FCA supervision. In addition to regulation by the FCA, we are also subject to regulation by the U.K. Information Commissioner’s Office, which focuses on upholding information rights in the public interest and the protection of data privacy for individuals.
• In Europe, we are subject to the European General Data Protection Regulation (“GDPR”). The GDPR establishes multiple privacy and data protection requirements that are more specific and comprehensive than those of the U.S. and most other countries where Equifax operates. In addition, the GDPR includes data breach notification requirements and it establishes the ability of regulators to pursue substantial penalties for non-compliance.
• In Canada, federal and provincial laws govern how we collect, use or disclose personal information in the course of our commercial activities. Federally, the Personal Information Protection and Electronic Documents Act governs the collection, use and disclosure of personal information by organizations in the private sector. It sets out specific obligations with respect to accountability and identifying purposes, consent, collection, use, disclosure, retention, accuracy, safeguards, personal data breach reporting, individual access and compliance. Alberta, British Columbia and Quebec privacy legislation sets out similar privacy laws and rules that apply to our Canadian

business. The federal and provincial privacy regulators have powers of investigation and intervention, and provisions of Canadian law regarding civil liability apply in the event of unlawful processing which is prejudicial to the persons concerned. Canada also has specific credit reporting legislation that is regulated at a provincial level. At present, each province has credit reporting legislation, with the exception of the Territories (Northwest Territories, Yukon, and Nunavut). Generally speaking, the legislation regulates the contents of credit files, the length of time information can be included on a credit file and who can receive credit reports.

• In Latin America, data protection and credit reporting laws and regulations vary considerably among Latin American countries. Some countries, such as El Salvador, Ecuador and Honduras, establish a constitutional right to privacy without general data protection standards or a data protection authority. These countries, however, have laws that govern the functioning of credit bureaus. In 2018, Ecuador amended a 2017 law relating to the collection of credit data and the operation of a credit bureau within the country allowing the existence of private credit bureaus along with the public credit data registry to be established. Other countries, such as Argentina, Uruguay, Peru, Costa Rica and most recently Brazil have enacted comprehensive data protection legislation similar to the European GDPR. Brazil’s General Data Protection Law is scheduled to go into effect in August 2020. The EU recognizes Argentina and Uruguay as having adequate levels of protection for personal data transfers and processing. Peru also has a specific law for credit reporting. Paraguay and Chile have fewer comprehensive data protection laws in place, but do have rules regarding reporting periods, consent and data collection.
• In Australia, we are subject to regulatory oversight by various agencies. The Office of the Australian Information Commissioner (“OAIC”) is the agency with direct responsibility for administering the Australian Privacy Principles (which relate to the collection, holding, use and disclosure of personal information) and Part IIIA of the Privacy Act 1988 (which regulates credit reporting). The OAIC can investigate a complaint, conduct its own investigations, resolve/make binding determinations and seek civil penalties. Our credit reporting business, Equifax Information Services and Solutions, is a member of an external dispute resolution scheme, the Australian Financial Complaints Authority, which has been approved by the OAIC to handle privacy and credit reporting complaints and make binding determinations. The OAIC can register codes of practice under the Privacy Act 1988, and has registered the Privacy (Credit Reporting) Code 2014. The Australian Competition and Consumer Commission (“ACCC”) is the agency responsible for enforcing the Competition and Consumer Act of 2010 and related legislation concerning consumer protection and competition. The ACCC has the authority to use a range of actions to ensure compliance with the law, including investigative powers and the ability to seek penalties through litigation and other formal enforcement means. The Australian Retail Credit Association is a credit and credit reporting industry self-regulatory body, which administers principles and standards for the exchange of credit data between industry participants. Equifax Australasia Credit Ratings Pty Limited (formerly named Corporate Scorecard Pty Limited, one of our Australian subsidiaries) holds an Australia Financial Services License, which allows it to provide general advice to wholesale clients by issuing a credit rating, and has been approved by the Reserve Bank of New Zealand as a rating agency under section 86 of the Non-bank Deposit Takers Act of 2013. The Australian Securities and Investments Commission regulates that business and has authority to investigate, prosecute, ban individuals, and to seek civil penalties. In addition, new federal legislation comes into effect on April 1, 2020, mandating the supply by large banks of comprehensive credit information to credit reporting bodies, including Equifax, imposing certain disclosure, storage and reporting obligations on the credit reporting bodies and requiring the Attorney-General to review and report on the credit reporting system before October 1, 2023.
• In New Zealand, the regulatory framework provides for primary regulation under the Office of the Privacy Commissioner (“NZ OPC”). The NZ OPC investigates complaints relating to the collection, use, holding and disclosure of personal information, both credit-related and non-credit related. The NZ OPC can make a finding that there has been an interference with privacy but cannot impose civil penalties. In extreme cases where there has been an interference with privacy, it can refer these cases to the Director of Human Rights for determination in the Human Rights Review Tribunal. The NZ OPC can issue practice codes under the Privacy Act 1993 and has issued and subsequently amended the Credit Reporting Privacy Code 2004. A self-regulatory body, the Retail Credit Association of New Zealand addresses reciprocity of data issues relating to comprehensive credit reporting and data standards.
• In India, various legislation including the Information Technology Act of 2000 and rules framed thereunder and the Credit Information Companies (Regulation) Act of 2005 and rules and regulations framed thereunder, establishes a federal data protection framework. Entities that collect and maintain personal data and/or credit information must ensure that it is complete, accurate and safeguarded, and must adopt certain privacy principles with respect to collecting, processing, preserving, sharing and using such data and/or credit information. The

Indian parliament is expected to pass legislation that would allow individuals to sue for damages in the case of a data breach, if the entity negligently failed to implement reasonable security practices and procedures to protect personal data and/or credit information and in 2018 the Personal Data Protection Bill was released by the Indian government (recently revised and retitled as the 2019 Personal Data Protection Bill). This bill is expected to be enacted and eventually to impose additional privacy and data security requirements. Our Indian joint venture is subject to regulation by the Reserve Bank of India, which is India’s central banking institution.

• In Russia, credit reporting activities are governed by the Federal Law on Credit Histories No.218-fz, dated December 30, 2004. The law regulates the contents of credit files, who may submit data to a credit bureau and who can receive credit reports. Russia has also enacted a comprehensive data protection law that is similar to Europe’s approach and also has a data localization law. In December 2019, a law increasing the fines for infringing Russia data localization and data protection laws came into force.

Tax Management Services

The Tax Management Services business within our Employer Services business unit in our Workforce Solutions segment is potentially impacted by changes in renewal or non-renewal of U.S. federal and state tax laws or interpretations, for example, those pertaining to work opportunity tax credits and unemployment compensation claims.

Personnel

Equifax employed approximately 11,200 employees in 22 countries as of December 31, 2019. None of our U.S. employees are subject to a collective bargaining agreement and no work stoppages have been experienced. Pursuant to local laws, certain of our employees in Argentina and Spain are covered under government-mandated collective bargaining regulations that govern general salary and compensation matters, basic benefits and hours of work. In some of our non-U.S. subsidiaries, certain of our employees are represented by workers’ councils or statutory labor unions.

Forward-Looking Statements

This report contains information that may constitute “forward-looking statements.” Generally, the words “believe,” “expect,” “intend,” “estimate,” “anticipate,” “project,” “will” and similar expressions identify forward-looking statements, which generally are not historical in nature. All statements that address operating performance, events or developments that we expect or anticipate will occur in the future, including statements relating to future operating results and statements related to the 2017 cybersecurity incident and improvements in our information technology and data security infrastructure, including as part of our technology transformation, our strategy, our culture, our ability to innovate, the market acceptance of new products and services and similar statements about our business plans are forward-looking statements. Management believes that these forward-looking statements are reasonable as and when made. However, forward-looking statements are subject to certain risks and uncertainties that could cause actual results to differ materially from the Company’s historical experience and our present expectations or projections, including without limitation our expectations regarding the Company’s outlook, long-term organic and inorganic growth, and customer acceptance of our business solutions referenced above under “Item 1. Business” and below in “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operation — Business Environment and Company Outlook.” These risks and uncertainties include, but are not limited to, those described below in “Item 1A. Risk Factors,” and elsewhere in this report and those described from time to time in our future reports filed with the United States Securities and Exchange Commission (“SEC”). As a result of such risks and uncertainties, we urge you not to place undue reliance on any such forward-looking statements. Forward-looking statements speak only as of the date when made. We undertake no obligation to publicly update or revise any forward-looking statements, whether as a result of new information, future events or otherwise, except as required by law.

Available Information

Detailed information about us is contained in our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, proxy statements and other reports, and amendments to those reports, that we file with, or furnish to, the SEC. These reports are available free of charge at our website, www.equifax.com (http://www.equifax.com), as soon as reasonably practicable after we electronically file such reports with or furnish such reports to the SEC. However, our website and any contents thereof should not be considered to be incorporated by reference into this document. We will furnish copies of such reports free of charge upon written request to Equifax Inc., Attn: Office of Corporate Secretary, P.O. Box 4081, Atlanta, Georgia, 30302. These reports are also available at www.sec.gov (http://www.sec.gov).

All of the risks and uncertainties described below and the other information included in this Form 10-K should be considered and read carefully. The risks described below are not the only ones facing us. The occurrence of any of the following risks or additional risks and uncertainties not presently known to us or that we currently believe to be immaterial could materially and adversely affect our business, financial condition or results of operations. This Form 10-K also contains forward-looking statements and estimates that involve risks and uncertainties. Our actual results could differ materially from those anticipated in the forward-looking statements as a result of specific factors, including the risks and uncertainties described below.

Security breaches and other disruptions to our information technology infrastructure could compromise Company, consumer and customer information, interfere with our operations, cause us to incur significant costs for remediation and enhancement of our IT systems and expose us to legal liability, all of which could have a substantial negative impact on our business and reputation.

We are a global data, analytics and technology company. In the ordinary course of business, we collect, process, transmit and store sensitive data, including intellectual property, proprietary business information and personally identifiable information of consumers, employees and strategic partners. The secure operation of our information technology networks and systems, and of the processing and maintenance of this information, is critical to our business operations and strategy. Despite our substantial investment in physical and technological security measures, employee training and contractual precautions, our information technology networks and infrastructure (or those of our third-party vendors and other service providers) are potentially vulnerable to unauthorized access to data or breaches of confidential information due to criminal conduct, attacks by hackers, employee or insider malfeasance and/or human error. For example, in 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of personally identifiable information of U.S., Canadian and U.K. consumers.

Following the 2017 cybersecurity incident, we began undertaking significant remediation efforts and other steps to enhance our data security infrastructure which are ongoing. In connection with these efforts, we have incurred significant costs and expect to incur additional significant costs as we continue to enhance our data security infrastructure and take further steps to prevent unauthorized access to our systems and the data we maintain. Despite these efforts, we cannot assure you that all potential causes of this incident have been identified and remediated and that similar cyber incidents will not occur in the future.

Because our products and services involve the storage and transmission of personal information of consumers, we will continue to routinely be the target of attempted cyber and other security threats by outside third parties, including technically sophisticated and well-resourced bad actors attempting to access or steal the data we store. We are in the process of transforming our applications and infrastructure technologies, transitioning to cloud-based technologies. As we transition to cloud-based technologies, we may be exposed to additional cyber threats as we migrate our data from our legacy systems to cloud-based solutions. Our increased dependence on third parties to store our cloud-based data systems may also subject us to further cyber threats. Insider or employee cyber and security threats are also a significant concern for all companies, including ours.

We must continuously plan, develop and monitor our information technology networks and infrastructure to identify, protect, detect, respond to and recover from the risk of unauthorized access, misuse, malware, phishing and other events that could have a security impact. Because the techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently and often are not recognized until launched against a target, or even some time after, we may be unable to anticipate these techniques, implement adequate preventative measures or remediate any intrusion on a timely or effective basis even if our security measures are appropriate, reasonable, and/or in accordance with applicable legal requirements. If we experience additional breaches of our security measures, including from incidents that we fail to detect for a period of time, sensitive data may be accessed, stolen, disclosed or lost. Any such access, disclosure or other loss of information could subject us to significant litigation, regulatory fines, penalties, losses of customers or reputational damage, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or results of operations.

We cannot ensure that our insurance policies in the future will be adequate to cover losses from any future security breaches. Our $125.0 million cybersecurity insurance policy was not adequate to cover the losses we have incurred to date from the 2017 cybersecurity incident, and all future losses we incur as a result of the incident will not be covered by insurance. In addition, our insurance coverage will vary from time to time in both type and amount depending on availability, cost and our decisions with respect to risk retention.

As part of a global settlement, we entered into agreements with various parties to settle the U.S. Consumer MDL Litigation and certain federal and state government investigations arising out of the 2017 cybersecurity incident. If we are unable to comply with our obligations under these agreements, or if other lawsuits or investigations are filed or commenced, it could have a material adverse effect on our financial condition.

In July 2019, the Company entered into multiple agreements that resolve the U.S. consolidated consumer class action cases, captioned In re: Equifax, Inc. Customer Data Security Breach Litigation, MDL No. 2800 (Consumer Cases) (the “U.S. Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the Attorneys General of 48 states, the District of Columbia and Puerto Rico (the “MSAG Group”) and the NYDFS (collectively, the “Consumer Settlement”) relating to the 2017 cybersecurity incident. On January 13, 2020, the U.S. District Court for the Northern District of Georgia (the “Court”) entered an order granting final approval of the settlement in connection with the U.S. Consumer MDL Litigation, from which several objectors have appealed. Until the appeals are finally adjudicated or dismissed, we can provide no assurance that the U.S. Consumer MDL Litigation will be resolved as contemplated by the settlement agreement. If the Court’s order approving the settlement agreement were reversed by an appellate court, there is a risk that we would not be able to settle the U.S. Consumer MDL Litigation on acceptable terms or at all, which could have a material adverse effect on our financial condition.

In addition to the monetary payments and consumer redress, we also agreed as part of the Consumer Settlement to implement certain business practice commitments related to consumer assistance and our information security program, including third party assessments of our program. These business practice commitments are extensive and will require a significant amount of attention from management. We can provide no assurance that we will be able to comply with these business practice commitments. To the extent we were unable to comply or we are viewed as not being in compliance with these business practice commitments or other requirements of a relevant order, we could face an enforcement action or contempt proceeding that could potentially result in fines, penalties and new business practice commitments, which, depending on the amount and type, could have a material adverse effect on our financial condition.

In addition, other lawsuits and investigations related to the 2017 cybersecurity incident are still outstanding and additional lawsuits or investigations may be filed, commenced or issued. The resolution of these additional matters may result in damages, costs, fines or penalties, which, depending on the amount, could be material to the Company’s consolidated financial condition, results of operations, or cash flows in future periods.

The 2017 cybersecurity incident and the adverse publicity that followed have had a negative impact on our reputation and our relationships with our customers, and we cannot assure that it will not have a long-term effect on our relationships with our customers, our revenue and our business.

Our reputation with consumers and other stakeholders and our customer relationships were damaged following the 2017 cybersecurity incident, resulting in a negative impact on our revenue. Despite our progress made toward repairing our reputation and business relationships, if we experience another cybersecurity incident or are otherwise unable to demonstrate the security of our systems and the data we maintain and retain the trust of our customers, consumers and data suppliers, we could experience a substantial negative impact on our business.

If we fail to achieve and maintain key industry or technical certifications, our customers and business partners may stop doing business with us and we may not be able to win new business, which would negatively affect our revenue.

We are required by customers and business partners to obtain various industry or technical certifications, including from the International Organization for Standardization (“ISO”). ISO certifications specify requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented information security management system. Industry and technical certifications, such as the ISO certifications, are critical to our business because certain of our current and potential customers and the contracts governing certain customer relationships, as well as certain of our data suppliers, require us to maintain them as a requirement of doing business. As a result of the 2017 cybersecurity incident, we lost certain key certifications which adversely affected our business. We had to spend significant resources on remediation activities in order to obtain certain re-certifications. If we fail to achieve or maintain key industry or technical certifications as a result of another cybersecurity incident or for other reasons, customers and business partners may stop doing business with us and we may not be able to win new business, which would negatively affect our revenue.

The failure to realize the anticipated benefits of our technology transformation strategy could adversely impact our business and financial results.

We expect our technology transformation strategy, including our transition to cloud-based technologies, will significantly increase our efficiency and productivity, the functionality of our products and services, as well as decrease the cost of our overall systems infrastructure, all of which we expect will drive growth and have a positive effect on our business, competitive position and results of operations. This initiative is a major undertaking as we replace many of our previous operating systems with cloud-based systems. This complex, multifaceted and extensive initiative will be expensive and may cause material unanticipated problems and expenses. If our new systems do not operate as expected, we may have to incur significant additional costs to modify them. Moreover, we may experience issues with customer migration, as many of our customers may not want to migrate or may choose not to utilize our products and services during and after our transition to cloud-based technologies.

We cannot assure you that our technology transformation strategy will be beneficial to the extent, or within the timeframes, expected, or that the estimated efficiency, cost savings and other improvements will be realized as anticipated or at all. Market acceptance of cloud-based offerings is affected by a variety of factors, including information security, reliability, performance, the sufficiency of technological infrastructure to support our products and services in certain geographies, customer concerns with entrusting a third party to store and manage its data as well as the customer’s ability to access this data once a contract has expired, and consumer concerns regarding data privacy and the enactment of laws or regulations that restrict our ability to provide such services to customers. If we are unable to correctly respond to these issues, we may experience business disruptions, damage to our reputation, negative publicity, diminished customer trust and relationships and other adverse effects on our business. Even if the anticipated benefits and savings are substantially realized, there may be consequences, internal control issues or business impacts that were not expected. Our transition and migration to cloud-based technologies may increase our risk of liability and cause us to incur significant technical, legal or other costs.

Our technology transformation strategy places a significant strain on our management, operational, financial and other limited resources.

As part of our technology transformation strategy, we are transitioning and migrating our data systems from traditional data centers to cloud-based platforms. This initiative will place significant strain on our management, personnel, operations, systems, technical performance and financial resources and internal financial control and reporting function. In addition, many of our existing personnel do not have experience with native cloud-based technologies and, as a result, we have and will continue to hire personnel with such experience. This effort will be time consuming and costly. Our technology transformation strategy requires management time and resources to educate employees and implement new ways of conducting business. The dedication of resources to our technology transformation strategy and cloud-based technologies limits the resources we have available to devote to other initiatives or growth opportunities, or to invest in the maintenance of our existing internal systems. We cannot guarantee that our strategy is the right one or that investments in alternative technologies or other initiatives would not be a better use of our limited resources.

Additionally, as a result of our cloud migration efforts in connection with our technology transformation strategy, we may experience a loss of continuity, loss of accumulated knowledge or loss of efficiency during transitional periods. Reorganization and transition can require a significant amount of management and other employees’ time and focus, which may divert attention from operating activities and growing our business. If we fail to achieve some or all of the expected benefits of these activities, it could have a material adverse effect on our competitive position, business, financial condition, results of operations and cash flows.

Our transition to cloud-based technologies could expose us to operational disruptions.

We rely on the efficient and uninterrupted operation of complex information technology systems and networks, some of which are managed internally within the Company and some of which are outsourced to third parties. As part of our technology transformation strategy, we are upgrading a significant portion of the information technology systems used to operate our business and replacing them with cloud-based solutions. This transition will require substantial changes to our software and network infrastructure, which could lead to system interruptions, affect our data systems and further expose us to operational disruptions, and cause us to lose customers, all of which could have a material adverse effect on our results of operations.

Upon implementation of the new cloud-based solutions, much of our information technology systems will consist of outsourced, cloud-based infrastructure, platform and software-as-a-service solutions not under our direct management or control. Any disruption to either the outsourced systems or the communication links between us and the outsourced supplier could negatively affect our ability to operate our data systems and could impair our ability to provide services to our customers. We may incur additional costs to remedy the damages caused by these disruptions.

If our systems do not meet customer requirements for response time or high availability, or we experience system constraints or failures, or our customers do not modify and/or upgrade their systems to accept new releases of our products and services, our services to our customers could be delayed or interrupted, which could result in lost revenues or customers, lower margins or other harm to our business and reputation.

We depend on reliable, stable, efficient and uninterrupted operation of our technology network, systems, and data centers to provide service to our customers. Many of the services and systems upon which we rely have been outsourced to third parties. In addition, many of our revenue streams are dependent on links to third party telecommunications providers. These systems and operations, and the personnel that support, service and operate these systems, could be exposed to interruption, damage or destruction from power loss, telecommunication failures, computer viruses, denial-of-service or other cyber attacks, employee or insider malfeasance, human error, fire, natural disasters, war, terrorist acts or civil unrest. We may not have sufficient disaster recovery or redundant operations in place to cover a loss or failure of systems or telecommunications links in a timely manner. In addition, as part of our technology transformation, we continue to be intensely focused on enhancing our data security infrastructure and effecting our technology transformation strategy and implementation of those enhancements could result in service interruptions. Our customers expect high system availability and response time performance, as well as a very high degree of system resilience. Any significant system interruption or series of minor interruptions could result in the loss of customers and/or lost revenues, lower margins or other significant harm to our business or reputation.

The loss of access to credit, employment, financial and other data from external sources could harm our ability to provide our products and services.

We rely extensively upon data from external sources to maintain our proprietary and non-proprietary databases, including data received from customers, strategic partners and various government and public record sources. This data includes the widespread and voluntary contribution of credit data from most lenders in the U.S and many other markets as well as the contribution of data under proprietary contractual agreements, such as employers’ contribution of employment and income data to The Work Number®, financial institutions’ contribution of individual financial data to IXI, and telecommunications, cable and utility companies’ contribution of payment and fraud data to the National Cable, Telecommunications and Utility Exchange. For a variety of reasons, including concerns of data furnishers arising out of the 2017 cybersecurity incident, legislatively or judicially imposed restrictions on use, additional security breaches or competitive reasons, our data sources could withdraw, delay receipt of or increase the cost of their data provided to us. Where we currently have exclusive use of data, the providers of the data sources could elect to make the information available to competitors. We also compete with several of our third-party data suppliers. If a substantial number of data sources or certain key data sources were to withdraw or be unable to provide their data, if we were to lose access to data due to government regulation, if we lose exclusive right to the use of data, or if the collection, disclosure or use of data becomes uneconomical, our ability to provide products and services to our clients could be adversely affected, which could result in decreased revenue, net income and earnings per share and reputational loss. There can be no assurance that we would be able to obtain data from alternative sources if our current sources become unavailable.

Effective September 2018, federal law allows consumers to place freezes on their credit files at all credit bureaus including Equifax. If a significant number of consumers lock or freeze their file, our population of data is reduced which could affect our product offerings and value to our customers in our other businesses.

Negative changes in general economic conditions, including interest rates, unemployment rates, income, home prices, investment values and consumer confidence, could adversely affect us.

Our customers, and therefore our business and revenues, are sensitive to negative changes in general economic conditions, including the demand and availability of affordable credit and capital, the level and volatility of interest rates, inflation, employment levels, consumer confidence and housing demand, both inside and outside the U.S. Business customers use our credit information and related analytical services and data to process applications for new credit cards, automobile loans, home and equity loans and other consumer loans, and to manage their existing credit relationships. Demand for our services tends to be correlated to general levels of economic activity and to consumer credit activity, which can be impacted by changes in interest rates. Bank and other lenders’ willingness to extend credit are adversely affected by elevated consumer delinquency and loan losses in a weak economy. Consumer demand for credit (i.e., rates of spending and levels of indebtedness) also tends to grow more slowly or decline during periods of economic contraction or slow economic growth.

Our customer base suffers when financial markets experience volatility, illiquidity and disruption and the potential for increased and continuing disruptions going forward presents considerable risks to our business and revenue. High or rising rates of unemployment and interest, declines in income, home prices or investment values, lower consumer confidence and reduced access to credit adversely affect demand for many of our products and services, and consequently our revenue and results of operations, as consumers may postpone or reduce their spending and use of credit, and lenders may reduce the amount of credit offered or available.

Our markets are highly competitive and new product introductions and pricing strategies being offered by our competitors could decrease our sales and market share or require us to enhance our products and services or reduce our prices in a manner that reduces our operating margins.

We operate in a number of geographic, product and service markets that are highly competitive. Competitors may develop products and services that are superior to or that achieve greater market acceptance than our products and services. The size of our competitors varies across market segments, as do the resources we have allocated to the segments we target. Therefore, some of our competitors may have significantly greater financial, technical, marketing or other resources than we do in one or more of our market segments, or overall. As a result, our competitors may be in a position to respond more quickly than we can to new or emerging technologies and changes in customer requirements, or may devote greater resources than we can to the development, enhancement, promotion, sale and support of products and services, or some of our customers may develop products of their own that replace the products they currently purchase from us, which would result in lower revenue. In addition, many of our competitors have extensive consumer relationships, including relationships with our current and potential customers. Moreover, new competitors or alliances among our competitors may emerge and potentially reduce our market share, revenue or margins.

We also sell our information to competing firms, and buy information from certain of our competitors, in order to sell “tri-bureau” and other products, most notably into the U.S. mortgage market. Changes in prices between competitors for this information and/or changes in the design or sale of tri-bureau versus single or dual bureau product offerings may affect our revenue or profitability.

Some of our competitors may choose to sell products that compete with ours at lower prices by accepting lower margins and profitability, or may be able to sell products competitive to ours at lower prices, individually or as a part of integrated suites, given proprietary ownership of data, technological superiority or economies of scale. Price reductions by our competitors could negatively impact our margins and results of operations and could also harm our ability to obtain new customers on favorable terms. Historically, certain of our key products have experienced declines in per unit pricing due to competitive factors and customer demand. Since a significant portion of our operating expenses is relatively fixed in nature due to sales, information technology and development and other costs, if we were unable to respond quickly enough to changes in competition or customer demand, we could experience further reductions in our operating margins.

Our relationships with key long-term customers may be materially diminished or terminated.

We have long-standing relationships with a number of our customers, many of whom could unilaterally terminate their relationship with us or materially reduce the amount of business they conduct with us at any time. Many of our material customer agreements can be terminated by the customer for convenience on advance written notice, which provides our customers with the opportunity to renegotiate their contracts with us or to award more business to our competitors.

We also provide our services to business partners who may combine them with their own or other branded services to be offered as a bundle to consumers, governmental agencies and businesses in support of fraud or credit protection, credit monitoring, identity authentication, insurance or credit underwriting, and collections. Some of these partners are the largest providers of credit information or identity protection services to the consumer market.

Market competition, business requirements, financial condition and consolidation through mergers or acquisitions, could adversely affect our ability to continue or expand our relationships with our customers and business partners. There is no guarantee that we will be able to retain or renew existing agreements, maintain relationships with any of our customers or business partners on acceptable terms or at all, or collect amounts owed to us from insolvent customers or business partners. The loss of one or more of our major customers or business partners could adversely affect our business, financial condition and results of operations.

If we do not introduce successful new products, services and analytical capabilities in a timely manner, or if the market does not adopt our new services, our competitiveness and operating results will suffer.

We generally sell our products in industries that are characterized by rapid technological changes, frequent new product and service introductions and changing industry standards. In addition, certain of the markets in which we operate are seasonal and cyclical. Without the timely introduction of new products, services and enhancements, our products and services will become technologically or commercially obsolete over time, in which case our revenue and operating results would suffer. The success of our new products and services will depend on several factors, including our ability to properly identify customer needs; innovate and develop new technologies, services and applications; successfully commercialize new technologies in a timely manner; produce and deliver our products in sufficient volumes on time; differentiate our offerings from competitor offerings; price our products competitively; anticipate our competitors’ development of new products, services or technological innovations; and control product quality in our product development process. Our resources have to be committed to any new products and services before knowing whether the market will adopt the new offerings. In addition, our management is and will continue to be intensely focused on enhancing our security measures and our technology transformation and may not be able to devote as much time or resources to new product development, which could cause us to be less competitive as compared to our peers, lose out on new revenue opportunities and have an adverse effect on our growth and our business.

The demand for some of our products and services may be negatively impacted to the extent the availability of free or less expensive consumer information increases.

Public or commercial sources of free or relatively inexpensive consumer credit, credit score and other information have become increasingly available, particularly through the internet, and this trend is expected to continue. In addition, governmental agencies in particular have increased the amount of information to which they provide free public access and these or other sources of free or relatively inexpensive consumer information from competitors or other commercial sources may reduce demand for our services, particularly in our USIS and Global Consumer Solutions business units. Recently, there also has been an increase in companies offering free or low-cost direct-to-consumer credit services (such as credit scores, reports and monitoring) as part of alternative business models that use such services as a means to introduce consumers to other products and services. To the extent that our customers choose not to obtain services from us and instead rely on information obtained at no cost or relatively inexpensively from these other sources, our business, financial condition and results of operations may be adversely affected.

We and our customers are subject to various current laws and governmental regulations, and could be affected by new and evolving consumer privacy and cybersecurity or other data-related laws or regulations, compliance with which may cause us to incur significant expenses and change our business practices, and if we fail to maintain satisfactory compliance with certain laws and regulations, we could be subject to civil or criminal penalties.

We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy, cybersecurity, data and financial protection. See “Item 1. Business—Governmental Regulation” in this Form 10-K for a summary of the U.S. and foreign consumer and data protection laws and regulations to which we are subject. These regulations are complex, change frequently, have tended to become more stringent over time, and are subject to administrative interpretation and judicial construction in ways that could harm our business. Examples of such new and evolving laws and regulations include recent amendments to the FCRA requiring the provision of free credit freezes to consumers, cybersecurity and other requirements promulgated by the New York Department of Financial Services, the taking effect of the CCPA on January 1, 2020, and California data broker registration requirements that took effect on January 31, 2020. Furthermore, we expect there to be an increased focus on laws and regulations related to our business because of the great public concern in the U.S. with regard to the operation of credit reporting agencies, as well as the collection, use, accuracy, correction and sharing of personal information, which was in part heightened by the 2017 cybersecurity incident. We also use algorithms, artificial intelligence and machine learning in our business processes. There are a number of legislative proposals pending before the U.S. Congress, various state legislative bodies and foreign governments concerning privacy or cybersecurity that could affect us. For example, already in 2020 several states have introduced varying comprehensive privacy laws modeled to some degree on the CCPA and/or the GDPR. Compliance with multiple state laws containing varying requirements could be complicated and costly. While in the EU the GDPR already includes certain provisions relating to the automated processing of personal data, there has also been discussion in the EU of new legislative proposals to regulate business use of artificial intelligence and machine learning technologies that if enacted could impose new legal requirements addressing among other issues, privacy, discrimination and human rights. As of now, the specifics of such legislation are unclear. However, legislation in this area could also be introduced in other countries. In addition, a growing number of legislative and regulatory bodies have adopted consumer notification and other requirements in the event that consumer information is accessed or acquired by unauthorized persons and additional regulations regarding the use, access, accuracy and security of such data are possible. In the U.S., state laws provide for disparate notification regimes, all of which we are subject to. Further, any perception that our practices or products are an invasion of privacy, whether or not consistent with current or future regulations and industry practices, may subject us to public criticism, private class actions, reputational harm, or claims by regulators, which could disrupt our business and expose us to increased liability.

We devote substantial compliance, legal and operational business resources to strive for compliance with applicable regulations and requirements. In the future, we may be subject to significant additional expense related to compliance with applicable laws and regulations, including new laws and evolving interpretations that are difficult to predict, and to investigate, defend or remedy actual or alleged violations. Additionally, we cooperate with CFPB supervisory examinations and respond to other state, federal and foreign government examinations into or inquiries of our business practices. The enactment of new laws and how they are interpreted could impact our business. In particular, legislative activity in the privacy area may result in new laws that are applicable to us and that may hinder our business, for example, by restricting use or sharing of consumer data, including for marketing or advertising or limiting the use of, or otherwise regulating artificial intelligence and machine learning, including the use of algorithms and automated processing in ways that could materially affect our business, or which may lead to significant increases in the cost of compliance. Any failure by us to comply with, or remedy any violations of, applicable laws and regulations, could result in new costs for our operations, the curtailment of certain of our operations, the imposition of fines and penalties, liability to private plaintiffs as a result of individual or class action litigation, restrictions on the operation of our business and reputational harm. It is difficult to predict the impact on our business if we were subject to allegations of having violated existing laws. For example, in Europe, the GDPR, which includes extensive regulations for certain security incidents, could result in fines of up to four percent of annual worldwide “turnover” (a measure similar to revenues in the U.S.). In addition, because many of our products are regulated or sold to customers in various industries, we must comply with additional regulations in marketing our products. Moreover, our compliance with privacy laws and regulations and our reputation depend in part on customers’ adherence to privacy laws and regulations and their use of our services in ways consistent with consumer expectations and regulatory requirements. We cannot predict the ultimate impact on our business of new or proposed rules, supervisory examinations or government investigations or enforcement actions.

The following legal and regulatory developments also could have a substantial negative impact on our business, financial condition or results of operations:

• amendment, enactment or interpretation of laws and regulations that restrict the access and use of personal information and reduce the availability or effectiveness of our solutions or the supply of data available to customers;
• changes in cultural and consumer attitudes in favor of further restrictions on information collection and sharing, which may lead to regulations that prevent full utilization of our solutions;
• failure of data suppliers or customers to comply with laws or regulations, where mutual compliance is required;
• failure of our solutions to comply with current laws and regulations; and
• failure of our solutions to adapt to changes in the regulatory environment in an efficient, cost effective manner.

These laws and regulations (as well as actions that may be taken by legislatures and regulatory bodies in other countries) and the consequences of any violation could limit our ability to pursue business opportunities we might otherwise consider engaging in, impose additional costs on us, result in significant loss of revenue, result in significant restitution and fines, impact the value of assets we hold, or otherwise adversely affect our business. See “Item 1. Business—Governmental Regulation” and “Item 3. Legal Proceedings” in this Form 10-K.

Regulatory oversight of our contractual relationships with certain of our customers may adversely affect our business.

The federal banking agencies, including the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System and the CFPB, as well as many state banking agencies have issued guidance to insured depository institutions and other providers of financial services on assessing and managing risks associated with third-party relationships, which include all business arrangements between a financial services provider and another entity, by contract or otherwise, and generally requires banks and financial services providers to exercise comprehensive oversight throughout each phase of a bank or financial service provider’s business arrangement with third-party service providers, and instructs banks and financial service providers to adopt risk management processes commensurate with the level of risk and complexity of their third-party relationships. This guidance requires more rigorous oversight of third-party relationships that involve certain “critical activities.” In light of this guidance, our existing or potential bank and financial services customers subject to this guidance may continue to revise their third-party risk management policies and processes and the terms on which they do business with us, which may adversely affect our relationship with such customers. In 2018, we entered into a consent order with certain state banking regulators in response to their multi-state review of our information security program. This consent order obligates us to, among other things, make certain changes to our corporate governance and information security practices. If we are unable or otherwise fail to comply with this consent order, our ability to do business with financial institutions in those states could be impaired. It is possible that the consent order or other actions resulting from examinations by federal or state banking regulators could lead to adverse changes in our customer relationships.

Economic, political and other risks associated with international sales and operations could adversely affect our results of operations.

Sales outside the U.S. comprised 27% of our total revenue in 2019. As a result, our business is subject to various risks associated with doing business internationally. In addition, many of our employees, suppliers, job functions and facilities are located outside the U.S. Accordingly, our future results could be harmed by a variety of factors including:

• changes in specific country or region political, economic or other conditions;
• trade protection measures;
• data privacy and consumer protection laws and regulations;
• difficulty in staffing and managing widespread operations;
• differing labor, intellectual property protection and technology standards and regulations;
• business licensing requirements or other requirements relating to making foreign direct investments, which could increase our cost of doing business in certain jurisdictions, prevent us from entering certain markets, increase our operating costs or lead to penalties or restrictions;
• difficulties associated with repatriating cash generated or held abroad in a tax-efficient manner;
• implementation of exchange controls;
• geopolitical instability, including terrorism and war;
• foreign currency changes;
• increased travel, infrastructure, legal and compliance costs of multiple international locations;
• foreign laws and regulatory requirements;
• terrorist activity, natural disasters, pandemics and other catastrophic events;
• restrictions on the import and export of technologies;
• difficulties in enforcing contracts and collecting accounts receivable;
• longer payment cycles;
• failure to meet quality standards for outsourced work;
• unfavorable tax rules;
• the presence and acceptance of varying level of business corruption in international markets; and
• varying business practices in foreign countries.

We earn revenue, pay expenses, own assets and incur liabilities in countries using currencies other than the U.S. dollar, including among others the British pound, the Australian dollar, the Canadian dollar, the Argentine peso, the Chilean peso, the Euro, the New Zealand dollar, the Costa Rican colon, the Singapore dollar, the Brazilian real, the Russian ruble and the Indian rupee. Because our consolidated financial statements are presented in U.S. dollars, we must translate revenue, income and expenses, as well as assets and liabilities, into U.S. dollars at exchange rates in effect during or at the end of each reporting period. Therefore, increases or decreases in the value of the U.S. dollar against major currencies will affect our operating revenues, operating income and the value of balance sheet items denominated in foreign currencies. We generally do not mitigate the risks associated with fluctuating exchange rates, although we may from time to time through forward contracts or other derivative instruments hedge a portion of our translational foreign currency exposure or exchange rate risks associated with material transactions which are denominated in a foreign currency. The use of such hedging activities may not offset any or more than a portion of the adverse financial effects of unfavorable movements in foreign exchange rates over the limited time the hedges are in place. Accordingly, fluctuations in foreign currency exchange rates, particularly the strengthening of the U.S. dollar against major currencies, may materially affect our consolidated financial results.

Compliance with applicable U.S. and foreign laws and regulations, such as anti-corruption laws, tax laws, foreign exchange controls and restrictions on repatriation of earnings or other similar restraints, data privacy requirements, labor laws and anti-competition relations increases the cost of doing business in foreign jurisdictions. Although we have implemented policies and procedures to comply with these laws and regulations, a violation by our employees, contractors or agents could nevertheless occur.

We are regularly involved in claims, suits, government investigations, supervisory examinations and other proceedings that may result in adverse outcomes.

In addition to matters related to the 2017 cybersecurity incident, we are regularly involved in claims, suits, government investigations, supervisory examinations and regulatory proceedings arising from the ordinary course of our business, including actions with respect to consumer protection and data protection, including purported class action lawsuits. Such claims, suits, government investigations and proceedings are inherently uncertain and their results cannot be predicted with certainty. Regardless of their outcome, such legal proceedings can have an adverse impact on us because of legal costs, diversion of management and other personnel, and other factors. In addition, it is possible that a resolution of one or more such proceedings could result in reputational harm, liability, penalties or sanctions, as well as judgments, consent decrees or orders preventing us from offering certain features, functionalities, products or services, or requiring a change in our business practices, products or technologies, which could in the future materially and adversely affect our business, operating results, and financial condition. The FCRA contains an attorney fee shifting provision to provide an incentive for consumers to bring individual and class action lawsuits against a CRA for violation of the FCRA, and the number of consumer lawsuits (both individual and class action) against us alleging a violation of the FCRA and our resulting costs associated with resolving these lawsuits have increased substantially over the past several years.

We rely, in part, on acquisitions, joint ventures and other alliances to grow our business and expand our geographic reach. The acquisition, integration or divestiture of businesses by us may not produce the expected financial, operating results or IT and data security profile we expect. In addition, if we are unable to make acquisitions or successfully develop and maintain joint ventures and other alliances, our growth may be adversely impacted.

Historically, we have relied, in part, on acquisitions, joint ventures and other alliances to grow our business. Any acquisitions we do complete may not be on favorable terms, and the expected benefits, synergies and growth from these initiatives may not materialize as planned. We may have difficulty assimilating new businesses and their products, services, technologies, IT systems and personnel into our operations. IT and data security profiles of acquired companies may not meet our technological standards and may take longer to integrate and remediate than planned. This may result in significantly greater transaction, remediation and integration costs for future acquisitions than we have experienced historically, or it could mean that we will not pursue certain acquisitions where the costs of integration and remediation are too significant. We may also have difficulty integrating and operating businesses in countries and geographies where we do not currently have a significant presence, and acquisitions of businesses having a significant presence outside of the U.S. will increase our exposure to risks of conducting operations in international markets. These difficulties could disrupt our ongoing business, distract our management and workforce, increase our expenses and adversely affect our operating results and financial condition.

Despite our past experience, opportunities to grow our business through acquisitions, joint ventures and other alliances may not be available to us in the future. In addition, our focus on data security and our technology transformation strategy, including our migration to cloud-based technologies may limit our ability to identify and complete acquisitions as we will have less time and resources to devote to identifying suitable acquisition candidates and our technological criteria and standards for acquisition candidates may increase.

Dependence on outsourcing certain portions of our operations may adversely affect our ability to bring products to market and damage our reputation. Dependence on outsourced information technology and other administrative functions may impair our ability to operate effectively.

As part of our technology transformation, we have outsourced various components of our application development, information technology, operational support and administrative functions and will continue to evaluate additional outsourcing. If our outsourcing vendors fail to perform their obligations in a timely manner or at satisfactory quality levels including with respect to data and system security, or increase prices for their services to unreasonable levels, our ability to bring products to market and support our customers and our reputation could suffer. Any failure to perform on the part of these third-party providers could impair our ability to operate effectively and could result in lower future revenue, unrealized efficiencies and adversely impact our results of operations and our financial condition. Some of our outsourcing takes place in developing countries and, as a result, may be subject to geopolitical uncertainty.

Changes in income tax laws can significantly impact our net income.

Federal and state governments in the U.S. as well as a number of other governments around the world are currently facing significant fiscal pressures and have considered or may consider changes to their tax laws for revenue raising or economic competitiveness reasons. Changes to tax laws can have immediate impacts, either favorable or unfavorable, on our results of operations and cash flows, and may impact our competitive position versus certain competitors who are domiciled in other jurisdictions and subject to different tax laws. In December 2017, the U.S. enacted the Tax Cuts and Jobs Act of 2017 (the “Tax Act”) which significantly impacted our U.S. and global tax expense and net income and our earnings per share in 2018 and 2019. The IRS issued clarification notices and the U.S. Treasury issued Proposed Regulation which also provided clarity to the Tax Act. However, the IRS could issue additional clarification and additional changes could be made to the final issuance of the Regulations.

If our government contracts are terminated, if we are suspended from government work, or if our ability to compete for new contracts is adversely affected, our business could suffer.

We derive a portion of our revenue from direct and indirect sales to U.S., state and local governments and their respective agencies. Such contracts are subject to various procurement laws and regulations, and contract provisions relating to their formation, administration and performance. Failure to comply with these laws, regulations or provisions in our government contracts could result in the imposition of various civil and criminal penalties, termination of contracts, forfeiture of profits, suspension of payments or suspension of future government contracting. Following the 2017 cybersecurity incident, our government contracts received enhanced scrutiny and negative media attention that resulted in the suspension of one of our contracts. If we experience another material cybersecurity incident, our ability to maintain our existing and acquire new government contracts may be substantially impacted.

Also, the government programs to which we provide services, or which are the bases of compliance services we provide non-governmental clients, including, in particular, the employer requirements under the Affordable Care Act, may be terminated or substantially altered by the government and our services would no longer be needed. If our government contracts are terminated, if we are suspended from government work, if the services we provide are no longer needed due to government program change or termination, or if our ability to compete for new contracts is adversely affected, our business could suffer.

Third parties may claim that we are infringing on their intellectual property and we could suffer significant litigation or licensing expenses or be prevented from selling products or services.

There has been substantial litigation in the U.S. regarding intellectual property rights in the information technology industry. From time to time, third parties claim that one or more of our products or services infringe their intellectual property rights. We analyze and take action in response to each such claim on a case by case basis. A dispute or litigation regarding patents or other intellectual property can be costly and time-consuming due to the complexity of our technology and the inherent uncertainty of intellectual property litigation, could divert our management and key personnel from our business operations, and we may not prevail. A claim of intellectual property infringement could force us to enter into a costly or restrictive license agreement, which might not be available under acceptable terms or at all, or could subject us to significant damages or to an injunction against development and sale of certain of our products or services. Our intellectual property portfolio may not be useful in asserting a counterclaim, or negotiating a license, in response to a claim of intellectual property infringement. In certain of our businesses we rely on third-party intellectual property licenses and we cannot ensure that these licenses will be available to us in the future on favorable terms or at all. Although our policy is to obtain licenses or other rights where necessary, we cannot provide assurance that we have obtained all required licenses or rights.

Third parties may misappropriate or infringe on our intellectual property and we may suffer competitive injury or expend significant resources enforcing our rights.

Our success increasingly depends on our proprietary technology. We rely on various intellectual property rights, including patents, copyrights, database rights, trademarks and trade secrets, as well as contract restrictions, confidentiality provisions and licensing arrangements, to establish our proprietary rights. The extent to which such rights can be protected varies in different jurisdictions. If we do not enforce our intellectual property rights successfully, our competitive position may suffer which could harm our operating results. Our pending patent and trademark applications may not be allowed or competitors may challenge the validity or scope of our intellectual property rights. In addition, our patents, copyrights, trademarks and other intellectual property rights may not provide us a significant competitive advantage.

We may need to devote significant resources, including cybersecurity resources, to monitoring our intellectual property rights and we may or may not be able to detect misappropriation or infringement by third parties. Our competitive position may be harmed if we cannot detect misappropriation or infringement and enforce our intellectual property rights quickly or at all. In some circumstances, enforcement may not be available to us because a third party has a dominant intellectual property position or for other business reasons. In addition, competitors might avoid infringement by designing around our intellectual property rights or by developing non-infringing competing technologies. Intellectual property rights and our ability to enforce them may be unavailable or limited in some countries, which could make it easier for competitors to capture market share and could result in lost revenue.

The U.K.’s departure from the EU could adversely affect us.

We are subject to risks and uncertainties associated with the U.K.’s withdrawal from the EU (referred to as “Brexit”), including implications for the free flow of labor and goods in the U.K. and the EU and other financial, legal, tax and trade implications. Brexit could cause disruptions to and create uncertainty surrounding our business in the U.K., including affecting our relationships with our existing and future customers, suppliers and employees, which could have an adverse effect on our business, financial results and operations. In addition, developments regarding Brexit may also create global economic uncertainty, which may cause our customers, particularly those who do business in the U.K., to closely monitor their costs and reduce their spending on our solutions and services.

We may not be able to borrow under our revolving credit facility and Receivables Facility.

We are party to a $225.0 million receivables funding facility (the “Receivables Facility”) as well as the $1.10 billion unsecured revolving credit facility (the “Revolver”). Our Revolver and Receivables Facility have representations, covenants, financial covenants and events of default which may limit our ability to borrow under such debt obligations. Any breach of a representation or failure to comply with any covenant or financial covenant or the occurrence of any event of default under the Revolver or the Receivables Facility could result in a prohibition of further borrowings under the Revolver and Receivables Facility or acceleration of any obligations outstanding thereunder. Any event of default under the Revolver or Receivables Facility could result in a cross default under our other outstanding debt obligations.

Changes in interest rates could adversely affect our cost of capital and net income.

Rising interest rates, credit market dislocations and decisions and actions by credit rating agencies can affect the availability and cost of our funding and adversely affect our net income.

Our business will suffer if we are not able to retain and hire key personnel.

Our future success, including our ability to implement our technology transformation strategy, depends partly on the continued service of our key development, sales, marketing, executive and administrative personnel. Additionally, increased retention risk exists in certain key areas of our operations, such as IT and data security, which require specialized skills, such as maintenance of certain legacy computer systems, data security experts and analytical modelers. If we fail to retain and hire a sufficient number of these personnel, we will not be able to maintain or expand our business. As part of our technology transformation strategy, we have hired a significant number of new employees and contract workers. Hiring, training, motivating, retaining and managing employees with the skills required is time-consuming and expensive. There is intense competition for certain highly technical specialties in geographic areas where we continue to recruit, and it may become more difficult to retain our key employees. If we are not able to hire sufficient employees to support our technology transformation, or to train, motivate, retain and manage the employees we do hire, it could have a material adverse effect on our business operations or financial results.

Our retirement and post-retirement pension plans are subject to financial market risks that could adversely affect our future results of operations and cash flows.

We have significant retirement and post-retirement pension plan assets and obligations. The performance of the financial markets and interest rates impact our plan expenses and funding obligations. Significant decreases in interest rates, decreases in the fair value of plan assets and investment losses on plan assets will increase our funding obligations, and adversely impact our results of operations and cash flows.

We are subject to other risks and uncertainties inherent in doing business in our industry.

In addition to the specific factors discussed above, we are subject to risks that are inherent to doing business as a global data, analytics and technology company. These include growth rates, general economic and political conditions, customer satisfaction with the quality of our products and services, technological changes, rising costs of employment, costs of obtaining insurance, changes in unemployment rates, and other events that can impact revenue and the cost of doing business in our industry.

Our executive offices are located at 1550 Peachtree Street, N.W., Atlanta, Georgia. Our other properties are geographically distributed to meet sales and operating requirements worldwide. We consider these properties to be both suitable and adequate to meet our current operating requirements. We ordinarily lease office space for conducting our business and are obligated under approximately 85 leases and other rental arrangements for our field locations. We owned 8 office buildings at December 31, 2019, including our executive offices, one campus which houses our Alpharetta, Georgia technology center, a building utilized by our Workforce Solutions operations located in St. Louis, Missouri, as well as three buildings utilized by our Latin America operations.

For additional information regarding our obligations under leases, see Note 6 of the Notes to Consolidated Financial Statements in this Form 10-K. We believe that suitable additional space will be available to accommodate our future needs.

Litigation and Investigations related to the 2017 Cybersecurity Incident

Following the 2017 cybersecurity incident, hundreds of class actions and other lawsuits were filed against us typically alleging harm from the 2017 cybersecurity incident and seeking various remedies, including monetary and injunctive relief. We were also subject to investigations and inquiries by federal, state and foreign governmental agencies and officials regarding the 2017 cybersecurity incident and related matters. As described below, most of these lawsuits and government investigations have concluded or been resolved, including pursuant to the settlement agreements described below, while others remain ongoing. The Company’s participation in these settlements does not constitute an admission by the Company of any fault or liability, and the Company does not admit fault or liability.

Consumer Settlement.

On July 19, 2019 and July 22, 2019, we entered into multiple agreements that resolve the U.S. consolidated consumer class action cases, captioned In re: Equifax, Inc. Customer Data Security Breach Litigation, MDL No. 2800 (Consumer Cases) (the “U.S. Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the MSAG Group and the NYDFS (collectively, the “Consumer Settlement”). Under the terms of the Consumer Settlement, the Company will contribute $380.5 million to a non-reversionary settlement fund (the “Consumer Restitution Fund”) to provide restitution for U.S. consumers identified by the Company whose personal information was compromised as a result of the 2017 cybersecurity incident.

The Consumer Restitution Fund will be used to (1) compensate affected consumers for certain unreimbursed costs or expenditures incurred by affected consumers that are fairly traceable to the 2017 cybersecurity incident, (2) provide affected consumers with an opportunity to enroll in at least four years of credit monitoring services provided by a third party unaffiliated with the Company or alternative compensation for affected consumers who already have other credit monitoring services, (3) provide affected consumers with additional benefits such as identity restoration services and (4) pay reasonable attorneys’ fees and reasonable costs and expenses for the plaintiffs’ counsel in the U.S. Consumer MDL Litigation (not to exceed $80.5 million) and administrative and notice costs.

The Company has agreed to contribute up to an additional $125.0 million to the Consumer Restitution Fund to cover unreimbursed costs and expenditures described in (1) above in the event the $380.5 million in the Consumer Restitution Fund is exhausted.

In accordance with the terms of the Consumer Settlement, in the third quarter of 2019, the Company paid $180.5 million to the MSAG Group and the following monetary penalties: (1) $100.0 million to the CFPB and (2) $10.0 million to the NYDFS. As part of the Consumer Settlement, the Company also agreed to implement certain business practice commitments related to consumer assistance and its information security program, including conducting third party assessments of its information security program.

In the third quarter of 2019, the agreements with the FTC and CFPB were approved by the U.S. District Court for the Northern District of Georgia. The settlement with the MSAG Group, which consists of substantially similar agreements with each of the participating jurisdictions, was approved by courts in the relevant jurisdiction also in the third quarter of 2019.

On January 13, 2020, the Northern District of Georgia, the U.S. District Court overseeing centralized pre-trial proceedings for the U.S. Consumer MDL Litigation and numerous other federal court actions relating to the 2017 cybersecurity incident (the “MDL Court”), entered an order granting final approval of the settlement in connection with the U.S. Consumer MDL Litigation, from which several objectors have appealed. Until the appeals are finally adjudicated or dismissed, we can provide no assurance that the U.S. Consumer MDL Litigation will be resolved as contemplated by the settlement agreement. If the MDL Court’s order approving the settlement were reversed by an appellate court, there is a risk that we would not be able to settle the U.S. Consumer MDL Litigation on acceptable terms or at all, which could have a material adverse effect on our financial condition.

Other Settlements.

Securities Class Action Litigation. A consolidated putative class action lawsuit alleging violations of certain federal securities laws in connection with statements and alleged omissions regarding our cybersecurity systems and controls was filed against us and our former Chairman and Chief Executive Officer in the U.S. District Court for the Northern District of Georgia. The consolidated complaint seeks certification of a class of all persons who purchased or otherwise acquired Equifax securities from February 25, 2016 through September 15, 2017 and unspecified monetary damages, costs and attorneys’ fees. The

Company moved to dismiss the complaint in its entirety. On January 28, 2019, the court dismissed claims against certain individual defendants and claims challenging certain statements, but allowed other claims against Equifax and our former Chairman and Chief Executive Officer to proceed.

On February 12, 2020, we entered into a settlement agreement to resolve the securities class action lawsuit in which the Company agreed to create a settlement fund for the benefit of class members. The settlement is subject to a number of conditions, including certification of a settlement class, notice, and preliminary and final court approvals. We can provide no assurance that all conditions will be satisfied or that the necessary court approvals will be obtained.

Shareholder Derivative Litigation. A consolidated putative shareholder derivative action naming certain of our current and former executives, officers and directors as defendants and naming us as a nominal defendant was filed in the U.S. District Court for the Northern District of Georgia. Among other things, the consolidated complaint alleges claims for breaches of fiduciary duties, unjust enrichment, corporate waste and insider selling by certain defendants, as well as certain claims under the federal securities laws. The complaint seeks unspecified damages on behalf of the Company, plus certain equitable relief. We appointed a committee of independent directors (the “Demand Review Committee”) empowered to evaluate and respond in our best interests to the claims and related litigation demands.

On February 12, 2020, the Company, by and through the Demand Review Committee, and individual defendants entered into a settlement agreement with the plaintiffs which, subject to court approval, will resolve the matter by agreeing to adopt certain governance changes and obtaining an insurance recovery for the Company. We can provide no assurance that the necessary court approvals will be obtained.

Government Lawsuits. Separate civil enforcement actions were filed against us in state court by the respective Attorneys General of Indiana and Massachusetts alleging violations of commonwealth/state consumer protection laws and seeking injunctive relief, civil penalties, restitution, costs and other relief. The Company filed motions to dismiss the actions which were denied. On December 26, 2019, we filed a motion asking the court in the Indiana action to certify its order denying our motion to dismiss for interlocutory appeal, and that motion was granted on February 6, 2019.

The Company has reached an agreement in principle with each of the Attorneys General of Massachusetts and Indiana to resolve their actions. These settlements, in which the Company has agreed to make a monetary payment and to injunctive relief consistent with the MSAG Group settlement, are subject to finalizing definitive settlement agreements and court approval in each respective jurisdiction.

Financial Institutions MDL Class Action. Certain class actions were filed by financial institutions and transferred to the MDL Court (the “Financial Institutions MDL Litigation”). These class actions allege that the financial institutions’ businesses have been placed at risk due to the 2017 cybersecurity incident, generally assert common law claims such as claims for negligence, as well as, in some cases, statutory claims and seek compensatory damages, injunctive relief and other related relief. The Company moved to dismiss the financial institutions’ consolidated class action complaint in its entirety, and the MDL Court dismissed certain claims, while allowing other claims to proceed. The financial institution plaintiffs filed a motion to amend their class action complaint which was granted in part and denied in part on December 18, 2019. The majority of the claims which the financial institutions sought to revive by amendment, however, remained dismissed.

The Company has reached an agreement in principle to enter into a class-wide settlement of the remaining financial institutions’ claims. Upon submission of the final settlement documents and necessary court approvals, the settlement will resolve any remaining claims that could be asserted by the financial institutions before the MDL Court. The settlement contemplates payment for claims up to a maximum amount and certain non-monetary relief. The settlement is subject to a number of conditions, including notice, and preliminary and final court approvals. We can provide no assurance that all conditions will be satisfied or that the necessary court approvals will be obtained.

Pennsylvania State Court Financial Institution Class Action. One of the initial named plaintiffs in Financial Institutions MDL Litigation filed a purported class action suit against us in the Court of Common Pleas of Lawrence County, Pennsylvania on behalf of financial institutions headquartered in Pennsylvania. The claims being asserted in this matter are substantially similar to claims that previously were dismissed in the MDL proceeding for lack of standing. We filed preliminary objections to the complaint on September 5, 2019, and a hearing on the preliminary objections is scheduled for June 29, 2020. The Company has reached an agreement in principle to resolve this matter. The settlement is subject to court approval, and we can provide no assurance that the necessary court approval will be obtained.

Indian Tribes Class Actions and City of Chicago Lawsuit. Three Indian Tribes and the City of Chicago filed separate suits with respect to the 2017 cybersecurity incident, which were subsequently transferred to the MDL Court. The Indian Tribes brought their claims purportedly on behalf of themselves and other similarly situated federally recognized Indian Tribes and

Nations. The Company has reached an agreement in principle to resolve the three Indian Tribes’ claims as well as an agreement in principle to resolve the City of Chicago’s lawsuit.

Other Matters.

We face other lawsuits and government investigations related to the 2017 cybersecurity incident that have not yet been concluded or resolved. These ongoing matters may result in judgments, fines or penalties, settlements or other relief. We dispute the allegations in the remaining lawsuits and intend to defend against such claims. Set forth below are descriptions of the main categories of these matters.

Georgia State Court Consumer Class Actions. Four putative class actions arising from the 2017 cybersecurity incident were filed against us in Fulton County Superior Court and Fulton County State Court in Georgia based on similar allegations and theories as alleged in the U.S. Consumer MDL Litigation and seek monetary damages, injunctive relief and other related relief on behalf of Georgia citizens. These cases were transferred to a single judge in the Fulton County Business Court and three of the cases were consolidated into a single action. On July 27, 2018, the Fulton County Business Court granted the Company’s motion to stay the remaining single case, and on August 17, 2018, the Fulton County Business Court granted the Company’s motion to stay the consolidated case. These cases remain stayed pending resolution of the U.S. Consumer MDL Litigation.

Canadian Class Actions. Eight Canadian class actions, six of which are on behalf of a national class of approximately 19,000 Canadian consumers, have been filed against us in Ontario, Saskatchewan, Quebec, British Columbia and Alberta. Each of the proposed Canadian class actions asserts a number of common law and statutory claims seeking monetary damages and other related relief in connection with the 2017 cybersecurity incident. The plaintiffs in each case seek class certification/authorization on behalf of Canadian consumers whose personal information was allegedly impacted by the 2017 cybersecurity incident. In some cases, plaintiffs also seek class certification on behalf of a larger group of Canadian consumers who had contracts for subscription products with Equifax around the time of the incident or earlier and were not impacted by the incident.

On October 21, 2019, the court in the Quebec case dismissed the plaintiff’s motion for authorization to institute a class action. On December 13, 2019, the court in the active Ontario case granted certification of a nationwide class that includes impacted Canadians as well as Canadians who had subscription products with Equifax between March 7, 2017 and July 30, 2017. We have sought leave to appeal this decision. All remaining purported class actions are at preliminary stages. In addition, one of the cases in Ontario as well as the Saskatchewan case have been stayed. The court’s order staying the Saskatchewan case is on appeal.

Individual Consumer Litigation. We have several hundred individual consumer actions pending against us in state (general jurisdiction and small claims) and federal courts across the U.S. related to the 2017 cybersecurity incident. The plaintiffs/claimants in these cases have generally claimed to have been harmed by alleged actions and/or omissions by Equifax in connection with the 2017 cybersecurity incident and assert a variety of common law and statutory claims seeking primarily monetary damages. Where possible, actions filed in or removed to federal court were noticed for transfer to the MDL Court. We believe that many of the remaining individual consumer actions will be subject to the settlement in the U.S. Consumer MDL Litigation discussed above, unless the individual consumers submitted a valid and timely request to be excluded from the settlement.

Government Investigations. We have cooperated with federal, state and foreign governmental agencies and officials investigating or otherwise seeking information, testimony and/or documents, regarding the 2017 cybersecurity incident and related matters.

The FCA opened an enforcement investigation against our U.K. subsidiary, Equifax Limited, in October 2017. The investigation by the FCA has involved a number of information requirements and interviews. We continue to respond to the information requirements and are cooperating with the investigation.

The New York State Attorney General Investor Protection Bureau (“IPB”) issued a subpoena in September 2017 relating to its investigation of whether there has been a violation of the Martin Act. We have cooperated with the IPB in its investigation, and the IPB has not contacted us regarding the investigation since January 2019.

Although we continue to cooperate in the above investigations and inquiries, an adverse outcome to any such investigations and inquiries could subject us to fines or other obligations, which may have an adverse effect on how we operate our business or our results of operations.

ACCC Investigation

In March 2017, the ACCC commenced an investigation to determine whether the Company has been or is engaged in unlawful acts or practices relating to advertising, marketing and sale of consumer reports, credit scores or credit monitoring products in violation of the Australian Consumer Law, which prohibits misleading or deceptive conduct and false representations. The ACCC issued a number of notices to produce documents and information. On March 16, 2018, the ACCC commenced proceedings against the Company. The proceedings were settled on October 2, 2018. Pursuant to the settlement, Equifax paid a monetary penalty and provided refunds to certain impacted consumers. As it was not possible to refund all impacted customers, Equifax has undertaken to the ACCC to refund those customers if and when their current address and/or bank account details become known. The proceedings formally concluded on November 30, 2019.

California Bankruptcy Litigation

In consolidated actions filed in the U.S. District Court for the Central District of California, captioned Terri N. White, et al. v. Equifax Information Services LLC, Jose Hernandez v. Equifax Information Services LLC, Kathryn L. Pike v. Equifax Information Services LLC, and Jose L. Acosta, Jr., et al. v. Trans Union LLC, et al., plaintiffs asserted that Equifax violated federal and state law (the FCRA, the California Credit Reporting Act and the California Unfair Competition Law) by failing to follow reasonable procedures to determine whether credit accounts are discharged in bankruptcy, including the method for updating the status of an account following a bankruptcy discharge. On August 20, 2008, the District Court approved a Settlement Agreement and Release providing for certain changes in the procedures used by defendants to record discharges in bankruptcy on consumer credit files. That settlement resolved claims for injunctive relief, but not plaintiffs’ claims for damages. On May 7, 2009, the District Court issued an order preliminarily approving an agreement to settle remaining class claims. The District Court subsequently deferred final approval of the settlement and required the settling parties to send a supplemental notice to those class members who filed a claim and objected to the settlement or opted out, with the cost for the re-notice to be deducted from the plaintiffs’ counsel fee award. Mailing of the supplemental notice was completed on February 15, 2011 and the deadline for this group of settling plaintiffs to provide additional documentation to support their damage claims or to opt-out of the settlement was March 31, 2011. On July 15, 2011, the District Court approved the settlement. Several objecting plaintiffs subsequently filed notices of appeal to the U.S. Court of Appeals for the Ninth Circuit, which, on April 22, 2013, issued an order vacating the settlement and remanding the case to the District Court for further proceedings. On January 21, 2014, the District Court denied the objecting plaintiffs’ motion to disqualify counsel for the settling plaintiffs and granted the motion of counsel for the settling plaintiffs to be appointed as interim lead class counsel. On March 28, 2016, the U.S. Court of Appeals for the Ninth Circuit affirmed the District Court’s lead counsel appointment. On January 9, 2017, the United States Supreme Court denied the objectors’ Petition for a Writ of Certiorari. The parties re-engaged in settlement discussions, including participation in mediations in August 2016 and November 2016, and reached an agreement to again settle the monetary claims. Settlement documents were filed with the District Court on April 14, 2017. On June 16, 2017, the Court granted preliminary approval of the proposed settlement, conditionally certified the settlement class, and appointed class counsel and administrator. A Final Fairness Hearing was held on December 11, 2017 and on April 6, 2018, the Court granted final approval. A Notice of Appeal was filed on May 7, 2018. Following the Notice of Appeal, the parties reached a Stipulation Regarding Attorneys’ Fees and Costs with the District Court subject to affirmance of the settlement with the U.S. Court of Appeals for the Ninth Circuit. On December 12, 2019, the Ninth Circuit affirmed the settlement and remanded to the District Court for recalculation of the attorneys’ fee award to class counsel. On January 10, 2020, the objecting plaintiffs filed a Petition for Rehearing and Rehearing En Banc which was denied.

Other

Equifax has been named as a defendant in various other legal actions, including administrative claims, regulatory matters, government investigations, class actions and other litigation arising in connection with our business. Some of the legal actions include claims for substantial compensatory or punitive damages or claims for indeterminate amounts of damages. We believe we have defenses to and, where appropriate, will contest, many of these matters. Given the number of these matters, some are likely to result in adverse judgments, penalties, injunctions, fines or other relief. We may explore potential settlements before a case is taken through trial because of the uncertainty and risks inherent in the litigation process.

For information regarding our accounting for legal contingencies, see Note 6 of the Notes to Consolidated Financial Statements in this Form 10-K.

As used herein, the terms Equifax, the Company, we, our and us refer to Equifax Inc., a Georgia corporation, and its consolidated subsidiaries as a combined entity, except where it is clear that the terms mean only Equifax Inc.

All references to earnings per share data in Management’s Discussion and Analysis, or MD&A, are to diluted earnings per share, or EPS, unless otherwise noted. Diluted EPS is calculated to reflect the potential dilution that would occur if stock options or other contracts to issue common stock were exercised and resulted in additional common shares outstanding.

BUSINESS OVERVIEW

Equifax Inc. is a global data, analytics and technology company. We provide information solutions and human resources business process outsourcing services for businesses, governments and consumers. We have a large and diversified group of clients, including financial institutions, corporations, governments and individuals. Our services are based on comprehensive databases of consumer and business information derived from numerous sources including credit, financial assets, telecommunications and utility payments, employment, income, demographic and marketing data. We use advanced statistical techniques, machine learning and proprietary software tools to analyze available data to create customized insights, decision-making solutions and processing services for our clients. We also provide information, technology and services to support debt collections and recovery management. Additionally, we are a leading provider of payroll-related and human resource management business process outsourcing services in the United States of America, or U.S. For consumers, we provide products and services to help people understand, manage and protect their personal information and make more informed financial decisions.

We currently operate in four global regions: North America (U.S. and Canada), Asia Pacific (Australia, New Zealand and India), Europe (the United Kingdom, or U.K., Spain and Portugal) and Latin America (Argentina, Chile, Costa Rica, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru and Uruguay). We maintain support operations in the Republic of Ireland, Chile, Costa Rica and India. We also offer Equifax branded credit services in Russia through a joint venture, have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia, Singapore and the United Arab Emirates, have an investment in a consumer and commercial credit information company in Brazil and have an investment in an identity authentication company in Canada.

2017 Cybersecurity Incident

In 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of certain personally identifiable information of U.S., Canadian and U.K. consumers. Criminals exploited a software vulnerability in a U.S. website application to gain unauthorized access to our network. In March 2017, the U.S. Department of Homeland Security distributed a notice concerning the software vulnerability. We undertook efforts to identify and remediate vulnerable systems; however, the vulnerability in the website application that was exploited was not identified by our security processes. We discovered unusual network activity in late-July 2017 and upon discovery promptly investigated the activity. Once the activity was identified as potential unauthorized access, we acted to stop the intrusion and engaged a leading, independent cybersecurity firm to conduct a forensic investigation to determine the scope of the unauthorized access, including the specific information impacted. Based on our forensic investigation, the unauthorized access occurred from mid-May 2017 through July 2017. No evidence was found that the Company’s core consumer, employment and income, or commercial reporting databases were accessed. We continue to cooperate with law enforcement in connection with the criminal investigation into the actors responsible for the 2017 cybersecurity incident. On February 10, 2020, the U.S. Department of Justice announced that four members of the Chinese People’s Liberation Army were indicted on criminal charges for their involvement in the 2017 cybersecurity incident.

Product Liability. As a result of the 2017 cybersecurity incident, we offered TrustedID® Premier, a credit file monitoring and identity theft protection product, for free to all eligible U.S. consumers who signed up through January 31, 2018. In late 2018, the Company extended the free credit monitoring services for an additional twelve months for eligible consumers impacted by the 2017 cybersecurity incident by providing them the opportunity to enroll in Experian® IDNotify™ at no cost. We also provided free credit reports and scores, credit monitoring and identity theft protection for twenty four months to impacted consumers in Canada and the U.K. We have recorded the expenses necessary to provide this service to those who signed up. The remaining product liability balance at December 31, 2019 and 2018 was not material to the Consolidated Financial Statements.

Litigation, Claims and Government Investigations. As a result of the 2017 cybersecurity incident, we were subject to a significant number of proceedings and investigations as described in Part I, “Item 3. Legal Proceedings” in this Form 10-K. We recorded expenses, net of insurance recoveries, of $800.9 million in other current liabilities and selling, general, and administrative expenses in our Consolidated Balance Sheets and Statements of (Loss) Income, respectively, as of and for the twelve months ended December 31, 2019, exclusive of our legal and professional services expenses. The amount accrued represents our best estimate of the liability related to these matters. The Company will continue to evaluate information as it becomes known and adjust accruals for new information and further developments in accordance with ASC 450-20-25.

Future Costs. We are currently executing substantial initiatives in security and consumer support, and a company-wide transformation of our technology infrastructure, which we refer to as our technology transformation, and incurred substantial increased expenses and capital expenditures in 2019 related to these initiatives. We expect to continue to incur significant expenses and capital expenditures in 2020 related to these initiatives, at similar levels as those incurred in 2019.

We incurred significant legal and professional services expenses related to the lawsuits, claims and government investigations to which we were a party in 2019, and expect to continue to incur these expenses until all matters are fully resolved. However, we expect that the level of legal and professional service expenses related to these matters will be significantly lower in 2020 due to the settlement of all of the significant matters in the U.S.

We will recognize the expenses and capital expenditures referenced herein as they are incurred.

Insurance Coverage. At the time of the 2017 cybersecurity incident, we had $125.0 million of cybersecurity insurance coverage, above a $7.5 million deductible, to limit our exposure to losses such as those related to this incident. Since the announcement of the 2017 cybersecurity incident in September 2017, we have received the maximum reimbursement under the insurance policy of $125.0 million. We also maintained a directors and officers insurance policy of which we have recorded our estimated maximum recoveries as of December 31, 2019.

Segment and Geographic Information

Segments. The USIS segment, the largest of our four segments, consists of three service lines: Online Information Solutions, Mortgage Solutions, and Financial Marketing Services. Online Information Solutions and Mortgage Solutions revenue is principally transaction-based and is derived from our sales of products such as consumer and commercial credit reporting and scoring, identity management, fraud detection and modeling services. USIS also markets certain decisioning software services which facilitate and automate a variety of consumer and commercial credit-oriented decisions. Financial Marketing Services revenue is principally project and subscription based and is derived from our sales of batch credit and consumer wealth information such as those that assist clients in acquiring new customers, cross-selling to existing customers and managing portfolio risk.

The Workforce Solutions segment consists of the Verification Services and Employer Services business lines. Verification Services revenue is transaction-based and is derived primarily from employment and income verification. Employer Services revenue is derived from our provision of certain human resources business process outsourcing services that include both transaction and subscription based product offerings. These services include unemployment claims management, employment-based tax credit services and other complementary employment-based transaction services.

The International segment consists of Asia Pacific, Europe, Latin America and Canada. Canada’s services are similar to our USIS offerings. Asia Pacific, Europe and Latin America are made up of varying mixes of service lines that are generally in our USIS reportable segment. We also provide information and technology services to support lenders and other creditors in the collections and recovery management process.

Global Consumer Solutions revenue is both transaction and subscription based and is derived from the sale of credit monitoring and identity theft protection products, which we deliver electronically to consumers primarily via the internet in the U.S., Canada, and the U.K. We also sell consumer and credit information to resellers who combine our information with other information to provide direct-to-consumer monitoring, reports and scores. Due to the 2017 cybersecurity incident, we ceased advertising our consumer business in the U.S. in September 2017. We resumed advertising our U.S. paid products in the fourth quarter of 2018.

Geographic Information. We currently have operations in the following countries: Argentina, Australia, Canada, Chile, Costa Rica, Ecuador, El Salvador, Honduras, India, Mexico, New Zealand, Paraguay, Peru, Portugal, the Republic of Ireland, Spain, the U.K., Uruguay and the U.S. We also offer Equifax branded credit services in Russia through a joint venture, have investments in consumer and/or commercial credit information companies through joint ventures in Cambodia, Malaysia,

Singapore and the United Arab Emirates, have an investment in a consumer and commercial credit information company in Brazil and have an investment in an identity authentication company in Canada. Approximately 73% and 71% our revenue was generated in the U.S. during both of the twelve months ended December 31, 2019 and 2018, respectively.

Key Performance Indicators. Management focuses on a variety of key indicators to monitor operating and financial performance. These performance indicators include measurements of operating revenue, change in operating revenue, operating income, operating margin, net income, diluted earnings per share, cash provided by operating activities and capital expenditures. Key performance indicators for the twelve months ended December 31, 2019, 2018 and 2017, include the following:

(In millions, except per share data)

*Amounts above include accruals for capital expenditures.

Business Environment and Company Outlook

Demand for our services tends to be correlated to general levels of economic activity and to consumer credit activity, small commercial credit and marketing activity. Demand is also enhanced by our initiatives to expand our products, capabilities, and markets served. In the United States, we expect 2020 economic activity, as measured by GDP, to be down from 2019. We expect modest growth in consumer credit, excluding mortgage, over the course of 2020. U.S. mortgage market inquiries are expected to be approximately flat in 2020 versus 2019, with strong growth in inquiries in the first half of 2020, offset by a decline in inquiries in the second half of 2020. We anticipate 2020 economic activity, as measured by GDP, in Canada to be slightly below 2019. In Australia, we anticipate 2020 economic activity, as measured by GDP, to be up from 2019. In the European markets we serve, the U.K., Spain and Portugal, we are expecting 2020 economic activity, as measured by GDP, to be down or slightly below 2019. In Latin America, our two largest markets are Argentina and Chile. In Argentina, the market continued to weaken in 2019. We are expecting continued weakness in 2020 but at lower levels than in 2019. In Chile, we are expecting economic activity in 2020 to be down slightly compared to 2019. Additional uncertainty exists in Argentina due to the Argentinean political environment and in the U.K. due to the impact of Brexit in the U.K.

In 2019 and beyond, we have incurred and will continue to incur increased costs and capital expenditures related to our technology transformation, which includes costs for enhanced data security. In 2019 and beyond, we had and will continue to have increases in the ongoing run-rate of technology and security spending. We also expect to continue to incur increased expenses for insurance, finance, compliance activities, and to meet increased legal and regulatory requirements. The ultimate amount of these increases is expected to be significant.

As a result of the 2017 cybersecurity incident, we were subject to a significant number of proceedings and investigations as described in “Item 3. Legal Proceedings” in this Form 10-K. We recorded expenses, net of insurance recoveries, of $800.9 million in other current liabilities and selling, general, and administrative expenses in our Consolidated Balance Sheets and Statements of (Loss) Income, respectively, as of and for the twelve months ended December 31, 2019, exclusive of our legal and professional services expenses. The amount accrued represents our best estimate of the liability related to these matters. The Company will continue to evaluate information as it becomes known and adjust accruals for new information and further developments in accordance with ASC 450-20-25. While it is reasonably possible that losses exceeding the amount accrued may be incurred, it is not possible at this time to estimate the additional possible loss in excess of the amount already accrued that might result from adverse judgments, settlements, penalties or other resolution of the proceedings and investigations described in “Item 3. Legal Proceedings” in this Form 10-K based on a number of factors, such as the various stages of these proceedings and investigations, including matters on appeal, that alleged damages have not been specified or are uncertain, the uncertainty as to the certification of a class or classes and the size of any certified class, as applicable, and the lack of resolution on significant factual and legal issues. As such, as of any given date, we could have exposure to losses as to which no liability has been accrued or as to which the accrued liability is inadequate. The ultimate amount paid on these actions, claims and investigations in excess of the amount already accrued could be material to the Company’s consolidated financial condition, results of operations, or cash flows in future periods.

RESULTS OF OPERATIONS —

TWELVE MONTHS ENDED DECEMBER 31, 2019, 2018 AND 2017

Consolidated Financial Results

Operating Revenue

(In millions)

Revenue for 2019 increased by 3% compared to 2018. The growth was driven by our Workforce Solutions and USIS segments which was partially offset by declines in International and Global Consumer Solutions. Workforce Solutions saw strong growth driven by Verification Services. USIS growth was primarily driven by increases in core credit decisioning volumes and revenue from acquisitions. International had local currency growth across Latin America and Canada. The effect of foreign exchange rates reduced revenue by $74.7 million, or 2%, in 2019 compared to 2018. Global Consumer Solutions revenue decreased primarily due to decreases in consumer direct revenue in the U.S. and the U.K.

Revenue for 2018 increased by 1% compared to 2017. The growth was driven by our Workforce Solutions and International segments which was partially offset by declines in USIS and Global Consumer Solutions which were negatively impacted by the 2017 cybersecurity incident. Workforce Solutions saw strong growth driven by Verification Services. International had local currency growth across all regions. The effect of foreign exchange rates reduced revenue by $28.3 million, or 1%, in 2018 compared to 2017.

Operating Expenses

(In millions)

Cost of Services. Cost of services increased $81.3 million in 2019 compared to 2018. The increase is due to increased royalty and technology costs. We also incurred increased incremental technology and data security costs of $20.3 million in

2019. These increased technology and security costs predominantly reflect the investments we are making in our technology transformation, which include costs for enhanced data security. We expect these incremental costs as well as increased ongoing technology and security costs to continue in 2020. The effect of changes in foreign exchange rates reduced cost of services by $33.2 million.

Cost of services increased $229.7 million in 2018 compared to 2017. We incurred increased technology and data security costs of $146.5 million in 2018. These increased technology and security costs predominantly reflect the investments we are making in our technology transformation, which include costs for enhanced data security. The remaining increase is due to increased people and royalty costs. The effect of changes in foreign exchange rates reduced cost of services by $6.4 million.

Selling, General and Administrative Expenses. Selling, general and administrative expenses increased $776.9 million in 2019 compared to 2018.

The increase in 2019 is primarily due to losses, net of insurance recoveries, of $800.9 million associated with certain legal proceedings and government investigations related to the 2017 cybersecurity incident. The impact of changes in foreign currency exchange rates decreased our selling, general and administrative expenses by $24.4 million.

Selling, general and administrative expenses increased $181.3 million in 2018 as compared to 2017.

We incurred increased incremental technology and data security costs of $160.7 million in 2018. As was the case in cost of services, these increased technology and security costs predominately reflect the investments we are making in our technology transformation, which include costs for enhanced data security. The remaining changes were driven by increases due to the restructuring charge of $46.1 million, people, the public records litigation settlement of $18.5 million and insurance costs which were partially offset by decreased advertising costs. The impact of changes in foreign currency exchange rates decreased our selling, general and administrative expenses by $10.2 million.

Depreciation and Amortization. Depreciation and amortization expense for 2019 and 2018 increased by $20.7 million and $22.6 million, respectively. The increase is due to amortization of capitalized internal-use software and systems costs and depreciation of production equipment, partially offset by a decrease in amortization of purchased intangibles.

Operating Income and Operating Margin

(In millions)

Total company operating margin decreased in 2019 versus 2018, primarily due to losses, net of insurance recoveries, of $800.9 million associated with certain legal proceedings and government investigations related to the 2017 cybersecurity incident which are reflected in selling, general, and administrative expenses in our Consolidated Statements of (Loss) Income.

Total company operating margin decreased in 2018 versus 2017, primarily due to the aforementioned technology and data security spending by the Company after the 2017 cybersecurity incident of $326.2 million reflected in costs of services and selling, general, and administrative expenses in our Consolidated Statements of (Loss) Income.

Interest Expense and Other Income (Expense), net

(In millions)

Interest expense increased in 2019, when compared to 2018, due to an increase in our overall debt outstanding during the year due to borrowings on our Receivables Facility and under our commercial paper program. These borrowings were paid down with the proceeds from the issuance of the $750.0 million Senior Notes in November 2019.

Interest expense increased in 2018, when compared to 2017, due to an increase in our overall average cost of debt resulting from the issuance of the 3.60%, Floating Rate and 3.95% Senior Notes in May 2018.

The increase in other income, net in 2019 is primarily due to higher earnings on certain equity method investments and partially offset by an increased loss related to the foreign exchange impact of remeasuring the peso denominated monetary assets and liabilities as a result of Argentina becoming a highly inflationary economy for accounting purposes starting in July 2018.

The increase in other income, net in 2018 is primarily due to higher earnings on certain equity method investments, an increase in interest income, and the release of a liability from a past acquisition. These increases were partially offset by increased pension expense and the foreign exchange impact of remeasuring the peso denominated monetary assets and liabilities as a result of Argentina becoming a highly inflationary economy for accounting purposes in 2018.

Income Taxes

(In millions)

Our effective tax rate was 9.3% for 2019, down from 14.0% for the same period in 2018. Our effective tax rate is lower for the year ended December 31, 2019 compared to 2018 due to the operating loss of the Company in 2019 and permanent tax differences resulting from certain non-deductible amounts related to the accrual for losses associated with certain legal proceedings and government investigations related to the 2017 cybersecurity incident.

Our effective tax rate was 14.0% for 2018, down from 19.9% for the same period in 2017. The decrease in our effective income tax rate is due to the decrease in the statutory U.S. tax rate as a result of the Tax Act enacted in the fourth quarter of 2017 and the increase in the benefit received from the reversal of uncertain tax positions. These changes were offset by an increase in the impact of equity compensation, an increase in the foreign rate differential impact, and the deferred tax benefit recorded in the fourth quarter of 2017 to reflect the impact of the Tax Act.

Net (Loss) Income

(In millions, except per share amounts)

Consolidated net (loss) income decreased by $699.1 million in 2019 compared to 2018 due to decreased operating income primarily driven by losses, net of insurance recoveries, associated with certain legal proceedings and government investigations related to the 2017 cybersecurity incident of $800.9 million.

Consolidated net (loss) income decreased by $291.7 million, or 49%, in 2018 compared to 2017 due to decreased operating income primarily driven by the $326.2 million of aforementioned incremental technology and data security costs. Net income was benefitted by the decrease in the statutory U.S. tax rate as a result of the Tax Act enacted in the fourth quarter of 2017.

Segment Financial Results

U.S. Information Solutions

(In millions)

U.S. Information Solutions revenue increased 2% in 2019 compared to 2018 due to increases in our core credit decisioning services volumes and revenue from acquisitions, partially offset by $20.0 million in settlements with commercial customers and declines in Mortgage Solutions.

U.S. Information Solutions revenue decreased 1% in 2018 compared to 2017 due to declines in our core credit decisioning services and lower project related revenue as well as the negative impact from the 2017 cybersecurity incident.

These declines were partially offset by revenue from a 2018 acquisition, growth in core mortgage, and revenue from mortgage channel partners.

Online Information Solutions. Revenue for 2019 increased 5% compared to 2018, due to increases in core credit decisioning services volumes, revenue from acquisitions and our identity and fraud solutions business. These increases were partially offset by a $15.0 million settlement with a commercial customer.

Revenue for 2018 decreased 1% compared to 2017, due to declines in our core credit decisioning services and identity and fraud solutions revenue. These declines were partially offset by growth from a 2018 acquisition and revenue from mortgage, auto, and direct to consumer channel partners.

Mortgage Solutions. Revenue decreased 11% in 2019 compared to 2018, primarily due to channel shift between our Mortgage Solutions and Online Information Solutions businesses, partially offset by an increase in mortgage market transaction volumes.

Revenue increased 3% in 2018 compared to 2017, primarily due to a new product offering. This growth was partially offset by declines in the mortgage market and our other mortgage product offerings.

Financial Marketing Services. Revenue remained flat in 2019 compared to 2018 due to an increase in project related revenue, offset by a $5.0 million settlement with a commercial customer.

Revenue decreased 4% in 2018 compared to 2017 due to a reduction in projects delivered.

U.S. Information Solutions Operating Margin. USIS operating margin decreased to 33.1% in 2019 compared to 35.4% in 2018, primarily due to increases in royalties, technology, data security and people costs and settlements with commercial customers. These increases were partially offset by the public records litigation settlement of $18.5 million in 2018 that did not recur in 2019. USIS operating margin decreased to 35.4% in 2018 compared to 42.7% in 2017, primarily due to the decrease in revenue and increases in incremental technology and data security costs, royalties, and the public records litigation settlement.

Workforce Solutions

(In millions)

Workforce Solutions revenue increased by 15% in 2019 compared to 2018 due to strong growth in Verification Services which was partially offset by decreased revenue in our tax management services and our Affordable Care Act compliance services.

Workforce Solutions revenue increased by 8% in 2018 compared to 2017 due to strong growth in Verification Services, partially offset by decreased revenue in unemployment claims.

Verification Services. Revenue increased 23% in 2019 compared to 2018, due to strong growth in mortgage, government, financial, healthcare and talent solutions verticals, and continued addition of new records to The Work Number database.

Revenue increased 13% in 2018 compared to 2017, due to strong growth in government, mortgage, talent solutions, and healthcare verticals, and continued addition of new records to The Work Number database.

Employer Services. Revenue decreased 4% in 2019 compared to 2018 due to declines in our tax management services and Affordable Care Act compliance services. These declines were partially offset by revenue from acquisitions.

Revenue decreased 1% in 2018 compared to 2017 due to declines in our unemployment claims services, workforce analytics and our other employer services. These declines were partially offset by growth from our 2018 acquisitions.

Workforce Solutions Operating Margin. Operating margin increased to 41.0% in 2019 compared to 40.2% in 2018 primarily due to the increase in revenue. Operating margin decreased to 40.2% in 2018 compared to 43.4% in 2017 due to increases in people, incremental technology and data security, and royalty costs.

International

(In millions)

International revenue decreased by 5% in 2019 as compared to 2018. Local currency revenue growth for 2019 was 3%, driven by growth in the Latin America and Canada regions. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $73.1 million, or 8%.

International revenue increased by 4% in 2018 as compared to 2017. Local currency revenue growth for 2018 was 7%, driven by growth across all regions. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $29.5 million, or 3%.

Asia Pacific. Local currency revenue decreased 1% in 2019 as compared to 2018 primarily driven by weak consumer and commercial lending markets in Australia resulting in declines in consumer lending and direct-to-consumer related revenue. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $21.5 million, or 7%, in 2019. Reported revenue decreased 8% in 2019 as compared to 2018.

Local currency revenue growth was 8% in 2018 primarily due to the Mercury acquisition and growth in our commercial business. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $8.8 million, or 3%, in 2018 as compared to 2017. Reported revenue increased 5% in 2018 as compared to 2017.

Europe. Local currency revenue was flat in 2019 as compared to 2018 primarily due to growth in credit operations revenue in U.K. and Spain offset by a decline in our debt management services. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $12.9 million, or 4%, for 2019. Reported revenue decreased 4% in 2019 as compared to 2018.

Local currency revenue growth was 1% in 2018 as compared to 2017 primarily due to growth in U.K. and Spain credit operations revenue and was partially offset by a decline in our debt management services. Local currency fluctuations against the U.S. dollar positively impacted revenue by $10.0 million, or 4%, for 2018. Reported revenue increased 5% in 2018 as compared to 2017.

Latin America. Local currency revenue increased 9% in 2019 as compared to 2018 driven by core growth primarily in Argentina, Chile and Ecuador. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $35.0 million, or 17%, in 2019, primarily from Argentina and Chile. Reported revenue decreased 8% in 2019 as compared to 2018.

Local currency revenue increased 11% in 2018 as compared to 2017 driven by core growth primarily in Argentina, Chile and Ecuador. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $30.8 million, or 14%, in 2018, most notably due to depreciation in the foreign exchange rate of the Argentine peso. Reported revenue increased 3% in 2018 as compared to 2017.

Canada. Local currency revenue increased 8% in 2019 as compared to 2018 primarily due to broad based revenue growth including growth from acquisitions. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $3.7 million, or 3%, in 2019. Reported revenue increased 5% in 2019 as compared to 2018.

Local currency revenue increased 8% in 2018 as compared to 2017 primarily due to broad based revenue growth. Local currency fluctuations against the U.S. dollar negatively impacted revenue by $0.1 million in 2018. Reported revenue increased 8% in 2018 as compared to 2017.

International Operating Margin. Operating margin decreased to 10.4% in 2019 as compared to 11.2% in 2018. The reduced margin is due to increased production costs and negative impacts from foreign currency exchange rates. Operating margin decreased to 11.2% in 2018 as compared to 18.2% in 2017. The reduced margin is due to an increase in incremental technology and data security, people, and production costs as well as depreciation and amortization. These increased costs were positively impacted by foreign currency fluctuations during the year.

Global Consumer Solutions

(In millions)

Revenue decreased 3% for 2019 in reported and local currency revenue, as compared to 2018. The decrease in revenue is primarily due to a decrease in our consumer direct revenue in the U.S. as we ceased advertising our consumer paid products in the U.S. in September 2017 following the 2017 cybersecurity incident. We resumed advertising our U.S. consumer paid products in the fourth quarter of 2018. These decreases were partially offset by an increase in our partner revenue. Local currency fluctuations against the U.S. dollar negatively impacted revenue in Canada and the U.K. by $1.6 million for 2019.

Operating margin decreased in 2019 to 13.4% compared to 18.4% in 2018, due to the decreased revenue and an increase in advertising and production costs which were partially offset by decreased people costs.

Revenue decreased 8% for 2018 in reported and local currency revenue, as compared to 2017. The decrease in revenue is due to a decrease in our consumer direct revenue in the U.S. as we ceased advertising our consumer paid products in the U.S. in September 2017 following the 2017 cybersecurity incident and the U.K. as we were impacted by the Global Data Protection Regulations in the U.K. These decreases were partially offset by an increase in our partner revenue, which includes revenue from the ID Watchdog acquisition. We resumed advertising our U.S. consumer paid products in the fourth quarter of 2018. Local currency fluctuations against the U.S. dollar positively impacted revenue by $1.2 million for 2018.

Operating margin decreased in 2018 to 18.4% compared to 26.4% in 2017, due to the decreased revenue and an increase in incremental technology and data security costs which were partially offset by decreased advertising costs.

General Corporate Expense

(In millions)

Our general corporate expenses are unallocated costs that are incurred at the corporate level and include those expenses impacted by corporate direction, including shared services, technology, administrative, legal, restructuring, and the portion of management incentive compensation determined by total company-wide performance.

General corporate expense increased $789.4 million in 2019. The increase in 2019 as compared to 2018 is primarily due to losses, net of insurance recoveries, of $800.9 million associated with certain legal proceedings and government investigations related to the 2017 cybersecurity incident.

General corporate expense increased $188.8 million in 2018. We incurred increased incremental technology and data security costs following the announcement of the 2017 cybersecurity incident of $186.7 million in 2018. This was partially offset by a decrease in legal and investigative fees and the costs to fulfill and support the free credit monitoring service provided to eligible consumers of $75.2 million in 2018. Further, we benefited from an increase in the recognition of insurance proceeds of $75.0 million to offset these costs in 2018, versus the $50.0 million of insurance proceeds recorded in 2017. Additionally, we recorded $46.1 million of restructuring charges in 2018 which primarily relate to a reduction of headcount. The remaining increase is due to people and insurance costs.

LIQUIDITY AND FINANCIAL CONDITION

Management assesses liquidity in terms of our ability to generate cash to fund operating, investing and financing activities. We continue to generate substantial cash from operating activities, remain in a strong financial position, and manage our capital structure to meet short- and long-term objectives including reinvestment in existing businesses and strategic acquisitions.

Sources and Uses of Cash

Funds generated by operating activities, our Revolver and related commercial paper program and our Receivables Facility, more fully described below, are our most significant sources of liquidity. The Company has and expects to make payments to resolve certain legal proceedings and investigations related to the 2017 cybersecurity incident, described more fully in “Item 3. Legal Proceedings” in this Form 10-K. In 2019, the Company made payments of $341.5 million principally related to the Consumer Settlement comprised of $180.5 million to the MSAG Group, $100.0 million to the CFPB, $25.2 million to the Consumer Restitution Fund and $10.0 million to the NYDFS. The remaining $355.3 million to be paid to the Consumer Restitution Fund will be made after a final adjudication affirming the U.S. Consumer MDL Litigation Settlement or dismissal of the pending appeals. Although we expect this payment and the remaining settlement payments to be made in 2020, we can give no assurance that these payments will occur in 2020 due to pending approvals or appeals. As a result of the possible payments that could be made in 2020 related to the losses associated with certain legal proceedings and government investigations related to the 2017 cybersecurity incident, funds generated by operating activities are not expected to be sufficient to fund working capital and other cash requirements throughout 2020. Our plan is to finance the payments with existing borrowing capacity, including under our Revolver. At December 31, 2019, $1.10 billion was available to borrow under our Revolver. As of December 31, 2019, $221.7 million was available to borrow under our Receivables Facility. In the event that additional financing is needed, we would finance using the public and private corporate bond markets and/or syndicated loan markets, if available.

Fund Transfer Limitations. The ability of certain of our subsidiaries and associated companies to transfer funds to the U.S may be limited, in some cases, by certain restrictions imposed by foreign governments. These restrictions do not, individually or in the aggregate, materially limit our ability to service our indebtedness, meet our current obligations or pay dividends. As of December 31, 2019, we held $154.6 million of cash in our foreign subsidiaries.

Information about our cash flows, by category, is presented in the Consolidated Statements of Cash Flows. The following table summarizes our cash flows for the twelve months ended December 31, 2019, 2018 and 2017:

(In millions)

Operating Activities

Cash provided by operating activities for 2019 decreased by $358.4 million compared to 2018. The decrease is due to partial payment of the losses associated with certain legal proceedings and investigations related to the 2017 cybersecurity incident as well as having received $110.0 million in insurance proceeds in 2018.

Cash provided by operating activities for 2018 decreased by $143.8 million compared to 2017, due to the decrease in net income, adjusted for depreciation and amortization. This decrease was partially offset by an improvement in our working capital and the change in deferred income taxes.

Investing Activities

(In millions)

*Amounts above are total cash outflows for capital expenditures.

Our capital expenditures are used for developing, enhancing and deploying new and existing software in support of our expanding product set, replacing or adding equipment, updating systems for regulatory compliance, licensing of standard software applications, investing in system reliability, security and disaster recovery enhancements, and updating or expanding our office facilities.

Capital expenditures increased in 2019 and 2018 from 2018 and 2017, respectively, due to our ongoing technology transformation.

Acquisitions, Divestitures and Investments

(In millions)

2019 Acquisitions and Investments. During 2019, we completed the acquisition of PayNet in our USIS and International operating segments and completed additional acquisitions in our Workforce Solutions segment.

2018 Acquisitions and Investments. During 2018, we completed acquisitions in our Workforce Solutions and International segments as well as DataX Ltd. in the third quarter of 2018 in our USIS segment.

2017 Acquisitions and Investments. During the fourth quarter of 2017, we acquired 100% of the outstanding stock of Mercury Group of Companies Pty Ltd (“Mercury”), an Australian-owned workforce management company. During the third quarter of 2017, we completed the acquisition of 100% of the outstanding stock of ID Watchdog, Inc.

For additional information about our acquisitions, see Note 3 of the Notes to Consolidated Financial Statements in this report.

Financing Activities

(In millions)

Borrowing and Repayment Activity. Net short-term (repayments) borrowings primarily represent repayments or borrowings of outstanding amounts under our commercial paper (“CP”) program. We primarily borrow under our CP program as needed and as availability allows.

The decrease in net short-term (repayments) borrowings in 2019 and 2018 and the increase in 2017 primarily relates to the net activity of CP notes.

The increase in proceeds from long-term debt in 2019 relates to the issuance of $750.0 million in senior notes in November 2019 and draw downs on our Receivable Facility during the year.

In November 2019, we issued $750.0 million aggregate principal amount of 2.6% Senior Notes due 2024 (the “2024 Notes”) in an underwritten public offering. Interest on the 2024 Notes accrue at a rate of 2.6% per year and will be payable semi-annually in arrears on June 1 and December 1 of each year, beginning on June 1, 2020. The net proceeds of the sale of the notes were used to repay borrowings under our Receivables Facility and our CP program and for general corporate purposes.

The increase in proceeds from long-term debt in 2018 relates to the issuance of $1.0 billion of senior notes in May 2018.

In May 2018, we issued $300.0 million aggregate principal amount of 3.6% Senior Notes due 2021 (the “2021 Notes”), $400.0 million aggregate principal amount of 3.95% Senior Notes due 2023 (the “2023 Notes”), and $300.0 million aggregate principal amount Floating Rate Notes due 2021 (the “Floating Rate Notes”) in an underwritten public offering. The net proceeds of the sale of the notes were used to repay borrowings under our Revolver, our prior $800.0 million three-year delayed draw term loan facility (“Term Loan”) and our CP program.

The increase in proceeds from long-term debt in 2017 is due to borrowings on our Revolver.

Payments on long-term debt in 2019 reflect payments on our Receivable Facility using proceeds from the issuance of the senior notes in 2019. Payments on long-term debt in 2018 reflect $100.0 million of payments on the Revolver using proceeds from the issuance of 3.60%, Floating Rate and 3.95% senior notes in 2018. Payments on long-term debt in 2017 reflect $272.5 million of payments related to senior notes, as well as $50.0 million of payments on the Term Loan.

Credit Facility Availability. In September 2018, the Company entered into the $1.10 billion five-year unsecured revolving credit facility with a group of financial institutions, which will mature in September 2023 (the “Revolver”). The Revolver replaced the Company’s previous $900.0 million unsecured revolving credit facility that was scheduled to mature in November 2020. Borrowings under the Revolver may be used for general corporate purposes, including working capital, capital expenditures, acquisitions and share repurchase programs. The Revolver has an accordion feature that allows us to request an increase in the total commitment to $1.60 billion. The Revolver includes an option to request a maximum of two one-year extensions of the maturity date, any time after the first anniversary of the Revolver closing. We believe we are currently in compliance with all representations and warranties necessary as a condition for borrowing under the Revolver, but we cannot assure that we will be able to comply with all such conditions to borrowing in the future. Availability of the Revolver is reduced by the outstanding principal balance of our commercial paper notes and by any letters of credit issued under the facility.

Our $1.10 billion CP program has been established to allow for borrowing through the private placement of CP with maturities ranging from overnight to 397 days. We may use the proceeds of CP for general corporate purposes. The CP program is supported by our Revolver and the total amount of CP which may be issued is reduced by the amount of any outstanding borrowings under our Revolver.

At December 31, 2019, the Company had no borrowings outstanding of CP, $0.7 million of letters of credit outstanding and no borrowings outstanding under the Revolver. At December 31, 2019, a total of $1.10 billion was available under the Revolver.

At December 31, 2019, approximately 91% of our debt was fixed rate and 9% was variable rate. Our variable-rate debt consists of the Floating Rate Notes. The interest rate resets periodically, based on the terms of the respective financing arrangement. At December 31, 2019, the interest rate on our variable-rate debt was 2.8%.

In December 2019, we amended our $225.0 million receivables funding facility (the “Receivables Facility”) to extend the maturity to December 2022. In the fourth quarter of 2017, Equifax entered into the Receivables Facility which had an original maturity in 2019 and was amended in November 2018 to extend the maturity to November 2020. Under the Receivables Facility, Equifax and certain of its U.S. subsidiaries sell the eligible third-party receivables of its U.S. based business, to Equifax Receivables Funding LLC, a consolidated, wholly-owned, bankruptcy-remote subsidiary that may subsequently transfer, without recourse, an undivided interest in these accounts receivable to investors. The investors have no recourse to the Company’s other assets except for customary repurchase, warranty and indemnity claims. Creditors of Equifax do not have recourse to the assets of Equifax Receivables Funding LLC.

Debt Covenants. A downgrade in credit ratings would increase the cost of borrowings under our CP program and Revolver, and could limit or, in the case of a significant downgrade, preclude our ability to issue CP. The outstanding indentures and comparable instruments contain customary covenants including, for example, limits on mortgages, liens and sale/leaseback transactions. In addition, the Revolver requires us to maintain a maximum leverage ratio of not more than 3.5 to 1.0. As permitted under the terms of the Revolver, we made the election to increase the covenant to 4.0 to 1.0, effective for four consecutive quarters, beginning in the second quarter of 2019 and continuing through the first quarter of 2020. None of these covenants are considered restrictive to our operations and, as of December 31, 2019, the Company was in compliance with all of our debt covenants.

The Company does not have any credit rating triggers that would accelerate the maturity of a material amount of the outstanding debt; however, the 2.3% senior notes due 2021, 3.6% senior notes due 2021, the Floating Rate Notes, 3.3% senior notes due 2022, 3.95% senior notes due 2023, 2.6% senior notes due 2024, 3.25% senior notes due 2026, and 7.0% senior notes due 2037 (together, the “Senior Notes”) contain change in control provisions. If the Company experiences a change of control or publicly announces the Company’s intention to effect a change of control and the rating on the Senior Notes is lowered by Standard & Poor’s (“S&P”) and Moody’s Investors Service (“Moody’s”) below an investment grade rating within 60 days of such change of control or notice thereof, then the Company will be required to offer to repurchase the Senior Notes at a price equal to 101% of the aggregate principal amount of the Senior Notes plus accrued and unpaid interest.

Credit Ratings. Credit ratings reflect an independent agency’s judgment on the likelihood that a borrower will repay a debt obligation at maturity. The ratings reflect many considerations, such as the nature of the borrower’s industry and its competitive position, the size of the company, its liquidity and access to capital and the sensitivity of a company’s cash flows to changes in the economy. The two largest rating agencies, S&P and Moody’s, use alphanumeric codes to designate their ratings. The highest quality rating for long-term credit obligations is AAA and Aaa for S&P and Moody’s, respectively. A security rating is not a recommendation to buy, sell or hold securities and may be subject to revision or withdrawal at any time by the assigning rating agency.

Long-term ratings of BBB- and Baa3 or better by S&P and Moody’s, respectively, reflect ratings on debt obligations that fall within a band of credit quality considered to be “investment grade.” At December 31, 2019, the long-term ratings for our obligations were BBB with a negative outlook for S&P and Baa1 with a negative outlook for Moody’s. A downgrade in our credit rating would increase the cost of borrowings under our CP program and Revolver, and could limit, or in the case of a significant downgrade, preclude our ability to issue CP. If our credit ratings were to decline to lower levels, we could experience increases in the interest cost for any new debt. In addition, the market’s demand for, and thus our ability to readily issue, new debt could become further affected by the economic and credit market environment. These ratings are subject to change as events and circumstances change.

For additional information about our debt, including the terms of our financing arrangements, basis for variable interest rates and debt covenants, see Note 5 of the Notes to Consolidated Financial Statements in this report.

Equity Transactions

(In millions)

48

Sources and uses of cash related to equity during the twelve months ended December 31, 2019, 2018 and 2017 were as follows:

• We did not repurchase any shares in 2019 and 2018. Under share repurchase programs authorized by our Board of Directors, we repurchased 0.5 million common shares during the twelve months ended December 31, 2017, for $77.1 million, at an average price per common share of $143.88. As of December 31, 2019, under the existing board authorization, the Company is approved for additional stock repurchases of $590.1 million.
• During the twelve months ended December 31, 2019, 2018 and 2017, we paid cash dividends to Equifax shareholders of $188.7 million, $187.9 million and $187.4 million, respectively, at $1.56 per share for 2019, 2018 and 2017.

We anticipate continuing the payment of quarterly cash dividends. The actual amount of such dividends is subject to declaration by our Board of Directors and will depend upon future earnings, results of operations, capital requirements, our financial condition and other relevant factors. There can be no assurance that the Company will continue to pay quarterly cash dividends at current levels or at all.

Contractual Obligations and Commercial Commitments

The following table summarizes our significant contractual obligations and commitments as of December 31, 2019. The table excludes commitments that are contingent based on events or factors uncertain at this time. Some of the excluded commitments are discussed below the footnotes to the table.

(In millions)

(1) The amounts are gross of unamortized discounts totaling $20.5 million at December 31, 2019. Total debt on our Consolidated Balance Sheets is net of the unamortized discounts and fair value adjustments. There were no fair value adjustments to our debt at December 31, 2019.

(2) Our operating lease obligations principally involve office space and equipment.

(3) These agreements primarily represent our minimum contractual obligations for services that we outsource associated with our computer data processing operations and related functions, and certain administrative functions. These agreements expire between 2020 and 2026.

(4) These long-term liabilities primarily relate to obligations associated with certain pension, postretirement and other compensation-related plans, some of which are discounted in accordance with U.S. generally accepted accounting principles, or GAAP. We made certain assumptions about the timing of such future payments. In the table above, we have not included amounts related to future pension plan obligations, as such required funding amounts beyond 2019 have not been deemed necessary due to our current expectations regarding future plan asset performance.

(5) This table excludes $24.6 million of unrecognized tax benefits, including interest and penalties, as we cannot make a reasonably reliable estimate of the period of cash settlement with the respective taxing authorities.

(6) For future interest payments on variable-rate debt, which bears a rate equal to three-month LIBOR on the interest determination date plus 0.87% per annum, we used the variable rate in effect at December 31, 2019 to calculate these payments. Our outstanding variable rate debt at December 31, 2019 consisted of the Floating Rate Notes. The variable rate at December 31, 2019 was 2.8%. Future interest payments may be different depending on future borrowing activity and interest rates.

Off-Balance Sheet Transactions

We do not engage in off-balance sheet financing activities.

Pursuant to the terms of certain industrial revenue bonds, we have transferred title to certain of our fixed assets with total costs of $156.4 million as of December 31, 2019 and 2018 to a local governmental authority in the U.S. to receive a property tax abatement related to economic development. The title to these assets will revert back to us upon retirement or cancellation of the applicable bonds. These fixed assets are still recognized on the Company’s Consolidated Balance Sheets as all risks and rewards related to the assets remain with the Company.

Letters of Credit and Guarantees

We will from time to time issue standby letters of credit, performance or surety bonds or other guarantees in the normal course of business. The aggregate notional amount of all performance and surety bonds and standby letters of credit was not material at December 31, 2019, and generally have a remaining maturity of one year or less. Guarantees are issued from time to time to support the needs of our operating units. The maximum potential future payments we could be required to make under the guarantees is not material at December 31, 2019.

Benefit Plans

We sponsor a qualified defined benefit retirement plan, the U.S. Retirement Income Plan (“USRIP”), that covers approximately 11% of current U.S. salaried employees who were hired on or before June 30, 2007, the last date on which an individual could be hired and enter the plan before the USRIP was closed to new participation at December 31, 2008. This plan also covers retirees as well as certain terminated but vested individuals not yet in retirement status. We also sponsor a retirement plan with both defined benefit and defined contribution components that cover most salaried and hourly employees in Canada, the Canadian Retirement Income Plan (“CRIP”); the defined benefit component was also closed to new hires on October 1, 2011.

During the twelve months ended December 31, 2019, we made no voluntary contributions to the USRIP and made contributions of $0.2 million to the CRIP. During the twelve months ended December 31, 2018, we made voluntary contributions of $30.0 million to the USRIP and made contributions of $0.4 million to the CRIP. At December 31, 2019, the USRIP met or exceeded ERISA’s minimum funding requirements. In the future, we will make minimum funding contributions as required and may make discretionary contributions, depending on certain circumstances, including market conditions and liquidity needs. We believe additional funding contributions, if any, would not prevent us from continuing to meet our liquidity needs, which are primarily funded from cash flows generated by operating activities, available cash and cash equivalents, and our credit facilities.

For our non-U.S., tax-qualified retirement plans, we fund an amount sufficient to meet minimum funding requirements but no more than allowed as a tax deduction pursuant to applicable tax regulations. For the non-qualified supplementary retirement plans, we fund the benefits as they are paid to retired participants, but accrue the associated expense and liabilities in accordance with GAAP.

For additional information about our benefit plans, see Note 9 of the Notes to Consolidated Financial Statements in this report.

Effects of Inflation and Changes in Foreign Currency Exchange Rates

Equifax’s operating results are not materially affected by inflation, although inflation may result in increases in the Company’s expenses, which may not be readily recoverable in the price of services offered. To the extent inflation results in rising interest rates and has other adverse effects upon the securities markets and upon the value of financial instruments, it may adversely affect the Company’s financial position and profitability.

A portion of the Company’s business is conducted in currencies other than the U.S. dollar and changes in foreign exchange rates relative to the U.S. dollar can therefore affect the value of non-U.S. dollar net assets, revenues and expenses. Potential exposures as a result of these fluctuations in currencies are closely monitored. We generally do not mitigate the risks associated with fluctuating exchange rates, although we may from time to time through forward contracts or other derivative instruments hedge a portion of our translational foreign currency exposure or exchange rate risks associated with material transactions which are denominated in a foreign currency.

RECENT ACCOUNTING PRONOUNCEMENTS

For information about new accounting pronouncements and the potential impact on our Consolidated Financial Statements, see Note 1 of the Notes to Consolidated Financial Statements in this report.

APPLICATION OF CRITICAL ACCOUNTING POLICIES AND ESTIMATES

The Company’s Consolidated Financial Statements are prepared in conformity with U.S. generally accepted accounting principles, or GAAP. This requires our management to make estimates and assumptions that affect the reported amounts of assets and liabilities, revenues and expenses and related disclosures of contingent assets and liabilities in our Consolidated Financial Statements and the Notes to Consolidated Financial Statements. The following accounting policies involve critical accounting estimates because they are particularly dependent on estimates and assumptions made by management about matters that are uncertain at the time the accounting estimates are made. In addition, while we have used our best estimates based on facts and circumstances available to us at the time, different estimates reasonably could have been used in the current period, or changes in the accounting estimates that we used are reasonably likely to occur from period to period, either of which may have a material impact on the presentation of our Consolidated Balance Sheets, Statements of (Loss) Income, and Statements of Comprehensive (Loss) Income. We also have other significant accounting policies which involve the use of estimates, judgments and assumptions that are relevant to understanding our results. For additional information about these policies, see Note 1 of the Notes to Consolidated Financial Statements in this report. Although we believe that our estimates, assumptions and judgments are reasonable, they are based upon information available at the time. Actual results may differ significantly from these estimates under different assumptions, judgments or conditions.

Revenue Recognition

In accordance with ASC 606, “Revenue from Contracts with Customers,” we recognize revenue when a performance obligation has been satisfied by transferring a promised good or service to a customer and the customer obtains control of the good or service. In order to recognize revenue, we note that the two parties must have an agreement that creates enforceable rights, the performance obligations must be distinct and the transaction price can be determined. Our revenue is derived from the provision of information services to our customers on a transactional basis, in which distinct services are delivered over time as the customer simultaneously receives and consumes the benefits of the services delivered. To measure our performance over time, the output method is utilized to measure the value to the customer based on the transfer to date of the services promised, with no rights of return once consumed. In these cases, revenue on transactional contracts with a defined price but an undefined quantity is recognized utilizing the right to invoice expedient resulting in revenue being recognized when the service is provided and billed. Additionally, multi-year contracts with defined pricing but an undefined quantity that utilize tier pricing would be defined as a series of distinct performance obligations satisfied over time utilizing the same method of measurement, the output method, with no rights of return once consumed. This measurement method is applied on a monthly basis resulting in revenue being recognized when the service is provided and billed.

Additionally, we recognize revenue from subscription-based contracts under which a customer pays a preset fee for a predetermined or unlimited number of transactions or services provided during the subscription period, generally one year. Revenue from subscription-based contracts having a preset number of transactions is recognized as the services are provided, using an effective transaction rate as the actual transactions are delivered. Any remaining revenue related to unfulfilled units is not recognized until the end of the related contract’s subscription period. Revenue from subscription-based contracts having an unlimited volume is recognized ratably during the contract term. Multi-year subscription contracts are analyzed to determine the full contract transaction price over the term of the contract and the subsequent price is ratably recognized over the full term of the contract.

Revenue is recorded net of sales taxes.

If at the outset of an arrangement, we determine that collectibility is not reasonably assured, revenue is deferred until the earlier of when collectibility becomes probable or the receipt of payment from the customer. If there is uncertainty as to the customer’s acceptance of the performance obligation, revenue is not recognized until the earlier of receipt of customer acceptance or expiration of the acceptance period.

We sell certain offerings that contain multiple performance obligations. These obligations may include consumer or commercial information, file updates for certain solutions, services provided by our decisioning technologies personnel, training services, statistical models and other services. In order to account for each of these obligations separately, the delivered promises within our contracts must meet the criterion to be considered distinct performance obligations to our customer. If we determine that the arrangement does not contain separate distinct obligations, the performance obligations are bundled together until a distinct obligation is achieved. This may lead to the arrangement consideration being recognized as the final contract obligation is delivered to our customer or ratably over the term of the contract.

Some of our arrangements with multiple performance obligations involve the delivery of services generated by a combination of services provided by one or more of our operating segments. No individual information service impacts the value or usage of other information services included in an arrangement and each service can be sold alone or, in most cases, purchased from another vendor without affecting the quality of use or value to the customer of the other information services included in the arrangement. Some of our products require the installation of interfaces or platforms by our technology personnel that allow our customers to interact with our proprietary information databases. These installation services do not meet the requirement for being distinct, thus any related installation fees are deferred when billed and are recognized over the expected period that the customer will benefit from the related services. Revenue from the delivery of one-time files and models is recognized as the service is provided and accepted, assuming all other revenue recognition criteria are met. The direct costs of installation of a customer are capitalized and amortized over the useful life of the identifiable asset.

We record revenue on a net basis for those sales in which we have in substance acted as an agent or broker in the transaction and therefore do not have control.

In certain instances within our debt collections and recovery management services in our International operating segment and certain tax management services within our Workforce Solutions operating segment, variable consideration is constrained due to the fact that the revenue is contingent on a particular outcome. Within our debt collections and recovery management businesses, revenue is calculated as a percentage of debt collected on behalf of the customer and, as such, is primarily recognized when the debt is collected assuming all other revenue recognition criteria are met. Within our Workforce Solutions operating segment, the fees for certain of our tax credits and incentives revenue are based on a percentage of the credit delivered to our clients. Revenue for these arrangements is recognized based on the achievement of milestones, upon calculation of the credit, approval from a regulatory agency or when the credit is utilized by our client, depending on the provisions of the client contract.

Certain costs incurred prior to the satisfaction of a performance obligation are deferred as contract costs and are amortized on a systematic basis consistent with the pattern of transfer of the related goods and services. These costs generally consist of labor costs directly relating to the implementation and setup of the contract.

Judgments and Uncertainties – Each performance obligation within a contract must be considered separately to ensure that appropriate accounting is performed for these distinct goods or services. These considerations include assessing the price at which the element is sold compared to its standalone selling price; concluding when the element will be delivered; evaluating collectability; and determining whether any contingencies exist in the related customer contract that impact the prices paid to us for the services.

Contract Balances – The contract balances are generated when revenue recognized varies from billing in a given period. A contract asset is created when an entity transfers a good or service to a customer and recognizes more revenue than what has been billed. As of December 31, 2019, the contract asset balance was $8.1 million. A contract liability is created when an entity transfers a good or service to a customer and recognizes less than what has been billed. Deferred revenue is recognized when we have an obligation to transfer goods or services to a customer and have already received consideration from the customer. We generally expect to recognize our deferred revenue as revenue within twelve months of being recorded based on the terms of the contracts.

Goodwill and Indefinite-Lived Intangible Assets

We review goodwill and indefinite lived intangible assets for impairment annually (as of September 30) and whenever events or changes in circumstances indicate the carrying value of an asset may not be recoverable. These events or circumstances could include a significant change in the business climate, legal factors, operating performance or trends, competition, or sale or disposition of a significant portion of a reporting unit. We have seven reporting units comprised of USIS

(which includes Online Information Solutions, Mortgage Solutions and Financial Marketing Services), Asia Pacific, Europe, Latin America, Canada, Global Consumer Solutions (“GCS”), and Equifax Workforce Solutions (which includes Verification Services and Employer Services).

The goodwill balance at December 31, 2019, for our seven reporting units was as follows:

(In millions)

Valuation Techniques

We performed a qualitative assessment to determine whether further impairment testing was necessary for our USIS, Europe, Latin America, Canada, GCS, and Workforce Solutions reporting units. In this qualitative assessment, we considered the following items for each of the reporting units: macroeconomic conditions, industry and market conditions, overall financial performance and other entity specific events. In addition, for each of these reporting units, the most recent fair value determination resulted in an amount that significantly exceeded the carrying amount of the reporting units. Based on these assessments, we determined the likelihood that a current fair value determination would be less than the current carrying amount of the reporting unit is not more likely than not. As a result of our conclusions, no further testing was required for these reporting units.

We performed a quantitative assessment for our Asia Pacific reporting unit to determine whether impairment exists as the Veda transaction, which comprises the majority of our Asia Pacific reporting unit, was only completed approximately three years ago and due to the size of the cushion for the reporting unit in relation to our other reporting units. In determining the fair value of the reporting unit we used a combination of the income and market approaches to estimate the reporting unit’s business enterprise value.

Under the income approach, we calculate the fair value of a reporting unit based on estimated future discounted cash flows which require assumptions about short and long-term revenue growth rates, operating margins for each reporting unit, discount rates, foreign currency exchange rates and estimates of capital charges. The assumptions we use are based on what we believe a hypothetical marketplace participant would use in estimating fair value. Under the market approach, we estimate the fair value based on market multiples of revenue or earnings before income taxes, depreciation and amortization, for benchmark companies or guideline transactions. We believe the benchmark companies used for our Asia Pacific reporting unit serve as an appropriate input for calculating a fair value for the reporting unit as those benchmark companies have similar risks, participate in similar markets, provide similar services for their customers and compete with us directly. The companies we use as benchmarks are principally outlined in our discussion of Competition in Item 1 of this Form 10-K. Competition for our Asia Pacific reporting unit generally includes global consumer credit reporting companies, such as Experian, which offer a product suite similar to the reporting unit’s credit reporting solutions.

The values separately derived from each of the income and market approach valuation techniques were used to develop an overall estimate of a reporting unit’s fair value. We use a consistent approach across all reporting units when considering the weight of the income and market approaches for calculating the fair value of each of our reporting units. This approach relies more heavily on the calculated fair value derived from the income approach, with 70% of the value coming from the income approach. We believe this approach is consistent with that of a market participant in valuing prospective purchase business combinations. The selection and weighting of the various fair value techniques may result in a higher or lower fair value. Judgment is applied in determining the weightings that are most representative of fair value.

We have not made any material changes to the valuation methodology we use to assess goodwill impairment since the date of our last annual impairment test.

Growth Assumptions

The assumptions for our future cash flows begin with our historical operating performance, the details of which are described in our Management’s Discussion & Analysis of operating performance. Additionally, we consider the impact that known economic, industry and market trends will have on our future forecasts, as well as the impact that we expect from planned business initiatives including new product initiatives, client service and retention standards, and cost management programs. At the end of the forecast period, the long-term growth rate we used to determine the terminal value of our Asia Pacific reporting unit was 4.85% based on management’s assessment of the minimum expected terminal growth rate of the reporting unit, as well as broader economic considerations such as GDP, inflation and the maturity of the markets we serve.

We projected revenue growth in 2020 for our Asia Pacific reporting unit in completing our 2019 impairment testing based on planned business initiatives and prevailing trends exhibited by this unit and not based on the assumption of meaningful acceleration in economic growth. The anticipated revenue growth in this reporting unit, however, is partially offset by assumed increases in expenses for the reporting unit which reflects the additional level of investment needed in order to achieve the planned revenue growth.

Discount Rate Assumptions

We utilize a weighted average cost of capital, or WACC, in our impairment analysis that makes assumptions about the capital structure that we believe a market participant would make and include a risk premium based on an assessment of risks related to the projected cash flows for the reporting unit. We believe this approach yields a discount rate that is consistent with an implied rate of return that a market participant would require for an investment in a company having similar risks and business characteristics to the reporting unit being assessed. To calculate the WACC, the cost of equity and cost of debt are multiplied by the assumed capital structure of the reporting unit as compared to industry trends and relevant benchmark company structures. The cost of equity was computed using the Capital Asset Pricing Model which considers the risk-free interest rate, beta, equity risk premium and specific company risk premium related to a particular reporting unit. The cost of debt was computed using a benchmark rate and the Company’s tax rate. For the 2019 annual goodwill impairment evaluation, the discount rate used to develop the estimated fair value of the Asia Pacific reporting unit was 9.1%.

Estimated Fair Value and Sensitivities

The estimated fair value of the reporting units is derived from the valuation techniques described above, incorporating the related projections and assumptions. An indication of possible impairment occurs when the estimated fair value of the reporting unit is below the carrying value of its equity. The estimated fair value for our Asia Pacific reporting unit exceeded the related carrying value as of September 30, 2019. As a result, no goodwill impairment was recorded.

The estimated fair value of the reporting unit is highly sensitive to changes in these projections and assumptions; therefore, in some instances changes in these assumptions could impact whether the fair value of a reporting unit is greater than its carrying value. For example, an increase in the discount rate and decline in the projected cumulative cash flow of a reporting unit could cause the fair value of certain reporting units to be below its carrying value. We perform sensitivity analyses around these assumptions in order to assess the reasonableness of the assumptions and the resulting estimated fair values. Ultimately, future potential changes in these assumptions may impact the estimated fair value of a reporting unit and cause the fair value of the reporting unit to be below its carrying value. Our Asia Pacific reporting unit primarily represents our recently completed acquisition of Veda. Due to the recency of this acquisition and its overall significance to the reporting unit, Asia Pacific is more sensitive to changes in the assumptions noted above that could result in a fair value that is less than its carrying value. The excess of fair value over carrying value for the Asia Pacific reporting unit as of September 30, 2019 was 14%.

Loss Contingencies

We are subject to various proceedings, lawsuits and claims arising in the normal course of our business. We determine whether to disclose and/or accrue for loss contingencies based on our assessment of whether the potential loss is estimable, probable, reasonably possible or remote.

In the third quarter of 2017, we announced a cybersecurity incident potentially impacting U.S., Canadian and U.K. consumers. As a result of the 2017 cybersecurity incident, we were subject to a significant number of proceedings and investigations as described in “Item 3. Legal Proceedings” in this Form 10-K. We recorded expenses, net of insurance recoveries, of $800.9 million in other current liabilities and selling, general, and administrative expenses in our Consolidated Balance Sheets and Statements of (Loss) Income, respectively, as of and for the twelve months ended December 31, 2019, exclusive of our legal and professional services expenses. The amount accrued represents our best estimate of the liability related to these matters. The Company will continue to evaluate information as it becomes known and adjust accruals for new information and further developments in accordance with ASC 450-20-25. While it is reasonably possible that losses exceeding the amount accrued may be incurred, it is not possible at this time to estimate the additional possible loss in excess of the amount already accrued that might result from adverse judgments, settlements, penalties or other resolution of the proceedings and investigations described in “Item 3. Legal Proceedings” in this Form 10-K based on a number of factors, such as the various stages of these proceedings and investigations, including matters on appeal, that alleged damages have not been specified or are uncertain, the uncertainty as to the certification of a class or classes and the size of any certified class, as applicable, and the lack of resolution on significant factual and legal issues. The ultimate amount paid on these actions, claims and investigations in excess of the amount already accrued could be material to the Company’s consolidated financial condition, results of operations, or cash flows in future periods.

Judgments and uncertainties — We periodically review claims and legal proceedings and assess whether we have potential financial exposure based on consultation with internal and outside legal counsel and other advisors. If the likelihood of an adverse outcome from any claim or legal proceeding is probable and the amount can be reasonably estimated, we record a liability on our Consolidated Balance Sheets for the estimated amount. If the likelihood of an adverse outcome is reasonably possible, but not probable, we provide disclosures related to the potential loss contingency. Our assumptions related to loss contingencies are inherently subjective.

Effect if actual results differ from assumptions — With the exception of the 2017 cybersecurity incident, we do not believe there is a reasonable likelihood that there will be a material change in the future estimates or assumptions we use to determine loss contingencies. However, if facts and circumstances change in the future that change our belief regarding assumptions used to determine our estimates, we may be exposed to a loss that could be material.

Income Taxes

We record deferred income taxes using enacted tax laws and rates for the years in which the taxes are expected to be paid. We assess the likelihood that our deferred tax assets will be recovered from future taxable income or other tax planning strategies. To the extent that we believe that recovery is not likely, we must establish a valuation allowance to reduce the deferred tax assets to the amount we estimate will be recoverable.

Our income tax provisions are based on assumptions and calculations which will be subject to examination by various tax authorities. We record tax benefits for positions in which we believe are more likely than not of being sustained under such examinations. We assess the potential outcome of such examinations to determine the adequacy of our income tax accruals.

Judgments and uncertainties — We consider accounting for income taxes critical because management is required to make significant judgments in determining our provision for income taxes, our deferred tax assets and liabilities, and our future taxable income for purposes of assessing our ability to realize any future benefit from our deferred tax assets. These judgments and estimates are affected by our expectations of future taxable income, mix of earnings among different taxing jurisdictions, and timing of the reversal of deferred tax assets and liabilities.

We also use our judgment to determine whether it is more likely than not that we will sustain positions that we have taken on tax returns and, if so, the amount of benefit to initially recognize within our financial statements. We review our uncertain tax positions and adjust our unrecognized tax benefits in light of changes in facts and circumstances, such as changes in tax law, interactions with taxing authorities and developments in case law. These adjustments to our unrecognized tax benefits may affect our income tax expense. Settlement of uncertain tax positions may require use of our cash. At December 31, 2019, $24.6 million was recorded for uncertain tax benefits, including interest and penalties, of which it is reasonably possible that up to $5.0 million of our unrecognized tax benefit may change within the next twelve months.

Effect if actual results differ from assumptions — Although management believes that the judgments and estimates discussed herein are reasonable, actual results could differ, and we may be exposed to increases or decreases in income tax expense that could be material.

Pension and Other Postretirement Plans

We consider accounting for our U.S. and Canadian pension and other postretirement plans critical because management is required to make significant subjective judgments about a number of actuarial assumptions, which include discount rates, expected return on plan assets, interest cost and mortality and retirement rates. Actuarial valuations are used in determining our benefit obligation and net periodic benefit cost.

During 2019, we adopted the new Pri-2012 mortality tables and MP-2019 mortality improvement projection scale in determining the liability for the U.S. plans. The updated mortality tables and projection scale, partially offset the decrease in the discount rates in 2019, the net of which resulted in the increase in the projected benefit obligation as of December 31, 2019.

During 2018, we adopted the new MP-2018 mortality improvement projection scale in determining the liability for the U.S. plans. This updated scale, along with the change in the discount rates, contributed to a decrease in the projected benefit obligation as of December 31, 2018.

During 2017, we adopted the new MP-2017 mortality improvement projection scale in determining the liability for the U.S. plans. This updated scale partially offset the decrease in the discount rates in 2017, the net of which resulted in the increase in the projected benefit obligation as of December 31, 2017.

Judgments and uncertainties — We believe that the most significant assumptions related to our net periodic benefit cost are (1) the discount rate and (2) the expected return on plan assets, in each case as it relates to our U.S. pension plan. Our Canadian plan is not significant, and the impact of changes in assumptions for that plan is not material.

We determine our discount rates primarily based on high-quality, fixed-income investments and yield-to-maturity analyses specific to our estimated future benefit payments available as of the measurement date. Discount rates are reset annually on the measurement date to reflect current market conditions. To determine the discount rate for our U.S. pension and postretirement benefit plans, we use a bond matching approach to select specific bonds that would satisfy our projected benefit payments. We believe the bond matching approach reflects the process we would employ to settle our pension and postretirement benefit obligations. For our Canadian plans we use a third-party yield curve to develop our discount rates. The yield curve provides discount rates related to a dedicated high-quality bond portfolio whose cash flows extend beyond the current period, from which we choose a rate matched to the expected benefit payments required for each plan.

In 2019, the Compensation Committee of the Board of Directors approved the termination of the plan. The CRIP will be frozen effective December 31, 2020 at which date all active members accruing defined benefits shall cease such accruals. The obligation is expected to be settled in 2022 with lump sum distributions and an annuity purchase.

The expected rate of return on plan assets is based on both our historical returns and forecasted future investment returns by asset class, as provided by our external investment advisor. In 2019, our U.S. pension plan investment earned 21.4%, which was above the expected return of 6.7%. The expected return for the USRIP for 2020 is 6.5% following asset allocation changes that resulted in higher allocation to fixed income securities. The CRIP investment earned 12.7% in 2019 versus the expected return of 6.0%. The expected return for the CRIP for 2020 is 6.0%. Our weighted-average expected rate of return for both plans for 2019 is 6.46% which is consistent with the 2019 expected rate.

Annual differences, if any, between the expected and actual returns on plan assets are included in unrecognized net actuarial gain or loss, a component of other comprehensive income. In calculating the annual amortization of the unrecognized net actuarial gain or loss, we use a market-related value of assets that smooths actual investment gains and losses on plan assets over a period up to five years. The resulting unrecognized net actuarial gain or loss amount is recognized in net periodic pension expense over the average remaining life expectancy of the participant group since almost all participants are inactive. The market-related value of our assets was $563.7 million at December 31, 2019. We do not expect our 2020 net periodic benefit cost, which includes the effect of the market-related value of assets, to be materially different than our 2019 cost. See Note 9 of the Notes to the Consolidated Financial Statements for details on changes in the pension benefit obligation and the fair value of plan assets.

Effect if actual results differ from assumptions — We do not believe there is a reasonable likelihood that there will be a material change in the future estimates or assumptions that are used in our actuarial valuations. Adjusting our weighted-average expected long-term rate of return (6.46% at December 31, 2019) by 50 basis points would change our estimated pension expense in 2019 by approximately $2.8 million. Adjusting our weighted-average discount rate (4.39% at December 31, 2019) by 50 basis points would change our estimated pension expense in 2019 by approximately $1.1 million. However, if actual results are not consistent with our estimates or assumptions, we may be exposed to changes in pension expense, pension liability or unrecognized prior service cost and actuarial gains (losses) that could be material.

In the normal course of our business, we are exposed to market risk, primarily from changes in foreign currency exchange rates and interest rates that could impact our results of operations and financial position. We manage our exposure to these market risks through our regular operating and financing activities, and, when deemed appropriate, through the use of derivative financial instruments, such as interest rate swaps, to hedge certain of these exposures. We use derivative financial instruments as risk management tools and not for speculative or trading purposes.

Foreign Currency Exchange Rate Risk

A substantial majority of our revenue, expense and capital expenditure activities are transacted in U.S. dollars. However, we do transact business in other currencies, primarily the British pound, the Australian dollar, the Canadian dollar, the Chilean peso, the Argentine peso and the Euro. For most of these foreign currencies, we are a net recipient, and, therefore, benefit from a weaker U.S. dollar and are adversely affected by a stronger U.S. dollar relative to the foreign currencies in which we transact significant amounts of business.

We are required to translate, or express in U.S. dollars, the assets and liabilities of our foreign subsidiaries that are denominated or measured in foreign currencies at the applicable year-end rate of exchange on our Consolidated Balance Sheets and income statement items of our foreign subsidiaries at the average rates prevailing during the year. We record the resulting translation adjustment, and gains and losses resulting from the translation of intercompany balances of a long-term investment nature within other comprehensive income, as a component of our shareholders’ equity. Foreign currency transaction gains and losses, which have historically been immaterial, are recorded on our Consolidated Statements of (Loss) Income. We generally do not mitigate the risks associated with fluctuating exchange rates, although we may from time to time through forward contracts or other derivative instruments hedge a portion of our translational foreign currency exposure or exchange rate risks associated with material transactions which are denominated in a foreign currency.

For the year ended December 31, 2019, a 10% weaker U.S. dollar against the currencies of all foreign countries in which we had operations during 2019 would have increased our revenue by $54.8 million and our pre-tax operating profit by $10.2 million. For the year ended December 31, 2018, a 10% weaker U.S. dollar against the currencies of all foreign countries in which we had operations during 2018 would have increased our revenue by $55.9 million and our pre-tax operating profit by $10.7 million. A 10% stronger U.S. dollar would have resulted in similar decreases to our revenue and pre-tax operating profit for 2019 and 2018.

On average across our mix of international businesses, foreign currencies at December 31, 2019 were weaker against the U.S. dollar than the average foreign exchange rates that prevailed across the full year 2019. As a result, if foreign exchange rates were unchanged throughout 2020, foreign exchange translation would reduce growth as reported in U.S. dollars. As foreign exchange rates change daily, there can be no assurance that foreign exchange rates will remain constant throughout 2020, and rates could go either higher or lower.

Interest Rate Risk

Our exposure to market risk for changes in interest rates relates to our variable-rate commercial paper, Revolver, and Floating Rate Notes borrowings. We attempt to achieve the lowest all-in weighted-average cost of debt while simultaneously taking into account the mix of our fixed- and floating-rate debt, and the average life and scheduled maturities of our debt. At December 31, 2019, our weighted average cost of debt was 3.8% and weighted-average life of debt was 4.54 years. At December 31, 2019, 91% of our debt was fixed rate, and the remaining 9% was variable rate. Occasionally we use derivatives to manage our exposure to changes in interest rates by entering into interest rate swaps. A 100 basis point increase in the weighted-average interest rate on our variable-rate debt would have increased our 2019 interest expense by $3.0 million.

Based on the amount of outstanding variable-rate debt, we have exposure to interest rate risk. In the future, if our mix of fixed-rate and variable-rate debt were to change due to additional borrowings under existing or new variable-rate debt, we could have additional exposure to interest rate risk. The nature and amount of our long-term and short-term debt, as well as the proportionate amount of fixed-rate and variable-rate debt, can be expected to vary as a result of future business requirements, market conditions and other factors.

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, evaluated the effectiveness of Equifax’s disclosure controls and procedures as of the end of the period covered by this report. Based on that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures as of the end of the period covered by this report (i) were appropriately designed to provide reasonable assurance of achieving their objectives and (ii) were effective and provided reasonable assurance that the information required to be disclosed by Equifax in reports filed under the Exchange Act is (a) recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms and (b) accumulated and communicated to Equifax’s management, including our Chief Executive Officer and Chief Financial Officer, as appropriate to allow timely decisions regarding required disclosure.

Management’s Annual Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting. Internal control over financial reporting is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act as a process designed by, or under the supervision of, our Chief Executive Officer and Chief Financial Officer and effected by our Board of Directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that:

• pertain to the maintenance of records that in reasonable detail accurately and fairly reflect transactions and dispositions of our assets;
• provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that our receipts and expenditures are being made only in accordance with authorizations of our management and directors; and
• provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Our management assessed the effectiveness of Equifax’s internal control over financial reporting as of December 31, 2019 using the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control-Integrated Framework (2013 Framework). Based on this assessment using those criteria, our management concluded that, as of December 31, 2019, Equifax’s internal control over financial reporting was effective. Management reviewed the results of its assessment with the Audit Committee of its Board of Directors. The effectiveness of Equifax’s internal control over financial reporting as of December 31, 2019 has been audited by Ernst & Young LLP, Equifax’s independent registered public accounting firm, as stated in their report, which appears in “Item 8. Financial Statements and Supplementary Data” of this Form 10-K on page 59.

Changes in Internal Control Over Financial Reporting

There have been no changes in internal control over financial reporting identified in connection with the foregoing that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.