Moody's (DUT) Risk Analysis

Moody's is subject to extensive regulation by federal, state and local authorities in the U.S. and by foreign jurisdictions. These regulations, the most important of which are discussed in further detail below, are complex, continually evolving and have tended to become more stringent over time. Additionally, in the U.S., changes in the Presidential administration, changes in Congress, and recent judicial actions may increase the uncertainty with regard to potential changes in these laws and regulations and the enforcement of any new or existing legislation or directives by government authorities. See "Regulation" in Part I, Item 1 of this annual report on Form 10-K for more information. Speculation concerning the impact of legislative, regulatory and government initiatives, including initiatives related to the emerging technology of AI systems, operational resilience, data privacy and climate-related risks, among others, that our products and services incorporate, and the increased uncertainty over potential liability and adverse legal or judicial determinations may negatively affect Moody's stock price, affect demand for our products and services, increase our costs of operations and impact our future business plans. Further, the Company's compliance and efforts to reduce the risk of fines, penalties or other sanctions can result in significant expenses. Legal proceedings that are increasingly lengthy can result in uncertainty over and exposure to liability. Moody's Investors Service. MIS operates in a highly regulated industry. The current U.S. laws and regulations relating to MIS, including the Reform Act and the Dodd-Frank Act: –seek to encourage, and may result in, increased competition among CRAs and in the credit rating business;–may result in alternatives to credit ratings, changes in the pricing of credit ratings, and/or diminished intellectual property protection relating to credit ratings and related research produced by MIS;–restrict the use of information in the development or maintenance of credit ratings;–increase regulatory oversight of the credit markets and CRA operations;–provide the SEC with direct jurisdiction over CRAs that seek NRSRO status, and grant authority to the SEC to inspect the operations of CRAs; and –provide for enhanced oversight standards and specialized pleading standards, which may result in increases in the number of legal proceedings claiming liability for losses suffered by investors on rated securities and aggregate legal defense costs. In addition to the extensive and evolving U.S. laws and regulations governing the credit rating industry, foreign jurisdictions have taken measures to regulate CRAs and the markets for credit ratings that significantly impact the operations and the markets for the Company's ratings-related products and services. In particular, the EU has adopted a common regulatory framework for CRAs operating in the EU, continues to monitor the credit rating industry and analyzes approaches that may strengthen existing regulation. The U.K. also has adopted a regulatory framework for CRAs that is based on the EU version. Credit ratings emanating from outside the EU are subject to ESMA's oversight if they are endorsed into the EU, and ratings endorsed into the U.K. are similarly subject to oversight of the FCA. Additionally, other foreign jurisdictions, such as Australia and Hong Kong and China, have taken measures to increase regulation of CRAs and markets for credit ratings. A failure to comply with these procedural and substantive requirements also exposes MIS to the risk of regulatory enforcement action, which could result in financial penalties or, in serious cases, affect its ability to conduct credit rating activities in certain jurisdictions. For example: –MIS is subject to formal regulation and periodic or other inspections in the EU and other foreign jurisdictions, such as, but not limited to, the U.K., Australia, Singapore, Japan, and Hong Kong, where it operates through registered subsidiaries. –In the EU and the U.K., applicable rules include procedural requirements with respect to credit ratings of sovereign issuers, liability for intentional or grossly negligent failure to abide by applicable regulations, mandatory analyst rotation requirements, and restrictions on CRAs or their shareholders if certain ownership thresholds are crossed. Additional procedural and substantive requirements include conditions for the issuance of credit ratings, rules regarding the organization of CRAs, restrictions on activities deemed to create a conflict of interest, including requirements that fees be based on costs and non-discriminatory, special requirements for credit ratings of structured finance instruments. Certain products currently offered by MIS may fall into scope of the EU Regulation on ESG Rating Activities, which could impose new substantive and procedural requirements on MIS relating to those products similar to those applicable to credit ratings. In addition, EU CRAs are also subject to DORA, which imposes a range of requirements in relation to the management of ICT risk, regulatory reporting, testing and the management of risks related to ICT services provided by third-parties. –In Hong Kong, applicable rules include liability for the intentional or negligent dissemination of false and misleading information and procedural requirements for the notification of certain matters to regulators. In addition, MIS Hong Kong is subject to a code of conduct applicable to CRAs that imposes procedural and substantive requirements on the preparation and issuance of credit ratings, restrictions on activities deemed to create a conflict of interest including the disclosure of its compensation arrangements with rated entities and special requirements for credit ratings of structured finance instruments. –In China, while MIS is not a licensed CRA, it does issue global credit ratings on Chinese issuers from offices outside of China. In addition, the Company holds a 30% investment in CCXI, a domestic CRA licensed in China. China has laws applicable to domestic CRAs as well as foreign investment in such entities and entities in general (including national security review). –In Australia, unless an exemption applies, CRAs are required to hold an Australian financial services license (AFSL) if they carry on a business of providing credit ratings in Australia. MIS Australia holds an AFSL authorizing it to provide general advice to wholesale clients only by issuing a credit rating. It is therefore required to comply with obligations as an AFSL holder including the requirement to provide financial services efficiently, honestly, and fairly, to manage conflicts of interest, and to comply with the conditions of its AFSL (which conditions include specific conditions about credit ratings). Future laws and regulations could extend to products and services not currently regulated. These regulations could: –affect the need for debt securities to be rated;–expand supervisory remits to include credit ratings issued outside the home jurisdiction;–increase the level of competition for credit ratings, including the distribution of credit ratings;–establish criteria for credit ratings or limit the entities authorized to provide credit ratings;–restrict the collection, use, accuracy, correction and sharing of information by CRAs; or –regulate pricing (for example, to require fees that are based on costs and are non-discriminatory) on products and services provided by MA such as those products that incorporate credit ratings and research originated by MIS. In turn, such developments may affect MIS's communications with issuers as part of the rating assignment process, alter the manner in which MIS's credit ratings are developed, assigned and communicated, affect the manner in which MIS or its customers or users of credit ratings operate, impact the demand for MIS's credit ratings or alter the economics of the credit ratings business, including by restricting or mandating business models for CRAs. It is difficult to accurately assess the future impact of legislative and regulatory requirements on MIS's business and its customers' businesses. If these laws and regulations, and any future rulemaking or court rulings, reduce demand for credit ratings or increase costs, MIS may be unable to pass such costs through to customers. Additionally, legislative and regulatory initiatives that apply to CRAs and credit markets generally may affect Moody's in a disproportionate manner. Each of these developments increases the costs and legal risk associated with the issuance of credit ratings and can have a material adverse effect on Moody's operations, profitability and competitiveness, the demand for credit ratings and the manner in which such ratings are utilized. Moody's Analytics. Certain of MA's subscription products contain credit ratings data and related research produced by MIS, and often are used by MA customers for regulatory compliance purposes, including determination of capital charges and regulatory reporting. Regulations concerning the issuance of credit ratings and the activities of CRAs, including the dissemination of ratings data, are likely to continue to be considered in the future, including, for example, provisions regarding fair and reasonable availability of ratings data, the terms and conditions associated with such data feeds, remuneration for data and the nature of the information to be included in credit opinions. Other laws, regulations and rules that are being considered or are likely to be considered in the future may impact MA products and services, for example, by requiring certain information to be provided free of charge. MA's other products and services, in particular its offering of products and services relating to sanctions, KYC and financial crime, are potentially subject to various laws and regulations affecting the collection, processing and sale of data-driven solutions. These laws and regulations generally are designed to protect information relating to individuals and small businesses, including information used for consumer credit reporting purposes, the data rights of individuals, and to prevent the unauthorized collection, access to and use of personal or confidential information available in the marketplace and prohibit certain deceptive and unfair acts. Additionally, refer to the risk factor entitled "The Company Is Exposed to Risks Related to Protection of Confidential and Personal Information." New laws and regulations are likely to be enacted and existing laws and regulations may change or be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible they will be interpreted and applied in ways that will materially and adversely affect our business. As a result of current and future laws and regulations, our customers' and other third parties' use of our products and services, as well as our use of information supplied by our suppliers and other third parties, can lead to regulatory inquiries or actions or related private litigation against us. The application of current and future laws relating to data access and portability may also require changes in the way that we contract for certain of our hosted data services and provide our customers of such services with the ability to terminate their relationships with us and port their data to alternative providers, and changes in the applicability of laws and regulations could require MA to modify its data processing practices and policies and restrict or dictate how MA collects, maintains, combines and disseminates information, which could have a material adverse effect on Moody's business, financial condition or results of operations. In the future, the Company may be subject to significant additional expense to ensure continued compliance with laws and regulations applicable to MA and to investigate, defend or remedy actual or alleged violations. Additionally, refer to the risk factor entitled "The Company Is Exposed to Risks Related to Protection of Confidential and Personal Information." Further, MA's bank and financial services customers are subject to additional regulatory oversight. For example: –U.S. banking regulators, including the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System and the Consumer Financial Protection Bureau, as well as many state agencies, have issued guidance to insured depository institutions and other providers of financial services on assessing and managing risks associated with third-party relationships, which include all business arrangements between a financial services provider and another entity, by contract or otherwise, and generally requires banks and financial services providers to exercise comprehensive oversight throughout each phase of a bank or financial service provider's business arrangement with third-party service providers, and instructs banks and financial service providers to adopt risk management processes commensurate with the level of risk and complexity of their third-party relationships. This guidance requires more rigorous oversight of third-party relationships that involve certain "critical activities."–Regulators in Europe and other foreign markets in which MA is active have issued guidance similar to that issued in the U.S. relating to financial institutions' assessment and management of risks associated with third-party relationships. For example, DORA requires EU financial institutions to have a comprehensive governance and control framework of the management of ICT risks, including risks relating to third-party providers of technology and data such as MA. In light of this, MA's existing or potential bank and financial services customers subject to this guidance have sought to and may further revise their third-party risk management policies and processes and the terms on which they do business with MA. –In China, MA is licensed to provide subscriptions to credit research and ratings data and other information relevant to the financial markets. China has laws applicable to Moody's that are broadly crafted, and the implementation, interpretation and enforcement of such laws are subject to the broad discretion of Chinese regulators, which could affect the Company's ability to conduct business in China. The EU AI Act has introduced a risk-based framework for regulating AI systems which applies different obligations to various participants in the AI supply chain. Compliance with the regulation, in its current form, could increase the Company's costs and expose it to the risk of penalties or fines for noncompliance; however, the ultimate impact of the EU AI Act on the Company remains uncertain, as the European Commission has proposed measures intended to reduce the regulatory burden on businesses. In addition, numerous other foreign jurisdictions and U.S. states have proposed or enacted legislation relating to the development and use of GenAI. Legal and regulatory developments can result in delayed or reduced sales to MA's customers, adversely affect MA's relationship with such customers, increase the costs of doing business with such customers and/or result in MA assuming greater financial and legal risk under its agreements with such customers.