Fair Isaac (FICO) Risk Analysis

In our markets, technology changes rapidly, and there are continuous improvements in computer hardware, network operating systems, programming tools, programming languages, operating systems, database technologies, cloud-based technologies and the use of the Internet. For example, artificial intelligence technologies, including generative artificial intelligence, and their use are currently undergoing rapid change. If we fail to enhance our current products and develop new products in response to changes in technology or industry standards, or if we fail to bring product enhancements or new product developments to market quickly enough, our products could rapidly become less competitive or obsolete. Our future success will depend, in part, upon our ability to: - innovate by internally developing new and competitive technologies;- use leading third-party technologies effectively;- continue to develop our technical expertise;- anticipate and effectively respond to changing customer needs;- initiate new product introductions in a way that minimizes the impact of customers delaying purchases of existing products in anticipation of new product releases; and - influence and respond to emerging industry standards and other technological changes.

Our success depends, in part, upon our proprietary technology and other intellectual property rights. To date, we have relied primarily on a combination of copyright, patent, trade secret, and trademark laws, and nondisclosure and other contractual restrictions on copying and distribution, to protect our proprietary technology. This protection of our proprietary technology is limited, and our proprietary technology could be used by others without our consent. In addition, patents may not be issued with respect to our pending or future patent applications, and our patents may not be upheld as valid or may not prevent the development of competitive products. Any disclosure, loss, invalidity of, or failure to protect our intellectual property could negatively impact our competitive position, and ultimately, our business. There can be no assurance that our protection of our intellectual property rights in the U.S. or abroad will be adequate or that others, including our competitors, will not use our proprietary technology without our consent. Furthermore, litigation may be necessary to enforce our intellectual property rights, to protect our trade secrets, or to determine the validity and scope of the proprietary rights of others. Such litigation could result in substantial costs and diversion of resources and could harm our business, financial condition or results of operations. Some of our technologies were developed under research projects conducted under agreements with various U.S. government agencies or subcontractors. Although we have commercial rights to these technologies, the U.S. government typically retains ownership of intellectual property rights and licenses in the technologies developed by us under these contracts, and in some cases can terminate our rights in these technologies if we fail to commercialize them on a timely basis. Under these contracts with the U.S. government, the results of research may be made public by the government, limiting our competitive advantage with respect to future products based on our research.

Our business requires that we develop or obtain a reliable source of sufficient amounts of current and statistically relevant data to analyze transactions and update some of our products. In most cases, these data must be periodically updated and refreshed to enable our products to continue to work effectively in a changing environment. We do not own or control much of the data that we require, most of which is collected privately and maintained in proprietary databases. Customers and key business partners provide us with the data we require to analyze transactions, report results and build new models. Our business strategy depends in part upon our ability to access new forms of data to develop custom and proprietary analytic tools. If we fail to maintain sufficient data sourcing relationships with our customers and business partners, or if they decline to provide such data due to privacy, security, competitive concerns, regulatory concerns, or prohibitions or a lack of permission from their customers or partners, we could lose access to required data and our products. If this were to happen, our development of new products might become less effective. We could also become subject to increased legislative, regulatory or judicial restrictions or mandates on the collection, disclosure, transfer or use of such data, in particular if such data is not collected by our providers in a way that allows us to legally use the data. Third parties have asserted copyright and other intellectual property interests in these data, and these assertions, if successful, could prevent us from using these data. We may not be successful in maintaining our relationships with these external data source providers or in continuing to obtain data from them on acceptable terms or at all. Any interruption of our supply of data could seriously harm our business, financial condition or results of operations.

We expect that revenues derived from our scoring solutions, fraud solutions, customer communication services, customer management solutions and decision management software will continue to account for a substantial portion of our total revenues for the foreseeable future. Our revenues will decline if the market does not continue to accept these products and services. Factors that might affect the market acceptance of these products and services include the following: - changes in the business analytics industry;- changes in technology;- our inability to obtain or use key data for our products;- saturation or contraction of market demand;- loss of key customers;- industry consolidation;- failure to successfully adopt cloud-based technologies;- our inability to obtain regulatory approvals for our products and services, including credit score models;- the increasing availability of free or relatively inexpensive consumer credit, credit score and other information from public or commercial sources;- failure to execute our selling approach; and - inability to successfully sell our products in new vertical markets.

During fiscal 2024, 92% of our revenues were derived from sales of products and services to the banking industry. Periods of global economic uncertainty experienced in the past have produced substantial stress, volatility, illiquidity and disruption of global credit and other financial markets, resulting in the bankruptcy or acquisition of, or government assistance to, several major domestic and international financial institutions. The potential for future stress and disruptions, including in connection with geopolitical tensions, military conflicts, the level of inflation and the volatility of interest rates, presents considerable risks to our businesses and operations. These risks include potential bankruptcies or credit deterioration of financial institutions, many of which are our customers. Such disruption would result in a decline in the revenue we receive from financial and other institutions. In addition, if consumer demand for financial services and products and the number of credit applications decrease, the demand for our products and services could also be materially reduced. These types of disruptions could lead to a decline in the volumes of products and services we provide our customers and could negatively impact our revenue and results of operations. While the rate of account growth in the U.S. banking industry has been slow, we have generated most of our revenue growth in the banking industry by selling and cross-selling our products and services to large banks and other credit issuers. If the banking industry experiences contraction in the number of participating institutions, we may have fewer opportunities for revenue growth due to reduced or changing demand for our products and services that support customer acquisition programs of our customers. In addition, industry contraction could affect the base of recurring revenues derived from contracts in which we are paid on a per-transaction basis as formerly separate customers combine their operations under one contract. There can be no assurance that we will be able to prevent future revenue contraction or effectively promote future revenue growth in our businesses. While we expand our sales into international markets, the risks are greater as these markets are also experiencing substantial disruption and we are less well-known in them.

Laws and governmental regulation affect how our business is conducted and, in some cases, subject us to the possibility of government supervision or enforcement and future lawsuits arising from our products and services. Laws and governmental regulations also influence our current and prospective customers' activities, as well as their expectations and needs in relation to our products and services. Laws and regulations that may affect our business and/or our current and prospective customers' activities include, but are not limited to, those in the following significant regulatory areas: - Privacy and security laws and regulations that limit the use and disclosure, require security procedures, or otherwise apply to the collection, processing, storage, use and transfer of personal data of individuals (e.g., the U.S. Financial Services Modernization Act of 1999, also known as the Gramm Leach Bliley Act; identity theft, file freezing, security breach notification and similar state privacy laws; and the data protection laws of other countries such as the General Data Protection Regulation (the "GDPR") in the European Union ("E.U.") and the United Kingdom ("U.K."));- Laws and regulations relating to the privacy, security and transmission of protected health information of individuals, including the Health Insurance Portability and Accountability Act of 1996, as amended by the American Recovery and Reinvestment Act of 2009 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH") and their respective implementing regulations;- Financial regulatory reform stemming from the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 and the many regulations mandated by that Act, including regulations issued by, and the supervisory and investigative authority of, the Consumer Financial Protection Bureau ("CFPB") with respect to enumerated federal consumer financial laws and unfair, deceptive, or abusive acts or practices ("UDAAP");- The application or extension of consumer protection laws, including implementing regulations (e.g., the Consumer Financial Protection Act, the Federal Trade Commission Act, the Truth In Lending Act and Regulation Z, the Fair Debt Collection Practices Act and Regulation F, the Servicemembers Civil Relief Act, the Military Lending Act, and the Credit Repair Organizations Act, and similar state consumer protection laws);- Use of data by creditors and consumer reporting agencies (e.g., the U.S. Fair Credit Reporting Act and similar state laws);- Special requirements that may apply when we provide products or services directly or indirectly to U.S. federal, state and local government agencies (e.g., the Privacy Act of 1974, the Internal Revenue Service's Publication 4812, and the Federal Acquisition Regulation);- Laws and regulations that limit the use of credit scoring models (e.g., state "mortgage trigger" or "inquiries" laws, state insurance restrictions on the use of credit-based insurance scores, and the E.U. Consumer Credit Directive);- Fair lending laws (e.g., the Equal Credit Opportunity Act and Regulation B, and the Fair Housing Act) and laws and regulations that may impose requirements relating to algorithmic fairness or accountability;- The Cybersecurity Act of 2015; the U.S. Department of Commerce's National Institute of Standards and Technology's Cybersecurity Framework; the Clarifying Lawful Overseas Use of Data Act; cyber incident notice requirements for banks and their service providers under rules and regulations issued by federal banking regulators; cybersecurity incident disclosure requirements for public companies under regulations issued by the SEC; and identity theft, file freezing, and similar state privacy laws;- Laws and regulations related to extension of credit to consumers through the Electronic Fund Transfers Act and Regulation E, as well as non-governmental VISA and MasterCard electronic payment standards;- Laws and regulations applicable to secondary market participants (e.g., Fannie Mae and Freddie Mac) that could have an impact on our scoring products and revenues, including 12 CFR Part 1254 (Validation and Approval of Credit Score Models) issued by the FHFA in accordance with Section 310 of the Economic Growth, Regulatory Relief, and Consumer Protection Act (Public Law 115-174), and any regulations, standards or criteria established pursuant to such laws or regulations, including the ongoing validation and approval of the use of the FICO Score by Fannie Mae, Freddie Mac, and the FHFA;- Laws and regulations applicable to our customer communication clients and their use of our products and services (e.g., the Telemarketing Sales Rule, Telephone Consumer Protection Act, the CAN-SPAM Act, the Fair Debt Collection Practices Act, and regulations promulgated thereunder, and similar state laws and similar laws in other countries);- Laws and regulations applicable to our insurance clients and their use of our insurance products and services;- Laws and regulations governing the use of the Internet and social media, telemarketing, advertising, endorsements and testimonials;- Anti-money laundering laws and regulations (e.g., the Bank Secrecy Act and the USA PATRIOT Act);- Laws and regulations restricting transactions with sanctioned parties and regarding export controls as they apply to FICO products delivered in non-U.S. countries or to foreign nationals (e.g., Office of Foreign Asset Control sanctions and Export Administration Regulations);- Anti-bribery and corruption laws and regulations (e.g., the Foreign Corrupt Practices Act and the UK Bribery Act 2010);- Financial regulatory standards (e.g., Sarbanes-Oxley Act requirements to maintain and verify internal process controls, including controls for material event awareness and notification);- Laws and regulations that apply to outsourcing of services by our clients, and that set forth requirements for managing third parties (e.g., vendors, contractors, suppliers and distributors); and - Laws and regulations relating to the environmental, social and governance, or sustainability, practices of companies, including enhanced climate-related disclosure requirements from regulators, such as California and the SEC, and the E.U.'s Corporate Sustainability Reporting Directive. Many U.S. and foreign jurisdictions have passed, or are currently contemplating, a variety of consumer protection, data privacy, and cyber and data security laws and regulations that may relate to our business or the business of our customers or affect the demand for our products and services. For example, the GDPR in the E.U. and the U.K. imposes strict obligations and restrictions on the collection and use of E.U. and U.K. personal data, and also on the transfer of such data to countries that have not been determined by the E.U. or the U.K. to provide adequate data privacy protections, unless there are additional approved transfer safeguards in place (such as the use of "standard contractual clauses" and the performance of appropriate data transfer impact assessments). Our implementation of processes to meet such requirements for affected data flows may involve additional compliance costs associated with maintaining appropriate regulatory certifications, performing any necessary assessments, engaging in contract negotiations with third parties and implementing approved standard contractual clauses, and/or (if appropriate) localizing certain data processing activities. Furthermore, such data transfer restrictions, which may involve interpretive issues, may have an adverse impact on cross-border transfers of personal data and may subject us and our customers to additional scrutiny from E.U. or U.K. data protection authorities. Numerous other countries have introduced and, in some cases, enacted, similar data privacy and cyber and data security laws. The California Consumer Privacy Act of 2018 ("CCPA") gives California residents certain privacy rights in the collection and disclosure of their personal information and requires businesses to make certain disclosures and take certain other acts in furtherance of those rights. Additionally, effective January 1, 2023, the California Privacy Rights Act (the "CPRA") revised and significantly expanded the scope of the CCPA. The CPRA also created a new agency, the California Privacy Protection Agency, authorized to implement and enforce the CCPA and the CPRA. Numerous other U.S. states have considered similar privacy laws, with many of those states having passed such laws with respective effective dates ranging from 2023 through 2026. The European Commission has finalized the EU AI Act, which establishes requirements for the provision and use of products that leverage artificial intelligence systems, including in credit scoring. The EU AI Act entered into force on August 1, 2024, and its provisions take effect between six and 36 months after that date, with most of those provisions becoming effective in 2026. Other countries, as well as the executive branch of the U.S. government and a number of U.S. states, are considering or have implemented regulations or standards applicable to the provision and use of artificial intelligence technologies. The costs and other burdens of compliance with such laws and regulations, along with the potential for increased regulatory actions, could negatively impact the use and adoption of our solutions and reduce overall demand for them. Additionally, concerns regarding data privacy and cyber and data security may cause our customers, or their customers and potential customers, to resist providing the data necessary to allow us to deliver our solutions effectively. Even the perception that the privacy or security of personal information is not satisfactorily protected or does not meet regulatory requirements could inhibit sales of our solutions and any failure to comply with such laws and regulations could lead to significant fines, penalties or other liabilities. Any such decrease in demand or incurred fines, penalties or other liabilities could have a material adverse effect on our business, results of operations, and financial condition. In addition to existing laws and regulations, changes in the U.S. or foreign legislative, judicial, regulatory or consumer environments could harm our business, financial condition or results of operations. The laws and regulations above, and changes to them or their interpretation by the courts, could affect the demand for or profitability of our products, including scoring and consumer products. New laws and regulations pertaining to our customers could cause them to pursue new strategies, reducing the demand for our products. We expect there will continue to be an increased focus on laws and regulations related to our business and/or the business of our clients, including with regard to the operation of consumer reporting agencies, the collection, use, accuracy, correction and sharing of personal information, credit scoring, the use of artificial intelligence and machine learning, and algorithmic accountability and fair lending.