Visa 2012 Annual Report Download - page 28

Table of Contents
revenues . If such attacks are not detected immediately, their effect could be compounded. Finally, potential and actual attacks
could also result in increased costs, both for recovery and for prevention against future attacks.
Additionally, we rely on service providers for the timely transmission of information across our global data network. If a service
provider fails to provide the communications capacity or services we require because of a natural disaster, operational disruption,
terrorism or any other reason, the failure could interrupt our services. Because of the centrality of our processing systems to our
business, any interruption or degradation could adversely affect the perception of our brands' reliability and materially reduce our
revenues or profitability.
Account data breaches involving card data processed, stored or transmitted by third parties or by us could adversely
affect our reputation and revenues.
Our clients, merchants, others and we process, store or transmit cardholder account information in connection with Visa-
branded payment cards. In addition, our clients may use third-
party processors to process transactions generated by cards carrying
our brands. Breach of the systems processing, storing or transmitting sensitive cardholder data and account information could lead
to fraudulent activity involving Visa-branded cards, to reputational damage and to claims against us. If we are sued in connection
with any material data security breach, we could be involved in protracted litigation. If unsuccessful in defending such lawsuits, we
may have to pay damages or change our business practices or pricing structure, any of which could have a material adverse effect
on our revenues and profitability. In addition, any reputational damage resulting from an account data breach at one or more of our
clients, merchants or other third parties could decrease the use and acceptance of our cards, which could have a material adverse
impact on our payments volume, revenues and future growth prospects. Finally, any data security breach could result in additional
regulation, which could materially increase our costs.
An increase in fraudulent or other illegal activity involving our cards could lead to reputational damage to our brands and
reduce the use and acceptance of our cards.
Criminals are using increasingly sophisticated methods to capture cardholder account information. They use the information to
conduct fraudulent transactions and to engage in other forms of illegal activities involving the payment system. Outsourcing and
specialization of functions within the payments system are increasing. As a result, more third parties are involved in processing
transactions using our cards. A rise in fraud levels and other illegal activities involving our cards could lead to reputational damage
to our brands. This could reduce the use and acceptance of our cards or lead to greater regulation, increasing our compliance
costs.
Failure to maintain interoperability between our and Visa Europe's authorization and clearing and settlement systems
could damage the business and global perception of the Visa brands.
Visa Europe and we maintain mostly separate authorization, clearing, and settlement systems. As a result, we have to ensure
that the two systems can process every transaction involving both of our territories, regardless of where it originates. Visa Europe's
independent system operations could present challenges to our business due to the heightened difficulty of maintaining the
interoperability of our respective systems. Failure to authorize or clear and settle inter-territory transactions quickly and accurately
could impair the global perception of the Visa brands.
Structural and Organizational Risks
We have little ability to control Visa Europe's operations and limited recourse if it breaches its obligations to us.
Visa Europe has very broad rights to operate the Visa business in its region under the agreement that governs our
relationship. If we want to change a global rule or to implement certain changes that would not have a positive return for Visa
Europe and its members, then Visa Europe is not required to implement that rule or change unless we agree to pay for the
implementation costs and expenses that Visa Europe and its members will incur as a consequence of the implementation.
If Visa Europe fails to meet its obligations, our remedies under this agreement are limited. We cannot terminate the agreement
even upon Visa Europe's material, uncured breach. Although we have a call right to acquire Visa Europe, we can exercise that right
under only extremely limited circumstances.
These and other features of the licenses granted under the agreement may also raise issues concerning the characterization
of the licenses for purposes of tax treatment of entry into the licenses and payments received thereunder.
In some instances, as in the case of CyberSource and PlaySpan, Visa Europe may have the right to control
26