Biggest changeFailure to comply with anti-corruption laws and regulations, economic and trade sanctions, anti-money laundering laws and regulations, and similar laws could have a materially adverse effect on our reputation, results of operations or financial condition, or have other adverse consequences Regulators worldwide continue to exercise a high level of scrutiny with respect to anti-corruption, economic and trade sanctions, and anti-money laundering laws and regulations.
Biggest changeOur Wisely® offerings and potentially other future offerings in the payments and/or consumer space may subject us to additional laws and regulations, some of which may not be uniform and may require us to modify or restrict our offerings and decrease our potential revenue and earnings. 16 Failure to comply with anti-corruption laws and regulations, economic and trade sanctions, anti-money laundering laws and regulations, and similar laws could have a materially adverse effect on our reputation, results of operations or financial condition, or have other adverse consequences Regulators worldwide continue to exercise a high level of scrutiny with respect to anti-corruption, economic and trade sanctions, and anti-money laundering laws and regulations.
Nonetheless, the global environment continues to grow increasingly hostile as attacks on information technology systems continue to grow in frequency, complexity and sophistication (including due to the use of AI), and we are regularly targeted by unauthorized parties using malicious tactics, code and viruses. Certain of these malicious parties may be state-sponsored and/or supported by significant financial and technological resources.
Nonetheless, the global environment continues to grow increasingly hostile as attacks on information technology systems continue to grow in frequency, complexity and sophistication (including due to the use of AI), and we are regularly targeted by unauthorized parties using malicious tactics, code and viruses. Certain of these unauthorized parties may be state-sponsored and/or supported by significant financial and technological resources.
Failure to comply with laws and regulations applicable to our operations or client solutions and services could cause us to incur substantial costs or could result in the suspension or revocation of licenses or registrations, the limitation, suspension or termination of services, the imposition of consent orders or civil and criminal penalties, including fines, and lawsuits, including class actions, that could damage our reputation and have a materially adverse effect on our results of operation or financial condition.
Failure to comply with laws and regulations applicable to our operations or client solutions and services could cause us to incur substantial costs or could result in the suspension or revocation of licenses or registrations, the limitation, suspension or termination of services, the imposition of consent orders or civil and criminal penalties, including fines, and lawsuits, including class actions, that could damage our reputation and have a materially adverse effect on our results of operations or financial condition.
While ADP maintains insurance coverage that, subject to policy terms and conditions and a significant self-insured 20 retention, is designed to address losses or claims that may arise in connection with certain aspects of data and cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the continually evolving area of data and cyber risk.
While ADP maintains insurance coverage that, subject to policy terms and conditions and a significant self-insured retention, is designed to address losses or claims that may arise in connection with certain aspects of data and cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the continually evolving area of data and cyber risk.
BUSINESS AND INDUSTRY RISKS Our industry is subject to rapid technological change, including as a result of AI, and if we fail to upgrade, enhance and expand our technology and services to meet client needs and preferences, the demand for our solutions and services may materially diminish Our businesses operate in industries that are subject to rapid technological advances (such as AI) and changing client needs and preferences.
BUSINESS AND INDUSTRY RISKS Our industry is subject to rapid technological change, including as a result of AI, and if we fail to upgrade, enhance and expand our technology and services to meet 20 client needs and preferences, the demand for our solutions and services may materially diminish Our businesses operate in industries that are subject to rapid technological advances (such as AI) and changing client needs and preferences.
Our use of generative AI in our products and operations also introduces additional risks, including risks related to accuracy, bias, security, and privacy. For example, if the data used to train a model or the model’s output is inaccurate or biased, or alleged to be inaccurate or biased, we could be subject to reputational damage or litigation.
Our use of generative AI in our products and operations also introduces additional risks, including risks related to accuracy, bias, transparency, security, and privacy. For example, if the data used to train a model or the model’s output is inaccurate or biased, or alleged to be inaccurate or biased, we could be subject to reputational damage or litigation.
We operate our business around the world, including in numerous developing economies where companies and government officials are more likely to engage in business practices that are 17 prohibited by domestic and foreign laws and regulations, including the United States Foreign Corrupt Practices Act and the U.K. Bribery Act 2010.
We operate our business around the world, including in numerous developing economies where companies and government officials are more likely to engage in business practices that are prohibited by domestic and foreign laws and regulations, including the United States Foreign Corrupt Practices Act and the U.K. Bribery Act 2010.
Further, while we perform due diligence prior to acquisitions and take actions to safeguard the businesses that we acquire, these businesses may not have invested as significantly as we do in security and technology and may be more susceptible to cybersecurity incidents, which may make us more vulnerable to cybersecurity incidents as well.
Further, while we perform due diligence prior to acquisitions and take actions to safeguard the businesses that we acquire, these businesses may not have invested as significantly as we do in security and technology and may be more susceptible to 19 cybersecurity incidents, which may make us more vulnerable to cybersecurity incidents as well.
A reduction in the availability of any such financing during periods of disruption in the financial markets or otherwise may increase our borrowing costs and/or require us to sell available-for-sale securities in our funds held for clients to satisfy our short-term funding requirements.
A reduction in the availability of any such financing during periods of disruption in the financial markets or otherwise may increase our borrowing costs and/or require us to sell 21 available-for-sale securities in our funds held for clients to satisfy our short-term funding requirements.
SECURITY AND TECHNOLOGY RISKS Our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of personal and business information, and collect, hold and transmit client funds, and a security or privacy breach may damage or disrupt our businesses or operations, result in the disclosure of confidential information, damage our reputation, increase our costs, cause losses and materially adversely affect our results of operations In connection with our business, we collect, host, store, transfer, process, disclose, use, secure, retain and dispose of large amounts of personal and business information about our clients, employees of our clients, our vendors and our employees, contractors and temporary staff, including payroll information, health care information, personal and business financial data, social security 19 numbers and their foreign equivalents, bank account numbers, tax information and other personal and business information.
SECURITY AND TECHNOLOGY RISKS Our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of personal and business information, and collect, hold and transmit client funds, and a security or privacy breach may damage or disrupt our businesses or operations, result in the disclosure of confidential information, damage our reputation, increase our costs, cause losses and materially adversely affect our results of operations In connection with our business, we collect, host, store, transfer, process, disclose, use, secure, retain and dispose of large amounts of personal and business information about our clients, employees of our clients, our vendors, our partners, and our employees, contractors and temporary staff, including payroll information, health care information, personal and business financial data, social security numbers and their foreign equivalents, bank account numbers, tax information and other personal and business information.
As part of our overall data protection compliance program in connection with the GDPR, we implemented Binding Corporate Rules (“BCRs”) as both a data processor and data controller, which permits us to process and transfer personal data across borders in compliance with EU data protection laws.
As part of our overall data protection compliance program in connection with the GDPR, we implemented Binding 17 Corporate Rules (“BCRs”) as both a data processor and data controller, which permits us to process and transfer personal data across borders in compliance with EU data protection laws.
In addition, data security events, concerns about privacy abuses by other companies and increased awareness of the potential (positive and negative) of AI are changing consumer and social expectations for enhanced protections (including with respect to bias and potential discrimination).
In addition, data security events, concerns about privacy abuses by other companies and increased awareness of the potential (positive and negative) of AI are changing client, consumer and social expectations for enhanced protections (including with respect to bias and potential discrimination).
In connection with our client funds assets investment strategy, we attempt to minimize the risk of not having funds collected from a client available at the time such 22 client’s obligation becomes due by generally impounding the client’s funds at or before the time of payment of such client’s obligation.
In connection with our client funds assets investment strategy, we attempt to minimize the risk of not having funds collected from a client available at the time such client’s obligation becomes due by generally impounding the client’s funds at or before the time of payment of such client’s obligation.
In addition , self-regulatory frameworks like the National Institute of Standards and Technology AI Risk 18 Management Framework are being promulgated and adherence to these may become an industry standard or a client expectation.
In addition , self-regulatory frameworks like the National Institute of Standards and Technology AI Risk Management Framework are being promulgated and adherence to these may become an industry standard or a client expectation.
We may also be obligated to indemnify our clients, vendors or partners in connection with any such claim or litigation. Even if we were to prevail in such a dispute, any litigation could be costly and time-consuming.
We may also be obligated to indemnify our clients, vendors or partners in 18 connection with any such claim or litigation. Even if we were to prevail in such a dispute, any litigation could be costly and time-consuming.
Although this is a global problem, it may affect our businesses more than other businesses because malevolent parties (which could include our personnel) may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of, and the client funds that we collect and transmit.
Although this is a global problem, it may affect our businesses more than other businesses because unauthorized parties (which could include our personnel) may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of, and the client funds that we collect and transmit.
Such scrutiny has resulted in aggressive investigations and enforcement of such laws and burdensome regulations, any of which could materially adversely impact our business.
Such scrutiny has resulted in aggressive investigations and enforcement of such laws and regulations, any of which could materially adversely impact our business.
We have been, and expect we will continue to be, the subject of cybersecurity attacks, including unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, and theft of sensitive information (including our intellectual property).
We have been, and expect we will continue to be, the subject of cybersecurity attacks, including unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, insider threats, and theft of sensitive information (including our intellectual property).
Our failure to achieve progress in these and other ESG areas on a timely basis, or at all, our failure to fully comply with these new ESG requirements, or our failure to do so in a timely manner, or a negative perception of our ESG initiatives could adversely impact our reputation, business, including employee recruitment and retention, financial results, and growth.
Our failure to achieve progress in these areas on a timely basis, or at all, our failure to fully comply with these requirements, or our failure to do so in a timely manner, or a negative perception of our initiatives could adversely impact our reputation, business, including employee recruitment and retention, financial results, and growth.
As a result, the breach or perceived breach of our security systems could result in a loss of confidence by our clients or potential clients and cause them to choose another service provider, which could have a materially adverse effect on our business, financial condition or results of operations.
As a result, the breach or perceived breach of our security systems or the security systems of our authorized third parties could result in a loss of confidence by our clients or potential clients and cause them to choose another service provider, which could have a materially adverse effect on our business, financial condition or results of operations.
Activist stockholders may create perceived uncertainties as to the future direction of our business or strategy, including with respect to our ESG efforts, which may be exploited by our competitors and may make it more difficult to attract and retain qualified personnel, potential clients and business partners and may affect our relationships with current clients, vendors, investors and other third parties.
Activist stockholders may create perceived uncertainties as to the future direction of our business or strategy which may be exploited by our competitors and may make it more difficult to attract and retain qualified personnel, potential clients and business partners and may affect our relationships with current clients, vendors, investors and other third parties.
While we have contingency plans in place for bank failures, a systemic shutdown of the banking industry would impede our ability to process funds on behalf of our payroll, tax and other money movement services clients and could have an adverse impact on our financial results and liquidity.
While we have contingency plans in place for isolated bank failures and outages, a systemic shutdown of the banking industry would impede our ability to process payments on behalf of our payroll, tax and other money movement services clients and could have an adverse impact on our financial results and liquidity.
Because our PEO is a co-employer with our PEO clients and a Certified PEO by the Internal Revenue Service, we may be subject to certain obligations, responsibilities and liabilities of an employer with respect to Worksite Employees (WSE), including with respect to their wages and the payment thereof, the payment of certain taxes with respect to WSE wages and employee benefits provided to the WSEs.
Because our PEO is a co-employer with our PEO clients and a Certified PEO by the Internal Revenue Service, we may be subject to certain obligations, responsibilities and liabilities of an employer with respect to Worksite Employees ( “ WSE”), including with respect to their wages and the payment thereof, tax credits for employers, the payment of certain taxes with respect to WSE wages and employee benefits provided to the WSEs.
In the future, a cybersecurity attack, unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, theft of non-public or other sensitive information, or similar act by a malevolent party (which could include our personnel), or inadvertent acts or inactions by our vendors, partners or personnel, could result in the loss, disclosure or misuse of confidential personal or business information or our intellectual property or the theft of client or ADP funds, which could have a materially adverse effect on our business or results of operations or that of our clients, result in liability, litigation, regulatory investigations and sanctions or a loss of confidence in our ability to serve clients, or cause current or potential clients to choose another service provider.
In the future, a cybersecurity attack, unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, theft of non-public or other sensitive information, or similar act by an unauthorized party (which could include our personnel) with respect to our businesses or our authorized third parties’ businesses, or inadvertent acts or inactions by our authorized third parties or personnel, could result in the loss, disclosure or misuse of confidential personal or business information or our intellectual property or the theft of client or ADP funds, which could have a materially adverse effect on our business or results of operations or that of our clients, result in liability, litigation, regulatory investigations and sanctions or a loss of confidence in our ability to serve clients, or cause current or potential clients to choose another service provider.
We believe that providing insights and content from data, including via artificial intelligence (AI) and machine learning (ML), will become increasingly important to the value that our solutions and services deliver to our clients.
We believe that providing insights and content from data, including via AI and ML, will become increasingly important to the value that our solutions and services deliver to our clients.
Any such event could prevent or materially delay the recovery of any funds from clients and could have an adverse impact on our financial results and liquidity. We are dependent upon various large banks to execute electronic payments and wire transfers as part of our client payroll, tax and other money movement services.
Any such event could prevent or materially delay the recovery of any funds from clients and could have an adverse impact on our financial results and liquidity. We are dependent upon various financial institutions to execute electronic funds transfer and paper check payments as part of our client payroll, tax and other money movement services.
We have registered our payroll card business as a provider of prepaid access, and registered ADP Trust Bank and ADP Retirement Trust Services with the Treasury Department’s Financial Crimes Enforcement Network (FinCEN). ADP Canada Co. is a registered entity with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a Money Service Business (MSB).
We have registered our prepaid card business as a provider of prepaid access, and registered ADP Trust Bank and ADP Retirement Trust Services with the Treasury Department’s Financial Crimes Enforcement Network. ADP Canada Co. is a registered entity with FINTRAC as a Money Service Business.
Hardware, software, applications or services that we develop or procure from third parties, or are required by third parties such as foreign governments to install on our systems, may contain defects in design or manufacture or other problems that could (or, in respect of third-party software, may be designed to) compromise the confidentiality, integrity or availability of data or our systems.
Hardware, software, applications or services that we develop or procure from authorized third parties, or are required by governmental or law enforcement agencies to install on our systems, may contain defects in design or manufacture or other problems that could (or in respect of third party software, may be designed to) compromise the confidentiality, integrity or availability of data or our systems.
However, legislation that governs the development and/or use of AI has been adopted or is under consideration in the U.S. at the state and local level, as well as abroad.
However, legislation that governs the development and/or use of AI has been adopted or is under consideration in the U.S. at the state and local level, as well as abroad, most notably the European Union’s Artificial Intelligence Act.
Litigation brought to protect and enforce our intellectual property rights could be costly and time-consuming. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights, which may be successful.
Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights, which may be successful.
In addition, while our operating environments are designed to safeguard and protect confidential personal and business information, we may not have the ability to monitor the implementation or effectiveness of any safeguards by our clients, vendors or partners and, in any event, third parties may be able to circumvent those security measures.
While our operating environments are designed to safeguard and protect confidential personal and business information, we do not have the ability to monitor the systems, personnel or physical facilities of, or the implementation or effectiveness of any safeguards by, our clients or our authorized third parties and, in any event, unauthorized parties have circumvented in the past, and may in the future be able to circumvent, those security measures.
Unauthorized parties have also attempted to gain (and in certain cases have gained), and will continue to attempt to gain, access to our systems or facilities, or those of third parties with whom we do business, through fraud, trickery, or other methods of deceiving these third parties or our personnel, including phishing and other social engineering techniques whereby attackers use end-user behaviors to distribute computer viruses and malware into our systems or otherwise compromise the confidentiality, integrity or availability of data or our systems.
Unauthorized parties have also attempted to gain (and in certain cases have gained), and will continue to attempt to gain, access to our systems and facilities, and those of our authorized third parties, through fraud, trickery, and other methods of deceit, including using stolen identities to obtain employment with us or our authorized third parties as well as phishing and other social engineering techniques whereby attackers use end-user behaviors to distribute computer viruses and malware into our systems, our authorized third parties’ systems or otherwise compromise the confidentiality, integrity or availability of data or our systems.
Competition for skilled employees in the outsourcing and other markets in which we operate is increasingly intense, making it more difficult and expensive to attract and retain highly skilled, motivated and diverse personnel. If we are unable to attract and retain highly skilled, motivated and diverse personnel, results of our operations and culture may suffer.
Competition for skilled employees in the outsourcing and other markets in which we operate is increasingly intense, making it more difficult and expensive to attract and retain highly skilled, motivated and diverse personnel.
In addition, the steps we take to protect our intellectual property rights may be inadequate or ineffective, or may not provide us with a significant competitive advantage. Our intellectual property (including source code) could be wrongfully acquired as a result of a cyber-attack or other wrongful conduct by third parties or our personnel.
In addition, the steps we take to protect our intellectual property rights may be inadequate or ineffective, or may not provide us with a significant competitive advantage.
Any such event could prevent or materially delay the recovery of any payments not timely remitted and could have an adverse impact on our financial results and liquidity.
Any such event could prevent or materially delay the recovery of any payments not timely remitted and could have an adverse impact on our financial results and liquidity. In addition, our payroll and tax processing services involve the collection and disbursement of a significant amount of funds to a large number of federal, state and local tax authorities.
Information or system access obtained by malevolent parties (which could include our personnel) resulting from successful attacks against our clients, vendors, partners or other third parties may, in turn, be used to attack our information technology systems.
Information or system access obtained by unauthorized parties (which could include our personnel) resulting from successful attacks against our clients or our authorized third parties may, in turn, be used to attack and compromise our information technology systems, or result in production downtimes and operational disruptions that could have a material adverse effect on our business, results of operations or financial condition.
From time to time, these systems, applications or solutions fail to operate properly or become disabled.
From time to time in the past, these systems, applications or solutions have failed to operate properly or become disabled, and they may do so in the future.
In addition, the nature of the office environment and remote or hybrid working is changing, which may make it more difficult to attract and retain personnel. It may also present operational and workplace culture challenges that may adversely affect our business. 23 Item 1B. Unresolved Staff Comments None.
It may also present operational and workplace culture challenges that may adversely affect our business. 23 Item 1B. Unresolved Staff Comments None.
There has also been an increase in current and proposed ESG regulations, standards and reporting requirements, which may result in legal and regulatory uncertainty as well as increased compliance costs for our business. Further, developments in the law relative to diversity may influence our talent strategies.
We publicly share certain information about our corporate social responsibility initiatives and we may face increased scrutiny related to these initiatives. Further, regulations, standards and reporting requirements in this respect continue to evolve, and may be inconsistent across jurisdictions, which may result in legal and regulatory uncertainty as well as increased compliance costs for our business.