Item 1A. Risk Factors
Risk Factor Summary
Below is a summary of the principal risk factors that could impact our business, financial condition, or operating results. Additional discussion of the risks summarized in this risk factor summary, and other risks that we face, can be found after this summary, and should be carefully considered.
•Risks Related to Our Business and Industry
◦Failing to maintain and protect our brand, independence, and reputation may harm our business
◦Failing to create innovative, proprietary and insightful product and service offerings or anticipate our clients’ changing needs may negatively affect our competitive position and business results
◦Prolonged volatility or downturns affecting the financial sector, global financial markets, and the global economy may impact our results
•Risks Related to Our Information Technology and Security
◦We could face significant reputational and financial consequences relating to cybersecurity and the protection of confidential information, including personal information about individuals
◦The AI technologies we are incorporating into certain of our products and processes may present business, legal and reputational risks
◦Our business, products and facilities are at risk of a number of material disruptive events, which our operational risk management and business continuity programs and insurance coverage may not be adequate to address
◦We could face liability for failing to adequately protect or properly use the information and data we collect, store, use, create, and distribute or the reports and other documents we publish or that are produced by our software products
◦Failure to protect our intellectual property rights, or claims of intellectual property infringement against us, could harm our brand, our financial performance and our ability to compete effectively
•Risks Related to Legal and Regulatory Matters
◦Compliance failures, regulatory action, or changes in laws applicable to our credit ratings operations, investment advisory, ESG and index businesses could adversely affect our business
◦Errors in our automated advisory tools may subject us to liability for any losses that result
•Risks Related to Our Operations
◦Our future success depends on our ability to recruit, develop, and retain qualified employees
◦Our business is complex and has experienced significant growth in recent years which could strain our resources and infrastructure, and if we are unable to effectively scale our operations and increase productivity, we may not be able to successfully implement our business plan
◦Our acquisitions and investments in companies or technologies may not realize the expected business or financial benefits and acquisitions could prove difficult to integrate, disrupt our business, dilute stockholder value and adversely affect our operating results and the market value of our common stock
◦The goodwill of our business and other intangible assets from our acquisitions could be impaired as a result of business conditions in the future, requiring us to record substantial impairments that would impact our operating income
◦Today’s fragmented geopolitical, regulatory, and cultural world could adversely affect our ability to expand our product and service offerings
◦As a global taxpayer, we face challenges due to increasing complexities in accounting for taxes (e.g., base erosion, minimum taxes, and tax transparency), which are high priorities in jurisdictions in which we operate and could materially affect our tax obligations and effective tax rate
◦Our revenues, expenses, assets and liabilities are subject to fluctuations in foreign currency exchange rate
◦Our indebtedness could adversely affect our cash flow and financial flexibility. Our variable rate indebtedness could subject us to interest rate risk, which could cause our debt service obligations to increase significantly
•Risks Related to Ownership of Our Common Stock
◦The concentrated ownership position of Joe Mansueto could adversely affect our other shareholders
◦Fluctuations in our operating results may negatively affect our stock price
◦The future sale of shares of our common stock may negatively affect our stock price
31
Table of Contents
Risk Factors
You should carefully consider the risks and uncertainties described below and all of the other information included in this Report when deciding whether to invest in our common stock or otherwise evaluating our business. If any of the following risks or uncertainties materialize, our business, financial condition, or operating results could suffer. In that case, the trading price of our common stock could decline, and you may lose all or part of your investment. Our operations could also be affected by other risks and uncertainties that are not presently known to us or that we currently consider to be immaterial to our operations.
Risks Related to Our Business and Industry
Failing to maintain and protect our brand, independence, and reputation may harm our business. Our reputation and business may also be harmed by allegations made about possible conflicts of interest, by other negative publicity or media reports, or by adverse outcomes in regulatory proceedings.
We believe that the reputation of our company and our brand generally, as well as the perception of our research and ratings products and services, is based on the trust that users of our products and services have in our commitment to our mission of empowering investor success, our independence of editorial judgment, our insistence on methodological rigor, and our transparency concerning our processes. Any failure to uphold these commitments and standards and real or perceived failure of our customers to have consistently positive experience with us could damage our reputation. Our reputation may also be harmed if any errors are found in our products or services.
Our ESG offerings has, and may in the future, put Morningstar in the public debate over a variety of issues surrounding climate, environment, social concerns, and corporate governance. Our position as an independent provider of investor choice may cause proponents of certain causes to question the adequacy, completeness and objectivity of our methodologies and models and of the data underlying them; the timing and nature of changes in our ratings or assessments and in other products, such as indexes, built on these ratings and assessments; the independence of our ratings determinations and editorial decisions and the influence of third parties, including governments and large institutional investors or asset owners, on such determinations or decisions; and our role in and influence upon various investment processes. Our position as a leading source of ESG research and opinions may also cause proponents of various causes to demand that we publicly take stands on a variety of controversial topics perceived by them as relevant to investor success or the evolving expectations of businesses; however, we may believe we are unsuited or unprepared to address some or all of these topics. New research and ratings offerings face a challenge to create objective, understandable methodologies in a rapidly developing field currently without widely accepted standards and for which regulatory oversight is emerging. Our methodologies generally are susceptible to potential claims of imprecision, empirical or methodological error, bias and puffery. We evaluate the potential impact of ESG factors on other companies and risk a claim of hypocrisy if we take or fail to take actions at the company level that are or seem inconsistent with our own sustainability and corporate responsibility policies and practices, including publicly disclosed ESG and climate-related targets and goals. Our failure to successfully navigate these issues as they arise from time to time may have an adverse effect on our reputation and our business.
As our business has evolved, we have entered lines of business and business arrangements that may give rise to allegations of conflicts of interest or perceived failures of our independence. We provide ratings, analyst research, and investment recommendations on mutual funds, ETFs and other investment products offered by our institutional clients. While we don’t charge asset management firms for their products to be rated, we do charge licensing fees for the use of our ratings. We also provide investment advisory and investment management services, including through our own series of mutual funds, which expose us to the claim that we are acting as both a referee and a player in the investment management industry. In our credit ratings business and Morningstar Sustainalytics’ Sustainable Finance Solutions products we are participants in an issuer-pay business model under which we receive payments from issuers for our ratings rather than from the investors who consume such ratings. These payments may create the perception that our ratings and research in these areas are not independently determined.
32
Table of Contents
The expansion of our business over time, including through acquisitions, has resulted in greater exposure to governmental regulation across our product lines and risks that acquired businesses may harbor business practices that could harm our brand. In some cases, such as with respect to our credit ratings business, interactions with regulators are extensive and continuous, raising the risk of enforcement investigations and proceedings. To the extent any of those investigations or proceedings result in a finding of misconduct or noncompliance, they could pose a significant reputational risk to us and negatively impact our business. Regardless of source, allegations of improper conduct, whether the ultimate outcome is favorable or unfavorable to us, as well as negative publicity or media reports about Morningstar and its relationships with third parties, whether valid or not, may harm our reputation and damage our business.
Our reputation may also be harmed by factors outside of our control, such as news reports about our clients, consultants, or suppliers, adverse publicity about certain types of investment and ratings products generally. We may also suffer brand dilution as our brand becomes associated with an ever more diverse variety of products and services that may align less well with our corporate mission. In addition, any failures by us to continue to instill effectively in our employees the non-negotiable expectation of independence and integrity may devalue our reputation over time and negatively affect both hiring and retention efforts.
Failing to create innovative, proprietary and insightful product and service offerings, keep pace with new investor requirements and technology developments, and trends, or anticipate our clients’ changing needs may negatively affect our competitive position and business results.
We believe innovation in financial information services and investable products available to investors and the various advisers and other intermediaries who serve them continues to accelerate. Developments in technology are fundamentally changing the ways investors, financial intermediaries, and other market participants access data and content, allowing for greater personalization of products customized to individual investor profiles and interests, such as direct indexing and sustainability goals-based investing. These developments can render our existing products less competitive, obsolete or unmarketable. As a result, our future success will continue to depend upon our ability to identify and develop new products and enhancements that address the future needs of our current and target markets and to deliver them in ways that support our customers’ investing needs and business models and on our ability to keep pace with the competitive landscape for our products.
Our core competencies are around data and research, technology, and design. Morningstar deploys each of these to create unique intellectual property, products, and solutions that clearly convey complex investment information to various investors, including individuals, financial advisors, asset managers, retirement plan providers and sponsors, institutional investors in the private capital markets, and participants in the fixed income markets. Our customers have access to a wide selection of investment data, fundamental equity research, manager research, credit ratings, private capital markets research, and ESG data and research, directly on Morningstar’s proprietary desktop or web-based software platforms, or through subscriptions, data feeds, and third-party distributors. Our financial technology solutions also allow advisors to serve investors at all stages of the investing process. Morningstar’s managed portfolio offerings help advisors outsource investment selection and asset allocation through proprietary portfolio strategies based on Morningstar’s valuation-driven, fundamentals-based approach to investing. Applying its expertise in asset allocation, investment selection, and portfolio construction, our global investment team creates long-term investment strategies built on Morningstar’s data and ratings. We also help retirement plan sponsors build high-quality savings programs for employees and advise participants in retirement plans on saving for retirement and choosing plan investments. We believe the breadth and depth of our current service offerings set us apart from our competitors, which we believe is a significant competitive advantage.
If we fail to continuously innovate and develop new datasets, research, methodologies, content or software to meet the needs of our customers, or fail to successfully communicate such innovations and developments in our offerings to our customers, our competitive position and business results may suffer. In addition, our reputation could be harmed if we are perceived as not moving quickly enough to meet the changing needs of investors or their financial advisors and may sacrifice new business opportunities or renewals from existing customers. These changing needs include a greater expectation that advice be delivered with a high degree of personalization. Investors are also increasingly focused on the security of data we collect from them, as well as the sharing of their data with third parties. Increased interest in alternative asset classes has also created a need for applicable datasets and analytical expertise. Our competitive position and business results may suffer if other companies have greater breadth of product offerings or are able to successfully and more quickly introduce innovative, proprietary research tools and software, including through the application of AI, that gain attention from our clients.
33
Table of Contents
In addition, the value of our products and services may be negatively affected by the increasing amount of information and tools that are available for free, or at low cost, through Internet sources or other low-cost delivery systems, and by the ability of machine learning and other AI systems to process and organize large data sets. The impact of costs-cutting pressures across the industries we serve could lower demand for our products. Also, clients within the financial services industry that strive to reduce their operating costs may seek to reduce their spending on our products and services or may build in-house capability to provide the technology or investment advisory services they would otherwise purchase from us. Although we believe our products and services contain value-added features and functionality that deeply embed them in our customers’ workflows, these developments may over time reduce the demand for, or customers’ willingness to pay for, certain of our products and services.
We must make long-term investments and commit significant resources often before knowing whether those investments will result in products or services that satisfy our clients’ needs or generate revenues sufficient to justify the investments. Our software development process is based on frequently rolling out new features so that we can quickly incorporate user feedback. However, at times adoption of new features or enhanced versions is slowed by the significant client investment required for more advanced use cases. In addition, from time to time, we also incur costs to transition clients to new or enhanced products, systems, or services, as well as additional operating expenses supporting multiple platforms for extended periods of time if clients decline to migrate to the new or enhanced products, systems or services. Such transitions can involve material execution risks and challenges and we cannot guarantee that we will successfully adapt our product offerings to meet evolving customer needs or that the transition to such new offerings will be seamless. If we are unable to manage these investments and transitions successfully, our business, financial condition, and results of operations could be materially and adversely affected.
As our financial intermediary customers further automate their business processes, their need for our products may change and the technological flexibility and interoperability of our systems may become more important. For example, the COVID-19 pandemic and the increase in remote and hybrid work environments has accelerated advisor and client demand for digital, friction-free technology and experiences with our turnkey asset management platform, shining a light on dated, legacy operational workflows. In addition, there has been an increasing focus on technology not merely supplying additional tools for users, but also offering solutions to specific client problems, such as those we are seeking to address for wealth advisors through bringing together our multiple wealth management capacities around asset management, data aggregation and client portfolio management software. We have a myriad of potential technology investments across our product lines and need to prioritize scarce technology development resources to focus on products that best anticipate the needs and priorities of our customers. In addition, only a limited number of employees have expertise in the software used for certain of our products. The loss of any such employees could negatively impact our development process.
Our technology is also heavily dependent on the quality and comprehensiveness of our data and our ability to successfully build analytics, research, and other intellectual property around that data. For example, in order to provide the personalized holistic advice that clients value, we need to collect, organize, and protect large, non-homogenous datasets and synthesize and effectively analyze the insights offered by this data. We are investing significant resources in consolidating our various data assets and improving their usability and deliverability across our platform of products. Our competitive position and business results may suffer if we fail to realize the value and potential of our data assets.
Additionally, our ability to continue to innovate and develop new products is reliant on the products of other vendors, including data, software and services vendors. Some of our products and offerings are dependent upon obtaining updates from data vendors as well as dependent on continuing access to current and historical data. Furthermore, many of our vendors are also competitors, and our ability to continue to provide our products and develop new products could be impacted if the vendors terminate our agreements with them or decide to change the terms or restrict use of the data and products, which could materially harm our business.
34
Table of Contents
Prolonged volatility or downturns affecting the financial sector, global financial markets, and the global economy may impact our financial results.
Our business results are partly driven by factors outside of our control, including general economic and financial market trends which may be impacted by changes in interest rates, availability of credit, inflation rates, changes in laws, trade barriers, commodity prices, currency exchange rates and controls, and national and international geopolitical circumstances and uncertainties. Prolonged economic and financial downturns, sustained volatility in the financial markets, interest and inflation rate fluctuations and periods of stagflation, and a lack of investor confidence can reduce investor interest and investment activity and decrease demand for our software, data, analyst ratings, and research products and flows of funds into our investment management products. We cannot predict the occurrence, timing or duration of any economic downturn, generally or in the markets in which our businesses operate. Fluctuations in interest rates and rate uncertainty brought on by central bank decisions that reduce credit issuance has, and may continue to, put negative pressure on our credit ratings business. Continued unfavorable trends in the market environment in which we operate could cause a corresponding negative effect on our business results. As a result, we may experience lower revenue, operating income, and other financial results in the event of a sustained market downturn.
For our licensed-based businesses, many of our customers are asset-management and financial advisory firms and other financial-services companies, which are also subject to external trends. The ascendance of passive investment strategies may affect both the profitability of asset managers, on whose success we in part depend, and the perceived value of our research regarding such strategies. A sustained global recession or other financial downturn or crisis would likely lead to material spending cutbacks among many of the companies to which we sell and longer sales cycles. Consolidation in the financial services sector reduces the number of potential clients for our products and services. Further, clients may discontinue their use of our products and services should they fail and/or merge with or become acquired by other entities that are not our clients or that use fewer of our products and services. These trends could impact demand for our products and services or change the financial services landscape in which we operate.
Many companies in the financial services industry have also been subject to sustained pressure to reduce fees. As a result, many of these firms have sought to reduce their operating costs by working with fewer service providers and/or negotiating lower fees for services they purchase. Our PitchBook business is also subject to cyclical trends specific to the private capital markets. Many of PitchBook’s clients are investment banks and other participants in the capital and M&A markets, which are subject to periodic business downturns driven by changes in such markets. During these downturns, they often seek to reduce spending on third-party services, as well as the number of employees, which would directly and adversely affect the number of prospective users for the PitchBook platform.
The amount of asset-based revenue we earn primarily depends on the value of assets on which we provide advisory services, and the size of our asset base can increase or decrease based on market performance. Our revenue from asset-based fees has been, and may in the future be, adversely affected by market declines. Asset levels can also be affected if inflows into the portfolios for which we provide investment advisory services drop or if these portfolios experience redemptions. A drop in inflows or an increase in redemptions can result from a variety of factors, including overall market conditions or uncompetitive investment performance. If the level of assets on which we provide investment advisory or investment management services goes down, we would expect our fee-based revenue to show a corresponding decline. The industrywide trend toward lower asset-based fees may also impact our fee-based revenue. A shift by investors to non-traditional asset classes such as cryptocurrencies, private debt, real estate, structured products, and collectibles may affect our assets under management if we are unable to incorporate them into our investment strategies or if they fail to perform in the manner that our research anticipates.
Our credit ratings business, as well as Morningstar Sustainalytics’ Second Party Opinion business, have been, and may continue to be, impacted by volatility in U.S. and international financial markets due to their dependence on the number and dollar volume of debt securities issued in the capital markets. In particular, recently our credit ratings business has, and may continue to be, impacted by reduced issuance of commercial mortgage-backed securities in the United States. Market disruptions, rising interest rates, widening credit spreads and economic slowdowns historically have impacted the volume of debt securities issued in global capital markets and the demand for credit ratings and ESG-related ratings and opinions. Demand for credit ratings can also be negatively affected by negative publicity about the credit ratings business, regulatory and political developments, growth in the use of alternative sources of credit, and defaults by significant issuers. Our ability to reduce costs in the event of such adverse developments can be negatively impacted by, among other things, our obligations to monitor and maintain outstanding ratings. Declines or other changes in the markets for debt securities may materially and adversely affect our business, operating results, and financial condition.
35
Table of Contents
Risks Related to Our Information Technology and Security
We could face significant reputational and financial consequences relating to cybersecurity and the protection of confidential information, including personal information about individuals.
Our business requires that we securely collect, process, store, and transmit confidential information, including personal information, relating to our operations, customers, employees, and other third parties. We continuously invest in systems, processes, controls, and other security measures designed to guard against the risk of improper access to or release of such information. However, these measures do not guarantee absolute security, and improper access to or release of confidential information may still occur through employee error or malfeasance, system error, other inadvertent release, failure to properly purge and protect data, failure to apply consistent security measures throughout our business or cyberattack.
We may be targeted by malicious individuals or groups (including those sponsored by nation-states or terrorist organizations) seeking to attack our products and services or penetrate our network infrastructure to gain access to intellectual property, confidential or personal information, or to facilitate distributed denial of service attacks. While we have dedicated resources responsible for cybersecurity and have implemented systems and processes intended to help identify cyberattacks and protect and remediate security issues in our software and network infrastructure, these attacks have become increasingly frequent, sophisticated, and difficult to detect. Even in cases where an attack is ultimately detected, based on industry data, incidents may go undetected for several months. Our measures may not be adequate or designed to prevent all eventualities or all types or sources of attacks, and we may be vulnerable to circumvention of security systems, denial of service attacks or other cyberattacks, hacking including “hacktivism”, “phishing” or other social engineering attacks, computer viruses, ransomware or malware, employee or insider error, employee or vendor malfeasance, physical breaches or other malicious actions. We offer a hybrid work environment, which provides employees with the flexibility to work remotely (and use personal devices) which introduces unique risk management challenges.
We may also be impacted by a cyberattack targeting one of our vendors or within our technology supply chain or infrastructure, including cloud providers. Our information technology systems interact with those of customers, vendors, and service providers and collect an increasing amount of confidential data as we expand our product and service offerings. As a result, inadequacies of third party security technologies and practices introduce additional monitoring risk and cost and may only be detected after a security breach has occurred. Additionally, as we continue to offer a hybrid work environment which provides employees with the flexibility to work from remote locations we continue to rely on video conferencing, web conferencing and cloud services in order to operate magnifying the importance of the integrity of our remote access security measures and which may expose us to additional cyber risks.
We are subject to regulatory expectations for the oversight of users, vendors and service providers, which further increase our compliance obligations. In addition, the proliferation of personal information privacy regimes across the globe have made scalable and comprehensive compliance practices ever more complex and costly to implement.
Any failure to safeguard confidential information or any material cybersecurity failures or incidents in our systems (or the systems of a customer, vendor, or service provider which stores or processes confidential information for which we are responsible, including cloud providers) could cause us to experience reputational harm, loss of customers, regulatory actions, sanctions or other statutory penalties, litigation, or financial losses and increased expenses related to addressing or mitigating the risks associated with any such material failures or incidents.
In addition to the risks above, we may also be subject to specific obligations relating to personal information and personal financial information. Our products and websites in certain cases collect, store, process, and transmit personal information about an individual, including financial information such as portfolio holdings, account numbers, and credit card information. Our business also operates across national borders and routinely moves personal information from one jurisdiction to another. Regulators and political leaders in various countries are increasingly interested in restricting cross-border data transfers that they perceive as problematic. We and our customers are often subject to federal, state, and foreign laws relating to privacy, cybersecurity, and data protection. The scope of applicable laws may be uncertain and required practices may be inconsistent with laws of other jurisdictions.
36
Table of Contents
Consequently, our business is subject to a variety of continuously evolving and possibly conflicting regulations and customer requirements. Our compliance with these changing and increasingly burdensome regulations and requirements may cause us to incur substantial costs or require us to change our business practices which may impact financial results. If we fail to comply with these regulations or requirements, we may be exposed to litigation expenses and possible significant liability, fees, or fines. For example, in the EU, noncompliance with the General Data Protection Regulation (GDPR) requirements could result in penalties of up to the greater of €20 million or 4% of worldwide revenues.
One of Morningstar’s core strengths is the ability to collect data and enrich it with data from another part of the business to provide valuable information and insights to investors. As data is accessible across our products, consistent data privacy practices and disclosure becomes more important and challenging. Failure to comply with our public statements or to adequately disclose our privacy or data protection practices could result in costly investigations by governmental authorities, litigation, and fines as well as reputational damage and customer loss.
We also from time to time acquire other companies that collect and process personal information. While we perform extensive due diligence on the technology systems and practices of these companies, there can be no assurance that such companies have not suffered data breaches or system intrusions prior to or continuing after our acquisition for which we may be liable. Acquired businesses may not have invested as heavily in such security measures or data privacy controls, and they introduce additional cybersecurity and data privacy risk as their systems are integrated with ours. Even after an acquisition is completed, time is required to integrate the acquired business' technology and processes, which may result in an increased risk of security incidents until the integration for the new business is completed.
While we maintain insurance coverage that is intended to address certain aspects of cybersecurity and data protection risks, such coverage may not be sufficient to cover all or the majority of the costs, losses, or types of claims. Our insurance coverage would not extend to any reputational damage, loss of customers, or required improvements to our systems.
The AI technologies we are incorporating into certain of our products and processes may present business, legal, and reputational risks.
We use, and may continue to expand our use of, machine learning and AI technologies into certain of our products and processes. If other firms incorporate AI technologies into their products and offerings more effectively than we do, or if we otherwise fail to keep pace with rapidly evolving AI technological developments, our competitive position and business results may suffer. At the same time, use of AI has recently become the source of significant media attention and political debate. The introduction of AI technologies, particularly generative AI, into new or existing offerings may result in new or expanded risks and liabilities, including due to enhanced governmental or regulatory scrutiny, litigation, compliance issues, ethical concerns, confidentiality or security risks, as well as other factors that could adversely affect our business, reputation, and financial results. For example, AI technologies can lead to unintended consequences, including generating content that appears correct but is factually inaccurate, misleading or otherwise flawed, or that results in unintended biases and discriminatory outcomes, which could harm our reputation and business and expose us to liability. We may also not identify inaccurate information, which may expose us to liability. Laws, regulations or industry standards that develop in response to the use of AI may be burdensome or may significantly restrict the deployment of AI, particularly generative AI technologies, in our products or processes.
We use AI technologies from third parties, which may include open-source software. If we are unable to maintain rights to use these AI technologies on commercially reasonable terms, we may be forced to acquire or develop alternate AI technologies, which may limit or delay our ability to provide competitive offerings and may increase our costs. These AI technologies also may incorporate data from third-party sources, which may expose us to risks associated with data rights and protection, and may also lead to the unintended consequences of using AI discussed above. The intellectual property ownership and license rights surrounding AI technologies as well as data protection laws related to the use and development of AI are currently not fully addressed by courts or regulators. The use or adoption of AI technologies into our products may result in exposure to claims by third parties of copyright infringement or other intellectual property misappropriation, which may require us to pay compensation or license fees to third parties. The evolving legal, regulatory and compliance framework for AI technologies may also impact our ability to protect our own data and intellectual property against infringement.
37
Table of Contents
Our business, products and facilities are at risk of a number of material disruptive events, including an outage of our database, technology-based products and services or network facilities, which our operational risk management and business continuity programs and insurance coverage may not be adequate to address.
Our business and several of our major products are dependent on our ability to provide data, software applications, and other products and services on a current and time-sensitive basis. We rely extensively on our computer systems, database storage facilities, and other network infrastructure, which are located across multiple facilities in the U.S. and globally. Our computer systems, database and network facilities may be vulnerable to external attacks that misappropriate our data, corrupt our databases, or limit access to our information systems. Further, our operations and those of our vendors and customers are at risk of disruptions from numerous factors, including pandemic, violent incident, natural disaster, power loss, terrorist attack, telecommunications and Internet failures, civil unrest, cybersecurity attacks and breaches, and other events beyond our reasonable control. Our exposure to these types of disruptions may be more acute in circumstances where our business activities expose us to potential controversy and opposition, including various ESG-related matters. We are also subject to potential shortcomings in our own business resilience practices, such as failures to fully understand dependencies between different business processes across the locations in which they are performed, inadequate vendor risk assessment and management processes and critical vendor dependencies, concentration of certain critical activities in areas of geopolitical risk, concentration of certain skills and know-how with small groups of key employees, and possibly ineffective recovery strategies in the event of a disruption. As we have grown in recent years through acquisitions and continue to do so in the future, the newly acquired businesses may not have invested in technological infrastructure and disaster recovery to the same extent as we have. As their systems are integrated into ours, a vulnerability could be introduced, which could impact our platforms across the company.
We engage third party vendors in several locations, including Colombia, India, and Ukraine, which provide contract labor in support of our operations. If a pandemic, war, natural disaster, violent incident, or another dangerous emergency significantly impacted the safety or communication connectivity of people living in and around these locations and/or at our significant office locations including but not limited to our corporate headquarters in Chicago, Illinois and our data collection, technology, and operational center in Mumbai, India, we might not be able to continue business operations at an acceptable level that would meet all our legal and contractual commitments. Each of these locations has experienced or may in the future experience various types of geopolitical risks and changes in laws and regulations relating to data privacy, security, protection of intellectual property rights, and acceptable telecommunication infrastructure which create uncertainty regarding our long-term operations there. Any extended disruptions to our operations in these locations would make it difficult for us to meet our operating goals.
We do have a long-standing relationship with a third-party vendor in Ukraine which provides contract labor in support of development efforts at PitchBook. Our team has provided financial help and other assistance to these individuals and to date, we have been able to maintain the operations conducted by our contractors in Ukraine at an acceptable level. Through advanced preparation and business continuity planning, there has been limited disruption to the operations of PitchBook or our clients’ access to the platform. However, the situation remains volatile and our team continues to monitor new developments to guard against negative impacts to our operations.
We have shifted the storage of a majority of our data and delivery of several of our products and services to cloud-based delivery systems. We rely on cloud providers and other vendors to maintain, service, and improve our technological infrastructure, which underpins and protects our data, research, and other products and services. Some of these providers have recently experienced widely reported service disruptions that affected numerous customers including ourselves. To defend against these threats, we have implemented a series of controls focusing on both prevention and detection, including firewalls, intrusion detection systems, automated scanning and testing, server hardening, antivirus software, training, and patch management. We make significant investments in servers, storage, and other network infrastructure to prevent incidents of network failure and downtime, but we cannot guarantee that these efforts will work as planned. If disruptions, failures, or slowdowns of these electronic delivery systems or the Internet occur, our ability to distribute our products and services effectively and to serve our customers could be negatively impacted. In addition, the daily activities and productivity of our work force is now closely tied to key vendors, such as video conferencing services, to consistently deliver their services without material disruption. Our ability to deliver information using the Internet and to operate in a hybrid working environment may be impaired because of infrastructure failures, service outages at third-party Internet providers, malicious attacks, or other factors. If disruptions, failures, or slowdowns of these electronic delivery systems or the Internet occur, our ability to distribute our products and services effectively and to serve our customers may be impaired.
38
Table of Contents
We primarily rely on a third party to provide backup facilities for our data. We cannot guarantee that these facilities will not be impacted by interruptions in the future. We may not be able to fully recover data or information lost during a database or network facility outage impacting the provider of our backup facilities. Any losses, service disruption, or damages incurred by us could have a material adverse effect on our business, operating results, or financial condition.
Although we maintain insurance, at levels we believe to be appropriate, this insurance may not provide adequate protection in the event of a loss. Additionally, the existence, magnitude and impact of the risks we face often remain unknown for substantial periods of time. These risks could damage our brand and reputation, result in litigation, regulatory actions, sanctions or other statutory penalties, lead to loss of customer confidence in our business operations, including the security and reliability of our products, services and system, any of which could harm our ability to retain customers and gain new ones, result in financial losses for which we are not insured or adequately insured, and could lead to increased expenses to address or mitigate any damages or disruptions.
We could face liability for failing to adequately protect or properly use the information and data we collect, store, use, create, and distribute or the reports and other documents we publish or that are produced by our software products.
We may be subject to claims for securities law violations, defamation (including libel and slander), negligence, or other claims relating to the information we publish, including our research and ratings. For example, investors may take legal action against us if they rely on published information that contains an error, or a company may claim that we have made a defamatory statement about it or its employees. In addition, in our business component containing our credit ratings offerings, we have access to significant amounts of material nonpublic information on issuers of securities, the inadvertent disclosure of which, or the misappropriation by employees or others, could expose us to various liabilities under securities and other laws. Less significant errors could still require us to remove ratings, research, or data temporarily which could diminish the perceived value of the product or cause us to be deficient in our service-level agreements with clients that require us to meet certain obligations for delivering time-sensitive, up-to-date data and information.
Some of our products support the investment processes or the client account reporting practices and other activities of our clients who manage significant assets of other parties. Use of our products as part of such activities creates the risk that clients, or the parties whose assets are managed by our clients, may pursue claims against us for losses that may have some connection to our products, and we may be subject to investigation of our products and their use by government regulators who regulate the business of our clients. In the case of software products, even though most of our contracts for such products contain limitations of our liability in such cases, we may be required to compensate such clients or their customers for losses in order to maintain our business relationships. We could also be subject to claims based on the content that is accessible from our website through links to other websites.
Products and enhancements we develop or license have contained, and in the future may contain, undetected errors or defects despite testing or other quality assurance practices. Use of our products or services as part of the investment process and other activities creates the risk that our customers, investors, the companies that we rate or assess across our products or the shareholders of those companies, may pursue claims against us based on even a small error in our data, calculations, methodologies, input, or analysis or a malfunction or failure in our systems, products or services.
We rely on a variety of outside parties as the original sources for the information we use in our published data and research. These sources include securities exchanges, fund companies, hedge funds, transfer agents, issuers, and other data providers. We also incorporate data from a variety of third-party sources for many of our products. Accordingly, in addition to possible exposure for publishing incorrect information that results directly from our own errors, we could face liability based on inaccurate data provided to us by others. For example, our Morningstar Sustainalytics business component is reliant on self-reported information for some of its issuer-focused ESG ratings and analysis. We also face the risk that a significant data source terminates its distribution of the data to us, which could impact our products, research, or other calculations that utilize that information.
39
Table of Contents
We could be subject to claims by providers of data and information we compile from websites and other sources that we have improperly obtained that data in violation of the source’s copyrights or terms of use. We could also be subject to claims from third parties, such as securities exchanges from which we license and redistribute data and information, that we have used or redistributed the data or information in ways not permitted by our license rights or that we have inadequately permissioned our clients to use such data. The agreements with such exchanges and other data providers give them extensive data use audit rights, and such audits can be expensive and time consuming and potentially result in substantial fines. We could also be subject to claims from regulators that we have mishandled private ratings or nonpublic data and information, in particular in our business component containing our credit ratings products. These regulatory bodies have audit rights regarding our data use which could have similar adverse consequences in terms of time, expense, or fines. Defending claims based on the information we publish could be expensive and time-consuming and could adversely impact our business, operating results, and financial condition.
Additionally, we use and incorporate open-source code in our software development and our products, which could expose us to additional security risks, impede our ability to commercialize our products and services, and lead to additional costs. Security vulnerabilities with the use of open-source software could impact our products and services, which may result in the need for change control, testing and potential re-engineering efforts that could increase costs and impact our software development and products. Generally, open-source licenses will not contain warranties against infringement claims, or covering the quality or security of the code, and some licenses contain provisions requiring the public release of our proprietary source code if it is combined with the open-source code in a certain manner. The public release of our proprietary source code will put us at a competitive disadvantage, allowing competitors to develop similar products in less time and with minimal development efforts. In addition, many open-source licenses contain provisions which are ambiguous and have not been interpreted by U.S. or other courts. Any unanticipated restrictions or conditions on our ability to use, or claims involving our use of, open-source licenses could require us to seek alternative third-party licenses at increased costs or reduced scope, re-engineer products or systems, or discontinue the licensing of certain products.
Finally, our global business regularly seeks to optimize our data storage in order to improve information accuracy and streamline the technology, which supports our business operations. These efforts are constrained by data privacy legislation, such as GDPR, which defines standards for storage, transfer, and use of certain personal information from and about individuals, and which may limit the processing of information about individuals outside their home jurisdictions. Legislation aimed at protecting material nonpublic information or mitigating potential conflicts of interest further define how certain information can be accessed and retained which may result in less efficient or higher cost technological processes and infrastructure.
Failure to protect our intellectual property rights, or claims of intellectual property infringement against us, could harm our brand, our financial performance and our ability to compete effectively.
The steps we have taken to protect our intellectual property may not be adequate to safeguard our brand, proprietary information and competitive advantage. We rely primarily on patent, trademark, copyright, and trade secret rights, as well as contractual protections and technical safeguards, to protect our intellectual property rights and proprietary information. Despite these efforts, third parties may still be able to challenge, invalidate, or circumvent our rights or improperly obtain our proprietary information. Further, we may not be able to effectively utilize trademark, copyright, and trade secret protection in every country in which we offer our services or utilize our intellectual property.
We believe our trademark rights with respect to the Morningstar name and logo, along with our subsidiaries' names and logos represent materially valuable intangible assets. From time to time, we encounter jurisdictions in which one or more third parties have a pre-existing trademark registration in certain relevant international classes that may prevent us from registering these or other marks in those jurisdictions. Our continued ability to use the “Morningstar” name or logo, either on a stand-alone basis or in association with certain products or services, could be compromised in those jurisdictions because of these pre-existing registrations. Similarly, from time to time, we encounter situations in certain jurisdictions where one or more third parties are already using the Morningstar name, either as part of a registered corporate name, a registered domain name, or otherwise. Our ability to effectively market certain products and/or services or obtain adequate trademark protection in those locations could be adversely affected by these pre-existing usages.
40
Table of Contents
We have from time to time been subject to claims by third parties alleging infringement of their intellectual property rights. Such claims can also be alleged against clients, customers, or distributors of our products or services whom we have agreed to indemnify against third party claims of infringement. The defense of such claims can be costly and consume valuable management time and attention. We may be forced to settle such claims on unfavorable terms, which can include the payment of damages, the entry into royalty or licensing arrangements on commercially unfavorable terms, or the suspension of our ability to offer affected products or services. If litigation were to arise from any such claim, there can be no certainty we would prevail in it. If any of these risks were to materialize, it could have a material adverse effect on our business, financial condition, operating results or reputation. In addition, we are and continue to be susceptible to website spoofing attacks, where fraudulent websites are created to closely resemble our brand, products and offerings and are designed to lure potential clients to share personal sensitive information, such as login credentials, social security numbers, credit card information, bank account numbers, and in some instances send money to individuals portraying to be associated with our entities and brands. In addition to individual losses triggered by these attacks, these spoofing attacks could harm our brand, our reputation and negatively impact our ability to attract new clients and customers.
Risks Related to Legal and Regulatory Matters
Compliance failures, regulatory action, or changes in laws could adversely affect our business.
The laws, rules, and regulations, and their interpretations, applicable to our business are extensive and may change in the future and may be inconsistent or vary by jurisdiction. We have not always been able to, and in the future may not be able to comply with these changes or variances without extensive changes to our business practices. In the recent past, the scope and pace of global regulatory change has both increased and involved shorter compliance time frames, which has increased both the risk that we may fail to properly identify and respond to regulatory changes applicable to our operations and the risk that we may fail to implement such changes on a timely and complete basis. Regulations aimed at increasing transparency for investors or providing individuals greater control over their own data may devalue the investments we have made in our data sets or reduce their use cases. In addition, the broad scope of our business operations makes it more difficult to monitor areas that may be subject to regulatory and compliance risk. If we fail to comply with any applicable law, rule, or regulation, we could be fined, sanctioned, or barred from providing certain products and services in the future, which could adversely affect our reputation, business and financial results.
We are subject to various anti-corruption laws that prohibit improper payments or benefits or offers of payments or benefits to foreign governments and their officials and, in some cases, to employees of a business for the purpose of directing, obtaining or retaining business. We conduct business in countries and regions that are less developed than the U.S. and in some cases are generally recognized as potentially more corrupt business environments. Our activities in these countries create the risk of unauthorized payments or offers of payments by one of our employees or agents that could be in violation of various anti-corruption laws including the Foreign Corrupt Practices Act of 1977, as amended (FCPA) and the U.K. Bribery Act 2010 among other similar laws prohibiting bribery or corruption.
We have implemented policies and trainings to discourage these types of practices by our employees and agents. However, our policies, trainings, processes or future improvements thereof, may prove to be less than fully effective, and our employees or agents may engage in conduct for which we might be held responsible. If employees violate our policies or we fail to maintain adequate record-keeping and internal accounting practices to accurately record our transactions we may be subject to regulatory fines, sanctions, damages or other penalties or costs. Violations of any of these laws, including the FCPA or other anti-corruption laws, may result in severe criminal or civil sanctions and penalties, damage our brand and reputation and subject us to other liabilities which could have a material adverse effect on our business, operating results, or financial condition.
Additionally, as we have global business activities, we are subject to international trade restraints including economic and financial sanction laws and embargoes administered by the U.S. Treasury Department’s Office of Foreign Assets Controls, which prohibit or restrict the sale or supplying of certain products and services to embargoed or sanctioned countries, regions, governments, individuals, and entities. These international trade restraints have and may in the future impact our ability to continue to market and/or sell our products and services in these geographies, resulting in loss in revenue. Furthermore, new, and additional trade restrictions may be introduced at any time and may require us to change our operations and increase our risk of noncompliance. We may be exposed to increased compliance costs as a result of these changes. Failure to comply with these laws and regulations can subject us to significant fines and penalties and have material adverse effects on our reputation, brand, business, operating results and financial condition.
41
Table of Contents
Several of our businesses are highly regulated throughout the world and the regulatory environment is increasingly complicated and rapidly evolving.
Morningstar DBRS, our credit ratings business, operates in a highly regulated environment in Canada, the U.S., the U.K., and the EU. The laws and regulations governing credit ratings impose substantial ongoing compliance obligations and costs and subject Morningstar DBRS to regular regulatory examinations and occasional investigations, relating to the company itself or sometimes to the credit ratings industry as a whole. These laws and regulations may impose new or expanded requirements which could impact the day-to-day operations, our customers and the users of our credit ratings. At times, the scope, interpretation, and administration of these laws and regulations may also be uncertain, inconsistent across geographies and difficult to fully reconcile in a cost-efficient manner. Further, many aspects of credit ratings agency policies and practices and their compliance with applicable law, regulations, contracts and license arrangements are not the subject of definitive regulatory guidance or case law.
Three of our subsidiaries, Morningstar Investment Management LLC (MIM), Morningstar Investment Services LLC, and Morningstar Research Services LLC, are registered as investment advisers with the SEC under the Advisers Act. In addition, in the case of MIM’s advisory relationship with the Morningstar Funds Trust, it is subject to the Investment Company Act of 1940 and the Commodity Exchange Act. Morningstar Investment Services is also a broker/dealer registered under the Exchange Act and is subject to the rules of FINRA. Advisers Act requirements primarily relate to record-keeping, reporting, and standards of care, as well as general anti-fraud prohibitions. Registered investment advisers have several fiduciary obligations to their clients including obligations of good faith and full and fair disclosure of all facts material to the client’s engagement of the adviser, to provide investment advice suitable for the particular client, to have a reasonable, independent basis for investment recommendations, of best execution, and to vote client proxies in the best interests of the client. As registered investment advisers, these subsidiaries are subject to on-site examination by the SEC. In addition, in cases where these subsidiaries provide investment advisory services to retirement plans and their participants, they may be acting as fiduciaries under ERISA. As fiduciaries under ERISA, they have obligations to act in the best interest of their clients. They also have duties of loyalty and prudence, as well as duties to diversify investments and to follow plan documents to comply with the applicable portions of ERISA. We may face liabilities for actual or claimed breaches of our fiduciary duties, particularly in areas where we provide retirement or investment advice and managed retirement accounts. In some of our retirement contracts, we act as an ERISA fiduciary by, for example, selecting and monitoring a broad range of diversified plan options. We also provide a managed account service for retirement plan participants who elect to have their accounts managed by our programs. Such activities have been the subject of extensive class action litigation, including one such proceeding involving us that was dismissed. Many of our asset management and financial advisor clients are similarly regulated. If our license products and services fail to satisfy the regulatory requirements applicable to these clients, we may lose their business.
Our regulated investment services operations are subject to regulation in markets outside the U.S. Post Brexit, we made a strategic decision to restrict the provision of regulated investment management activity to EU domiciled clients in part to reduce regulatory risk. The 2022 acquisition of the U.K. and international operations of Praemium (the Morningstar Wealth Platform) has resulted in increased regulatory compliance obligations related to, among other things, the safeguarding and administration of client monies and assets, due to the offering of regulated products and services in the U.K. In addition, Morningstar Wealth Platform activity is also delivered through Jersey, a newer location for Morningstar, resulting in additional regulatory exposure and scrutiny.
In 2023, significant regulatory developments impacting Morningstar’s non-U.S. regulated investment activity became effective, most notably the overhaul of the EU and U.K. regulatory prudential regimes and the implementation of the U.K. Consumer Duty rules. These initiatives have further increased regulatory exposure for the relevant Morningstar entities. The addition of South Africa during 2023 to the Financial Action Task Force grey list of jurisdictions under increased monitoring has also resulted in the application of enhanced industry standards and assessment of associated firm processes for Morningstar’s regulated investment activities within South Africa.
42
Table of Contents
The Morningstar Funds Trust is a registered open-end mutual fund for which MIM acts as investment advisor under an investment management agreement. The independent trustees of the Morningstar Funds Trust must annually evaluate the terms of the investment management agreement (including fees) the Trust has with MIM. Upon evaluation, the independent trustees may elect to either renew the investment management agreement or make changes. Such changes could include taking steps to improve performance (e. g. removing a portfolio manager, or enhancing research capabilities), merge or liquidate a fund, close a fund to new investors, adjust an advisory fee schedule, or terminate the investment management agreement with MIM any of which could have an adverse effect on MIM.
Our index business, Morningstar Indexes, is subject to regulations related to the oversight of the provision of benchmark administration services in both the EU and U.K.. Specifically, the EU and U.K. benchmarks regulation seeks to improve governance and controls over the benchmark process, in order to ensure that administrators effectively manage conflicts of interest. Furthermore, the regulations require administrators to improve the quality of input data and methodologies and ensure that contributors to benchmarks and the data they provide are subject to adequate controls. Under the existing arrangements, Morningstar entities in the U.S., U.K. and EU are subject to certain requirements of the benchmarks regulation. Work continues to reduce the associated risk by consolidating the regulatory exposure to just the EU and U.K. entities. In addition, Morningstar Indexes has continued to monitor previously identified developments whereby the SEC sought comment on whether index providers, model portfolio providers and pricing services should be regulated as investment advisers or outsourced service providers in the U.S. These potential developments could increase regulatory exposure and compliance costs if and when adopted.
Compliance failures by any of these highly regulated businesses could lead to negative publicity, fines, settlements (as was the case with the previously-disclosed settlements between the SEC and DBRS, Inc. in 2023), and/or temporary or permanent operating restrictions, which could have a material adverse impact on our operating results or financial condition. New laws, regulations and regulatory implementation guidance may also affect the day-to-day operation of these businesses and our customers, including by imposing new or expanded requirements. The failure to timely or adequately address changing or expanding regulatory requirements could have a material adverse impact on our business, operations and financial results.
Environmental, social, and governance considerations could expose us to potential liabilities, increased costs (regulatory or otherwise), compliance failures and reputational harm.
We are subject to laws, regulations, and other measures that govern a wide range of topics, including those related to matters beyond our core business. New laws, regulations, policies, and international accords relating to ESG matters, including sustainability, climate change, human capital, and diversity, are being developed and formalized in the EU, the U.S., and elsewhere, which may require us to comply with specific, target-driven frameworks and/or disclosure requirements. For instance, the European Union Corporate Sustainability Reporting Directive (CSRD) became effective in 2023. CSRD applies to both EU and non-EU in-scope entities and requires such entities to provide expansive disclosures on various sustainability topics including climate change, biodiversity, workforce, supply chain, and business ethics. The CSRD did not apply to our operations in calendar year 2023, but we are assessing our obligations under the CSRD, and we expect that compliance with the CSRD could require significant effort in future years. In the U.S., the SEC has proposed broad climate change disclosure requirements which would require significant compliance efforts, if and when adopted. A number of states have also passed, or are in the process of adopting, broad climate change disclosure requirements. We believe we have implemented robust ESG programs, and have adopted reporting frameworks and principles and announced a number of goals and initiatives related to ESG with the advice from external consultants, including on our decarbonization efforts. Morningstar has committed to decarbonize 50% of our scope 1 and scope 2 greenhouse gas emissions by 2030 and to publicly disclosure our emissions annually. The implementation of these goals and initiatives, as well as compliance with emerging regulatory obligations, and forward-looking milestones may require considerable management time and may result in significant expense to us, and we cannot guarantee that we will achieve our objectives. Moreover, increasingly different stakeholder groups have divergent views on ESG matters, which increases the risk that any action or lack thereof with respect to ESG will be perceived negatively by at least some stakeholders and adversely impact our reputation.
43
Table of Contents
Our Morningstar Sustainalytics business could be negatively affected by increased regulation of ESG research, ratings and data. The EU regulation for registering and supervising companies that act as external reviewers for green bonds aligned with the European Green Bond Standards (EuGBS) framework, as well as the draft EU legislative proposal for registering and supervising companies that provide ESG ratings would require significant investments to build and maintain appropriate internal control and compliance processes for these teams. As legislation is evolving in EU, other jurisdictions are running consultation processes to put in place Codes of Conduct for ESG ratings, ESG data and/ or second party opinion providers, that contemplate governance policies, quality assurance and other internal control programs requirements. The final form of any of these regulations or other measures is still uncertain.
Such regulatory regimes could impose significant compliance burdens and costs on Morningstar Sustainalytics and, as with all new regulation, could be subject to ambiguous interpretation that could result in inadvertent noncompliance. Furthermore, as our Morningstar Sustainalytics business operates globally and we look to integrate ESG factors throughout our products, we may be subject to future regulation in multiple jurisdictions, which may be inconsistent.
Any failure, or perceived failure, by us to comply fully with ESG laws and regulations, or meet evolving and varied stakeholder expectations and standards could harm our business, operating results, and financial condition.
Errors in our automated advisory tools may subject us to liability for any losses that result.
We rely on automated investment technology for our retirement advice and managed retirement accounts services. The Wealth Forecasting Engine is our core advice and managed accounts engine that determines appropriate asset allocations for retirement plan participants and assigns individuals to portfolios. We also rely on automated portfolio construction tools. As these become more interconnected with other product offerings, including the technology of clients and other third parties, the increasing complexity of the technology requires more expertise and efforts to manage and test. Problems could arise if these programs do not work as intended, particularly if we failed to detect program errors over an extended period and are found to be liable for such errors, which may include liability for breach of our fiduciary duty or applicable law. Such program errors may not be detected despite quality assurance practices. There is a need to continually invest in training to develop and maintain in-house expertise to manage these systems effectively and to educate recordkeeper and retirement plan clients and participants in the capabilities, proper use, and competitive differentiation of these offerings, which can be costly and time consuming.
We seek to constantly innovate and improve our retirement services offering, for example to add new capabilities around modeling and advising on income generating products, and in doing so, we regularly release new versions of the technology and update our methodology. Additional customer support may be needed to ensure that clients implement the new versions and updates properly and understand the implications for their plan participants, including issues concerning suitability of certain strategies. More resources may also be required to continue to support legacy versions of the Wealth Forecasting Engine that continue to be used by certain clients. If we make an error, we may be subject to potentially large liabilities for make-whole payments and/or litigation.
Risks Related to Our Operations
Our future success depends on our ability to recruit, develop, and retain qualified employees.
Execution of our business plan requires identifying, attracting, hiring, and on-boarding new qualified employees. Engineering, research, quantitative, fixed income data and credit analysis skill sets are particularly needed to support and strengthen our key product offerings. We experience competition for analysts, technology experts, data and software engineers, and other employees from other companies and organizations. While we have a geographically diversified workforce location strategy, building valued teams in a variety of locations around the globe, we experience recruiting challenges in nearly all our global locations. There are also challenges inherent in effectively managing an increased number of employees over large geographic distances, including the need to implement appropriate systems, policies, benefits and compliance programs. Our talent acquisition activities may place a strain on our human resource management team. We must continue to refine and expand our recruiting capabilities, systems and processes in order to meet our talent acquisition needs in a highly competitive employment market.
44
Table of Contents
The development, maintenance, and support of our products and services are also dependent upon the knowledge, skills, experience, and abilities of our existing employees. We invest in our employees’ continued development and growth through learning tools, educational stipends, speaker series, mentoring, and other resources to help them chart a fulfilling career at Morningstar. We are also thoughtful about employee engagement and communications to keep our staff focused and motivated by our mission and our company’s success. However, changes in labor markets, such as the willingness of some employers to offer fully remote work brought on, in part, by the COVID-19 pandemic, may make it more difficult for us to retain existing employees or maintain traditional workplace arrangements. We require most employees in our business locations to make a commitment to a minimum amount of in-office work, but we remain uncertain as to the long-term effect of such requirements on employee attrition and engagement.
We believe the success of our business depends to a significant extent upon the continued service of our senior business and functional leaders and other key employees. However, the talents and experience of these individuals make them attractive candidates to many of our competitors, as well as to early-stage companies that can offer the potential for outsize financial rewards if they are successful. Thus, competition for these employees is intense and the loss of such business leaders could pose substantial challenges to our business. We may not be able to retain these leaders and employees or to develop and retain similar highly qualified personnel in the future, which may cause us to lose potential clients and suffer a decline in revenues.
In addition, we are currently exposed to rising wage scales in most of the employment markets in which our facilities are located, which negatively affect our compensation costs. Inflationary pressures, strong stock performance in our sector, and shortages of applicants with certain skills put upward pressure on wages. Shifting preferences regarding remote work flexibility and a backlog of immigration applications may further complicate our talent acquisition efforts.
Our future success also depends on the continued service of our executive officers, including Joe Mansueto, our executive chairman and largest shareholder, and Kunal Kapoor, our chief executive officer. The loss of Mansueto, Kapoor, or other executive officers could hurt our business, operating results, or financial condition. We do not have employment agreements or noncompete agreements in place with any of our executive officers. They may leave us and work for our competitors or start their own competing businesses.
Our business is complex and has experienced significant growth in recent years which could strain our resources and infrastructure, and if we are unable to effectively scale our operations and increase productivity, we may not be able to successfully implement our business plan.
Our business has and continues to experience significant growth in our diversity of products and services and operational scale, which has placed a strain on and in the future may stress the capabilities of our management, administrative, operational and financial infrastructure. Significant additional investments, both in terms of management attention and one-time and annual costs, have been and are expected to continue to be required to effectively scale our operations and increase productivity across our organization, to address the needs of our customers, to further develop and enhance our products and services, to expand into new geographic areas, and to increase our operating margin over time. Such additional investments will increase our cost base, making it more difficult for us to offset any future revenue shortfalls by reducing expenses in the short term. We may not be able to make these investments as quickly or effectively as necessary to successfully and competitively scale our operations.
We regularly upgrade or replace our various software and data offerings and our operating systems and processes. If implementations are delayed, or if we encounter unforeseen problems with our upgraded or new offerings, systems and processes or in migrating away from existing offerings, systems and processes, our operations and our ability to manage our business could be negatively impacted.
45
Table of Contents
Morningstar’s growth also places increasing demands on our functional resources to scale and optimize globally and to balance global consistency with local flexibility. Our sales and marketing teams are focused on multi-product-based strategies to bring the breadth of our offerings and the full value of our intellectual property to our customers. However, such sales efforts can breed customer confusion, implicate regulatory limits on how certain products or services can be sold and by whom in certain jurisdictions, and if coupled with misaligned incentive structures, can create opportunities for misconduct or excessive risk taking. Additional complexity also creates a need for clear responsibilities and ownership across various global teams within Morningstar, which we may not be successful in implementing. Morningstar is fortunate to have many opportunities for global growth in its strategic plan, however, we cannot be certain that further growth or profitability will be at the same or higher level given the headwinds of deglobalization and political, regulatory, and cultural fragmentation.
Our success will depend in part upon the ability of our senior management – including the senior management of companies we acquire — to manage our business and plans for growth efficiently. To do so, we must continue to increase the productivity and effectiveness of our existing employee base and to hire, train and manage new employees who can meet or exceed our standards. During 2023, we undertook workforce reductions in certain areas of our business to strengthen the financial footing of the consolidated company. We cannot guarantee that these actions will achieve our intended results in the long-term, and these efforts also subject us to risks such as greater than anticipated costs, adverse effects on employee retention, and increased difficulty managing the scale and complexity of our business. Our hybrid office model and any adjustments made to our current and future office environments may not meet our productivity expectations, on the one hand, and the expectations of our workforce, on other hand, which could negatively impact our growth plans and our ability to attract and retain our employees. We will need to continue to improve our operational, financial and management controls, our reporting systems and procedures, our uses of automation and AI systems to increase productivity, and our utilization of real estate. If we fail to successfully scale our operations and increase productivity, we may be unable to execute our business plan and the value of our company could decline. The investment we make and additional resources we use to expand our operations, target new international customers and expand our presence globally may not produce desired levels of revenue or profitability, which could adversely affect our business and operating results.
Our acquisitions and investments in companies or technologies may not realize the expected business or financial benefits and acquisitions could prove difficult to integrate, disrupt our business, dilute stockholder value and adversely affect our operating results and the market value of our common stock.
As a means to implement our business strategy, we periodically evaluate and make investments in, or acquisitions of, complementary businesses, services and technologies, and intellectual property rights, and expect to continue to make such investments and acquisitions in the future. However, there can be no assurance we can identify suitable investment or acquisition candidates at acceptable prices. In addition, although we conduct robust due diligence through cross-functional teams when making an acquisition, each acquisition presents potential challenges and risks, including the following:
From a technology perspective, we may face potential identified or unknown security vulnerabilities in acquired products that expose us to additional security risks and penalties or delay our ability to integrate the product into our service offerings; difficulties in increasing or maintaining at an acceptable cost the security standards for acquired technology consistent with our other services; difficulty in transitioning the acquired technology onto our existing platforms and customer acceptance of multiple platforms on a temporary or permanent basis; and challenges augmenting the acquired technologies and platforms to the levels that are consistent with our brand and reputation.
From a human resources perspective, we may face difficulties in assimilating, integrating, or retraining acquired employees, which may lead to retention risk with respect to both key acquired employees and our existing key employees or disruption to existing teams; differences between our values and those of our acquired companies, as well as disruptions to our workplace culture; difficulties in and financial costs of addressing acquired compensation structures inconsistent with our compensation structure; and additional stock-based compensation issued or assumed in connection with the acquisition, including the impact on stockholder dilution and our results of operations.
46
Table of Contents
From an operational perspective, we may face diversion of financial and managerial resources from existing operations; challenges relating to the potential entry into new markets in which we have little experience or where competitors may have stronger market positions; difficulties in integrating acquired operations, challenges with the acquired company’s customers and partners, including our ability to maintain such relationships and changes to perception of the acquired business as a result of the acquisition; challenges with the acquired company’s third-party service providers, including those that are required for ongoing access to third-party data; challenges in incorporating the acquired company's disaster recovery and cyber security protocols with those of Morningstar; the potential for acquired products to impact the profitability of existing products; and in the case of foreign acquisitions, challenges caused by integrating operations over distance, and across different languages, cultures and political environments.
From a financial perspective, we may face challenges and costs relating to known and potential unknown liabilities associated with the acquired businesses, including due to litigation; difficulties in managing, or potential write-offs of, acquired assets or investments, and potential financial and credit risks associated with acquired customers; difficulties in retaining the clients of acquired businesses; negative impact to our results of operations because of the depreciation and amortization of acquired intangible assets, fixed assets and operating lease right-of-use assets; the loss of acquired unearned revenue and unbilled unearned revenue; delays in customer purchases due to uncertainty related to the acquisition; ineffective or inadequate financial controls, procedures and policies at the acquired company; and the tax effects of any such acquisitions including related integration and business operation changes, and assessment of the impact on the realizability of our future tax assets or liabilities.
We also have, and expect to continue to make, various investments in companies where we do not have or obtain a controlling interest. Such investments are motivated both by their prospective financial return and the access they give us to certain new technologies, products, business ideas, and management teams. While we obtain various rights in connection with such investments, the future value of such investments is highly dependent on the management skill of the managers of those companies, among other factors.
Finally, our ability to acquire other businesses or technologies, make strategic investments or integrate acquired businesses effectively may be impaired by trade tensions and increased global scrutiny of foreign investments and acquisitions and investments in the technology sector. For example, several countries, including the U.S. and countries in Europe and the Asia-Pacific region, are considering or have adopted restrictions of varying kinds on transactions involving foreign investments. Antitrust authorities in a number of countries have also reviewed acquisitions and investments in the technology industry with increased scrutiny. Governments may continue to adopt or tighten restrictions of this nature, and such restrictions or government actions could negatively impact our acquisition and investment opportunities, business and financial results. Acquisitions may expose us to litigation from our shareholders or other third parties, which, even if unsuccessful, could be costly to defend and serve as a distraction to management.
The goodwill of our business and other intangible assets from our acquisitions could be impaired as a result of business conditions in the future, requiring us to record substantial impairments that would impact our operating income.
We assess the recoverability of recorded goodwill amounts on an annual basis or when evidence of potential impairment exists. Intangible assets are evaluated when events or changes in circumstances arise that indicate the carrying value of the asset may be unrecoverable. The impairment testing is based on several factors which require judgement from management. In general, changes in our business condition or changes in fair market valuations and our operating performance may result in future impairments of goodwill or intangible assets which could have a material adverse impact on our operating results. Additionally, our goodwill and intangible assets may become impaired if we fail to obtain our anticipated operating efficiencies associated with our acquisitions.
47
Table of Contents
Today’s fragmented geopolitical, regulatory, and cultural world could adversely affect our ability to expand our product and service offerings.
Morningstar’s business plan involves, in part, expansion into new and adjacent product lines to anticipate and meet our customers’ needs. Our ability to realize those opportunities in one of our businesses, however, may be hindered by regulatory requirements governing a different business within the Morningstar group. In certain cases, regulatory sanctions against one of our businesses could affect our ability to continue to operate in unrelated regulated areas. In addition, the day-to-day sharing and optimization of the value of our intellectual property across our product lines can be affected by regulatory concerns. Similarly, differences in data privacy regimes and governmental surveillance rights applicable in specific countries significantly affect our workforce location strategy and technology infrastructure in relation to cross-border processing of personally identifiable information of customers, employees and other third parties. Such limitations, which seem likely to proliferate as global consensus regarding regulatory principles wanes, may impact our ability to execute on our strategy.
The dynamics of today’s geopolitical discourse may also impact business opportunities across different markets. It has been our experience that adoption of many ESG-focused products has been more rapid in European countries than in other parts of the world, and there is more agreement on ESG taxonomies, methodologies, and acceptable sources of data in that market. Customer opinions about such products, or preferences regarding their methodology or approach, are at times impacted by regional or national political trends which may differ significantly. Preferred terminology and information sources may similarly differ from place to place. In such an environment, Morningstar may struggle to maintain its reputation for methodological transparency and consistency which underpins the value and reputation of our research.
As a global taxpayer, we face challenges due to increasing complexities in accounting for taxes (e.g., base erosion, minimum taxes, and tax transparency), which are high priorities in jurisdictions in which we operate and could materially affect our tax obligations and effective tax rate.
Our effective tax rate is based on the mix of income and losses in our U.S. and non-U.S. operations, statutory tax rates, and tax-planning opportunities available in the various jurisdictions in which we operate. We could be subject to changes in our tax rates, the adoption of new U.S. or non-U.S. tax legislation or exposure to additional tax liabilities. Due to economic and political conditions, tax rates in various jurisdictions may be subject to significant change. Our future effective tax rates could be affected by changes in the mix of earnings in countries with differing statutory tax rates including, impacts related to transfer pricing, changes in the valuation of deferred tax assets and liabilities, or changes in tax laws or their interpretation by relevant authorities. Significant judgment is required to evaluate our tax positions.
Corporate tax reform, base-erosion efforts, and tax transparency continue to be high priorities in many jurisdictions in which we operate. In October 2021, the Organization for Economic Co-operation and Development (OECD) agreed to a two-pillar approach to global taxation focusing on global profit allocation (Pillar One) and a global minimum tax rate (Pillar Two). In December 2022, the EU member states agreed to implement the OECD’s global corporate minimum tax rate of 15% under Pillar Two to be effective in January 2024. Other countries are also considering changes to their tax laws to adopt certain parts of the OECD’s proposals. This legislation represents a significant change in the international tax regime and could result in increases to our effective tax rate as a result of the imposition of minimum taxes. We are continuing to monitor developments and administrative guidance in addition to evaluating the potential impact on our consolidated financial statements for future periods.
Our revenues, expenses, assets and liabilities are subject to fluctuations in foreign currency exchange rate.
As a business with international business activities, we are subject to risks related to fluctuations in foreign currency exchange rates. Movements in the exchange rates can impact theU.S. dollar reported value of our revenues, expenses, assets and liabilities denominated in non-U.S. dollar currencies or where the currency of such items is different than the functional currency of the entity where these items were recorded. In addition, the value of assets in indexed investment products can fluctuate significantly over short periods of time and such volatility may be further impacted by fluctuations in foreign currency exchange rates.
48
Table of Contents
We incur expenses for employee compensation and other operating expenses at our non-U.S. locations in the local currency. In the future if there is an increase or decrease in our international business activities that recorded in local currencies, our exposure to fluctuations in foreign currency exchange rates may correspondingly increase or decrease, which could materially adversely affect our business, financial condition or operating results. Although we may in the future decide to undertake foreign exchange hedging transactions, to date, we have not engaged in currency hedging, and we do not currently have any positions in derivative instruments to hedge our currency risk.
Our indebtedness, could adversely affect our cash flows and financial flexibility. Our variable rate indebtedness could subject us to interest rate risk, which could cause our debt service obligations to increase significantly.
For an overview of our current outstanding indebtedness, refer to Item 7 — Management's Discussion and Analysis of Financial Condition and Results of Operations— Liquidity and Capital Resources below. Our long-term debt was $940.3 million at December 31, 2023.While our business has historically generated strong cash flow and we are in compliance with all of our debt covenants, borrowings under our current credit facility are floating rate. As a result, our annual debt service requirements are affected by rising interest rates and we cannot provide assurance that we will generate and maintain cash flows sufficient to permit us to service our indebtedness. Our ability to make payments on our indebtedness and to fund planned capital expenditures depends on our ability to generate and access cash in the future, which, in turn, is subject to general economic, financial, competitive, regulatory, tax and other factors, many of which are beyond our control. If we cannot refinance or otherwise pay our obligations as they mature and fund our liquidity needs, our business, financial condition, results of operations, cash flows, liquidity, ability to obtain financing and ability to compete in our industry could be materially adversely affected.
In addition, any borrowings under our current credit facility bear interest at fluctuating interest rates based on the Secured Overnight Financing Rate (SOFR) which replaced USD LIBOR as the reference rate under our credit facility. SOFR is intended to be a broad measure of the cost of borrowing cash overnight collateralized by U.S. Treasury securities and is not the economic equivalent of USD LIBOR. While SOFR is a secured rate, USD LIBOR is an unsecured rate. As a result, there can be no assurance that SOFR will perform in the same way as USD LIBOR would have at any time, which may result in increased volatility in the interest rates payable under our credit facility and potentially increase our funding costs.
Furthermore, the terms of our debt agreements include restrictive covenants that limit, among other things, our and our subsidiaries’ financial flexibility and ability to implement certain transactions. If we are unable to comply with the restrictions and covenants in our debt agreements, there could be a default that, in some cases, if continuing, could result in the accelerated payment of our debt obligations or the termination of borrowing commitments on the part of the lenders under our Credit Agreement. Refer to Item 7—Management's Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources for a description of the restrictive covenants in our debt agreements.
We are dependent on third-party service providers in our operations.
We utilize numerous third-party service providers in our operations, including for the provision of contract labor in several locations and backup facilities for our data. A failure by a third-party service provider could expose us to an inability to provide contractual services to our clients in a timely manner. Additionally, if a third-party service provider is unable to provide these services, we may incur significant costs to either internalize some of these services or find a suitable alternative. A failure in the performance of our due diligence processes and controls related to the supervision and oversight of these firms in detecting and addressing conflicts of interest, fraudulent activity, data breaches and cyber-attacks or noncompliance with relevant securities and other laws could cause us to suffer financial loss, regulatory sanctions or damage to our reputation.
49
Table of Contents
Risks Related to Ownership of Our Common Stock
The concentrated ownership position of Joe Mansueto could adversely affect our other shareholders.
As of December 31, 2023, Joe Mansueto, our Executive Chairman and Chairman of the Board, owned approximately 37.4% of our outstanding common stock. While Joe has reduced his percentage ownership of the company in recent years as part of a personal plan to diversify his assets, his concentrated ownership position gives him substantial influence over substantially all matters submitted to our shareholders for approval, including the election and removal of directors and any merger, consolidation, or sale of our assets. This concentration of ownership may disincentivize other shareholders from proposing the election of other persons to our board of directors, delay or prevent a change in control, impede a merger, consolidation, takeover, or other business combination involving Morningstar, discourage a potential acquirer from making a tender offer or otherwise attempting to obtain control of the company, or result in actions that may be opposed by other shareholders.
Fluctuations in our operating results may negatively affect our stock price.
We believe our business has relatively large fixed costs, principally in relation to compensation, and low variable costs, which has historically magnified the impact of revenue fluctuations on our operating results. As a result, a decline in our revenue may lead to a larger decline in operating income. In addition, because we manage our business with a long-term perspective, we generally don’t make significant adjustments to our strategy or cost structure in response to short-term factors. For example, if the U.S. economy were to experience current inflationary pressures over a prolonged period, increased compensation and other expenses could adversely impact our operating results. Uncertainty regarding inflation could also impact our ability to forecast costs, which inform our longer-term budget and capital allocation decisions. In addition, we do not provide earnings guidance and our executive team generally doesn't take one-on-one meetings with investors and research analysts. Because of this policy and limited analyst coverage of our stock, our stock price has not and may not always reflect the intrinsic value of our business and assets. If our operating results or other operating metrics fail to meet the expectations of outside research analysts and investors, the market price and trading volume of our common stock may decline.
We cannot guarantee we will pay dividends in the future or make any repurchases of our common stock under our repurchase program.
We have historically paid cash dividends on our common stock, but there is no guarantee that such dividends will continue in the future. Whether our Board authorizes future dividends will depend on a number of factors, including, our results of operations, financial condition, contractual restrictions, restrictions imposed by applicable law, and other factors. Moreover, our Board may determine to repurchase shares of our common stock pursuant to an authorized share repurchase program.
On December 6, 2022, our board of directors approved a share repurchase program that authorizes the company to repurchase up to $500 million of our outstanding common stock. Under this, we may, but are not obligated to, make share repurchases through a variety of methods, including open market or private transactions in amounts that we deem appropriate, in accordance with applicable federal securities laws. The timing and amount of repurchases, if any, will be subject to liquidity, stock price, market and economic conditions, compliance with applicable legal requirements and other relevant factors, including any future indebtedness and loan facilities that could prohibit or restrict our ability to pay dividends, make distributions to our shareholders, or repurchase our shares. Our stock repurchase program may be accelerated, suspended, delayed or discontinued at any time. Any failure to repurchase stock after we have announced our intention to do so may adversely impact our reputation and investor confidence in us and may adversely impact our stock price.
The existence of these share repurchase programs could cause our stock price to be higher than it otherwise would and could potentially reduce the market liquidity for our stock. Repurchase programs are also subject to potential excise tax as under the Inflation Reduction Act of 2022.
50
Table of Contents
The future sale of shares of our common stock may negatively affect our stock price.
If our significant shareholders sell substantial amounts of our common stock, the market price of our common stock could fall. A significant reduction in ownership by Joe Mansueto or any other large shareholder over a short period of time could cause the market price of our common stock to fall. In addition, the average daily trading volume in our stock is relatively low. Low trading volume in our stock may lead to greater fluctuations in our stock price, and may also make it difficult for shareholders to effect transactions in a timely fashion.
Item 1B. Unresolved Staff Comments
We do not have any unresolved comments from the Staff of the SEC regarding our periodic or current reports under the Exchange Act.
Item 1C. Cybersecurity
The purpose of our information security program is to enable the business to effectively identify, assess, prioritize and manage cybersecurity risk in order to support our long-term corporate objectives and to protect our employees, customers, and company assets from threats to our information systems. Cybersecurity is a critical component of our enterprise risk management and the company has identified cybersecurity as one of the key risk categories it faces.
Risk Management and Strategy
Morningstar takes a risk-based approach for managing its cybersecurity program. Currently, the program is evaluated periodically, including against the NIST Cybersecurity Framework. The outcome of these reviews, as well as any changes implemented as a result of these reviews, are reported to the audit committee of the board of directors (the “Audit Committee”).
Morningstar deploys various safeguards to help protect against cybersecurity threats, including but not limited to, anti-malware (EDR) tools, email security, web filtering, multi-factor authentication and single-sign-on, regular patch cadence and vulnerability management, and hardened laptops with full disk encryption and admin permissions removed. For in-house software, Morningstar deploys various security tools to detect vulnerabilities, including but not limited to, static application security and dynamic application security testing, SAC tooling, cloud security posture management and central logging.
The InfoSec Team conducts vulnerability scans and third-party security assessments of operating systems, network devices, and web-facing applications. In order to ensure the resilience of Morningstar products, we require all products to follow enterprise-wide Disaster Recovery (DR) standards. Identified vulnerabilities and DR tasks are assigned to appropriate owners and on a weekly basis we produce a cybersecurity scorecard for each Morningstar product. These scorecards are disseminated to the relevant leadership team.
The InfoSec Team, under the supervision of the chief information security officer (CISO), has also implemented processes to evaluate cybersecurity controls of third-party service providers. As part of the Company’s processes for engaging vendors, subcontractors and other third-parties, the InfoSec Team evaluates any such entities that may process confidential information prior to conducting business with them. We evaluate the security status of our critical third parties periodically to determine whether they continue to meet our security standards.
Employees undergo annual security awareness training, and a quarterly phishing exercise is conducted. Quarterly security incident tabletop exercises are conducted with appropriate stakeholders to practice response procedures, and an annual tabletop exercise is conducted with the executive leadership team to test our enterprise resilience. The enterprise resilience team manages both disaster recovery as well as business continuity plans in preparation to recover from high-impact incidents.
51
Table of Contents
Governance
We have a team of experienced information security professionals (InfoSec Team) headed by our CISO, who reports to our chief technology officer (CTO), a member of our executive leadership team. Our CISO holds a Ph.D. in Computer Science with a focus on Cybersecurity and Privacy and has more than 15 years of information security experience. The InfoSec Team is responsible for assessing and managing cybersecurity risks and threats. The InfoSec Team, under the leadership of our CISO, manages our Information Security Program (InfoSec Program), which has oversight of IT risk governance, IT third-party risk management, software and product security, security operations and incident management, IT compliance, technical disaster recovery, and establishing enterprise-wide information security policies and procedures.
Our CISO co-chairs an internal Security and Privacy Advisory Council (SPAC), comprised of senior leaders from the IT, Legal, Audit, and Compliance departments, that meets on a quarterly basis to discuss environmental, regulatory, and technological changes and associated risks to the security and confidentiality of our information. The InfoSec team is tasked with executing this strategy through the implementation of cybersecurity policies, procedures, and strategies. The SPAC receives regular updates on pertinent objectives of the InfoSec Program, as well as a summary of recent security events and reporting on how any incidents were resolved.
The Audit Committee reviews and discusses with management risks relating to our cybersecurity and data privacy practices and has oversight of our cybersecurity risks. Our CTO and CISO provide an update to the Audit Committee at each of its regular meetings, which covers recent trends, identifies emergent risks to our technology infrastructure, DR plan statistics, employee training metrics, and updates on vulnerability assessments and threat landscape as needed. The Audit Committee is also provided a summary of events and reporting on how any such events were resolved.
Cybersecurity Event Management
We have instituted a specific event management process for the identification and resolution of cybersecurity incidents. Cybersecurity incidents are responded to and managed by our 24-hour Security Operations Center (SOC), and technical outages/accidental occurrences are reviewed and managed by operational teams at the relevant Morningstar product and by the Technology Operations Center (TOC). Upon resolution of a cybersecurity incident, we conduct a retrospective analysis to inform our security and operational efforts going forward. We engage third parties, such as incident response service providers, as appropriate, based on the severity of the cybersecurity event and/or the work required to remediate. Upon identification of a cybersecurity event, we assign a significance rating to the event. All cybersecurity events that meet or exceed designated criteria are escalated to the CISO or Chief Information Officer (CIO). Cybersecurity events which may be significant are further escalated to the Cyber Incident Disclosure Committee (Cyber Committee).
The Cyber Committee consists of the CTO, the CIO, the CISO, the chief privacy officer, the chief legal officer, the chief communications officer, representatives of the affected business unit and/or their respective delegates.
We believe that currently we have not encountered a cybersecurity event that has had a material impact on our business, financial condition, or results of our operation. We continue to invest in our IT security infrastructure and framework and to enhance our internal controls and processes to help protect our data from cybersecurity threats. For a discussion of the risks cybersecurity threats pose to our business strategy, results of operations and financial condition, please see “Item 1A. Risk Factors — Risks Related to Our Information Technology and Security” in this Report.
52
Table of Contents
Item 2. Properties
As of December 31, 2023, we leased approximately 526,000 square feet of office space for our U.S. operations, with approximately half of the space for our corporate headquarters located in Chicago, Illinois. We also lease approximately 710,000 square feet of office space in 26 other countries around the world, including approximately 272,000 square feet in Mumbai, India and approximately 90,000 square feet in Toronto, Canada. We believe that our existing and planned office facilities, which are used by all of our segments, are adequate for our needs and that additional or substitute space is available to accommodate growth and expansion.
Item 3. Legal Proceedings
We incorporate by reference the information regarding legal proceedings set forth in Note 15 of the Notes to our Consolidated Financial Statements contained in Part II, Item 8 of this Report.
Item 4. Mine Safety Disclosures
Not applicable.
53
Table of Contents
Part II
Item 5. Market for Registrant's Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities
Our common stock is listed on the Nasdaq Global Select Market under the symbol "MORN."
As of February 16, 2024, there were 601shareholders of record of our common stock. The actual number of stockholders is greater than this number of record holders and includes stockholders who are beneficial owners but whose shares are held in street name by brokers and other nominees.
We paid four quarterly dividends during 2023. In the fourth quarter of 2023, we announced an increase of our quarterly cash dividend from 37.5 cents per share to 40.5 cents per share. While subsequent dividends will be subject to board approval, we expect to pay a regular quarterly dividend of 40.5 cents per share in 2024.
Any determination to pay dividends in the future will be at the discretion of our board of directors and will be dependent upon our results of operations, financial condition, contractual restrictions, restrictions imposed by applicable law, and other factors deemed relevant by the board of directors. Future indebtedness and loan facilities could also prohibit or restrict our ability to pay dividends and make distributions to our shareholders.
Issuer Purchases of Equity Securities
Subject to applicable law, we may repurchase shares at prevailing market prices directly on the open market or in privately negotiated transactions in amounts that we deem appropriate.
The table below presents information related to repurchases of common stock we made during the three months ended December 31, 2023. Refer to Note 16 of the Notes to our Consolidated Financial Statements for more information regarding our share repurchase program:
Total — $ — —
______________________________________
(a) Repurchases will only be effected pursuant to the $500.0 million share repurchase program authorized by our board of directors and announced publicly on December 6, 2022, which commenced on January 1, 2023 and which will expire on December 31, 2025.
54
Table of Contents
Rule 10b5-1 Sales Plans
Our directors and executive officers may exercise stock options or purchase or sell shares of our common stock in the market from time to time. We encourage them to make these transactions through plans that comply with Exchange Act Rule 10b5-1(c). Morningstar will not receive any proceeds, other than proceeds from the exercise of stock options, related to these transactions.
The following table, which we are providing on a voluntary basis, shows the Rule 10b5-1 sales plans entered into by our directors and executive officers that were in effect as of February 16, 2024:
During the year ended December 31, 2023, the previously disclosed Rule 10b5-1 plan dated March 23, 2023 for Gail Landis and the Rule 10b5-1 plan dated August 31, 2022 for Joe Mansueto, completed in accordance with their respective terms.
_______________________________
(1) This column reflects an estimate of the number of shares each identified director and executive officer will beneficially own following the sale of all shares under the Rule 10b5-1 sales plan. This information reflects the beneficial ownership of our common stock on February 16, 2024 and includes shares of our common stock subject to options that were then exercisable or that will have become exercisable by April 16, 2024 and restricted stock units that will vest by April 16, 2024. The estimates do not reflect any changes to beneficial ownership that may have occurred since February 16, 2024. Each director and executive officer identified in the table may amend or terminate his or her Rule 10b5-1 sales plan and may adopt additional Rule 10b5-1 plans in the future.
Item 6. [Reserved]
55
Table of Contents
Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations
The discussion included in this section, as well as under "Item 1—Business" and other sections of this Report, contains forward-looking statements as that term is used in the Private Securities Litigation Reform Act of 1995. These statements are based on our current expectations about future events or future financial performance. Forward-looking statements by their nature address matters that are, to different degrees, uncertain, and often contain words such as “committed,” “consider,” “estimate,”“forecast,” “future,” “goal,” “is designed to,” “maintain,” “may,” “might,” “objective,” “ongoing,” “could,” “expect,” “intend,” “plan,” “possible,” “potential,” “seek,” “anticipate,” “believe,” “estimate,” “predict,” “potential,” “prospects”, “continue,” “seek,” “strategy,” “strive,” “will,” “would,” or the negative thereof, and similar expressions. These statements involve known and unknown risks and uncertainties that may cause the events we discuss not to occur or to differ significantly from what we expect. For us, these risks and uncertainties include, among others:
•failing to maintain and protect our brand, independence, and reputation;
•failure to prevent and/or mitigate cybersecurity events and the failure to protect confidential information, including personal information about individuals;
•compliance failures, regulatory action, or changes in laws applicable to our credit ratings operations, investment advisory, environmental, social, and governance (ESG), and index businesses;
•failing to innovate our product and service offerings or anticipate our clients’ changing needs;
•the impact of artificial intelligence (AI) and related new technologies on our business, legal, and regulatory exposure profile and reputation;
•failure to detect errors in our products or failure of our products to perform properly due to defects, malfunctions or similar problems;
•failing to recruit, develop, and retain qualified employees;
•prolonged volatility or downturns affecting the financial sector, global financial markets, and the global economy and its effect on our revenue from asset-based fees and credit ratings business;
•failing to scale our operations and increase productivity in order to implement our business plans and strategies;
•liability for any losses that result from errors in our automated advisory tools or errors in the use of the information and data we collect;
•inadequacy of our operational risk management, business continuity programs and insurance coverage in the event of a material disruptive event;
•failing to efficiently integrate and leverage acquisitions and other investments, which may not realize the expected business or financial benefits, to produce the results we anticipate;
•failing to maintain growth across our businesses in today's fragmented geopolitical, regulatory and cultural world;
•liability relating to the information and data we collect, store, use, create, and distribute or the reports that we publish or are produced by our software products;
•the potential adverse effect of our indebtedness on our cash flows and financial and operational flexibility;
•challenges in accounting for tax complexities in the global jurisdictions we operate in could materially affect our tax obligations and tax rates; and
•failing to protect our intellectual property rights or claims of intellectual property infringement against us.
A more complete description of these risks and uncertainties, among others, can be found in Item 1A—Risk Factors of this Report. If any of these risks and uncertainties materialize, our actual future results and other future events may vary significantly from what we expect. We do not undertake to update our forward-looking statements as a result of new information, future events, or otherwise, except as may be required by law. You are, however, advised to review any further disclosures we make on related subjects, and about new or additional risks, uncertainties, and assumptions in our future filings with the Securities and Exchange Commission (SEC) on Forms 10-K, 10-Q, and 8-K.
56
Table of Contents
This section includes comparisons of certain 2023 financial information to the same information for 2022. Year-to-year comparisons of the 2022 financial information to the same information for 2021 can be found in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part II, Item 7 of the company’s Annual Report on Form 10-K for the fiscal year ended December 31, 2022, filed with the SEC on February 24, 2023. This section also includes comparisons of 2022 segment financial information to the same information for 2021.
All dollar and percentage comparisons, which are often accompanied by words such as “increase,” “decrease,” “grew,” “declined,” “was up,” “was down,” “was flat,” or “was similar”, refer to a comparison with the prior year unless otherwise stated.
Understanding Our Company
Key Business Characteristics
Our mission is to empower investor success. The investing ecosystem is complex, and navigating it with confidence requires a trusted, independent voice. We deliver our perspective to institutions, advisors, and individuals with a single-minded purpose: to empower investors with the conviction that they can make better-informed decisions and realize success on their own terms.
Our strategy is to deliver insights and experiences that are essential to the investor workflow. Proprietary data sets, meaningful analytics, independent research, and effective investment strategies are at the core of the powerful digital solutions that investors across our client segments rely on. We have a keen focus on innovation across data, research, product, and delivery so that we can effectively cater to the evolving needs and expectations of investors globally.
Segments
Effective as of December 31, 2023, the company concluded that it has seven operating segments which are presented as the following five reportable segments: Morningstar Data and Analytics, PitchBook, Morningstar Wealth, Morningstar Credit, and Morningstar Retirement. The operating segments of Morningstar Sustainalytics and Morningstar Indexes do not individually meet the quantitative segment reporting thresholds and have been combined and presented as part of Corporate and All Other, which is not a reportable segment. Prior period segment information is presented on a comparable basis to the basis on which current period segment information is presented and reviewed by the chief operating decision maker (CODM). For additional information about our segment reporting, refer to Note 6 of the Notes to our Consolidated Financial Statements in Part II of this Report.
Revenue
We offer an extensive line of investment-related products and services for individual investors, financial advisors, asset managers, retirement plan providers and sponsors, and institutional investors and other participants in the private capital markets.
Our segments sell many of our research and data products and services through license agreements on either a per user or enterprise-basis. Morningstar Data and Analytics and PitchBook generate most of our licensed-based revenue. Our license agreements typically range from one to three years and are accounted for as subscription services available to customers and not as a license under the accounting guidance.
Our Morningstar Wealth and Morningstar Retirement segments generate most of our asset-based revenue where basis points and other fees are charged for assets under management or advisement (AUMA). Our asset-based arrangements typically range from one to three years.
Our transaction-based revenue, which is recognized primarily in our Morningstar Credit and Morningstar Wealth segments, is one-time in nature, compared with the recurring revenue streams represented by our license and asset-based products.
57
Table of Contents
Deferred Revenue
We invoice some of our clients and collect cash in advance of providing services or fulfilling subscription services to our customers. Deferred revenue totaled $544.0 million (of which $517.7 million was classified as a current liability with an additional $26.3 million included in long-term liabilities) at the end of 2023. We expect to recognize this deferred revenue in future periods as we fulfill the service obligations under our license and subscription agreements.
Operating Expense
We classify our operating expense into separate categories for cost of revenue, sales and marketing, general and administrative, and depreciation and amortization, as described below.
• Cost of revenue. This category includes compensation expense for employees who produce the products and services we deliver to our customers. For example, this category covers production teams and analysts who write investment research reports. It also includes compensation expense for programmers, designers, and other employees who develop new products and enhance existing products. In some cases, we capitalize the compensation costs associated with certain software development projects resulting in reduced expense that we would otherwise report in this category. Cost of revenue also includes other expenses, such as third-party data purchases and data lines as well as professional fees for third-party development activities.
• Sales and marketing. This category includes compensation expense for our sales teams, product managers, and marketing professionals. We also include the cost of advertising, digital marketing campaigns, and other marketing and promotion efforts in this category.
• General and administrative. This category includes compensation expense for our management team and other corporate functions, including employees in our compliance, finance, human resources, and legal departments. It also includes costs for corporate systems and facilities.
• Depreciation and amortization. Our capital expenditures mainly relate to capitalized software development costs, information technology equipment, and leasehold improvements. We amortize capitalized software development costs over their estimated economic life, generally three years. We depreciate property and equipment using the straight-line method based on the useful lives of the assets, which range from three to seven years. We amortize leasehold improvements over the lease term or their useful lives, whichever is shorter. We also include amortization related to identifiable intangible assets, which is mainly driven by acquisitions, in this category. We amortize intangible assets using the straight-line method over their estimated economic useful lives, which range from one to twenty years.
International Operations
As of December 31, 2023, we had wholly- or majority-owned subsidiaries in 31 countries outside of the U.S. and included their results of operations and financial condition in our consolidated financial statements. We also have investments outside of the U.S., and where we have significant influence, we apply the equity method of accounting.
How We Evaluate Our Business
When our analysts evaluate a stock, they focus on assessing the company's estimated intrinsic value, which is based on estimated future cash flows, discounted to their value in today's dollars. Our approach to evaluating our own business works the same way.
Our goal is to increase the intrinsic value of our business over time, which we believe is the best way to create value for our shareholders. We do not make public financial forecasts for our business because we want to avoid creating any incentives for our management team to make speculative statements about our financial results that could influence our stock price or take actions that help us meet short-term forecasts, but may not build long-term shareholder value.
58
Table of Contents
We provide the following measures that can help investors generate their own assessment of how our intrinsic value has changed over time:
• Revenue (including organic revenue);
• Operating income (including adjusted operating income);
• Operating margin (including adjusted operating margin); and
• Free cash flow.
Organic revenue, adjusted operating income, adjusted operating margin, and free cash flow are not measures of performance set forth under U.S. generally accepted accounting principles (GAAP).
We define organic revenue as consolidated revenue excluding acquisitions, divestitures, adoption of new accounting standard changes (accounting changes), and foreign currency translations. We present organic revenue because we believe it helps investors better compare our period-to-period results, and our management team uses this measure to evaluate the performance of our business. We exclude revenue from businesses acquired or divested from organic revenue for a period of 12 months after we complete the acquisition or divestiture. Organic revenue is not equivalent to any measure required under GAAP and may not be comparable to similarly titled measures reported by other companies.
We define adjusted operating income as operating income excluding all mergers and acquisitions (M&A)-related expenses (including M&A-related earn-outs) and amortization, as well as all expenses related to the significant reduction and shift of the company's operations in China. We define adjusted operating margin as operating margin excluding all M&A-related expenses (including M&A-related earn-outs) and amortization, as well as all expenses related to the significant reduction and shift of the company's operations in China. We present these measures because we believe they better reflect period-over-period comparisons and improves overall understanding of the underlying performance of the business absent the impact of M&A and the shift of the company's operations in China.
We define free cash flow as cash provided by or used for operating activities less capital expenditures. Free cash flow is presented solely as a supplemental disclosure to help investors better understand how much cash is available after making capital expenditures. Our management team uses free cash flow to evaluate the health of our business. Free cash flow is not equivalent to any measure required under GAAP and should not be considered an indicator of liquidity. Moreover, the free cash flow definition we use may not be comparable to similarly titled measures reported by other companies.
In addition to the measures described above, we calculate revenue renewal rates to evaluate how successful we've been in maintaining existing business for products and services that have revenue associated with periodic renewals. We use the annual contract value method, which tracks the dollar value of renewals compared with the total dollar value of contracts up for renewal during the period. We include changes in the contract value in the renewal amount. We also include variable-fee contracts in this calculation and use the actual revenue for the previous comparable fiscal period as the base rate for calculating the renewal percentage. The renewal rate excludes setup and customization fees and contract renewals that were pending as of January 31, 2024.
Regulatory Trends Affecting Our Business
In addition to the industry developments described under Part I, Item 1. Business - "Our Strategy" there are several longer-term regulatory trends we consider relevant to our business, as summarized below and as described in more detail in Part I, Item 1. Business - “Government Regulation” and in Part I, Item 1A - “Risk Factors” of this Report.
Even in its fragmented state, regulators globally continue to focus on certain recurring themes, including access to financial services, the quality of advice and the value of the services provided, the protection of customer data and transparency around the uses of such data, the minimization of conflicts of interest, and improvements in corporate governance and risk management.
With respect to our credit ratings business, the European Securities Market Authority or the U.K. Financial Conduct Authority may begin to make inconsistent modifications to the laws and regulations of the credit rating agency regulatory regimes, which would increase the cost and complexity of regulatory compliance for our credit ratings business.
59
Table of Contents
In the U.K. and Continental Europe, with respect to our Investment Management business, Morningstar continues to navigate the equivalence regimes and domestic laws governing matters of access in financial services post-Brexit. In other parts of the world, recent regulations and other guidance in jurisdictions, like Australia and New Zealand, have focused on investment management compliance practices, such as design and distribution obligations, conflicts of interest and fee disclosures. The increased complexity and extent of regulatory change globally is a challenge for both Morningstar and its clients, and we continue to expend resources to remain in compliance.
Interest from investors, regulators and other relevant stakeholders in firms adopting ESG-related business and operational risk strategies persists. Morningstar is impacted by these trends on the corporate level, as a United States (U.S.) public company with international operations, and on a business level, as a provider of ESG data, ratings and other services to help investors and companies identify, understand, and manage ESG-driven risks and opportunities and inform their decisions. These developments are expected to have long term impacts on our delivery of products and services, customer interactions, physical operations, technology systems, and dependencies on third parties.
Morningstar is monitoring proposed legislation in the U.S., European Union (EU), and in other jurisdictions relevant to its ESG business activities. These and other potential regulations may impact not only the scope of our disclosure obligations and the ESG-related products and services we provide to customers, but also present an opportunity to guide and inform investors who are looking to understand the regulations and develop their own workflows to ensure their compliance with new requirements.
The politicization of ESG-related business activities and investments has increased in recent years, particularly in the U.S. This politicization has led to the rise of anti-ESG proponents and actions, including individual and multi-state inquiries into companies’ ESG activities, the submission of anti-ESG shareholder proposals to U.S.-based public companies, and the filing of shareholder derivative lawsuits against U.S. companies. As Morningstar provides data and analysis with respect to ESG-related investments, Morningstar, along with other financial service providers, faces scrutiny in this political environment and expends resources in responding to inquiries. Morningstar continues to closely monitor the ESG and anti-ESG landscape.
Data privacy regulation continues to proliferate, as numerous national and state jurisdictions have adopted or are considering new data privacy regulations.
As a related matter, issues of cybersecurity as they relate to the identification and mitigation of cyber threats also continue to grow in prominence and laws governing data breaches continue to proliferate globally. Financial regulators have also increased scrutiny on the data protection practices of the entities, such as Morningstar, that they oversee. In the U.S., the SEC recently adopted disclosure requirements regarding cybersecurity hygiene and preparedness and cyber incident reporting.
Regulators in various global jurisdictions have adopted or are considering regulations governing AI technologies, including the EU’s AI Act. Additionally, regulators have sought to clarify that existing regulations apply to novel use cases involving AI technologies. Combined, this regulatory activity creates a complex and potentially costly compliance environment as Morningstar deploys AI technologies in its products and in tools used in the workplace.
Finally, our company is impacted by government regulation and policies focused on macroeconomic trends such as inflation and unemployment. Central banks’ increases in interest rates to combat inflationary pressures increases our interest expense on our variable rate indebtedness, while the volatile rate environment reduces credit issuance putting negative pressure on our credit rating business. Our compensation expense reflects rising wage scales in many of the markets where we operate as unemployment rates remain low. Overall, our business, balance sheet, technological infrastructure, and teams have shown resilience and flexibility navigating global macroeconomic trends.
60
Table of Contents
Consolidated Results
Key metrics (in millions) 2023 2022 Change
Operating margin 11.3 % 9.0 % 2.3 pp
Cash provided by operating activities $ 316.4 $ 297.8 6.2 %
Cash used for investing activities $ (81.9) $ (799.3) (89.8) %
Cash provided by (used for) financing activities $ (278.4) $ 415.1 (167.1) %
___________________________________________________________________________________________
pp — percentage points
61
Table of Contents
Consolidated Revenue
Revenue by type (1)
Change
Morningstar Data and Analytics
Asset-based — — — — % — %
PitchBook
Asset-based — — — — % — %
Transaction-based — — — — % — %
Morningstar Wealth
Morningstar Credit
License-based $ 11.7 $ — $ — NMF — %
Asset-based — — — — % — %
Morningstar Retirement
Corporate and All Other (2)
_________________________________________________________________________
NMF — Not meaningful
(1) Starting with the quarter ended March 31, 2023, the company updated its revenue-type classifications to account for product areas with more than one revenue type. Prior periods have not been restated to reflect the updated classifications. Revenue from Morningstar Sustainalytics' second-party opinions product was reclassified from license-based to transaction-based. Revenue from Morningstar Indexes data and services products was reclassified from asset-based to license-based. Revenue from Morningstar DBRS and Morningstar Credit data products was reclassified from transaction-based to license-based.
62
Table of Contents
(2) Corporate and All Other provides a reconciliation between revenue from our reportable segments and consolidated revenue. Corporate and All Other includes Morningstar Sustainalytics and Morningstar Indexes as sources of revenues.
2023 versus 2022
In 2023, our consolidated revenue rose $168.0 million, or 9.0%. Foreign currency movements decreased revenue by $3.2 million in 2023.
License-based revenue, which represents subscription services available to customers, increased 14.0%, or 11.8% on an organic basis, during 2023. Reported and organic revenue growth was primarily driven by strong demand for PitchBook and Morningstar Data and Analytics products.
Asset-based revenue increased 3.8%, or 5.6% on an organic basis, during 2023, primarily due to increases in Morningstar Indexes as well as increases in Morningstar Retirement and Morningstar Wealthasset-based revenue, driven by the rebound in global asset values and net inflows across multiple products compared to the prior year.
Transaction-based revenue decreased 10.4%, or 11.5% on an organic basis, during 2023, primarily due to declines in Morningstar Credit revenue.
2022 versus 2021
In 2022, our consolidated revenue rose $171.3 million, or 10.1%. Foreign currency movements decreased revenue by $45.9 million in 2022.
License-based revenue increased 17.7%, or 18.0% on an organic basis, during 2022. Reported and organic revenue growth was primarily driven by strong demand for PitchBook and Morningstar Data and Analytics products.
Asset-based revenue increased 1.7%, or 1.5% on an organic basis, during 2022, driven by increases in Morningstar Indexes which was partially offset by lower asset-based revenue in Morningstar Wealth and Morningstar Retirement reflecting declines in global markets.
Transaction-based revenue decreased 11.0%, or 8.3% on an organic basis, during 2022, primarily due to declines in Morningstar Credit revenue.
Organic revenue
Organic revenue (revenue excluding acquisitions, divestitures, adoption of new accounting standard changes (accounting changes), and the effect of foreign currency translations) is considered a non-GAAP financial measure. The definition of organic revenue we use may not be the same as similarly titled measures used by other companies. Organic revenue should not be considered an alternative to any measure of performance as required under GAAP.
We present organic revenue because we believe it helps investors better compare our period-to-period results, and our management team uses this measure to evaluate the performance of our business and product areas. We exclude revenue from acquired businesses from our organic revenue growth calculation for a period of 12 months after we complete the acquisition. For divestitures, we exclude revenue in the prior period for which there is no comparable revenue in the current period.
Excluding revenue from acquisitions, accounting changes, and the impact of foreign currency translations, organic revenue increased 7.5% in 2023. PitchBook and Morningstar Data and Analytics were the largest drivers of the increase in organic revenue during 2023.
63
Table of Contents
The tables below reconcile consolidated revenue to organic revenue:
Less: acquisitions (30.9) — NMF
Less: accounting changes — — — %
Effect of foreign currency translations 3.2 — NMF
Revenue by geographical area
International revenue comprised approximately 28% of our consolidated revenue in 2023 and 2022. Approximately 59% of international revenue was generated from Continental Europe and the U.K. in 2023. Revenue from international operations increased $51.3 million, or 9.9%, in 2023 driven by strong demand for Morningstar Data and Analytics products.
64
Table of Contents
Revenue Renewal Rates
As discussed in How We Evaluate Our Business, we calculate revenue renewal rates to help measure how successful we've been in maintaining existing business for products and services that have renewable revenue. The figures for license-based products includes the effect of price changes; increasing client bases upon contract renewal; any loss of clients due to cancellations; changes to the contract value upon renewal (such as increased users); and changes in the value of variable-fee contracts. These factors, therefore, can result in renewal rate percentages greater or lower than 100%.
Our revenue renewal rate calculation includes only those products that we consider to be license-based. These are primarily weighted toward Morningstar Data and Analytics and PitchBook products, but also includes other license-based products and services. For these license-based products and services, we estimate that our annual renewal rate was approximately 103% in 2023 versus 105% in 2022.
Consolidated Operating Expense
% of revenue 9.1 % 8.9 % 0.2 pp
65
Table of Contents
In 2023, operating expense increased $105.2 million, or 6.2%.
In July 2022, the company began to significantly reduce its operations in Shenzhen, China and to shift the work related to its global business functions to other Morningstar locations. Costs incurred in 2023 related to this transition totaled $15.6 million, due primarily to severance and personnel costs, transformation costs, which consisted of professional fees and the temporary duplication of headcount as the company hired replacement roles in other markets and continued to employ certain Shenzhen-based staff through the transition, and asset impairment costs. This compared to $35.7 million in 2022. During the third quarter of 2023, the company substantially completed these activities.
Excluding the impact of the China operations transition, M&A-related expenses, and intangible amortization, operating expenses increased 8.9% during 2023.
Higher compensation expense (which primarily consists of salaries, bonuses, and other company-sponsored benefits), depreciation expense, SaaS-based software subscriptions, facilities-related expenses, and commissions were the key contributors to operating expense growth in 2023. Foreign currency translations had a favorable impact of $8.3 million on operating expense in 2023.
Compensation expense increased $121.7 million in 2023. These higher costs reflect higher bonus expense and higher salary costs, including the impact of merit increases, in the PitchBook and Morningstar Data and Analytics segments to support growth.
Depreciation expense increased $15.4 million during 2023 as a result of higher capitalized software costs for product enhancements in prior periods. The shift in headcount to regions with higher compensation costs due to the company's China operations transition contributed to higher capitalized software costs. Higher leasehold improvements and additions of computer equipment also drove higher depreciation expense in 2023.
Higher software subscriptions were also a driver during 2023, increasing $10.9 million, due to the company's investment in various SaaS-based platforms across the business.
Facilities-related expense increased $8.7 million during 2023, in connection with lease expansion in certain geographies.
Sales commission expense increased $8.2 million in 2023, due to strong sales performance and higher amortization of capitalized commissions related to prior year sales performance.
On September 29, 2023, DBRS, Inc. (DBRS) entered into two settlements with the SEC requiring DBRS to pay an aggregate of $8.0 million in civil monetary penalties, thus resulting in $8.0 million of expense in 2023. Under the terms of the settlements, DBRS paid a $6.0 million civil monetary penalty to the SEC to resolve the investigation related to record-keeping, and paid a $2.0 million civil monetary penalty to the SEC to resolve the investigation related to commercial mortgage-backed securities (CMBS) ratings methodologies, both in early October 2023.
These increases were partially offset by lower stock-based compensation, professional fees, severance expense, and capitalized labor.
Stock-based compensation decreased $30.5 million in 2023, primarily driven by the PitchBook management bonus plan. The current year of the plan features lower target payouts versus the prior year. In 2022, higher stock-based compensation was driven in large part by the overachievement of targets under the prior year plan.
Professional fees decreased $17.1 million in 2023, reflecting efforts to reduce the use of outside professional services as well as lower expenses for third-party resources supporting M&A activity and the transition of the company's China-based activities. In addition, professional fees in 2022 reflected the impact of higher legal fees primarily associated with a completed independent investigation regarding certain research practices of Morningstar Sustainalytics.
66
Table of Contents
Severance expense decreased $12.7 million in 2023, compared to the prior year when severance related to the transition and shift of the company's China operations totaled $25.9 million. This decline was partially offset by $9.0 million of severance expense during 2023, respectively, related to targeted reorganizations and headcount reductions in certain parts of the business, including Morningstar Sustainalytics, Morningstar Wealth, and Morningstar DBRS. During 2023, the most significant reductions were at Morningstar Sustainalytics. These reorganizations were in part in response to slower than anticipated progress against growth targets due in part to softening demand for ESG solutions for Morningstar Sustainalytics, the impact of sharp market declines in 2022 for Morningstar Wealth, and weak credit issuance activity, especially in U.S. CMBS, for Morningstar DBRS. In addition, the company incurred $2.4 million in severance expense related to the company's China operations transition during 2023.
An increase of $11.7 million in capitalized software development related to the shift in headcount to regions with higher compensation costs due to the company's China operations transition and accelerated product development efforts for our key product areas reduced operating expense in 2023.
Cost of revenue
Cost of revenue is our largest category of operating expense, representing about one-half of our total operating expense. Our business relies heavily on human capital, and cost of revenue includes the compensation expense for employees who produce our products and services. We include compensation expense for approximately 75% of our employees in this category.
Cost of revenue increased $64.2 million, or 8.2%, in 2023. Higher compensation expense of $66.1 million was the largest contributor to the increase, primarily due the factors noted above. Cloud computing and production expense also increased $5.6 million and $4.7 million, respectively. These increases were partially offset by lower capitalized software expense of $11.7 million and lower professional fees of $10.7 million, due to the factors described above.
Continuous focus on the development of our major software platforms for our key product areas, in addition to bringing new products and capabilities to market, resulted in an increase in capitalized software development over the prior year, which in turn reduced operating expense. In 2023, we capitalized $100.0 million associated with software development activities, internal infrastructure, and software, compared with $88.3 million in 2022. The increase in capitalized software development related to the company's China operations transition resulted in a shift of headcount to higher compensation regions.
Sales and marketing
Sales and marketing expense increased $67.3 million, or 18.9%, in 2023. Higher compensation expense of $54.3 million was the largest contributor, primarily due to the factors noted above. Sales commission expense grew by $7.6 million due in large part to strong sales performance and higher amortization of capitalized commissions related to prior year sales performance, primarily for PitchBook. Advertising and marketing costs increased $5.3 million during 2023 due to higher pay-per-click advertising and marketing campaign expense.
General and administrative
General and administrative expense decreased $44.6 million, or 11.1%, in 2023. A decline in stock-based compensation expense of $32.4 million was the largest contributor to the decline during 2023. The decrease in stock-based compensation expense was primarily driven by the PitchBook management bonus plan. The current year of the plan features lower target payouts versus the prior year. In 2022, higher stock-based compensation was driven in large part by the overachievement of targets under the prior year plan.
Severance expense also declined $18.2 million during 2023 due to the factors noted above. The decline in severance expense was partially offset by an increase of $9.0 million of severance expense related to targeted reorganizations in certain areas of business during 2023 as noted above. Professional fees decreased $6.3 million during 2023.