TRU US Equity☆

ck0001552033-20201231

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

For the fiscal year ended December 31, 2020

- OR -

For the transition period from to

Commission file number 001-37470

TransUnion

(Exact name of registrant as specified in its charter)

(Address of principal executive offices) (Zip Code)

312-985-2000

(Registrant’s telephone number, including area code)

Securities Registered Pursuant to Section 12(b) of the Act:

Title of each class Trading Symbol(s) Name of each exchange on which registered

Common Stock, par value $0.01 per share TRU New York Stock Exchange

Securities Registered Pursuant to Section 12(g) of the Act:

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

☒ Yes ☐ No

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.

☐ Yes ☒ No

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.

☒ Yes ☐ No

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232-405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files).

☒ Yes ☐ No

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer”, “accelerated filer”, “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

☒ Large accelerated filer ☐ Accelerated filer

☐ Non-accelerated filer ☐ Smaller reporting company

☐ Emerging growth company

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act.

☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report.

☒ Yes ☐ No

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act).

☐ Yes ☒ No

The aggregate market value of the voting and non-voting common equity held by non-affiliates of the registrant was approximately $16.5 billion as of June 30, 2020 (based on the closing stock price of such stock as quoted on the New York Stock Exchange).

As of January 31, 2021, there were 190.7 million shares of TransUnion common stock outstanding, par value $0.01 per share.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the Proxy Statement of TransUnion for the Annual Meeting of Stockholders to be held May 11, 2021 are incorporated by reference to the extent specified in Part III of this Form 10-K.

TRANSUNION

ANNUAL REPORT ON FORM 10-K

YEAR ENDED DECEMBER 31, 2020

TABLE OF CONTENTS

PART I 1

ITEM 1. BUSINESS 1

ITEM 1A. RISK FACTORS 21

ITEM 1B. UNRESOLVED STAFF COMMENTS 35

ITEM 2. PROPERTIES 35

ITEM 3. LEGAL PROCEEDINGS 35

ITEM 4. MINE SAFETY DISCLOSURES 35

INFORMATION ABOUT OUR EXECUTIVE OFFICERS 36

ITEM 6. SELECTED FINANCIAL DATA 40

ITEM 7A. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK 64

ITEM 8. FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA 65

Consolidated Balance Sheets 69

Consolidated Statements of Income 70

Consolidated Statements of Comprehensive Income 71

Consolidated Statements of Cash Flows 72

Consolidated Statements of Stockholders’ Equity 73

Notes to Consolidated Financial Statements 76

ITEM 9A. CONTROLS AND PROCEDURES 107

ITEM 9B. OTHER INFORMATION 107

ITEM 10. DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE 108

ITEM 11. EXECUTIVE COMPENSATION 108

ITEM 14. PRINCIPAL ACCOUNTING FEES AND SERVICES 108

ITEM 15. EXHIBITS AND FINANCIAL STATEMENT SCHEDULES 109

Cautionary Notice Regarding Forward-Looking Statements

This Annual Report on Form 10-K, including the exhibits hereto, contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. These statements are based on the current beliefs and expectations of TransUnion’s management and are subject to significant risks and uncertainties. Actual results may differ materially from those described in the forward-looking statements. Any statements made in this report that are not statements of historical fact, including statements about our beliefs and expectations, are forward-looking statements. Forward-looking statements include information concerning possible or assumed future results of operations, including descriptions of our business plans and strategies. These statements often include words such as “anticipate,” “expect,” “guidance,” “suggest,” “plan,” “believe,” “intend,” “estimate,” “target,” “project,” “should,” “could,” “would,” “may,” “will,” “forecast,” “outlook,” “potential,” “continues,” “seeks,” “predicts,” or the negatives of these words and other similar expressions.

Factors that could materially affect our financial results or such forward-looking statements include:

•the effects of the COVID-19 pandemic on the economy;

•the duration of the COVID-19 pandemic and the timing of the economic recovery following the COVID-19 pandemic;

•macroeconomic and industry trends and adverse developments in the debt, consumer credit and financial services markets;

•our ability to provide competitive services and prices;

•our ability to retain or renew existing agreements with large or long-term customers;

•our ability to maintain the security and integrity of our data;

•our ability to deliver services timely without interruption;

•our ability to maintain our access to data sources;

•government regulation and changes in the regulatory environment;

•litigation or regulatory proceedings;

•regulatory oversight of critical activities;

•our ability to effectively manage our costs;

•economic and political stability in the United States and international markets where we operate;

•our ability to effectively develop and maintain strategic alliances and joint ventures;

•our ability to timely develop new services and the markets’ willingness to adopt our new services;

•our ability to manage and expand our operations and keep up with rapidly changing technologies;

•our ability to make acquisitions and successfully integrate the operations of acquired businesses and realize the intended benefits of such acquisitions;

•our ability to protect and enforce our intellectual property, trade secrets and other forms of intellectual property;

•our ability to defend our intellectual property from infringement claims by third parties;

•the ability of our outside service providers and key vendors to fulfill their obligations to us;

•further consolidation in our end-customer markets;

•the increased availability of free or inexpensive consumer information;

•losses against which we do not insure;

•our ability to make timely payments of principal and interest on our indebtedness;

•our ability to satisfy covenants in the agreements governing our indebtedness;

•our ability to maintain our liquidity;

•share repurchase plans; and

•our reliance on key management personnel.

There may be other factors, many of which are beyond our control, that may cause our actual results to differ materially from the forward-looking statements, including factors disclosed under the sections entitled “Risk Factors” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in this report. You should evaluate all forward-looking statements made in this report in the context of these risks and uncertainties.

The forward-looking statements contained in this report speak only as of the date of this report. We undertake no obligation to publicly release the result of any revisions to these forward-looking statements, to reflect the impact of events or circumstances that may arise after the date of this report.

PART I

Unless the context indicates otherwise, any reference to the “Company,” “we,” “us,” and “our” refers to TransUnion and its direct and indirect subsidiaries.

ITEM 1 BUSINESS

Overview

TransUnion is a leading global information and insights company that strives to make trust possible between businesses and consumers, working to ensure that each person is reliably and safely represented in the marketplace. At TransUnion, we find innovative ways to leverage data and information to help businesses and consumers transact with confidence and achieve great things. We call this Information for Good.

Grounded in our legacy as a credit reporting agency, we have built a robust and accurate database of information for a large portion of the adult population in the markets we serve. We use our data fusion methodology to link and match an increasing set of other disparate data to further enrich our database. We use this enriched data, combined with our expertise, to continuously develop more powerful and useful solutions for our customers, all in accordance with global laws and regulations. Because of our work, organizations can better understand consumers in order to make more informed decisions, and earn consumer trust through great, personalized experiences, and the proactive extension of the right opportunities, tools and offers. In turn, we believe consumers can be confident that their data identities will result in the opportunities they deserve.

We provide consumer reports, actionable insights and analytics such as credit and other scores, and technology solutions to businesses. Businesses embed our solutions into their process workflows to acquire new customers, assess consumer ability to pay for services, identify cross-selling opportunities, measure and manage debt portfolio risk, collect debt, verify consumer identities and investigate potential fraud. Consumers use our solutions to view their credit profiles and access analytical tools that help them understand and manage their personal information and take precautions against identity theft. We have deep domain expertise across a number of attractive industries, which we also refer to as verticals, including Financial Services, Healthcare, Insurance and other markets we serve. We have a global presence in over 30 countries and territories across North America, Latin America, Europe, Africa, India, and Asia Pacific.

Our addressable market includes the data and analytics market, which continues to grow as companies around the world recognize the benefits of building an analytical enterprise where decisions are made based on data and insights, and as consumers recognize the importance that data and analytics play in their ability to procure goods and services and protect their identities. There are several underlying trends supporting this market growth, including the creation of large amounts of data, advances in technology and analytics that enable data to be processed more quickly and efficiently to provide business insights, and growing demand for these business insights across industries and geographies. Leveraging our more than 50 year operating history and our established position as a leading provider of information and insights, we have advanced our business by investing in a number of strategic initiatives such as evolving our technology infrastructure to leverage both internal and external capabilities as appropriate to best serve our customers, expanding the breadth and depth of our data, strengthening our analytics capabilities and enhancing our business processes. As a result, we believe we are well positioned to expand our share within the markets we currently serve and capitalize on the larger data and analytics opportunity.

Our solutions are based on a foundation of financial, credit, alternative credit, identity, bankruptcy, lien, judgment, healthcare, insurance claims, automotive and other relevant information obtained from thousands of sources including financial institutions, private databases and public records repositories. We refine, standardize and enhance this data using sophisticated algorithms to create proprietary databases. Our technology infrastructure allows us to efficiently integrate our data with our analytics and technology capabilities to create and deliver innovative solutions to our customers and to quickly adapt to changing customer needs. Our deep analytics resources, including our people and tools driving predictive modeling and scoring, customer segmentation, benchmarking and forecasting, enable us to provide businesses and consumers with better insights into their data. Our technology solutions capabilities, which are generally delivered on a software-as-a-service platform, allow businesses to interpret data and apply their specific qualifying criteria to make decisions and take actions. Collectively, our data, analytics and technology solutions capabilities allow businesses to authenticate the identity of consumers, effectively determine the most relevant products for consumers, retain and cross-sell to existing consumers, identify and acquire new consumers and reduce loss from fraud and data breaches. Similarly, our capabilities allow consumers to see how their credit profiles have changed over time, understand the impact of financial decisions on their credit scores, manage their personal information and take precautions against identity theft.

We leverage our differentiated capabilities in order to serve a global customer base across multiple geographies and industry verticals. We offer our solutions to business customers in Financial Services, Healthcare, Insurance and other industries, and our customer base includes many of the largest companies in the industries we serve. We sell our solutions to leading consumer lending banks, credit card issuers, alternative lenders, auto insurance carriers, auto lenders, healthcare providers, and federal, state and local government agencies. We have been successful in leveraging our brand, our expertise and our solutions in our

1

global operations and have a leading presence in several high-growth international markets. Millions of consumers across the globe also use our data to help manage their personal finances and take precautions against identity theft.

We believe we have an attractive business model that has highly recurring and diversified revenue streams, low capital requirements, significant operating leverage and strong and stable cash flows. The proprietary and embedded nature of our solutions and the integral role that we play in our customers’ decision-making processes have historically translated into high customer retention and revenue visibility. We continue to demonstrate organic growth by increasing our sales to existing customers, innovating new solutions and gaining new customers. We have a diversified portfolio of businesses across our segments, reducing our exposure to cyclical trends in any particular industry vertical or geography. We operate primarily on a contributory data model in which we typically obtain updated information including a growing set of public record and alternative data at little or no cost, as we develop new solutions and expand into new industries and geographies. We are evolving our hybrid public-private technology infrastructure to ensure that our systems remain highly secure, reliable, and performant by design. We are focused on processes and foundational technology that allows us to leverage demand-led consumption from public cloud providers and from our high performance privately owned infrastructure.

On March 11, 2020, the World Health Organization declared COVID-19 a global pandemic and recommended extensive containment and mitigation measures worldwide. The pandemic has reached all of the regions in which we do business, and governmental authorities around the world have implemented numerous measures attempting to contain and mitigate the effects of the virus, including travel bans and restrictions, border closings, quarantines, shelter-in-place orders, shutdowns, limitations or closures of non-essential businesses, school closures, social distancing requirements and various economic stimulus initiatives. While certain of these measures have been relaxed or reversed to varying degrees throughout the world, many have been subsequently reinstated and even tightened, adding an additional layer of uncertainty. In the fourth quarter of 2020, several COVID-19 vaccines were approved for use by various governments throughout the world, including in the United States. The vaccines have begun to be distributed and administered in the United States and various other regions where we operate, with varying degrees of success. The ultimate success of these efforts will also be impacted by vaccine manufacturers’ ability to successfully produce and effectively distribute adequate doses of the vaccine in a timely manner, the availability of a sufficient number of healthcare workers to administer the vaccines, as well as the public’s perception of the safety of the vaccines and their willingness to receive them, among others.

The global spread of COVID-19 and actions taken in response to the virus continue to negatively affect workforces, customers, consumer confidence, financial markets, employment rates, consumer spending, credit markets and housing demand, cause significant economic, business and social disruptions, volatility and financial uncertainty, and have led to a significant economic downturn, including in the markets where we operate. Businesses and consumers continue to react and adapt to the uncertainty with varying degrees of success in the markets where we operate. Since mid-March 2020, the COVID-19 pandemic, widespread measures implemented to contain its effects, and business and consumer responses to such measures, have had a material and adverse impact on numerous aspects of our business, including customer demand for our services and solutions in all of our segments. While we have seen signs of increased demand for our services in the markets where we operate since the low point in April 2020, including ongoing improvements through the fourth quarter of 2020, the impact of COVID-19, including government measures and business and consumer responses to such measures, may continue to have a material adverse impact on our business and financial results for an uncertain period of time.

In the face of these challenges, our primary focus has been and continues to be the health and safety of our associates, our customers, and the wider communities in which we operate. We quickly and effectively moved to a work-from-home model in the early days of the pandemic in every market we serve, and continue to adhere to that model. This has allowed us to protect our associates and the broader population while continuing to operate our businesses and provide services and solutions to customers and consumers. We remain focused on ensuring impacted consumers are aware of resources and relief available to them, and we are working with trade associations and industry peers to facilitate access to resources and educational materials aimed at consumers.

During this challenging period, our total revenues increased from $2.656 billion for the year ended December 31, 2019 to $2.717 billion for the year ended December 31, 2020, representing a year-over-year increase of 2.3%. Our Net Income attributable to TransUnion decreased from $346.9 million for the year ended December 31, 2019, to $343.2 million for the year ended December 31, 2020, representing a year-over-year decrease of 1.1%. Our Adjusted EBITDA decreased from $1,058.9 million for the year ended December 31, 2019 to $1,044.9 million for the year ended December 31, 2020, representing a year-over-year decrease of 1.3%. As of December 31, 2020, the book value of our debt was $3.454 billion. See Part II, Item 7, “Management’s Discussion and Analysis of Financial Conditions and Results of Operations - Key Performance Measures,” for our definition of Adjusted EBITDA and the reconciliation to net income attributable to TransUnion.

Our Evolution

We are dedicated to evolving our legacy as a global information and insights company that makes trust possible, so businesses and consumers can transact with confidence and achieve great things. Our business has over 50 years of operating history and a

2

long track record of providing information and insights to businesses and consumers while continuing to innovate to meet their changing needs. Since our founding as a provider of regional credit reporting services, we have built a comprehensive, valuable, and unique database of U.S. consumers to build solutions that span many industry verticals and customer processes. We expanded our operations by targeting new customers, industry verticals and geographies and also entered the consumer solutions space. We have strengthened our analytics and technology solutions capabilities and acquired complementary datasets and technologies enabling us to enhance our solutions, diversify our revenue base and expand into other verticals, such as Healthcare, Media and Insurance. We continue to grow our global presence, creating and acquiring credit reporting agencies in new geographies and establishing strong international footholds to expand into other emerging markets. We also expanded the reach of our consumer solutions by partnering with other market leaders and innovators.

As part of our continued evolution, we have invested in a number of strategic initiatives that we believe will allow us to cater to the growing demand for data and analytics, provide differentiated solutions and better serve our customers. These initiatives include:

•Investing in our Technology: Technology is at the core of the solutions we provide to our customers. We continue to make significant investments to evolve our technology infrastructure by leveraging both internal and external resources. We also leverage the latest data and analytics technologies which enable us to be quicker, more efficient and more cost-effective. Our significant ongoing investments allow us to organize and handle high volumes of disparate data, improve delivery speeds, provide better availability, strengthen product development capabilities and continue to invest in information security on the basis of risk, while lowering our overall cost structure. Our technology allows us to build capabilities and leverage them across multiple geographies and industry verticals.

•Expanding our Data: We continue to invest in the breadth and depth of our data. We introduced the concept of trended data to provide the trajectory of a consumer’s risk profile, used public records data to enhance the scope of business issues we can address, incorporated alternative data into our databases to allow for a more comprehensive risk assessment of banked and unbanked consumers, and have made several recent acquisitions in our Media vertical to add yet another dimension to our ability to match data in a digital world. We believe we are the largest provider in the United States of both nationwide consumer credit data and comprehensive, diverse public records data. We continue to improve the quality of our data, provide deeper insights into risk and create differentiated solutions for our customers.

•Strengthening our Analytics Capabilities: We have strengthened our analytics capabilities by leveraging modern technology and differentiated data assets, strategic acquisitions, utilizing more advanced tools and growing our analytics team. This has allowed us to create solutions that produce greater insights and more predictive results, which help our customers make better decisions. Our strengthened analytics capabilities have also shortened our time-to-market to create and deliver these solutions to our customers.

•Broadening our Target Markets: We have grown our target markets by establishing a presence in attractive high-growth and strategic international markets such as the United Kingdom, India, Colombia and the Philippines. We have also established and grown our presence in diversified verticals such as Healthcare, Insurance, Public Sector, and Media, as well as expanded the reach of our consumer offerings by partnering with traditional and emerging providers in new verticals. Our capabilities enable us to develop scalable products that we are able to deploy across new markets and verticals globally.

•Enhancing our Business Processes and Capabilities: We continue to enhance our business processes and capabilities to support our growth. We have developed technology centers-of excellence, common tools and technologies, and redundancy and disaster recovery plans. We have hired additional industry experts, which has allowed us to create and sell new vertical-specific solutions that address our customers’ needs. Our global sales force structure includes dedicated teams for our largest customers, shared sales teams for our mid-sized customers, and call center support teams for our smaller customers, which increases our sales team’s effectiveness across our target markets.

We believe that our ongoing focus on evolving with the market and with our customers’ needs ensures continued improvement in our overall services to businesses and consumers. Leveraging our trusted brand, global scale and strong market position in the verticals we serve will allow us to capitalize on business opportunities worldwide and contribute to our long-term growth.

Our Market Opportunity

We believe we are well-positioned to capitalize on the long-term trend of businesses and consumers using data and analytics to make more informed decisions and manage risk more effectively. As worldwide spending on data and analytics increases, we believe there are several key trends in the global macroeconomic environment affecting the geographies and industry verticals we serve that will create increasing demand for our solutions:

•Rapid Growth in Data Creation and Application: Larger and more diversified datasets are now assembled faster while the breadth of analytical applications and solutions has expanded. Companies are increasingly relying on

3

business analytics and data technologies to help process this data in a cost-efficient manner. Non-traditional sources of data have become important in deriving alternative metrics. The proliferation of smartphones and other mobile devices generates enormous amounts of data tied to consumers, activities and locations. We believe that the demand for targeted data and sophisticated analytical solutions will continue to grow meaningfully as businesses seek real-time access to more granular views of consumer populations and more holistic views on individual consumers.

•Advances in Technology and Analytics Unlocking the Value of Data: Ongoing advances in data collection, storage and analytics technology have contributed to the greater use and value of data and analytics in decision making. As businesses have gained the ability to rapidly aggregate and analyze data, they increasingly expect access to real-time data and analytics from their information providers as well as solutions that fully integrate into their workflows. We believe this has made sophisticated technology critical for gaining and retaining business in the risk and information services industry.

•Greater Adoption of Data Solutions Across New and Existing Industry Verticals: With the proliferation of data, we believe companies across new and existing industry verticals recognize the value of risk information and analytical tools, particularly when tailored to their specific needs.

◦Financial Services Industry: The combination of increased capital requirements, additional compliance costs and the overhang of legacy assets is pushing large segments of small-to-medium-sized business and consumer lenders out of the banking sector, resulting in the creation of new specialty finance companies, such as peer-to-peer lending platforms and online balance sheet lenders, which are actively filling the void. These technology-enabled lending platforms provide access to credit in a fast and efficient manner by utilizing sophisticated risk assessment tools that leverage data, such as behavioral data, transactional data and employment and credit information. At the same time, traditional financial services companies are also increasing the use of applications and data in order to address regulatory requirements, lower operating costs and better serve their customers.

◦Healthcare Industry: Greater patient financial responsibility, focus on cost management and regulatory supervision are all driving healthcare providers to use data and related analytics tools to better manage their revenue cycle. For example, to reduce collection risks, healthcare providers seek information about their patients’ insurance coverage and ability to pay at the time of registration. Insurance discovery tools are increasingly being utilized to optimize accounts receivable management, maximize collections and minimize uncompensated care.

◦Insurance Industry: As consumers increasingly obtain quotes from multiple insurers in an effort to lower their costs, insurers are trying to improve the accuracy of their risk assessments and initial quotes. For example, insurance carriers are using driver violation data to uncover offenses that will impact pricing earlier in the quoting process so consumers have a more accurate view of the premiums they will be charged.

◦Other Emerging Verticals: We also offer solutions in a diversified portfolio of other emerging verticals such as Media, Collections, Tenant and Employment, Public Sector, Diversified Markets and other verticals. Within the Media vertical, our highly accurate consumer data helps companies improve their marketing investments through solutions that provide more targeted audience segments to reach the right consumers across digital channels. In Collections, our solutions improve third party collectors’ bottom line and help provide a quality customer experience by delivering actionable consumer insights and services. Our Tenant and Employment business provides data and insights to make informed investment, hiring, and rental decisions. Our suite of solutions in the Public Sector gives government agencies the superior data assets, analytics, and security they need to manage compliance and boost services for the constituents they serve. We also offer data-driven solutions in other verticals that address the entire customer lifecycle in industries such as technology, retail and e-commerce, communications and energy, and services and screening.

•Increasing Lending Activity in Emerging International Markets:As economies in emerging markets continue to develop and mature, we believe there will continue to be favorable socio-economic trends, such as an increase in the size of the middle class and a significant increase in the use of financial services by under-served and under-banked consumers. In addition, credit penetration is relatively low in emerging markets when compared to developed markets. For example, using our database of information compiled from financial institutions as a benchmark of credit activity, we estimate that approximately 30% of the adult population in India is currently credit active. Furthermore, the widespread adoption and use of mobile phones in emerging markets have enabled greater levels of financial inclusion and access to banking and credit. We expect the populations in emerging markets to continue to become more credit active, resulting in increased demand for our services.

•Increased Management and Monitoring of Personal Financial Information and Identity Protection by Consumers: We expect demand for consumer solutions to continue to rise with greater consumer awareness of the

4

importance and usage of their credit information, increased risk of identity theft due to data breaches and increasingly available free credit information. The proliferation of mobile devices has also made data much more accessible, enabling consumers to manage their finances and monitor their information in real-time. We believe these trends will continue to drive growth for our consumer business.

Our Competitive Strengths

Comprehensive and Unique Datasets

Our long operating history and thought leadership in the industry have allowed us to build comprehensive and unique data assets that would be difficult for a new market entrant to replicate. Our solutions are based on a foundation of financial, credit, alternative credit, identity, bankruptcy, lien, judgment, healthcare, insurance claims, automotive and other relevant information obtained from thousands of sources including financial institutions, private databases, public records repositories, and other alternative data sources. We refine, standardize and enhance this data using sophisticated algorithms to create proprietary databases. We are constantly updating our data to keep it current, and we continue to identify opportunities to acquire additional data. We believe that our data is unique and differentiates us from our competitors. We own several proprietary datasets such as consumer credit information, driver violation history, healthcare eligibility information, business data and rental payment history. Our global data assets encompass alternative data, such as the voter registry in India, a vehicle information database in South Africa, and a mobile device database from our acquisition of iovation, Inc. (“iovation”). We have also acquired public record datasets, which are time consuming and difficult for others to obtain and associate with the correct person. We believe we are the largest provider of scale in the United States to possess both nationwide consumer credit data and comprehensive, diverse public records data, which allows us to better predict behaviors, assess risk and address a broader set of business issues for our customers.

Technology Infrastructure

While technology advances never cease, we continue to evolve our infrastructure and our capabilities to efficiently interface with our clients in the business ecosystems in which we participate. The need to further expand and evolve our enterprise approach to technology has become more significant as TransUnion has increasingly become a global company. Our technology infrastructure allows us to continually improve our overall services to businesses and consumers and ensures that we are well positioned to differentiate our datasets and capabilities. We believe our technology infrastructure capabilities have resulted in increased throughput, improved data matching, greater efficiency, advanced platform flexibility, better information security, and lower operating costs.

•Powerful Data Capabilities: Our technology gives us the ability to process, organize and analyze high volumes of data across multiple operating systems, databases and file types as well as to deal with both structured and unstructured data that changes frequently. We process billions of transactions on a daily basis.

•Enhanced Linking and Matching: Because our data matching technology is able to interrelate data across disparate sources, industries and time periods, we believe that we are able to create differentiated datasets and provide our customers with comprehensive insights that allow them to better evaluate risk. For example, our TLOxp solution leverages these data matching capabilities across various datasets to identify and investigate relationships among people, assets, locations and businesses, allowing us to offer enhanced due diligence, threat assessment, identity authentication and fraud prevention and detection solutions.

•Continuing Evolution of Our Hybrid Public-Private Cloud Infrastructure:At the beginning of 2020, we announced an initiative to further enhance our technology infrastructure through a three-year investment that we refer to as Project Rise. This investment is a continuing evolution of our hybrid public-private cloud infrastructure, a significant upgrade to our existing infrastructure. Project Rise is an initiative designed to ensure that our technology is even more effective, efficient, secure and reliable, which we believe will enable us to perform at our highest level across all of TransUnion. Our investment will be concentrated in streamlining processes, increasing automation, and rapidly adopting a hybrid public and private cloud approach globally. The benefits we expect to realize under Project Rise include:

◦refactoring and optimizing our applications into a more modern API-based and microservices-oriented architecture.

◦simplifying the delivery of our intellectual property on a global basis, further increasing our speed-to-market. We will more easily push our intellectual property into the public cloud and then pull it down for use in a given market. This approach will help us continue our rapid international expansion and more effortlessly deploy solutions across our markets.

◦creating meaningful scaled economies around company-driven consumption of our infrastructure using cloud-based technology. We will consume and pay for only needed infrastructure as we develop new applications.

5

Using this infrastructure-as-code approach eliminates the time-consuming manual provisioning process and replaces it with auto-provisioning from either the private cloud or a public cloud provider.

◦utilizing readily available innovative tools from cloud-service providers instead of developing them ourselves. This shift will enable faster product development through new compliance tools, model training, machine learning and other cutting-edge technologies. By employing more highly automated tools with auto-provisioning infrastructure, our developers will focus on value-added, revenue generating work, freeing them from traditional preparation and enablement activities.

◦accessing the new public cloud business models. For example, public cloud providers have been building application and data marketplaces. This move will help ensure that no matter how data and applications are delivered to customers, whether through a public cloud marketplace or our own Prama DataHub, we will be able to participate.

Sophisticated and Flexible Analytics and Technology Solutions Capabilities

We have developed sophisticated and flexible analytics and technology solutions capabilities by investing in technology, tools and people. Our technology allows us to quickly build sophisticated analytics and technology solutions functionality that caters to our customers’ evolving needs. Our analysts leverage our technology infrastructure and data matching capabilities to gain real-time access to our entire dataset across different data sources and run analyses across this data while remaining compliant with permitted data use. Our analysts are typically able to create data samples for model development, model validations and custom analyses in less than one day using self-serve data access. Our analysts are equipped with a diverse modeling and analytical toolkit, such as visualization and machine learning, which allows them to quickly build and deploy these capabilities. We have an experienced analytics team with substantial industry experience, complemented by a deep knowledge of consumer credit data. Our team is highly qualified with advanced degrees or doctorates in statistics, math, finance or engineering, and is instrumental in understanding customer requirements, sourcing raw data and turning that data into solutions that provide insights and decisions to solve our customers’ problems.

Innovative and Differentiated Solutions

We consistently focus on innovation to develop new and enhanced solutions that meet the evolving needs of our customers. We believe our specialized data, analytics and solution services and collaborative approach with our customers differentiate us from our competitors. Our solutions are often scalable across different customers, geographies and verticals. Several examples of our innovative and differentiated solutions include:

•CreditVision: We continue to enhance our credit data by including new data fields, enriching values in existing data fields and expanding account history. Our enhanced credit data has been combined with hundreds of algorithms to produce CreditVision and CreditVision Link, first to market and market-leading solutions that provide greater granularity and evaluate consumer behavior patterns over time. This results in a more predictive view of the consumer, increases the total population of consumers who can effectively be scored and helps consumers gain improved pricing.

•CreditVision Acute Relief Solution suite: Today’s uncertain economic environment continues to impact consumer behavior and performance. Using FCRA-governed data, this newly released set of trended credit attributes and accompanying score provides a more precise view of consumers impacted by acute economic conditions, enabling more clarity to help our customers manage accounts appropriately. CreditVision Acute Relief Attributes help identify credit relationships and payment behaviors for consumers previously or currently in relief status during acute economic conditions, allowing support strategies to be adjusted if necessary. CreditVision Acute Relief Risk Score uses trended usage and payment data as strong leading indicators of risk, enhancing insights during acute situations.

•CreditView:CreditView is an interactive dashboard that provides consumers with credit information and educational tools in a comprehensive, user-friendly format. Consumers are able to easily see how their credit profiles have changed over time, receive alerts on key credit changes, simulate the impact of financial decisions on their credit score, and see relevant offers for financial products.

•TLOxp:TLOxp leverages our data matching capabilities across thousands of data sources to identify and investigate relationships among specific people, assets, locations and businesses. This allows us to offer enhanced due diligence, threat assessment, identity authentication and fraud prevention and detection solutions, and to expand our solutions into new verticals such as government and law enforcement.

•DriverRisk: Leveraging our driver violation database, we developed DriverRisk, a data and analytic solution that helps auto insurance carriers cost effectively validate driving records and assess risk during the underwriting and renewal process to improve returns.

6

•Insurance Discovery Solutions: Our robust insurance discovery platform helps identify incomplete, inaccurate, or missing patient data to find maximum coverage for our healthcare customers. Our solutions explore all possible avenues to identify hard-to-find coverage from third-party payers, resulting in healthier bottom lines.

•IDVision with iovation: IDVision with iovation provides insights based on experience with billions of unique mobile devices, and offers an enhanced suite of identity management, authentication and fraud prevention solutions that protect businesses from fraud. With our holistic fraud solution, businesses and consumers can safely and seamlessly transact in a digital world.

•Prama:Prama provides insights on data through a self-service, visual platform built to help understand consumer behavior, identify growth opportunities, and improve portfolio profitability. Through tools such as Market Insights, Vintage Analysis, Benchmarking,Data Extract, and Attribute Manager, Prama delivers on-demand consumer credit insights for better loan portfolio analysis.

•Audience Segmentation: Our technology platformleverages data science and machine learning technology to quickly model, build, and distribute custom audiences based on our customer’s criteria. The platform quickly translates multiple data points into insights and effective audiences, which leads to higher return on advertising spend in digital marketing channels.

•TransUnion Seamless Onboarding: Customers in many emerging markets often lack an effective seamless online onboarding tool. As COVID-19 reduced or eliminated in-person interaction, we created a digital onboarding solutions package that bundles our robust suite of pre-fill, ID verification, credit solutions tools. We deliver this solution to our customers via a single API, customized to their needs. Customers can deploy this digital onboarding solution as a mobile app, mobile website or as a white label tool built into their own platforms. We quickly launched this solution in India, South Africa, Colombia and the Philippines, creating a multi-million dollar business in less than a year, and are looking to leverage this success to build solutions in our developed markets.

Deep and Specialized Industry Expertise

We have deep expertise in a number of attractive industry verticals including Financial Services, Healthcare and Insurance. Our expertise has allowed us to develop sophisticated vertical-specific solutions within these targeted industries that play an integral role in our customers’ decision-making processes and are often embedded into their workflows. Our team includes industry experts with significant experience in the verticals that we target and relationships with leading companies in those verticals. We also have regulatory compliance expertise across the industries that we serve. Together, this expertise provides us with a comprehensive understanding of business trends and insights for customers in these verticals, allowing us to build solutions that cater to these customers’ specific requirements. We have been able to apply our industry knowledge, data assets, technology and analytics capabilities to develop new solutions and revenue opportunities within key verticals. For example, in Financial Services, our differentiated position allowed us to anticipate the increased demand from alternative consumer lending providers such as peer-to-peer lending platforms, so we created solutions that catered to these emerging providers. In Insurance, we partnered with a vehicle history data provider to launch a vehicle history score that helps insurance carriers further segment risk based on the attributes of a specific automobile. In Healthcare, we developed a solution that allows healthcare providers to search for additional health insurance coverage and recover additional uncompensated care costs.

Leading Presence in Attractive International Markets

We have been operating internationally for over 30 years and have strong global brand recognition. We have strategically targeted attractive international markets in both developed and emerging economies and have a diversified global presence, including a strong presence in Canada, Latin America, the United Kingdom, Africa, India, and Asia Pacific. Local senior management in our International markets provide us with deeper insights into these markets and stronger relationships with our customers. We have leveraged our brand, operating history, global footprint and technology infrastructure to establish new credit bureaus in several international markets, such as Canada in 1989, India in 2001 and the Philippines in 2011. Once we establish a foothold in a region, our model is to expand the services we offer within these markets and then move into adjacent emerging markets. For example, we have used our operations in Hong Kong to expand into other Asia Pacific countries and provide analytic scoring models in the Philippines, Singapore, Malaysia and Thailand. We have used our operations in South Africa to expand into neighboring African countries. We have also entered new markets through strategic acquisitions, including the United Kingdom in 2018, Colombia in 2016, and Brazil in 2011.

Proven and Experienced Management Team

Our senior management team has a proven track record of strong performance and significant expertise in the markets we serve, with an average of over twenty years of industry experience. We continue to attract and retain experienced management talent for our businesses. Our team has deep knowledge of the data and analytics sector and expertise across the various industries that we serve. Our team has overseen our expansion into new industries and geographies, while managing ongoing strategic

7

initiatives including our significant technology investments. As a result of the sustained focus of our management team, we have been successful in consistently driving growth, both organically and through acquiring and integrating businesses.

Our Growth Strategy

Enhance Underlying Data, Technology and Analytics Capabilities to Develop Innovative Solutions

As the demand for data and analytics solutions grows across industries and geographies, we will continue to expand the scope of our underlying data, improve our tools and technology and enhance our analytics and technology solutions capabilities to provide innovative solutions that address this demand. As the needs of businesses and consumers continue to evolve, we continue to help them meet their challenges, which our ongoing investments in data, technology and analytics enable us to do more quickly and efficiently. With our insights and information, our customers can explore connections between people, businesses, assets and locations; identify assets, uncover inconsistencies and identify misrepresentations; and uncover evidence of financial distress.

Our continuous technology investments have also reduced the time to market for new solutions, which allow us to react quickly to customer requirements. In addition, these investments also improve efficiency, reliability, security, and performance. We also continue to take advantage of strategic partnerships that differentiate us from our competitors. For example, by leveraging our fast, available, and secure technology infrastructure and working together with one of our strategic partners we were able to provide real-time credit decisions in a matter of seconds, enabling the use of a new virtual credit card through consumers’ digital wallets.

Further Penetrate Existing Industry Verticals with Current and New Solutions

We are a leading provider of risk and information solutions in several industry verticals today, including Financial Services, Healthcare and Insurance. We believe there is significant opportunity for further growth within these industries by expanding the number of customers to whom we sell our current solutions as well as by creating innovative new solutions that we can use to grow our presence in these industries. We focus on developing new solutions that address evolving customer needs within our industry verticals. In the Financial Services vertical, we launched Prama, a self-service, visual platform that enables access to massive anonymized data sets for benchmarking and attribute development. We also developed CreditVision, which provides customers with a time-based risk trend and increases the total eligible population of consumers. Similarly, in Insurance, we introduced the DriverRisk solution that leverages our driver violation database to cost effectively identify drivers with ratable violations, resulting in unique insights into driver risk, reduced costs, and higher returns for insurance carriers. In order to more effectively address these opportunities, we have redeployed and reallocated our sales resources to focus either on new customer opportunities or on selling additional services and solutions to existing customers. With our leading market positions, existing strong relationships in Financial Services, Healthcare and Insurance verticals, and with our consumer partners, we believe we have the opportunity to further penetrate our existing customer base and capture a strong proportion of their spending across the consumer lifecycle.

Establish Positions in New, Adjacent Industry Verticals

In addition to increasing penetration in industries where we have a substantial presence, we continue to create solutions that address customer needs in attractive new industries. Our strategy is to develop new solutions for a specific application, industry, or geography, and then deploy these solutions to other markets where they may be applicable. We believe that our capabilities allow us to quickly create and deliver solutions to new industries and geographies where information-based analytics and technology solutions capabilities are currently underutilized. For example, our strong position in Financial Services and Insurance verticals has allowed us to establish a presence in the Healthcare vertical to capitalize on the increasing demand for data and analytics solutions. Combining our in-house expertise with recent acquisitions, we have created a comprehensive suite of holistic front-end and back-end solutions in the healthcare revenue cycle management industry. We have created innovative solutions that help engage patients early, ensure earned revenue is paid and optimize payment strategies. We continue to target other verticals such as Public Sector, Tenant and Employment, and Media, where we see opportunities to leverage our existing data, analytics and technology solutions capabilities.

Expand our Presence in Attractive International Markets

We believe international markets present a significant opportunity for growth. We have significant scale in some of the world’s fastest growing markets, such as India and Latin America, which positions us to take advantage of the favorable dynamics in these regions as their populations become more credit active. We leverage solutions developed in the United States and deploy them to international markets, after localizing them to individual market requirements. For example, after launching CreditVision in the United States, we have expanded our offerings with similar solutions globally. In markets where we have established a presence in a particular vertical, we will expand further into adjacent verticals, such as Insurance and Consumer Solutions. We intend to continue to expand into new geographic markets by forming alliances with financial services institutions, industry associations and other local partners, and by pursuing strategic acquisitions. Across all our international

8

expansion initiatives, we will continue to leverage our technology infrastructure to drive speed to market, scale and differentiation.

Broaden Our Reach in Consumer Market through Direct and Indirect Channels

Our consumer business continues to deliver growth with strong margins, driven by our innovative solutions and flexible and collaborative partnership model that has expanded the market for consumer services, along with greater consumer awareness of the value of their credit information and increased risk of identity theft. Our strategy is to grow our own member base in the direct channel as well as expand our reach through partnerships in the indirect channel. Across both channels, our focus is on delivering value-added solutions and features while continuing to improve the consumer experience with more user-friendly interfaces and better customer service and educational tools. Within our indirect channel, we will continue to leverage and enhance our flexible technology platform to expand our relationship with existing partners as well as develop relationships with new partners and enter new verticals. We believe that partnerships not only enable us to grow our own business, but also expand the overall market and provide us access to new consumer segments. We will also continue to leverage our approach in the U.S. consumer market to expand our consumer operations globally.

Pursue Strategic Acquisitions

We will continue to pursue acquisitions to accelerate growth within our existing businesses and diversify into new businesses. We are focused primarily on opportunities that expand our geographic footprint, increase the breadth and depth of our datasets, enhance our services, provide us with industry expertise in our key verticals and deepen our presence in our international markets.

We have expanded our geographic footprint in new countries such as the United Kingdom, Brazil, Chile, and Colombia in the last several years. In June 2018, we entered the world’s second largest credit market in the U.K. Our U.K. business provides data, analytics and technology solutions to help businesses and consumers make informed decisions across a diverse group of industries. With a strong record of growth and innovation in both core credit and emerging solutions we have achieved strong market success in the U.K.

In our Media vertical, we have made three recent acquisitions - Tru Optik Data Corp (“Tru Optik”) and Signal Digital, Inc. (“Signal”) in 2020, and TruSignal, Inc. (“TruSignal”) in 2019, which provide us with an industry-leading position within a clearly defined part of the Media industry. These acquisitions allow us to deliver more real-time targeted data across online streaming services to improve our customers’ digital marketing campaigns. Together with TransUnion’s complementary capabilities, these acquisitions will allow us to enhance the customer base with higher accuracy and transparency that is missing in current identity and audience development products in the digital marketing space.

We enhanced our fraud and identity management service offerings when we acquired iovation in June 2018, one of the most advanced providers of device-based information in the world. We launched IDVision with iovation, which combines our extensive personal data with iovation’s digital data to offer an enhanced suite of identity management, authentication and fraud prevention solutions that protect businesses from fraud while improving the online user experience. This results in a global network of fraud and risk insights that help businesses to quickly and accurately determine authentic customers from fraudulent ones.

Our 2017 acquisitions of FactorTrust, Inc., a provider of consumer reporting models that captures a wide range of positive payment behaviors, and eBureau, LLC, a leading provider of custom analytic solutions with both credit-risk and anti-fraud applications demonstrate our commitment to build upon our success as a source of groundbreaking and versatile data and analytics capabilities.

We also developed a comprehensive set of domestic solutions in the Healthcare vertical. In June 2018, we acquired Healthcare Payment Specialists, Inc. By focusing on payment areas where superior technology and deep domain expertise can drive significant improvements, this part of our Healthcare business helps providers maximize Medicare reimbursements, which account for approximately 20% of total healthcare expenditures in the U.S. We also acquired Rubixis, Inc. (“Rubixis”) in October 2018. Rubixis’ revenue cycle optimization capabilities, particularly around denials and underpayments, round out our Healthcare solutions and positions us as the leader in revenue recovery for providers seeking to maximize reimbursement and prevent revenue leakage.

We have a strong track record of integrating acquisitions and driving long-term value creation, and we will continue to maintain a disciplined approach to pursuing acquisitions.

Segment Overview

We manage our business and report our financial results in three reportable segments: U.S. Markets, International and Consumer Interactive. We also report expenses for Corporate, which provides shared services and conducts enterprise functions. See Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” Part

9

II, Item 8 “Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements,” and Note 18, “Reportable Segments,” for further information about our reportable segments.

U.S. Markets

Our U.S. Markets segment provides consumer reports, actionable insights and analytics such as credit and other scores, and technology solutions capabilities to businesses. These businesses use our services to acquire new customers, assess consumer ability to pay for services, identify cross-selling opportunities, measure and manage debt portfolio risk, collect debt, verify consumer identities and investigate potential fraud.

We deliver our solutions across multiple industry vertical markets and report disaggregated revenue as follows:

Financial Services: The Financial Services vertical, which accounts for approximately 55.4% of our 2020 U.S. Markets revenue, consists of our consumer lending, mortgage, auto and cards and payments lines of business. Our financial services customers consist of most banks, credit unions, finance companies, auto lenders, mortgage lenders, online-only lenders (FinTech), and other consumer lenders in the United States. We also distribute our solutions through most major resellers, secondary market players and sales agents. Beyond traditional lenders, we work with a variety of credit arrangers, such as auto dealers and peer-to-peer lenders. We provide solutions across every aspect of the lending lifecycle; customer acquisition and engagement, fraud and ID management, retention and recovery. Our products are focused on mitigating risk and include credit reporting, credit marketing, analytics and consulting, identity verification and authentication and debt recovery solutions.

Emerging Verticals:Emerging verticals include Healthcare, Insurance, Tenant and Employment, Collections, Public Sector, Media, Diversified Markets and other verticals. Our solutions in these verticals are also data-driven and address the entire customer lifecycle. We offer onboarding and transaction processing products, scoring and analytic products, marketing solutions, fraud and identity management solutions and customer retention solutions.

Within U.S. Markets, we leverage our comprehensive data assets, data matching expertise and predictive analytics to develop risk-based solutions:

•Comprehensive Data Assets: Our credit database contains the name and address of substantially all of the U.S. credit-active population, a listing of their existing credit relationships and their timeliness in repaying debt obligations. The information in our database is voluntarily provided by thousands of credit-granting institutions and other data furnishers. We enhance our data assets with alternative credit sources. We also actively source information from courts, government agencies and other public records including suits, liens, judgments, bankruptcies, professional licenses, real property, vehicle ownership, other assets, driver violations, criminal records and contact information for certain databases. Our databases are updated, reviewed and monitored on a regular basis.

•Predictive Analytics: Our predictive analytics capabilities allow us to analyze our proprietary datasets and provide insights to our customers to allow them to drive better business decisions. Our tools allow customers to investigate past behavior, reasonably predict the likelihood of future events and strategize actions based on those predictions. We have numerous tools such as predictive modeling and scoring, customer segmentation, benchmarking, forecasting, fraud modeling and campaign optimization, all of which cater to specific customer requirements. Our predictive analytics capabilities are developed by an analytics team with deep industry experience and a broad array of specialized qualifications.

International

The International segment provides services similar to our U.S. Markets segment to businesses in select regions outside the United States. Depending on the maturity of the credit economy in each country, services may include credit reports, analytics and technology solutions services and other value-added risk management services. We also have insurance, business and automotive databases in select geographies. These services are offered to customers in a number of industries including financial services, retail credit, insurance, automotive, collections, public sector and communications, and are delivered through both direct and indirect channels. The International segment also provides consumer solutions similar to those offered by our Consumer Interactive segment to help consumers proactively manage their personal finances. We report disaggregated revenue of our International segment for the following regions:

Canada: We have operated in Canada since 1989 and are one of only two nationwide consumer reporting agencies in the Canadian market. We operate across multiple verticals in Canada with leading positions in insurance and automotive with a strong and growing presence in Financial Services. Our Canadian customer base encompasses some of the largest companies in their verticals, including many of the top banks, credit card issuers, insurance companies and auto manufacturer lenders.

Latin America: We have been active in Latin America since 1985 when we entered the Puerto Rican market, and now operate in numerous Central and South American countries, including a strong presence in two major markets - Colombia and Brazil. We also have significant credit bureau businesses in the Dominican Republic and Chile, and a 25.69% ownership interest in

10

Trans Union de México, S.A., the primary credit reporting agency in Mexico. In Guatemala, we maintain a centralized database that services Guatemala, Nicaragua and Costa Rica.

United Kingdom: In June 2018, we entered the world’s second largest credit market, the United Kingdom, when we acquired Callcredit, the second largest consumer credit bureau in the U.K. Our U.K. business provides data, analytics and technology solutions to help businesses and consumers make informed decisions across a diverse group of industries, and serves a broad set of customers including leading financial institutions and customers in other attractive, high-growth segments.

Africa: We launched our operations in Africa by entering South Africa in 1993, and have since expanded into many surrounding countries. We are highly diversified and serve a variety of industries through traditional consumer credit reporting services, insurance solutions, auto information solutions, and commercial credit information services. We provide risk and information solutions in Africa to many of the leading banks, retailers, auto dealer groups, and insurance companies.

India: In 2001, we partnered with prominent Indian financial institutions to create CIBIL, the first consumer and business credit reporting agency in India. We have since launched the country’s first generic credit score, which is the most widely used credit score across the financial services industry in India. In the absence of a comprehensive national ID, we created an innovative matching algorithm that allowed us to create the most extensive consumer credit database in India. We also own or have access to several non-credit data sources that we use to enhance our solutions, including the national voters’ registry, the confirmed and suspected fraud registry, property registry and tax ID database. We offer a suite of risk and information solutions across the credit lifecycle for banks, telecommunication companies and insurance companies, as well as consumer solutions such as online credit reports and scores. India has become our second largest and our fastest growing region.

Asia Pacific: Our operations in Asia Pacific include markets such as Hong Kong, the Philippines, Thailand, Singapore, and China. Asia Pacific is a growing market with increasing demand for credit driven by a rising middle class that offers significant growth potential in analytics and technology solutions. We do business with many of the top financial institutions in the countries we serve. We have had a majority ownership interest in the principal consumer credit reporting company in Hong Kong since 1998. In partnership with leading credit card issuers in the Philippines, we launched the first consumer credit reporting agency in that market in 2011. We have also built credit risk scores for the National Credit Bureau of Thailand, in which we have a 12.25% ownership interest, the Credit Bureau of Singapore and the Credit Bureau of Malaysia.

Consumer Interactive

The Consumer Interactive segment offers solutions that help consumers manage their personal finances and take precautions against identity theft. Services in this segment include credit reports and scores, credit monitoring, fraud protection and resolution, and financial management for consumers. The segment also provides solutions that help businesses respond to data breach events. Our products are provided through user-friendly online and mobile interfaces and are supported by educational content and customer support. Our Consumer Interactive segment serves consumers through both direct and indirect channels.

Direct: We provide services directly to consumers, primarily on a subscription basis through websites and mobile applications. Product features include credit reports, credit scores and analysis, alerts to changes in credit information, debt analysis, debt and retirement calculators, identity protection services, and the ability to restrict third-party access to a consumer’s TransUnion and Equifax credit reports through our paid subscription offering. We complement these features with educational content that explains how credit and financial data is used in various industries to evaluate consumers and how a consumer’s financial choices impact this evaluation. Our integrated, data-driven marketing strategy spans multiple channels including paid search, online display and email, which allows us to efficiently acquire and retain high quality consumers.

Indirect: We also provide our services to partners who may offer them on a stand-alone basis or with their own or other branded services as a bundle to consumers, governmental agencies and businesses in support of fraud or credit protection, credit monitoring, identity authentication, data breach services or as a means to engage with and acquire consumers. We offer a broad suite of solutions that include many of the features, educational content and customer support available in our direct channel. We have taken a proactive and flexible partnership approach, which has resulted in long-term strategic relationships with some of the largest providers of credit information or identity protection services in the U.S. consumer market as well as with several large financial institutions. Through these partnerships, we have significantly expanded the overall market as well as the reach of our business.

Corporate

Corporate provides support services to each segment, holds investments and conducts enterprise functions. Certain costs incurred in Corporate that are not directly attributable to one or more of the segments remain in Corporate. These costs are typically enterprise-level costs and are primarily administrative in nature.

11

Markets and Customers

We have a highly diversified customer base that includes companies across multiple industries, including Financial Services, Healthcare and Insurance. A substantial portion of our revenue is derived from companies in the financial services industry and from sales in the United States.

We leverage our comprehensive data assets, industry expertise and our technology infrastructure, allowing us to build solutions once and deploy them multiple times across the different verticals and regions. Our evolution to a hybrid public-private cloud infrastructure augments this capability. We provide services to our customers through real-time, online delivery for services such as credit reports and predictive scores, in batch form for services that help our customers proactively acquire new customers, cross-sell to existing customers and help them monitor and manage risk, and through our software-as-a-service offerings, which include a number of solutions that help businesses interpret data, maximize reimbursements, visualize insights, predict model results and apply their customer-specific criteria to facilitate real-time automated decisions at the time of customer interaction, and through our websites to consumers, for various subscription-based and transaction-based products in the United States and in other regions we serve.

We market our services globally, primarily through our own sales force. We have dedicated sales teams for our largest customers focused by industry group and geography. These dedicated sales teams provide strategic account management and direct support to customers. We use shared sales teams to sell our services to mid-size customers. These sales teams are based in our headquarters office and in field offices strategically located throughout the United States and abroad. Smaller customers’ sales needs are serviced primarily through call centers. We also market our services through indirect channels such as resellers, who sell directly to businesses and consumers. Our interactive direct-to-consumer services are sold primarily through our website.

Seasonality

Seasonality in the U.S. Markets segment is correlated to volumes of online credit data purchased by our financial services and mortgage customers, and our sales have generally been higher during the second and third quarters. Seasonality in our International segment is driven by local economic conditions and relevant macroeconomic market trends. In our Consumer Interactive segment, demand for our products is usually higher in the first half of the year, impacted by seasonality and our advertising spend.

Competition

The market for our services is highly competitive. We compete primarily on the basis of differentiated solutions, datasets, analytics capabilities, ease of integration with our customers’ technology, stability of services, customer relationships, innovation and price. We believe that we compete favorably in each of these categories. Our competitors vary based on the business segment, industry vertical and geographical market that our solutions address.

In our U.S. Markets segment, our competition generally includes Equifax, Experian and LexisNexis, in addition to certain competitors whom we only compete with in specific industry verticals. For example, we compete with FICO in the Financial Services vertical, with Verisk in the Insurance vertical, and with Experian Health, Waystar, and Cloudmed in the Healthcare vertical.

In our International segment, we generally compete with Equifax and Experian directly or indirectly through their subsidiaries or investments. We also compete with other competitors that may focus on a particular vertical, country or region.

In our Consumer Interactive segment, we generally compete with Equifax, Experian, FICO and LifeLock as well as emerging businesses, some of whom offer free credit information.

In addition to these competitors, we also compete with a number of other companies that may offer niche solutions catering to more specific customer requirements.

We believe the services we provide to our customers reflect our understanding of our customers’ businesses, the depth and breadth of our data and the quality of our analytics and technology solutions capabilities. By integrating our services into our customers’ workflows, we ensure efficiency, continuous improvement and long-lasting relationships.

Information Technology

Technology

The continuous operation of our information technology systems is fundamental to our business. Our information technology systems collect, refine, access, process, deliver and store the data that is used to provide our solutions. Customers connect to our systems using a number of different technologies, including secured internet connections, virtual private networks and dedicated network connections. Control and management of the technology that operates our business is critical to our success and to this end, we directly control and manage all of our technology and infrastructure. Our technology relies on several third-

12

party best-of-breed solutions as well as proprietary software and tools which we integrate into our platforms. Our control of our technology and infrastructure allows us to prioritize any changes and manage the roll-out of any upgrades or changes. We contract with various third-party providers to help us maintain and support our systems.

We have established technology Centers-of-Excellence that utilize similar tools and technology in order to provide scale and efficiency in modifying existing applications and developing new applications for our businesses. We deploy new development methodologies globally to enable rapid delivery of solutions and increase our speed-to-market. Our technology team includes both our own employees as well as additional resources from third-party providers.

We believe that our technology is at the core of our innovative solutions, and we continually invest in our technology and thought leaders to be a market leader. We continue to make significant investments in our infrastructure to leverage the latest data and analytics technologies. We believe that our technology platform enables us to be quicker, more efficient and more cost-effective across each step of our process chain, including receiving, consolidating and updating data, implementing analytics and technology solutions capabilities, creating innovative solutions, delivering those solutions to our customers and incorporating customer feedback. Our platform has significant scale and capacity and enables us to deliver actionable information immediately to our customers. Our technology infrastructure gives us the ability to organize and handle high volumes of disparate data, maintain and improve our delivery speeds, increase availability and enhance our product development capabilities, while at the same time lowering our overall cost structure.

Data Centers and Business Continuity

In order to create redundancy and increase resiliency, we utilize multiple data centers in all of our major markets. We generally employ similar technologies and infrastructures in each data center to enable the optimal sharing of technical resources across geographies.

We maintain a framework for business continuity that includes written policies requiring each business and operating unit to identify critical functions. Our businesses and operating units have processes in place that are designed to maintain such functions in case there is a disruptive event. We also have a specific disaster recovery plan that will take effect if critical infrastructure or systems fail or become disabled.

As part of our program, each business unit’s continuity plan is periodically updated and stored in a centralized database. These plans are monitored and reviewed by our compliance team. From time to time, our compliance team tests one or more of these plans using desktop exercises or in connection with actual events. We also periodically confirm the state of preparedness of our most critical disaster recovery procedures. We maintain systems redundancy plans for our primary U.S. data centers that allow for the transfer of capacity between geographically disbursed environments in the event there is a failure of computer hardware or a loss of our primary telecommunications lines or power sources. On an enterprise basis, our systems are designed to recover most of our operational capacity in a scenario where our primary data centers become inoperable.

During the COVID-19 pandemic, our business continuity plans kept us well positioned to continue to operate when the pandemic required global lockdowns. In each of the markets we serve, we quickly and effectively moved to a work-from-home model that we continue to adhere to. This has allowed us to protect our associates and the broader population while continuing to operate our businesses and provide services and solutions to customers and consumers.

Security

The security and protection of non-public consumer information is one of our highest priorities. TransUnion’s written information security program focuses on managing risk and fulfilling global information security regulations and standards, including ISO/IEC 27001:2013, NIST CSF, PCI-DSS, HIPAA, and other international regulatory expectations in locations where we operate. Our information security program follows a risk-based approach that continuously evaluates threats, industry events and asset values to introduce enhancements when necessary. We deploy a wide range of physical and technical safeguards that provide security around the collection, storage, use, access and delivery of information we have in our possession. These safeguards include firewalls, intrusion protection and monitoring, anti-virus and malware protection, vulnerability threat analysis, management and testing, advanced persistent threat monitoring, forensic tools, encryption technologies, data transmission standards, contractual provisions, customer credentialing, identity and access management, data loss, access and anomaly reports and training programs for associates. We, with other global financial services organizations, including U.S. nationwide consumer credit reporting companies, share cyber threat and attack information through our participation in the Financial Information Sharing and Analysis Council and other forums that may be targeted at our industry to better understand and monitor our systems and our connectivity to our customers, as well as how specific solutions that were implemented to protect against such attacks are performing. We undergo SSAE 16 reviews annually, and several of our major customers routinely audit our security controls. We conduct an annual Payment Card Industry Data Security Standard (PCI-DSS) compliance program and remain PCI certified. We regularly engage independent third-party organizations to evaluate TransUnion’s security program via testing and assessments. Additionally, we hire third parties to conduct independent information security assessments.

13

Intellectual Property and Licensing Agreement

Our intellectual property is a strategic advantage and protecting it is critical to our business. Because of the importance of our intellectual property, we treat our brand, software, technology, know-how, concepts and databases as proprietary. We attempt to protect our intellectual property rights under the trademark, copyright, patent, trade secret and other intellectual property laws of the United States and other countries, as well as through the use of licenses and contractual agreements, such as nondisclosure agreements. While we hold various patents, we do not rely primarily on patents to protect our core intellectual property. Through contractual arrangements, disclosure controls and continual associate training programs, our principal focus is to treat our key proprietary information and databases as trade secrets. Also, we have registered certain trademarks, trade names, service marks, logos, internet URLs and other marks of distinction in the United States and foreign countries, the most important of which is the trademark TransUnion name and logo. This trademark is used in connection with most of the services we sell and we believe it is a known mark in the industry.

We own proprietary software that we use to maintain our databases and to develop and deliver our services. We develop and maintain business-critical software that transforms data furnished by various sources into databases upon which our services are built. We also develop and maintain software to manage our consumer interactions, including providing disclosures and resolving disputes. In all business segments, we develop and maintain software applications that we use to deliver services to our customers, through a software-as-a-service model. In particular, we develop and maintain analytics and technology solutions infrastructure that we host and make available for our customers to develop and deploy analytics to improve business performance.

We license certain data and other intellectual property to other companies on arms-length terms that are designed to protect our rights to our intellectual property. We generally use standard licensing agreements and do not provide our intellectual property to third parties without a nondisclosure and license agreement in place.

We also license certain intellectual property that is important for our business from third parties. For example, we license credit-scoring algorithms and the right to sell credit scores derived from those algorithms from third parties for a fee.

Our History

TransUnion Corp. was spun-off from its parent, Marmon Holdings, Inc. in 2005 to the Pritzker family. On June 15, 2010, an affiliate of Madison Dearborn Partners, LLC, on behalf of certain of its investment funds, acquired 51.0% of our outstanding common stock from the Pritzker family and certain employee and director stockholders of TransUnion Corp. On April 30, 2012, TransUnion Corp. was acquired by TransUnion Holding Company, Inc., substantially all the common stock of which was owned by Advent International Corporation and The Goldman Sachs Group, Inc. On March 26, 2015, TransUnion Holding Company, Inc. was renamed TransUnion and TransUnion Corp. was renamed TransUnion Intermediate Holdings, Inc. On June 30, 2015, we completed the initial public offering of our common stock at a public offering price of $22.50 per share. Our stock trades on the New York Stock Exchange under the ticker “TRU.”

Legal and Regulatory Matters

Compliance with legal and regulatory requirements is a top priority. We are subject to numerous laws governing the collection, protection, dissemination and use of non-public personal information, credit information and other information. These laws are enforced by U.S. federal, state and local regulatory agencies, foreign regulatory authorities and, in some instances, through private civil litigation. Our failure to comply with applicable legal and regulatory requirements could have a negative impact on our financial condition or overall operations.

We proactively manage our compliance with laws and regulations through a global and legal compliance department that ensures enterprise standards are followed. Through the legal and compliance functions, we provide training to our associates, monitor all material laws and regulations, establish compliance policies, routinely review internal processes to determine whether business practice changes are warranted, assist in the development of new services, and promote regular meetings with principal regulators and legislators to establish transparency in our operations and create a means to understand and react should any issues arise.

14

U.S. Data and Privacy Protection

Our U.S. operations are subject to numerous laws and regulations governing privacy, data security, consumer protection and the use of consumer credit or an individual’s healthcare information. Certain of these laws provide for civil and criminal penalties for the unauthorized release of, or access to, this protected information. The laws and regulations that affect our U.S. business include, but are not limited to, the following:

•Fair Credit Reporting Act (the “FCRA”): FCRA applies to consumer credit reporting agencies, including us, as well as data furnishers and users of consumer reports. FCRA promotes the accuracy, fairness and privacy of information in the files of consumer reporting agencies that engage in the practice of assembling or evaluating information relating to consumers for certain specified purposes. FCRA limits what information may be reported by consumer reporting agencies, limits the distribution and use of consumer reports, establishes consumer rights to access and dispute their own credit files, includes provisions designed to prevent identity theft and assist fraud victims, requires consumer reporting agencies to make a free annual credit report available to consumers and imposes many other requirements on consumer reporting agencies, data furnishers and users of consumer report information. Violation of FCRA can result in civil and criminal penalties. Regulatory enforcement of FCRA is under the purview of the Federal Trade Commission (the “FTC”), the Consumer Financial Protection Bureau (the “CFPB”) and state attorneys general, acting alone or in concert with one another.

•The Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”): A central purpose of the Dodd-Frank Act is to “protect consumers from abusive financial services practices, and for other purposes.” The Dodd-Frank Act also prohibits unfair, deceptive or abusive acts or practices (“UDAAP”) with respect to consumer financial products and provides the CFPB with authority to enforce those provisions. The CFPB has stated that its UDAAP authority may allow it to find statutory violations even where a specific regulation does not prohibit the relevant conduct, or prior published regulatory guidance or judicial interpretation has found the activity to be in accordance with law.

•The Economic Growth, Regulatory Relief, and Consumer Protection Act (the “EGRRCPA”): In May 2018, Congress passed the EGRRCPA, which amended certain parts of the Dodd-Frank Act, FCRA and other U.S. federal laws applicable to us. Specifically, FCRA was amended to require that a credit reporting agency provide consumers with at least one year to submit a fraud alert to the credit reporting agency. The law also amended the FCRA for purposes of implementing a national security freeze that credit reporting agencies must provide free of charge upon formal request by a consumer. The credit freeze prevents credit reporting agencies from disclosing the content of a consumer report. Credit reporting agencies must also notify consumers of this right and provide instructions on how to implement and lift a credit freeze. The law increases veteran credit protection by implementing a process to remove inaccurate medical information and veteran medical debt and creates standards for verifying veteran medical debt. In addition, credit reporting agencies are required to provide free credit reporting monitoring, which requires notifying the consumer of any changes to his or her file, to any active duty military consumer.

•State unfair and deceptive practices acts and practices laws: Many states have enacted statutes that prohibit unfair and deceptive acts and practices, relating to, among other things, marketing, disclosures and billing practices within the state or directed to consumers within the state. The Company and others in the industry may be subject to these laws with respect to the marketing of consumer credit information products.

•Gramm-Leach Bliley Act (the “GLBA”): The GLBA regulates, among other things, the receipt, use and disclosure of non-public personal information of consumers held by financial institutions, including us. Several of our datasets are subject to GLBA provisions, including limitations on the use or disclosure of the underlying data and rules relating to the technological, physical and administrative safeguarding of non-public personal information. Violation of the GLBA can result in civil and criminal liability. Regulatory enforcement of the GLBA is under the purview of the FTC, the CFPB, the federal prudential banking regulators, the SEC and state attorneys general, acting alone or in concert with each other.

•Drivers’ Privacy Protection Act (the “DPPA”): The DPPA requires all states to safeguard certain personal information included in licensed drivers’ motor vehicle records from improper use or disclosure. The DPPA limits the use of this information sourced from State departments of motor vehicles to certain specified purposes, and does not apply if a driver has consented to the release of their data. The DPPA imposes criminal fines for non-compliance and grants individuals a private right of action, including actual and punitive damages and attorneys’ fees. The DPPA provides a federal baseline of protections for individuals, and is only partially preemptive, meaning that except in a few narrow circumstances, state legislatures may pass laws to supplement the protections made by the DPPA. Many States are more restrictive than the federal law.

•Data security breach laws: All states and some territories have adopted data security breach laws that may require notice be given to affected consumers in the event of a breach of personal information, and in some cases the provision

15

of additional benefits such as free credit monitoring to affected individuals. Some of these laws require additional data protection measures over and above the GLBA data safeguarding requirements. If data within our system is compromised, we may be subject to provisions of various state security breach laws, including regulatory investigations or enforcement actions from state attorneys general, who enforce state data breach or unfair and deceptive practices laws.

•Identity theft laws: Under the federal EGRRCPA, consumers can place a security freeze on their credit reports to prevent others from opening new accounts or obtaining new credit in their name and obtain one-year of fraud alerts free of charge. In addition, all states and the District of Columbia have passed laws that give consumers the right to place a security freeze on their credit report. Generally, these state laws require us to respond to requests for a freeze within a certain period of time, to send certain notices or confirmations to consumers in connection with a security freeze and to unfreeze files upon request within a specified time period.

•Federal Trade Commission Act (the “FTC Act”): The FTC Act prohibits unfair methods of competition and unfair or deceptive acts or practices. We must comply with the FTC Act when we market our services, such as consumer credit monitoring services through our Consumer Interactive segment. Our data collection, use and disclosure practices and the security measures we employ to safeguard the personal data of consumers could also be subject to the FTC Act, and our data practices or our failure to safeguard data adequately may subject us to regulatory scrutiny or enforcement action. There is no private right of action under the FTC Act.

•The Credit Repair Organizations Act (“CROA”): CROA regulates companies that claim to be able to assist consumers in improving their credit standing. Some courts have applied CROA to credit monitoring services offered by consumer reporting agencies and others. CROA allows for a private right of action and permits consumers to recover all money paid for alleged “credit repair” services in the event of violation. We, and others in our industry, have settled purported consumer class actions alleging violations of CROA without admitting or denying liability.

•The Health Insurance Portability and Accountability Act of 1996, as amended by the American Recovery and Reinvestment Act of 2009 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act (“HITECH”): HIPAA and HITECH require companies to implement reasonable safeguards to prevent intentional or unintentional misuse or wrongful disclosure of protected health information. In connection with receiving data from and providing services to entities in the healthcare industry or providing services to the healthcare industry, we may handle data subject to HIPAA and HITECH requirements. We obtain protected health information from healthcare providers and payors of healthcare claims that is subject to the privacy, security and transactional requirements imposed by HIPAA. We are frequently required to secure HIPAA-compliant “business associate” agreements with the providers and payors who supply data to us. As a business associate, we are obligated to limit our use and disclosure of health-related data to certain statutorily permitted purposes, HIPAA regulations, as outlined in our business associate agreements, and to preserve the confidentiality, integrity and availability of this data. HIPAA and HITECH also require, in certain circumstances, the reporting of breaches of protected health information to affected individuals and to the United States Department of Health and Human Services. A violation of any of the terms of a business associate agreement or noncompliance with HIPAA or HITECH data privacy or security requirements could result in administrative enforcement action and/or imposition of statutory penalties by the United States Department of Health and Human Services or a state attorney general. HIPAA and HITECH requirements supplement but do not preempt state laws regulating the use and disclosure of health-related information; state law remedies, which can include a private right of action, remain available to individuals affected by an impermissible use or disclosure of health-related data.

•California Consumer Privacy Act (the “CCPA”): The CCPA requires businesses to provide California consumers with certain rights regarding their personal information: the right to be informed about the type of information collected about them, the right to opt out of the sale of their personal information, the right to request deletion of their personal information, and the right to access their personal information. The CCPA exempts much of the data whose use is covered by FCRA, GLBA, HIPAA and DPPA and therefore much of our data is not subject to the CCPA. The CCPA creates a private right of action for security breaches. On November 3, 2020, California adopted the California Privacy Rights Act (the “CPRA”), which amends and expands CCPA. It is anticipated that most of the substantive provisions of CPRA will go into effect in 2023.

•Requirements for Government Contractors: Special requirements may apply to TransUnion when providing services to U.S. federal, state and local government agencies. The applicable requirements depend upon the monetary value of the awarded contract, the particular government agency awarding or funding the contract, the scope of services to be delivered by TransUnion, and the level of access that the agency will need to provide to TransUnion to enable TransUnion to perform the contract. For example and without limitation, TransUnion may need to abide by the Privacy Act of 1974, the Internal Revenue Service’s Publication 4812, and various Federal Acquisition Regulation and associated supplemental contract clauses. Each of these laws, regulations and contract clauses dictates particular

16

measures for the protection of personal information or information that is otherwise categorized as sensitive by the government. Government agencies frequently modify or supplement these requirements, and consequences for violations of applicable requirements may include penalties, civil liability and for severe infractions, criminal liability.

We are also subject to U.S. federal and state laws that are generally applicable to any U.S. business with national or international operations, such as antitrust laws, the Foreign Corrupt Practices Act, the Americans with Disabilities Act and various employment laws. We continuously monitor U.S. federal and state legislative and regulatory activities that involve credit reporting, data privacy and security, and other relevant subjects to identify issues in order to remain in compliance with all applicable laws and regulations.

International Data and Privacy Protection

We are subject to data protection, privacy and consumer credit laws and regulations in other jurisdictions where we conduct business. These laws and regulations include, but are not limited to, the following:

•Canada: Personal Information Protection and Electronic Documents Act of 2000 (“PIPEDA”) - The PIPEDA and substantially similar provincial laws govern how private sector organizations collect, use and disclose personal information in the course of commercial activities. The PIPEDA gives individuals the right to access and request correction of their personal information collected by such organizations. The PIPEDA requires compliance with the Canadian Standard Association Model Code for the Protection of Personal Information. Most Canadian provinces also have laws dealing with consumer reporting. These laws typically impose an obligation on credit reporting agencies to have reasonable processes in place to maintain the accuracy of the information, place limits on the disclosure of the information and give consumers the right to have access to, and challenge the accuracy of, the information.

•Colombia:The Colombian Financial Data Protection Regime (Law 1266 of 2008) regulates the collection, use and transfer of personal data pertaining to financial services, including credit reporting. The Colombian General Data Protection Regime (Law 1581 of 2012 and Decree 1377 of 2013) covers regulation of all other personal data. Both of these regimes have applicability to credit reporting services in Colombia and together address obligations of information furnishers, database owners, consumer right of access, consumer consent and permitted information disclosures.

•European Union: Our data management activities and the commercial solutions we make available to the European market are subject to the General Data Protection Regulation (“GDPR”). This law establishes significant data protection and privacy standards that empower European Union consumers to exercise significant control over their personal data. In addition to a litany of substantive provisions empowering consumers to limit how data may be used, GDPR also imposes operational, data processing, and other technical requirements with which we must comply. Failure to comply with any provision of GDPR could result in significant regulatory or other enforcement penalties.

•United Kingdom: Our UK operations are subject to GDPR and the Privacy and Electronic Communications Regulation (the “PECR”), which together govern the processing of personal data pertaining to UK citizens. Enforcement of data regulation and consumer privacy matters in the UK resides with the Information Commissioners Office (the “ICO”), an independent body set up to uphold the rights of individuals in relation to the use of their personal data. The provision of credit referencing services in the UK is also a regulated activity that is authorized by the Financial Conduct Authority (the “FCA”). The FCA has regulated credit reference agencies since 2014 with the objectives of protecting consumers, protecting financial markets and promoting competition. TransUnion UK (previously Callcredit), Experian and Equifax were granted full FCA authorization in early 2016 and are therefore all required to follow the rules and principles issued by the FCA.

In 2018, the FCA introduced Open Banking which aims to improve customer experience and to increase competition in the banking sector. Consumers can share transaction data with third parties via application program interfaces (“APIs”) to identify best products and take up multi-bank products. As part of Open Banking, the Second Payment Services Directive came into effect in January 2018 and affects the payments industry, allowing merchants to retrieve a customer’s account data from their bank with their consent. The implementation of Open Banking platforms will increase the number of payment service providers available to consumers and will expand beyond traditional banks. TransUnion UK is an authorized information services provider under this regime.

•South Africa: National Credit Act of 2005 (the “NCA”) - The NCA and its implementing regulations govern credit bureaus and consumer credit information. The NCA sets standards for filing, retaining and reporting consumer credit information. The NCA also defines consumers’ rights with respect to accessing their own information and addresses the process for disputing information in a credit file. The NCA is enforced by The National Credit Regulator who has authority to supervise and examine credit bureaus. In addition, the Protection of Personal Information Act (“POPIA”), went into effect on July 1, 2020, with enforcement commencing on July 1, 2021. POPIA regulates the processing of personal information of legal and juristic persons, and imposes compliance obligations and sanctions.

17

•India: Credit Information Companies Regulation Act of 2005 (“CICRA”) - CICRA requires entities that collect and maintain personal credit information to ensure that it is complete, accurate and protected. Entities must adopt certain privacy principles in relation to collecting, processing, preserving, sharing and using credit information. In addition, India has privacy legislation that would allow individuals to sue for damages in the case of a data breach, if the entity negligently failed to implement “reasonable security practices and procedures” to protect personal data.

•Hong Kong: Personal Data (Privacy) Ordinance (“PDPO”) and The Code of Practice on Consumer Credit Data (“COPCCD”) - PDPO and the COPCCD regulate the operation of consumer credit reference agencies. They prescribe the methods and security controls under which credit providers and credit reference agencies may collect, access and manage credit data.

•Brazil: The Brazilian General Data Protection Law (“LGPD”), went into effect on September 18, 2020. LGPD regulates the processing of personal information and imposes compliance obligations and sanctions comparable to those of GDPR. It is anticipated that the sanctions provisions of the LGPD will go into effect on August 1, 2021.

We are also subject to various laws and regulations generally applicable to all businesses in the other countries where we operate.

Sustainability

We believe that our responsibility to the world does not stop at connecting information, consumers, and clients; rather, we are dedicated to making meaningful, positive contributions to society. We are making an impact today through our commitments in advancing underrepresented people, enabling life-changing access to credit in new markets, and using trended data to help consumers improve their credit.

To determine the environmental, social, and governance (“ESG”) issues most material to our business we regularly engage key stakeholders and monitor the evolving landscape. We also conduct periodic materiality assessments to ensure that the focus of the sustainability program is aligned with ESG risks and opportunities.

Our sustainability program focus areas are:

•Security, Governance, and Compliance: We maintain robust security, compliance and governance programs to ensure alignment with the requirements of our industry. In particular, we focus on consumer privacy, data integrity and the overall security of information under our stewardship.

•People, Social Innovation, and Communities: We value our people and communities, and work diligently to provide expanded opportunities in and outside the workplace. We are dedicated to providing a welcoming, diverse, inclusive and growth-oriented work environment that enables all our people to reach their full potential. We also strive to expand just and equitable economic inclusion of all communities, providing the foundation for enhanced quality of life.

•Climate Change and Environmental Footprint: We seek to limit our environmental footprint and support responsible resource use. Reducing our energy and resource use lowers our operational costs and climate change impact, helping to ensure the well-being of communities and our associates.

Human Capital Management

We employed approximately 8,200 employees at December 31, 2020. Central to our long-term strategy is attracting, developing and retaining the best talent globally with the right skills to drive our success. Our board of directors receives regular updates on topics including, sustainability, employee retention, engagement and survey results, enterprise compliance, investigations and associate health and safety.

Other than certain employees in Brazil, none of our employees are currently represented by a labor union or have terms of employment that are subject to a collective bargaining agreement. We consider our relationships with our employees to be good and have not experienced any work stoppages.

Diversity Strategy

We see diversity as a source of strength and know that it is essential to our mission, innovation and growth. At TransUnion, we know that diversity helps us win. We have a three-pronged approach to our diversity, equity and inclusion strategy consisting of the following:

•Hire: We seek to expand the diversity of our talent pool through a dedicated diversity recruiter, targeted sourcing methods and job postings.

•Develop: We cultivate diverse internal talent through development plans and customized programming for under-represented groups.

18

•Promote: We continue to expand our rigorous pay and promotion practices designed to remove bias, including ongoing pay equity analysis and compensation review, and development opportunities designed to ensure fair and equitable treatment of all employees.

We believe that a critical component of continuing to deliver innovative products to consumers and customers is maintaining diverse and inclusive teams. We detail below our progress in advancing diversity in our leadership and associate population in alignment with Sustainability Accounting Standards Board reporting standards. Select workforce diversity statistics for 2020 and 2019 are as follows:

Worldwide Gender

Women Senior Leaders (1) 30% 27%

U.S. Race/Ethnicity (3)

Black Senior Leaders (1) 3% 3%

Black Overall (2) 9% 9%

Hispanic Senior Leaders (1) 7% 6%

Hispanic Overall (2) 8% 8%

Asian Senior Leaders (1) 10% 9%

Other Senior Leaders (1,4) 2% 2%

Other Overall (2,4) 2% 2%

1.Senior Leaders include all employees at a Vice President level or above.

2.Overall include all employees, inclusive of the Senior Leader grouping.

3.U.S. race/ethnicity diversity demographic information includes only U.S. employees who chose to self-identify and excludes those who did not self-identify.

4.Other race/ethnicity includes American Indian or Alaska Native, Native Hawaiian or Other Pacific Islanders, and those employees who disclosed two or more categories.

Talent Acquisition and Retention

Our talent acquisition and retention is multi-faceted. We aim to recruit the most qualified candidates, and strive for a diverse and well-balanced workforce.

We reward and support employees through competitive pay, benefits, and perquisite programs that allow employees and their families to thrive. Our benefit offerings are designed to meet the varied and evolving needs of a diverse workforce tailored to the variety of businesses and geographies in which we operate.

This year we enhanced the ways we help our employees care for themselves and their families, especially in response to the COVID-19 pandemic. This includes child care benefits that provide access to onsite or community centers, enhanced back-up care choices that include personal caregivers, child care referral assistance and child care provider discounts, help with homework and a variety of parenting educational resources. We also provide our employees with access to free mental and behavioral health resources, including on-demand access to the Employee Assistance Program for employees and their dependents.

Employee Engagement, Training and Development

We prioritize and invest in helping our employees grow and build their careers through several training and development programs. These include online, instructor-led and on-the-job learning formats as well as executive talent and succession planning paired with an individualized development approach.

Safety and Wellness

We have heightened our focus on the health and safety of our associates, our customers, and the wider communities in which we operate. We quickly and effectively moved to a work-from-home model in the early days of the pandemic in every market we serve, and continue to adhere to that model. This has allowed us to protect our associates and the broader population while continuing to operate our businesses and provide services and solutions to customers and consumers. In addition, we have taken several actions to support those who are financially impacted by the COVID-19 pandemic in the locations where we operate. We remain focused on ensuring impacted consumers are aware of resources and relief available to them, and we are working

19

directly with our partners across the broader consumer credit ecosystem in an effort to prevent adverse impacts to consumers as a result of the pandemic. We are also working with industry peers to develop additional proactive solutions to help impacted consumers and to facilitate access to resources and educational materials aimed at consumers.

See our upcoming 2020 Sustainability Report and 2020 Diversity Report for additional information on these topics.

Available Information

Through our corporate website under the heading “About Us - Investor Relations,” at http://www.transunion.com, you can access electronic copies of our governing documents free of charge, including our Corporate Governance Guidelines and the charters of the committees of our board of directors. In addition, through our website, you can access the documents we file with the U.S. Securities and Exchange Commission (SEC), including our annual reports on Form 10-K, quarterly reports on Form 10-Q and current reports on Form 8-K, and all amendments thereto, as soon as reasonably practicable after we file or furnish them. You also may request printed copies of our SEC filings or governance documents, free of charge, by writing to our corporate secretary at the address on the cover of this report. Information contained on our website is not incorporated herein by reference and should not be considered part of this report.

In addition, the SEC maintains an Internet site (www.sec.gov) that contains reports, proxy and information statements and other information regarding issuers that file electronically with the SEC.

Our corporate headquarters are located at 555 West Adams Street, Chicago, Illinois 60661, and our telephone number is (312) 985-2000.

20

ITEM 1A. RISK FACTORS

You should carefully consider the following risks as well as the other information included in this report, including “Selected Financial Data,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our financial statements and related notes. Any of the following risks could materially and adversely affect our business, financial condition or results of operations. However, the selected risks described below are not the only risks facing us. Additional risks and uncertainties not currently known to us or those we currently view to be immaterial may also materially and adversely affect our business, financial condition or results of operations.

Risks Related to the COVID-19 Pandemic

Our results of operations have been materially and adversely impacted and could be materially and adversely impacted in the future by the COVID-19 global pandemic or the outbreak of other highly infectious diseases.

The global spread and unprecedented impact of COVID-19 has created significant volatility, uncertainty and economic disruption. The countries and territories in which our services and solutions are sold are in varying stages of restrictions and re-opening to address the COVID-19 pandemic. Certain jurisdictions have begun re-opening only to return to restrictions in the face of increases in new COVID-19 cases. The extent to which the COVID-19 pandemic continues to materially and adversely impact our business, operations, and consolidated financial statements remains highly uncertain and will depend on numerous evolving factors that we may not be able to accurately predict, including: the duration, scope, severity, and any resurgences of the pandemic; the effectiveness of vaccine rollout plans; the public’s perception of the safety of the vaccines and their willingness to take the vaccines; the continued impact on worldwide macroeconomic conditions, including interest rates, employment rate, consumer confidence, and foreign exchange rates in each of the markets in which we operate; governmental, business, and individuals’ actions that have been, and continue to be, taken in response to the pandemic (which could include limitations on or changes to our operations or mandates to provide services); the effect on our customers; changes in customer and consumer demand for our services; the effect on consumer confidence and spending; our ability to sell and provide our services, including the impact of travel restrictions and people working from home; the ability of our customers to pay for our services; the health of, and the effect on, our workforce; and the potential effects on our internal controls, including those over financial reporting, as a result of changes in working environments for our employees and business partners.

The global spread of COVID-19, widespread measures implemented to contain its effects, and business and consumer responses to such measures have had a material and adverse impact on numerous aspects of our business, including customer demand for our services and solutions, our consolidated financial statements and the trading price of our securities. While we have seen signs of increased demand for our services in the markets where we operate since the low point in April 2020, including ongoing improvements through the fourth quarter of 2020, the impact of COVID-19 may continue to have a material and adverse impact on our business for an uncertain period of time. The impact of COVID-19 may also heighten other risks discussed in our Annual Report on Form 10-K, which could materially and adversely impact our business, consolidated financial statements and stock price.

Risks Related to Our Business

Our revenues are concentrated in the U.S. financial services and consumer credit industries. When these industries or the broader financial markets experience a downturn, demand for our services and revenues may be adversely affected.

Our largest customers, and therefore our business and revenues, depend on favorable macroeconomic conditions and are impacted by the availability of credit, the level and volatility of interest rates, inflation, employment levels, consumer confidence and housing demand. In addition, a significant amount of our revenues are concentrated among certain customers, industries, product offerings and in distinct geographic regions, primarily in the United States. In 2020 and 2019, 52% and 49% of our consolidated gross revenues, respectively, were concentrated in our U.S. Markets Financial Services vertical and our Consumer Interactive segment. Our customer base suffers when financial markets experience volatility, liquidity issues and disruption, which has occurred in the past and which could reoccur, and the potential for increased and continuing disruptions going forward, present considerable risks to our business and revenue. Changes in the economy have resulted, and may continue to result, in fluctuations in volumes, pricing and operating margins for our services. If businesses in these industries experience economic hardship, we cannot assure you that we will be able to generate future revenue growth. In addition, if consumer demand for financial services and products and the number of credit applications decrease, the demand for our services could also be materially reduced. These types of disruptions could lead to a decline in the volumes of services we provide our customers and could negatively impact our revenue and results of operations.

We are subject to significant competition in the markets in which we operate and we may face significant competition in the new markets that we plan to enter.

The market for our services is highly competitive, and we may not be able to compete successfully against our competitors, which could impair our ability to sell our services. We compete on the basis of differentiated solutions, datasets, analytics capabilities, ease of integration with our customers’ technology, stability of services, customer relationships, innovation and

21

price. Our regional and global competitors vary in size, financial and technical capability, and in the scope of the products and services they offer. Some of our competitors may be better positioned to develop, promote and sell their products. Larger competitors may benefit from greater cost efficiencies and may be able to win business simply based on pricing. We consistently face downward pressure on the pricing of our products, which could result in reduced prices for certain products, or a loss of market share. Our competitors may also be able to respond to opportunities before we do, by taking advantage of new technologies, changes in customer requirements or market trends.

Our Consumer Interactive segment experiences competition from emerging companies. For example, prior to 2008, Equifax and Experian were our top competitors for direct-to-consumer credit services, such as credit reports and identity theft protection services. In the past several years, there has been an influx of other companies offering similar services, some of whom leverage the free services mandated by law to be provided by nationwide credit reporting agencies. These developments have resulted in increased competition.

Many of our competitors have extensive customer relationships, including relationships with our current and potential customers. New competitors, or alliances among competitors, may emerge and gain significant market share. Existing or new competitors may develop products and services that are superior to ours or that achieve greater market acceptance. If we are unable to respond to changes in customer requirements as quickly and effectively as our competition, our ability to expand our business and sell our services may be adversely affected.

Our competitors may be able to sell services at lower prices than us, individually or as part of integrated suites of several related services. This ability may cause our customers to purchase from our competitors rather than from us. Price reductions by our competitors could also negatively impact our operating margins or harm our ability to obtain new long-term contracts or renewals of existing contracts on favorable terms. Additionally, some of our customers may develop products of their own that replace the products they currently purchase from us, which would result in lower revenue.

We also expect that there will be significant competition in the new markets that we enter. We cannot assure you that we will be able to compete effectively against current and future competitors. If we fail to successfully compete, our business, financial condition and results of operations may be adversely affected.

To the extent the availability of free or relatively inexpensive consumer information increases, the demand for some of our services may decrease.

Public and commercial sources of free or relatively inexpensive consumer information have become increasingly available and this trend is expected to continue. Public and commercial sources of free or relatively inexpensive consumer information, including free credit information from lead generation companies and from banks, may reduce demand for our services. Beginning in April 2020, we began to offer free credit reports on a weekly basis. To the extent that our customers choose not to obtain services from us and instead rely on information obtained at little or no cost from these public and commercial sources, our business, financial condition and results of operations may be adversely affected.

Our relationships with key long-term customers may be materially diminished or terminated.

We have long-standing relationships with a number of our customers, many of whom could unilaterally terminate their relationship with us or materially reduce the amount of business they conduct with us at any time. Our customer agreements relating to our core credit reporting service offered through our U.S. Markets segment are terminable upon advance written notice (typically ranging from 30 days to six months) by either us or the customer, which provides our customers with the opportunity to renegotiate their contracts with us or to award more business to our competitors.

We also provide our services to business partners who may combine them with their own or other branded services to be offered as a bundle to consumers, governmental agencies and businesses in support of fraud or credit protection, credit monitoring, identity authentication, insurance or credit underwriting, and collections. Some of these partners are the largest providers of credit information or identity protection services to the U.S. consumer market.

Market competition, business requirements, financial condition and consolidation through mergers or acquisitions, could adversely affect our ability to continue or expand our relationships with our customers and business partners. There is no guarantee that we will be able to retain or renew existing agreements, maintain relationships with any of our customers or business partners on acceptable terms or at all, or collect amounts owed to us from insolvent customers or business partners. The loss of one or more of our major customers or business partners could adversely affect our business, financial condition and results of operations.

If we are unable to develop successful new services in a timely manner, or if the market does not adopt our new services, our ability to maintain or increase our revenue could be adversely affected.

In order to keep pace with customer demands for increasingly sophisticated service offerings, to sustain expansion into growth industries and to maintain our profitability, we must continue to innovate and introduce new services to the market. The process of developing new services is complex and uncertain. Our industry solutions require extensive experience and knowledge from

22

within the relevant industry. We must commit significant resources to this effort before knowing whether the market will accept new service offerings. Additionally, our business strategy is dependent on our ability to expand into new markets and to bring new products to market. We may not successfully enter into new markets or execute on our new services because of challenges in planning or timing, technical hurdles, difficulty in predicting market demand, changes in regulation or a lack of appropriate resources. Additionally, even if we successfully develop new products, our existing customers might not accept these new products or new markets might not adopt our products due to operational constraints, high switching costs or general lack of market readiness. Failure to successfully introduce new services to the market could adversely affect our reputation, business, financial condition and results of operations.

If our outside service providers and key vendors are not able to or do not fulfill their service obligations, our operations could be disrupted and our operating results could be harmed.

We depend on a number of service providers and key vendors such as telecommunication companies, software engineers, data processors, software and hardware vendors and providers of credit score algorithms, who are critical to our operations. These service providers and vendors are involved with our service offerings, communications and networking equipment, computer hardware and software and related support and maintenance. Although we have implemented service-level agreements and have established monitoring controls, our operations could be disrupted if we do not successfully manage relationships with our service providers, if they do not perform or are unable to perform agreed-upon service levels, or if they are unwilling to make their services available to us at reasonable prices. If our service providers and vendors do not perform their service obligations, it could adversely affect our reputation, business, financial condition and results of operations.

There may be further consolidation in our end-customer markets, which may adversely affect our revenues.

There has been, and we expect there will continue to be, merger, acquisition and consolidation activity in our customer markets. If our customers merge with, or are acquired by, other entities that are not our customers, or that use fewer of our services, our revenue may be adversely impacted. In addition, industry consolidation could affect the base of recurring transaction-based revenue if consolidated customers combine their operations under one contract, since most of our contracts provide for volume discounts. In addition, our existing customers might leave certain geographic markets, which would no longer require them to purchase certain products from us and, consequently, we would generate less revenue than we currently expect.

Risks Related to Technology and Cybersecurity

Data security and integrity are critically important to our business, and cybersecurity incidents, including cyberattacks, breaches of security, unauthorized access to or disclosure of confidential information, business disruption, or the perception that confidential information is not secure, could result in a material loss of business, regulatory enforcement, substantial legal liability and/or significant harm to our reputation.

As a global consumer credit reporting agency and provider of risk and information solutions, we collect, store and transmit a large amount of sensitive and confidential consumer information on over one billion consumers, including financial information, personally identifiable information and protected health information. We operate in an environment of significant risk of cybersecurity incidents resulting from unintentional events or deliberate attacks by third parties or insiders, which may involve exploiting highly obscure security vulnerabilities or sophisticated attack methods. These cyberattacks can take many forms, but they typically have one or more of the following objectives, among others:

•obtain unauthorized access to confidential consumer information;

•manipulate or destroy data; or

•disrupt, sabotage or degrade service on our systems.

We experience numerous attempts to access our computer systems, software, networks, data and other technology assets on a daily basis, none of which has resulted in a material data incident or otherwise had any material impact on our business, operations or financial results.

The security and protection of non-public consumer information is a top priority for TransUnion. We devote significant resources to maintain and regularly upgrade the wide array of physical, technical, and contractual safeguards we employ to provide security around the collection, storage, use, access and delivery of information we have in our possession. We cannot assure you that our systems, databases and services will not be compromised or disrupted in the future, whether as a result of deliberate attacks by malicious actors, breaches due to employee error or malfeasance, or other disruptions during the process of upgrading or replacing computer software or hardware, power outages, computer viruses, telecommunication or utility failures or natural disasters or other catastrophic events. We work to monitor and develop our information technology networks and infrastructure to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses and other events that could have a security impact.

23

Further, it is possible that we may acquire a company that has experienced a security incident that the acquired company has yet to discover, investigate and remediate. It is possible that neither the acquired company nor TransUnion may identify the issue in a timely manner and the event could spread more broadly to other parts of TransUnion during the integration effort.

Highly publicized cybersecurity incidents, including the data incident announced by Equifax on September 7, 2017, and more recently, the December 13, 2020 announcement by SolarWinds that its software supply chain was compromised, have heightened consumer, legislative and regulatory awareness of cybersecurity risks. These events continue to embolden individuals or groups to target our systems more aggressively.

The preventive actions we take to address cybersecurity risk, including protection of our systems and networks, may be insufficient to repel or mitigate the effects of cyberattacks in the future as it may not always be possible to anticipate, detect or recognize threats to our systems, or to implement effective preventive measures against all cybersecurity risks. This is because, among other things:

•the techniques used in cyberattacks change frequently and may not be recognized until after the attacks have succeeded;

•cyberattacks can originate from a wide variety of sources, including sophisticated threat actors involved in organized crime, sponsored by nation-states, or linked to terrorist or hacktivist organizations; and

•third parties may seek to gain access to our systems either directly or using equipment or security passwords belonging to employees, customers, third-party service providers or other users.

Unauthorized disclosure, loss or corruption of our data or inability of our customers to access our systems could disrupt our operations, subject us to substantial regulatory and legal proceedings and potential liability, result in a material loss of business and/or significantly harm our reputation.

We may not be able to immediately address the consequences of a cybersecurity incident because a successful breach of our computer systems, software, networks or other technology assets could occur and persist for an extended period of time before being detected due to, among other things:

•the breadth and complexity of our operations and the high volume of transactions that we process;

•the large number of customers, counterparties and third-party service providers with which we do business;

•the proliferation and increasing sophistication of cyberattacks;

•the possibility that a malicious third party compromises the software, hardware or services that we procure from a service provider unbeknownst to both the provider and to TransUnion; and

•the possibility that a third party, after establishing a foothold on an internal network without being detected, might obtain access to other networks and systems.

The extent of a particular cybersecurity incident and the steps that we may need to take to investigate it may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed and full and reliable information about the incident is known. While such an investigation is ongoing, we may not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, any or all of which could further increase the costs and consequences of a cybersecurity incident.

Due to concerns about data security and integrity, a growing number of legislative and regulatory bodies have adopted consumer notification and other requirements in the event that consumer information is accessed by unauthorized persons and additional regulations regarding the use, access, accuracy and security of such data are possible. In the United States, we are subject to federal and state laws that provide for more than 50 disparate notification regimes. In the event of unauthorized access, our failure to comply with the complexities of these various regulations could subject us to regulatory scrutiny and additional liability.

We may be unable to adequately anticipate, prevent or mitigate damage resulting from increasingly sophisticated methods of illegal or fraudulent activities committed against us, which could harm our business, financial condition and results of operations and could significantly harm our reputation.

The defensive measures that we take to manage threats, especially cyber-related threats, to our business may not adequately anticipate, prevent or mitigate harm we may suffer from such threats. Criminals use evolving and increasingly sophisticated methods of perpetrating illegal and fraudulent activities. For example, during the first week of September 2020, TransUnion experienced a series of Distributed Denial of Service (DDoS) attacks. While these attacks did not result in any unauthorized access to data or systems, there was disruption to TransUnion’s normal operations including degraded customer response time, intermittent timeouts and degraded internal information technology services utilized by TransUnion associates. TransUnion deploys a number of defensive measures to mitigate DDoS attacks, but persistent attackers can challenge these protections.

24

Also, in July 2019 TransUnion Limited, a Hong Kong entity in which the Company holds a 56.25 percent interest, was the victim of criminal fraud involving employee impersonation and fraudulent requests that successfully targeted TransUnion Limited, which resulted in a series of fraudulently induced wire transfers totaling $17.8 million for which we recorded one-time pre-tax charge plus $3.0 million of administrative expense, for a total of $20.8 million, $17.3 million net of tax, in net income in 2019 ($10.0 million in net income attributable to TransUnion). Fraudulent activities committed against us could disrupt our operations, have an adverse effect on our financial results, subject us to substantial legal proceedings and potential liability, result in a material loss of business and/or significantly harm our reputation.

If we experience system failures, personnel disruptions or capacity constraints, or our customers do not modify their systems to accept new releases of our distribution programs, the delivery of our services to our customers could be delayed or interrupted, which could harm our business and reputation and result in the loss of revenues or customers.

Our ability to provide reliable service largely depends on our ability to maintain the efficient and uninterrupted operation of our computer network, systems and data centers, some of which have been outsourced to third-party providers. In addition, we generate a significant amount of our revenues through channels that are dependent on links to telecommunications providers. Our systems, personnel and operations could be exposed to damage or interruption from fire, natural disasters, pandemic illness, power loss, war, terrorist acts, civil disobedience, telecommunication failures, computer viruses, DDoS attacks or human error. We may not have sufficient redundant operations to cover a loss or failure of our systems in a timely manner. Any significant interruption could severely harm our business and reputation and result in a loss of revenue and customers. Additionally, from time to time we send our customers new releases of our distribution programs, some of which contain security updates. Any failure by our customers to install these new releases could expose our customers to computer security risks.

We could lose our access to data sources which could prevent us from providing our services.

Our services and products depend extensively upon continued access to and receipt of data from external sources, including data received from customers, strategic partners and various government and public records repositories. In some cases, we compete with our data providers. Our data providers could stop providing data, provide untimely data or increase the costs for their data for a variety of reasons, including a perception that our systems are insecure as a result of a data security incidents, budgetary constraints, a desire to generate additional revenue or for regulatory or competitive reasons. We could also become subject to increased legislative, regulatory or judicial restrictions or mandates on the collection, disclosure or use of such data, in particular if such data is not collected by our providers in a way that allows us to legally use the data. If we were to lose access to this external data or if our access or use were restricted or were to become less economical or desirable, our ability to provide services could be negatively impacted, which would adversely affect our reputation, business, financial condition and results of operations. We cannot provide assurance that we will be successful in maintaining our relationships with these external data source providers or that we will be able to continue to obtain data from them on acceptable terms or at all. Furthermore, we cannot provide assurance that we will be able to obtain data from alternative sources if our current sources become unavailable.

If we fail to maintain and improve our systems, our data matching technology, and our interfaces with data sources and customers, demand for our services could be adversely affected.

In our markets, there are continuous improvements in computer hardware, network operating systems, programming tools, programming languages, operating systems, data matching, data filtering and other database technologies and the use of the internet. These improvements, as well as changes in customer preferences or regulatory requirements, may require changes in the technology used to gather and process our data and deliver our services. Our future success will depend, in part, upon our ability to:

•internally develop and implement new and competitive technologies;

•use leading third-party technologies effectively;

•respond to changing customer needs and regulatory requirements, including being able to bring our new products to the market quickly; and

•transition customers and data sources successfully to new interfaces or other technologies.

We cannot provide assurance that we will successfully implement new technologies, cause customers or data furnishers to implement compatible technologies or adapt our technology to evolving customer, regulatory and competitive requirements. If we fail to respond, or fail to cause our customers or data furnishers to respond, to changes in technology, regulatory requirements or customer preferences, the demand for our services, the delivery of our services or our market reputation could be adversely affected. Additionally, our failure to implement important updates could affect our ability to successfully meet the timeline for us to generate cost savings resulting from our investments in improved technology. Failure to achieve any of these objectives would impede our ability to deliver strong financial results.

25

Risks Related to Laws, Regulations and Government Oversight

Our business is subject to various governmental regulations, laws and orders, compliance with which may cause us to incur significant expenses or reduce the availability or effectiveness of our solutions, and the failure to comply with which could subject us to civil or criminal penalties or other liabilities.

Our businesses are subject to regulation under the FCRA, the GLBA, the DPPA, HIPAA, HITECH, the Dodd-Frank Act, the FTC Act and various other international, federal, state and local laws and regulations. See “Business-Legal and Regulatory Matters” for a description of select regulatory regimes to which we are subject. These laws and regulations, which generally are designed to protect the privacy of the public and to prevent the misuse of personal information available in the marketplace, are complex, change frequently and have tended to become more stringent over time. We already incur significant expenses in our attempt to ensure compliance with these laws.

Currently, public concern is high with regard to the operation of credit reporting agencies in the United States, as well as the collection, use, accuracy, correction and sharing of personal information, including Social Security numbers, dates of birth, financial information, medical information, department of motor vehicle data and other behavioral data. In addition, many consumer advocates, privacy advocates, legislatures and government regulators believe that existing laws and regulations do not adequately protect privacy and have become increasingly concerned with the collection and use of this type of personal information. As a result, several U.S. states have recently introduced and passed legislation to expand data security breach notification rules and to mirror some of the protections provided by the General Data Protection Regulation (“GDPR”) in the European Union and the U.K. These state laws are intended to provide consumers with greater transparency and control over their personal data. For example, CCPA, which became effective on January 1, 2020, applies to certain businesses that collect personal information from California residents and establishes several consumer rights, including a right to know what personal information is being collected about them and whether and to whom it is sold, a right to access their personal information and have it deleted, a right to opt out of the sale of their personal information, and a right to equal service and price regardless of exercise of these rights. While the CCPA includes specific exemptions for practices and activities regulated by GLBA or FCRA, including our credit reporting and financial services business lines, it requires, among other things, new disclosures to California consumers, impose new rules for collecting or using information about minors, and afford consumers new abilities to opt out of certain disclosures of personal information in other portions of our business that are not regulated by GLBA or FCRA. On November 3, 2020, California adopted the California Privacy Rights Act (the “CPRA”), which amends and expands CCPA. It is anticipated that most of the substantive provisions of CPRA will go into effect in 2023.

The data incident announced by Equifax on September 7, 2017, resulted in significantly increased legislative and regulatory activity at the federal and state levels as lawmakers and regulators continue to propose a wide range of further restrictions on the collection, dissemination or commercial use of personal information, information security standards, data security incident disclosure standards and requirements to provide certain of our services to consumers free of charge. This and additional legislative or regulatory efforts in the United States, or action by Executive Order of the President of the United States, could further regulate credit reporting agencies and the collection, use, communication, access, accuracy, obsolescence, sharing, correction and security of this personal information. Similar initiatives are underway in various other countries in which we do business. In addition, any perception that our practices or products are an invasion of privacy, whether or not consistent with current or future regulations and industry practices, may subject us to public criticism, private class actions, reputational harm, governmental intervention, or claims by regulators, which could disrupt our business and expose us to increased liability.

Public concern regarding identity theft also has led to more transparency for consumers as to what is in their credit reports. We provide credit reports and scores and monitoring services to consumers for a fee, and this income stream could be reduced or restricted by legislation that requires us to provide these services to consumers free of charge. For example, under U.S. federal law today, we are required to provide consumers with one credit report per year free of charge, and beginning in April 2020, we have begun to offer consumers free weekly credit reports.

The following legal and regulatory developments also could have a material adverse effect on our business, financial condition or results of operations:

•amendment, enactment or interpretation of laws and regulations that restrict the access and use of personal information and reduce the availability or effectiveness of our solutions or the supply of data available to customers;

•changes in governmental, cultural and consumer attitudes in favor of further restrictions on information collection and sharing, which may lead to regulations that prevent full utilization of our solutions;

•failure of data suppliers or customers to comply with laws or regulations, where mutual compliance is required;

•failure of our solutions to comply with current laws and regulations; and

•failure of our solutions to adapt to changes in the regulatory environment in an efficient, cost-effective manner.

26