TRU US Equity☆

ITEM 1A. RISK FACTORS

You should carefully consider the following risks as well as the other information included in this report, including “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our financial statements and related notes. Any of the following risks could materially and adversely affect our business, financial condition or results of operations. However, the selected risks described below are not the only risks facing us. Additional risks and uncertainties not currently known to us or those we currently view to be immaterial may also materially and adversely affect our business, financial condition or results of operations.

Risk Factors Summary

The following is a summary of the principal risks and uncertainties described in more detail in this report:

•Our revenues are concentrated in the U.S. financial services and consumer credit industries. When these industries or the broader financial markets experience a downturn, demand for our services and revenues may be adversely affected.

•We are subject to significant competition in the markets in which we operate and we may face significant competition in the new markets that we plan to enter.

•To the extent the availability of free or relatively inexpensive consumer information increases, the demand for some of our services may decrease.

•Our relationships with key long-term customers may be materially diminished or terminated.

•If we are unable to develop successful new services in a timely manner, or if the market does not adopt our new services, our ability to maintain or increase our revenue could be adversely affected.

•If our outside service providers and key vendors are not able to or do not fulfill their service obligations, our operations could be disrupted and our operating results could be harmed.

•There may be further consolidation in our end-customer markets, which may adversely affect our revenues.

•Data security and integrity are critically important to our business, and cybersecurity incidents, including cyberattacks, breaches of security, unauthorized access to or disclosure of our intellectual property or confidential information, business disruption, or the perception that confidential information is not secure, could result in a material loss of business, regulatory enforcement, substantial legal liability and/or significant harm to our reputation.

•We may be unable to adequately anticipate, prevent or mitigate damage resulting from increasingly sophisticated methods of illegal or fraudulent activities committed against us, which could harm our business, financial condition and results of operations and could significantly harm our reputation.

•If we experience system failures, personnel disruptions or capacity constraints, or our customers do not modify their systems to accept new releases of our distribution programs, the delivery of our services to our customers could be delayed or interrupted, which could harm our business and reputation and result in the loss of revenues or customers.

•We could lose our access to data sources which could prevent us from providing our services.

•If we fail to maintain and improve our systems, our data matching technology, and our interfaces with data sources and customers, demand for our services could be adversely affected.

•Our business is subject to various governmental regulations, laws and orders, compliance with which may cause us to incur significant expenses or reduce the availability or effectiveness of our solutions, and the failure to comply with which could subject us to civil or criminal penalties or other liabilities.

•The CFPB has supervisory and examination authority over our business and has in the past, and may initiate enforcement actions with regard to our compliance with federal consumer financial laws. Actions by the CFPB or other regulators against us or our executives could result in increased operating costs, reputational harm, payment of damages and civil money penalties, injunctive relief and/or restitution, any of which could have a material adverse effect on our business, results of operations and financial condition.

•Regulatory oversight of our contractual relationships with certain of our customers may adversely affect our business.

•The outcome of litigation, inquiries, investigations, examinations or other legal proceedings in which we are involved, in which we may become involved, or in which our customers or competitors are involved could subject us to significant monetary damages or restrictions on our ability to do business.

•Our ability to expand our operations in, and the portion of our revenue derived from, markets outside the United States is subject to economic, political and other inherent risks, which could adversely impact our growth rate and financial performance.

20

•We face geopolitical and other risks associated with our international operations, which could materially adversely impact our results of operations and our financial condition.

•We may be unable to protect our intellectual property adequately or cost-effectively, which may cause us to lose market share or force us to reduce our prices. We also rely on trade secrets and other forms of unpatented intellectual property that may be difficult to protect.

•We may face claims for intellectual property infringement, which could subject us to monetary damages or limit us in using some of our technologies or providing certain services.

•When we engage in acquisitions, investments in new businesses or divestitures of existing businesses, we face risks that may adversely affect our business.

•We depend, in part, on strategic alliances, joint ventures and acquisitions to grow our business. If we are unable to make strategic acquisitions and develop and maintain these strategic alliances and joint ventures, our growth may be adversely affected.

•We have a substantial amount of debt which could adversely affect our financial position and prevent us from fulfilling our obligations under the debt instruments.

•Despite our current level of indebtedness, we may still be able to incur additional indebtedness. This could further the risks associated with our substantial indebtedness.

•We may not be able to generate sufficient cash to service all of our indebtedness, and may be forced to take other actions to satisfy our obligations under our indebtedness, which may not be successful.

•Our inability to generate sufficient cash flow to satisfy our debt obligations, or to refinance our indebtedness on commercially reasonable terms or at all, would materially and adversely affect our financial position and results of operations and our ability to satisfy our obligations.

•Our stock price has recently been volatile and has declined, and may continue to be volatile and/or decline, regardless of our operating performance, and you may not be able to resell shares of our common stock at or above the price you paid or at all.

•Our business and operations are exposed to risks arising from developments and trends associated with climate change and ESG, including risks associated with our own reporting.

•Anti-takeover provisions in our organizational documents might discourage, delay or prevent acquisition attempts for us that you might consider favorable.

•Our ability to pay cash dividends may be limited by the terms of our secured credit facility.

•Economic and other conditions may adversely impact the valuation of our assets resulting in impairment charges that could have a material adverse impact on our results from operations.

•Our efforts to execute any element of our business strategy, including our transformation plan to optimize our operating model and invest in our technology, could experience difficulties, delays, or unexpected costs and may not achieve anticipated benefits and savings.

•Management has determined that our internal control over financial reporting and disclosure controls and procedures were not effective as of December 31, 2023. A failure to maintain effective internal control over financial reporting or disclosure controls and procedures could impact our ability to accurately and timely report our financial results and other material disclosures or otherwise cause us to fail to meet our reporting obligations, which could have a material adverse effect on our operations, investor confidence in our business, and the trading price of our common stock.

•Pandemics, epidemics, disease outbreaks and other public health crises, such as the COVID-19 pandemic, have disrupted our business and operations, and future public health crises could materially adversely impact our business, financial condition, liquidity and results of operations.

•We may not be able to attract and retain the skilled employees that we need to support our business.

•We are subject to losses from risks for which we do not insure.

•If we experience changes in tax laws or adverse outcomes resulting from examination of our tax returns, it could adversely affect our results of operations.

Risks Related to Our Business

Our revenues are concentrated in the U.S. financial services and consumer credit industries. When these industries or the broader financial markets experience a downturn, demand for our services and revenues may be adversely affected.

Our largest customers, and therefore our business and revenues, are influenced by macroeconomic conditions and are impacted by the availability of credit, the level and volatility of interest rates, inflation, employment levels, consumer confidence and

21

housing demand. In addition, a significant amount of our revenue is concentrated among certain customers, industries, product offerings and in distinct geographic regions, primarily in the United States. Our 2023 revenue in our U.S. Markets Financial Services vertical and in our Consumer Interactive segment accounted for approximately 33% and 15% of consolidated gross revenues, respectively. If businesses in these industries experience economic hardship, we cannot assure you that we will be able to generate future revenue growth. Our customer base suffers when financial markets experience volatility, liquidity issues and disruption, which has occurred in the past and which could reoccur, and the potential for increased and continuing disruptions going forward, present considerable risks to our business and revenue. Changes in the macroeconomic environment have resulted, and may continue to result, in fluctuations in volumes, pricing and operating margins for our services. In addition, if consumer demand for financial services and products and the number of credit applications decrease, the demand for our services could also be materially reduced. High inflation levels has a negative impact on our business by decreasing demand for credit due to slower consumer spending on non-essential goods and services and due to the Federal Reserve raising interest rates to combat inflation. Continued inflation and additional interest rate increases could further materially impact our business. These types of disruptions could lead to a decline in the volumes of services we provide our customers and could negatively impact our revenue and results of operations.

We are subject to significant competition in the markets in which we operate and we may face significant competition in the new markets that we plan to enter.

The markets for our services are highly competitive, and we may not be able to compete successfully against our competitors, which could impair our ability to sell our services. We compete on the basis of differentiated solutions, datasets, analytics capabilities, ease of integration with our customers’ technology, stability of services, customer relationships, innovation and price. Our regional and global competitors vary in size, financial and technical capability, and in the scope of the products and services they offer. Some of our competitors may be better positioned to develop, promote and sell their products. Larger competitors may benefit from greater cost efficiencies and may be able to win business simply based on pricing. We consistently face downward pressure on the pricing of our products, which could result in reduced prices for certain products, or a loss of market share. Our competitors may also be able to respond to opportunities before we do, by taking advantage of new technologies, changes in customer requirements or market trends.

Our Consumer Interactive segment experiences competition from emerging companies. In the past several years, there has been an influx of other companies offering similar services to ours, free of charge. These developments have resulted in increased competition.

Many of our competitors have extensive customer relationships, including relationships with our current and potential customers. New competitors, or alliances among competitors, may emerge and gain significant market share. Existing or new competitors may develop products and services that are superior to ours or that achieve greater market acceptance. If we are unable to respond to changes in customer requirements as quickly and effectively as our competition, our ability to expand our business and sell our services may be adversely affected.

Our competitors may be able to sell services at lower prices than we do, individually or as part of integrated suites of several related services. This ability may cause our customers to purchase from our competitors rather than from us. Price reductions by our competitors could also negatively impact our operating margins or harm our ability to obtain new long-term contracts or renewals of existing contracts on favorable terms. Additionally, some of our customers may develop products of their own that replace the products they currently purchase from us, which would result in lower revenue.

We also expect that there will be significant competition in the new markets that we enter. We cannot assure you that we will be able to compete effectively against current and future competitors. If we fail to successfully compete, our business, financial condition and results of operations may be adversely affected.

To the extent the availability of free or relatively inexpensive consumer information increases, the demand for some of our services may decrease.

Public and commercial sources of free or relatively inexpensive consumer information have become increasingly available and this trend is expected to continue. Public and commercial sources of free or relatively inexpensive consumer information, including free credit information from lead generation companies and from banks, may reduce demand for our services. Beginning in April 2020, we began offering free credit reports on a weekly basis. To the extent that our customers choose not to obtain services from us and instead rely on information obtained at little or no cost from these public and commercial sources, our business, financial condition and results of operations may be adversely affected.

Our relationships with key long-term customers may be materially diminished or terminated.

We have long-standing relationships with a number of our customers, many of whom could unilaterally terminate their relationship with us or materially reduce the amount of business they conduct with us at any time. Our customer agreements relating to our core credit reporting service offered through our U.S. Markets segment are terminable upon advance written

22

notice (typically ranging from 30 days to six months) by either us or the customer, which provides our customers with the opportunity to renegotiate their contracts with us or to award more business to our competitors.

We also provide our services to business partners who may combine them with their own or other branded services to be offered as a bundle to consumers, governmental agencies and businesses in support of fraud or credit protection, credit monitoring, identity authentication, insurance or credit underwriting, and collections. Some of these partners are the largest providers of credit information or identity protection services to the U.S. consumer market.

Market competition, business requirements, financial condition and consolidation through mergers or acquisitions, could adversely affect our ability to continue or expand our relationships with our customers and business partners. There is no guarantee that we will be able to retain or renew existing agreements, maintain relationships with any of our customers or business partners on acceptable terms or at all, or collect amounts owed to us from insolvent customers or business partners. The loss of one or more of our major customers or business partners could adversely affect our business, financial condition and results of operations.

If we are unable to develop successful new services in a timely manner, or if the market does not adopt our new services, our ability to maintain or increase our revenue could be adversely affected.

In order to keep pace with customer demands for increasingly sophisticated service offerings, to sustain expansion into growth industries and to maintain our profitability, we must continue to innovate and introduce new services to the market. The process of developing new services is complex and uncertain. Our industry solutions require extensive experience and knowledge from within the relevant industry. We must commit significant resources to this effort before knowing whether the market will accept new service offerings. Additionally, our business strategy is dependent on our ability to expand into new markets and to bring new products to market. We may not successfully enter into new markets or execute on our new services because of challenges in planning or timing, technical hurdles, difficulty in predicting market demand, changes in regulation or a lack of appropriate resources. Additionally, even if we successfully develop new products, our existing customers might not accept these new products or new markets might not adopt our products due to operational constraints, high switching costs or general lack of market readiness. Failure to successfully introduce new services to the market could adversely affect our reputation, business, financial condition and results of operations.

If our outside service providers and key vendors are not able to or do not fulfill their service obligations, our operations could be disrupted and our operating results could be harmed.

We depend on a number of service providers and key vendors such as telecommunication companies, software engineers, data processors, software and hardware vendors and providers of credit score algorithms, who are critical to our operations. These service providers and vendors are involved with our service offerings, communications and networking equipment, computer hardware and software and related support and maintenance. Although we have implemented service-level agreements and have established monitoring controls, our operations could be disrupted if we do not successfully manage relationships with our service providers, if they do not perform or are unable to perform agreed-upon service levels, or if they are unwilling to make their services available to us at reasonable prices. If our service providers and vendors do not perform their service obligations, it could adversely affect our reputation, business, financial condition and results of operations.

There may be further consolidation in our end-customer markets, which may adversely affect our revenues.

There has been, and we expect there will continue to be, merger, acquisition and consolidation activity in our customer markets. If our customers merge with, or are acquired by, other entities that are not our customers, or that use fewer of our services, our revenue may be adversely impacted. In addition, industry consolidation could affect the base of recurring transaction-based revenue if consolidated customers combine their operations under one contract, since most of our contracts provide for volume discounts. In addition, our existing customers might leave certain geographic markets, which would no longer require them to purchase certain products from us and, consequently, we would generate less revenue than we currently expect.

Risks Related to Technology and Cybersecurity

Data security and integrity are critically important to our business, and cybersecurity incidents, including cyberattacks, breaches of security, unauthorized access to or disclosure of our intellectual property or confidential information, business disruption, or the perception that confidential information is not secure, could result in a material loss of business, regulatory enforcement, substantial legal liability and/or significant harm to our reputation.

As a global consumer credit reporting agency and provider of risk and information solutions, we collect, store and transmit a large amount of sensitive and confidential consumer information on over one billion consumers, including financial information, personally identifiable information and protected health information. We also rely heavily on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business. We face significant and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our systems and data including unintentional events and deliberate attacks by third parties or insiders, such as the

23

exploitation of “bugs” or security vulnerabilities in software and hardware and sophisticated attack methods such as ransomware. These cyberattacks can take many forms, but they typically have one or more of the following objectives, among others:

•obtain unauthorized access to confidential data such as personal information;

•manipulate or destroy data;

•disrupt, sabotage or degrade service on our systems; or

•affect our operations or data through attacks on third-party business partners or service providers.

We experience numerous attempts to access our computer systems, software, networks, data and other technology assets on a daily basis. We have also experienced cyberattacks and other security incidents, and expect that such attacks and incidents will continue in varying degrees in the future. To date, none of these attacks or incidents has had a material impact on our business, operations or financial results. However, there can be no assurance that future attacks will be immaterial and even immaterial incidents may adversely impact us. For example, in March 2022, a criminal third party obtained access to a TransUnion South Africa server and certain customer personally identifiable information through misuse of an authorized client’s credentials. We promptly initiated our response processes, implemented technical containment measures, engaged cybersecurity and forensic experts and launched an investigation. As a precautionary measure, TransUnion South Africa temporarily took certain elements of our services offline, all of which have been resumed.

The security and protection of non-public consumer information is TransUnion’s top priority. However, there can be no assurance that our cybersecurity risk management program and processes, including our controls, will be fully implemented, complied with or effective. We cannot assure you that our systems, databases and services will not be compromised or disrupted in the future, whether as a result of deliberate attacks by malicious actors, breaches due to employee error or malfeasance, or other disruptions during the process of upgrading or replacing computer software or hardware, power outages, computer viruses, telecommunication or utility failures or natural disasters or other catastrophic events.

Further, it is possible that we may acquire a company that has experienced a security incident or has security vulnerabilities that the acquired company has yet to discover, investigate and remediate. While we execute security due diligence in these transactions, it is possible that neither the acquired company nor TransUnion may identify these issues in a timely manner, which could spread more broadly to other parts of TransUnion during the integration effort.

Highly publicized cybersecurity incidents, including the data incident announced by Equifax on September 7, 2017, and more recently, the December 13, 2020 announcement by SolarWinds that its software supply chain was compromised, have heightened consumer, legislative and regulatory awareness of cybersecurity risks. These events continue to embolden individuals or groups to target our systems more aggressively.

The preventive actions we take to address cybersecurity risk, including protection of our systems and networks, may be insufficient to repel or mitigate the effects of cyberattacks in the future as it may not always be possible to anticipate, detect or recognize threats to our systems, or to implement effective preventive measures against all cybersecurity risks. This is because, among other things:

•the techniques used in cyberattacks change frequently and are increasingly sophisticated (including due to attacker’s use of artificial intelligence), and may not be recognized until after the attacks have succeeded;

•cyberattacks can originate from a wide variety of sources, including sophisticated threat actors involved in organized crime, sponsored by nation-states, or linked to terrorist or hacktivist organizations; and

•third parties may seek to gain access to our systems either directly or using equipment or security passwords belonging to employees, customers, third-party service providers or other users (such as through social engineering and phishing attacks).

Unauthorized disclosure, loss or corruption of our data or inability of our customers to access our systems could disrupt our operations, subject us to substantial regulatory and legal proceedings (including class actions) and potential liability, result in a material loss of business and/or significantly harm our reputation.

We may not be able to timely address the consequences of a cybersecurity incident because a successful breach of our computer systems, software, networks or other technology assets could occur and persist for an extended period of time before being detected due to, among other things:

•the breadth and complexity of our operations and the high volume of transactions that we process;

•the large number of customers, counterparties and third-party service providers with which we do business;

•the proliferation and increasing sophistication of cyberattacks;

24

•the possibility that a malicious third party compromises the software, hardware or services that we procure from a service provider unbeknownst to both the provider and to TransUnion; and

•the possibility that a third party, after establishing a foothold on an internal network without being detected, might obtain access to other networks and systems.

The extent of a particular cybersecurity incident and the steps that we may need to take to investigate it may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed and full and reliable information about the incident is known. While such an investigation is ongoing, we may not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, any or all of which could further increase the costs and consequences of a cybersecurity incident.

Due to concerns about data security and integrity, a growing number of legislative and regulatory bodies around the world have adopted consumer notification and other requirements in the event that consumer information is accessed by unauthorized persons and additional regulations regarding the use, access, accuracy and security of such data are possible. For example, in the United States, we are subject to federal and state laws that provide for more than 50 disparate notification regimes, some of which also provide for statutory damages and private rights of action for plaintiffs who experience certain types of data breaches. In the event of unauthorized access, our failure to comply with the complexities of these various regulations could subject us to regulatory scrutiny and additional liability.

We may be unable to adequately anticipate, prevent or mitigate damage resulting from increasingly sophisticated methods of illegal or fraudulent activities committed against us, which could harm our business, financial condition and results of operations and could significantly harm our reputation.

The defensive measures that we take to manage threats, especially cyber-related threats, to our business may not adequately anticipate, prevent or mitigate harm we may suffer from such threats. Criminals use evolving and increasingly sophisticated methods of perpetrating illegal and fraudulent activities. For example, in September 2020, TransUnion experienced a series of Distributed Denial of Service (“DDoS”) attacks. While these attacks did not result in any unauthorized access to data or systems, there was disruption to TransUnion’s normal operations including degraded customer response time, intermittent timeouts and degraded internal information technology services utilized by TransUnion associates. TransUnion deploys a number of defensive measures to mitigate DDoS attacks, but persistent attackers can challenge these protections.

Also, in July 2019, TransUnion Limited, a Hong Kong entity in which the Company holds a majority interest, was a victim of a fraud incident that occurred in July 2019 in our Asia Pacific region involving employee impersonation and fraudulent requests that successfully targeted TransUnion Limited, which resulted in a series of fraudulently induced wire transfers totaling $17.8 million, a portion of which has been subsequently recovered.

Fraudulent activities committed against us could disrupt our operations, have an adverse effect on our financial results, subject us to substantial legal proceedings and potential liability, result in a material loss of business and/or significantly harm our reputation.

If we experience system failures, personnel disruptions or capacity constraints, or our customers do not modify their systems to accept new releases of our distribution programs, the delivery of our services to our customers could be delayed or interrupted, which could harm our business and reputation and result in the loss of revenues or customers.

Our ability to provide reliable service largely depends on our ability to maintain the efficient and uninterrupted operation of our computer network, systems and data centers, some of which have been outsourced to third-party providers. In addition, we generate a significant amount of our revenues through channels that are dependent on links to telecommunications providers. Our systems, personnel and operations could be exposed to damage or interruption from fire, natural disasters, pandemic illness, power loss, war, terrorist acts, civil disobedience, telecommunication failures, computer viruses, DDoS attacks or human error. We may not have sufficient redundant operations to cover a loss or failure of our systems in a timely manner. Any significant interruption could severely harm our business and reputation and result in a loss of revenue and customers. Additionally, from time to time we send our customers new releases of our distribution programs, some of which contain security updates. Any failure by our customers to install these new releases could expose our customers to computer security risks.

We could lose our access to data sources which could prevent us from providing our services.

Our services and products depend extensively upon continued access to and receipt of data from external sources, including data received from customers, strategic partners and various government and public records repositories. In some cases, we compete with our data providers. Our data providers could stop providing data, provide untimely data or increase the costs for their data for a variety of reasons, including a perception that our systems are insecure as a result of a data security incidents, budgetary constraints, a desire to generate additional revenue or for regulatory or competitive reasons. We could also become subject to increased legislative, regulatory or judicial restrictions or mandates on the collection, disclosure or use of such data,

25

in particular if such data is not collected by our providers in a way that allows us to legally use the data. If we were to lose access to this external data or if our access or use were restricted or were to become less economical or desirable, our ability to provide services could be negatively impacted, which would adversely affect our reputation, business, financial condition and results of operations. We cannot provide assurance that we will be successful in maintaining our relationships with these external data source providers or that we will be able to continue to obtain data from them on acceptable terms or at all. Furthermore, we cannot provide assurance that we will be able to obtain data from alternative sources if our current sources become unavailable.

If we fail to maintain and improve our systems, our data matching technology, and our interfaces with data sources and customers, demand for our services could be adversely affected.

In our markets, there are continuous improvements in computer hardware, network operating systems, programming tools, programming languages, operating systems, data matching, data filtering and other database technologies and the use of the internet. These improvements, as well as changes in customer preferences or regulatory requirements, may require changes in the technology used to gather and process our data and deliver our services. Our future success will depend, in part, upon our ability to:

•internally develop and implement new and competitive technologies;

•use leading third-party technologies effectively;

•respond to changing customer needs and regulatory requirements, including being able to bring our new products to the market quickly; and

•transition customers and data sources successfully to new interfaces or other technologies.

We cannot provide assurance that we will successfully implement new technologies, cause customers or data furnishers to implement compatible technologies or adapt our technology to evolving customer, regulatory and competitive requirements. If we fail to respond, or fail to cause our customers or data furnishers to respond, to changes in technology, regulatory requirements or customer preferences, the demand for our services, the delivery of our services or our market reputation could be adversely affected. Additionally, our failure to implement important updates could affect our ability to successfully meet the timeline for us to generate cost savings resulting from our investments in improved technology. Failure to achieve any of these objectives would impede our ability to deliver strong financial results.

Risks Related to Laws, Regulations and Government Oversight

Our business is subject to various governmental regulations, laws and orders, compliance with which may cause us to incur significant expenses or reduce the availability or effectiveness of our solutions, and the failure to comply with which could subject us to civil or criminal penalties or other liabilities.

Our businesses are subject to regulation under the FCRA, the GLBA, the DPPA, HIPAA, HITECH, the Dodd-Frank Act, the FTC Act and various other international, federal, state and local laws and regulations. See “Business-Legal and Regulatory Matters” for a description of select regulatory regimes to which we are subject. These laws and regulations, which generally are designed to protect the privacy of the public and to prevent the misuse of personal information available in the marketplace, are complex, change frequently and have tended to become more stringent over time. We already incur significant expenses to ensure compliance with these laws.

Currently, public concern is high with regard to the operation of consumer reporting agencies in the United States, as well as the collection, use, accuracy, correction and sharing of personal information, including Social Security numbers, dates of birth, financial information, medical information, department of motor vehicle data and other personal data.

In addition, many consumer advocates, privacy advocates, legislatures and government regulators believe that existing laws and regulations do not adequately protect privacy and have become increasingly concerned with the collection and use of this type of personal information. As a result, thirteen U.S. states have passed comprehensive privacy legislation intended to provide consumers with greater transparency and control over their personal information by providing consumers with certain rights, such as the right to know what personal information is being collected about them, and the right to access, delete, correct, or opt out of the sale of their personal information. The original California Consumer Privacy Act became effective in 2020, with amendments in the California Privacy Rights Act effective in 2023. Similar laws in Colorado, Connecticut, Utah and Virginia became effective over the course of 2023. Similar laws in Delaware, Indiana, Iowa, Montana, Oregon, New Jersey, Tennessee, and Texas take effect over the course of 2024 to 2026. While these laws include specific exemptions for practices and activities regulated by FCRA, GLBA, HIPAA and DPPA, including our credit reporting business, they apply to other portions of our business that are not regulated by these laws.

Public concern regarding identity theft also has led to more transparency for consumers as to what is in their credit reports. We provide credit reports and scores and monitoring services to consumers for a fee, and this income stream could be reduced or restricted by legislation that requires us to provide these services to consumers free of charge. For example, under U.S. federal

26

law today, we are required to provide consumers with one credit report per year free of charge, and beginning in April 2020, we began offering consumers free weekly credit reports.

The following legal and regulatory developments also could have a material adverse effect on our business, financial condition or results of operations:

•amendment, enactment or interpretation of laws and regulations that restrict the access and use of personal information and reduce the availability or effectiveness of our solutions or the supply of data available to customers;

•changes in governmental, cultural and consumer attitudes in favor of further restrictions on information collection and sharing, which may lead to regulations that prevent full utilization of our solutions;

•failure of data suppliers or customers to comply with laws or regulations, where mutual compliance is required;

•failure of our solutions to comply with current laws and regulations; and

•failure of our solutions to adapt to changes in the regulatory environment in an efficient, cost-effective manner.

Changes in applicable legislation or regulations that restrict or dictate how we collect, maintain, combine and disseminate information, or that require us to provide services to consumers or a segment of consumers without charge, could adversely affect our business, financial condition or results of operations. Evolutions in consumer finance regulatory requirements or market practices involving our customers also might negatively affect our businesses and the markets into which we sell. For instance, the Federal Housing Finance Agency and various government sponsored entities continue to evaluate permitting mortgage originators to underwrite loans using only two credit reports, rather than the current mandate to use a credit report from each of the three national consumer reporting agencies. In the future, we may be subject to significant additional expense to ensure continued compliance with applicable laws and regulations and to investigate, defend or remedy actual or alleged violations. Any failure by us to comply with applicable laws or regulations could also result in significant liability to us, including liability to private plaintiffs as a result of individual or class action litigation, or may result in the cessation of our operations or portions of our operations or impositions of fines and restrictions on our ability to carry on or expand our operations. Moreover, our compliance with privacy laws and regulations and our reputation depend in part on our customers’ adherence to privacy laws and regulations and their use of our services in ways consistent with consumer expectations and regulatory requirements. Certain of the laws and regulations governing our business are subject to interpretation by judges, juries and administrative entities, creating substantial uncertainty for our business. We cannot predict what effect the interpretation of existing or new laws or regulations may have on our business. See “Business-Legal and Regulatory Matters.”

The CFPB has supervisory and examination authority over our business and may initiate enforcement actions with regard to our compliance with federal consumer financial laws. Actions by the CFPB or other regulators against us or our executives could result in increased operating costs, reputational harm, payment of damages and civil money penalties, injunctive relief and/or restitution, any of which could have a material adverse effect on our business, results of operations and financial condition.

The CFPB has broad authority over our business. This includes authority to issue regulations under federal consumer financial protection laws, such as under FCRA and other laws applicable to us and our financial customers. The CFPB is authorized to prevent “unfair, deceptive or abusive acts or practices” through its regulatory, supervisory and enforcement authority.

The CFPB conducts examinations and investigations, and may issue subpoenas and bring civil actions in federal court for violations of the federal consumer financial laws including FCRA. In these proceedings, the CFPB can seek relief that includes: rescission or reformation of contracts, restitution, disgorgement of profits, payment of damages, limits on activities and civil money penalties of up to $1.0 million per day for knowing violations. The CFPB conducts periodic examinations of us and the consumer credit reporting industry, which could result in new regulations or enforcement actions or proceedings. Actions by the CFPB could result in requirements to alter or cease offering affected products and services, making them less attractive and restricting our ability to offer them.

For example, in January 2017, as part of a Consent Order entered into with the CFPB, we agreed among other things, to implement certain practice changes in the way we advertise, market and sell products and services offered directly to consumers. In June 2021, we received a Notice and Opportunity to Respond and Advise (“NORA”) letter from the CFPB, informing us that the CFPB’s Enforcement Division was considering whether to recommend that the CFPB take legal action against us and certain of our executive officers. The NORA letter alleged that we failed to comply with and timely implement the January 2017 Consent Order (the “2017 Consent Order”), and further alleged additional violations related to TransUnion Interactive Inc.’s marketing practices. On April 12, 2022, after failed settlement negotiations with the CFPB related to the matter, the CFPB filed a lawsuit against us, Trans Union LLC, TransUnion Interactive, Inc. (collectively, the “TU Entities”) and the former President of our Consumer Interactive business, John Danaher, seeking restitution, civil money penalties, and injunctive relief, among other remedies, and alleging that the TU Entities violated the 2017 Consent Order and engaged in deceptive acts and practices in marketing the TransUnion Credit Monitoring product, among other allegations. The CFPB further alleges that Mr. Danaher violated the 2017 Consent Order and that we and Trans Union LLC provided substantial

27

assistance to TransUnion Interactive, Inc. in violating the 2017 Consent Order and the law. We are currently in active litigation with the CFPB on this matter. As of December 31, 2023, we have an accrued liability of $56.0 million in connection with this matter and there is a reasonable possibility that a loss in excess of the amount accrued may be incurred, and such an outcome could have a material adverse effect on our results of operations and financial condition.

See Part II, Item 8, “Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements,” Note 23, “Contingencies” for information regarding the CFPB matter.

Additionally, in March 2022, we received a NORA letter from the CFPB, informing us that the CFPB’s Enforcement Division is considering whether to recommend that the CFPB take legal action against us related to our tenant and employment screening business, TransUnion Rental Screening Solutions, Inc. (“TURSS”). The NORA letter alleged that Trans Union LLC and TURSS violated the FCRA by failing to (i) follow reasonable procedures to assure maximum possible accuracy of information in consumer reports and (ii) disclose to consumers the sources of such information. On July 27, 2022, the CFPB’s Enforcement Division advised us that it had obtained authority to pursue an enforcement action jointly with the FTC. On October 5, 2023, we reached a settlement in the form of a Consent Order with the CFPB and the FTC regarding this matter, pursuant to which we agreed to pay $11.0 million in redress and $4.0 million in civil money penalties and implement certain business process changes. As of December 31, 2023, the settlement was paid in full to the CFPB.

In August 2022, the TU Entities received a NORA letter from the CFPB, informing us that the CFPB’s Enforcement Division was considering whether to recommend that the CFPB take legal action against us following an investigation relating to potential violations of law related to the placement and lifting of security freezes resulting from certain system issues. We have corrected associated system issues and have processes in place to monitor and address issues going forward. On April 14, 2023, the CFPB’s Enforcement Division advised us that it had obtained authority to pursue an enforcement action. On October 10, 2023, we reached a settlement in the form of a Consent Order with the CFPB regarding this matter, pursuant to which we agreed to pay $3.0 million in redress and $5.0 million in civil penalties. As of December 31, 2023, the settlement was paid in full to the CFPB.

Recently, the consumer reporting industry has been subject to heightened scrutiny. Based in part on public comments by CFPB officials, we believe that this trend is likely to continue and could result in more regulatory and legislative scrutiny of the practices of our industry and additional regulatory enforcement actions and litigation, which could adversely affect our business and results of operations.

Our compliance costs and legal and regulatory exposure could increase materially if we are targeted by the CFPB for additional enforcement actions, or if the CFPB or other regulators enact new regulations, change regulations that were previously adopted, modify through supervision or enforcement past regulatory guidance, or interpret existing regulations in a manner different or stricter than have been previously interpreted. For example, the CFPB recently issued guidance that indicates increased focus on consumer reporting agencies’ compliance with the accuracy and dispute obligations under the FCRA with respect to rental information. Although we have committed resources to enhancing our risk and compliance programs, actions by the CFPB or other regulators against us or our current or former executives could result in increased operating costs, reputational harm, payment of damages and civil monetary penalties, injunctive relief and/or restitution, any of which could have a material adverse effect on our business, results of operations and financial condition.

Regulatory oversight of our contractual relationships with certain of our customers may adversely affect our business.

The Office of the Comptroller of the Currency’s (the “OCC”) guidance to national banks and federal savings associations on assessing and managing risks associated with third-party relationships, which include all business arrangements between a bank and another entity, by contract or otherwise, requires banks to exercise comprehensive oversight throughout each phase of a bank’s business arrangement with third-party service providers, and instructs banks to adopt risk management processes commensurate with the level of risk and complexity of its third-party relationships. The OCC expects especially rigorous oversight of third-party relationships that involve certain “critical activities,” which include significant bank functions or significant shared services or other activities that could have a major impact on a bank’s operations. In light of this guidance, our existing or potential financial services customers subject to OCC regulation may continue to revise their third-party risk management policies and processes and the terms on which they do business with us, which may adversely affect our relationship with such customers.

The outcome of litigation, inquiries, investigations, examinations or other legal proceedings in which we are involved, in which we may become involved, or in which our customers or competitors are involved could subject us to significant monetary damages or restrictions on our ability to do business.

Legal proceedings arise frequently as part of the normal course of our business. These may include individual consumer cases, class action lawsuits and inquiries, investigations, examinations, regulatory proceedings or other actions brought by federal or state authorities or by consumers. The scope and outcome of these proceedings is often difficult to assess or quantify. Plaintiffs in lawsuits may seek recovery of large amounts and the cost to defend such litigation may be significant. There may also be

28

adverse publicity and uncertainty associated with investigations, litigation and orders (whether pertaining to us, our customers or our competitors) that could decrease customer acceptance of our services or result in material discovery expenses. In addition, a court-ordered injunction or an administrative cease-and-desist order or settlement may require us to modify our business practices or may prohibit conduct that would otherwise be legal and in which our competitors may engage. Many of the technical and complex statutes to which we are subject, including state and federal credit reporting, medical privacy and financial privacy requirements, may provide for civil and criminal penalties and may permit consumers to maintain individual or class action lawsuits against us and obtain statutorily prescribed damages. Additionally, our customers might face similar proceedings, actions or inquiries, which could affect their business and, in turn, our ability to do business with those customers. While we do not believe that the outcome of any pending or threatened legal proceeding, investigation, examination or supervisory activity will have a material adverse effect on our financial position, such events are inherently uncertain and adverse outcomes could result in significant monetary damages, penalties or injunctive relief against us.

See Part II, Item 8, “Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements,” Note 23, “Contingencies” for information regarding our legal proceedings.

Risks Related to Global Operations

Our ability to expand our operations in, and the portion of our revenue derived from, markets outside the United States is subject to economic, political and other inherent risks, which could adversely impact our growth rate and financial performance.

Over the last several years, we have derived a growing portion of our revenues from customers outside the United States, and it is our intent to continue to expand our international operations. We have sales and technical support personnel in numerous countries worldwide. We expect to continue to add personnel internationally to expand our abilities to deliver differentiated services to our international customers. Expansion into international markets will require significant resources and management attention and will subject us to new regulatory, economic and political risks. Moreover, the services we offer in developed and emerging markets must match our customers’ demand for those services. Due to price, limited purchasing power and differences in the development of consumer credit markets, there can be no assurance that our services will be accepted in any particular developed or emerging market, and we cannot be sure that our international expansion efforts will be successful. The results of our operations and our growth rate could be adversely affected by a variety of factors arising out of international commerce, some of which are beyond our control. These factors include:

•currency exchange rate fluctuations;

•foreign exchange controls that might prevent us from repatriating cash to the United States;

•difficulties in managing and staffing international offices;

•increased travel, infrastructure, legal and compliance costs of multiple international locations;

•foreign laws and regulatory requirements;

•terrorist activity, natural disasters and other catastrophic events;

•restrictions on the import and export of technologies;

•difficulties in enforcing contracts and collecting accounts receivable;

•longer payment cycles;

•failure to meet quality standards for outsourced work;

•unfavorable tax rules;

•political and economic conditions in foreign countries, particularly in emerging markets;

•the presence and acceptance of varying level of business corruption in international markets;

•varying business practices in foreign countries; and

•reduced protection for intellectual property rights.

For example, in 2023, reported revenue from our International segment increased 9.2% including the impact of foreign currencies, or 12.2% on a constant currency basis which excludes the impact of foreign currencies. See “Management’s Discussion and Analysis of Financial Condition and Results of Operations-Twelve Months Ended December 31, 2023, 2022 and 2021-Revenue-International Segment.” As we continue to expand our business, our success will partially depend on our ability to anticipate and effectively manage these and other risks. Our failure to manage these risks could adversely affect our business, financial condition and results of operations.

29

We face geopolitical and other risks associated with our international operations, which could materially adversely impact our results of operations and our financial condition.

We conduct operations in over 30 countries and, in the fiscal year ended December 31, 2023, approximately 21.1% of our revenue was derived from our international operations, which subjects us to various risks inherent in global operations. We may conduct business in additional foreign jurisdictions in the future, which may carry operational risks. At any particular time, our global operations may be affected by local changes in laws, regulations, and political and economic environments, including inflation, recession, currency volatility, and competition, as well as business and operational decisions made by joint venture partners.

Furthermore, geopolitical dynamics caused by political, economic, social or other conditions in foreign countries and regions may impact our business and results of operations. Significantly higher and sustained rates of inflation, with subsequent increases in operational costs, could have a material adverse effect on our business, financial position and results of operations. The continued threat of terrorism and heightened security and military action in response thereto, or any other current or future acts of terrorism, war (such as the ongoing conflicts in Ukraine and between Israel and Hamas), and other events (such as economic sanctions and trade restrictions, including those related to the ongoing Russia and Ukraine conflict and in the Middle East) may cause further disruptions to the economies of the United States and other countries and create further uncertainties or could otherwise negatively impact our business, operating results, and financial condition.

Changes or uncertainty in U.S. policies or policies in other countries and regions in which we do business, including any changes or uncertainty with respect to U.S. or international trade policies or tariffs, also can disrupt our global operations, as well as our customers and suppliers, in a particular location and may require us to spend more money to source certain products or materials that we purchase. Any of these factors could adversely affect our business, financial position, and results of operations.

Risks Related to Intellectual Property

We may be unable to protect our intellectual property adequately or cost-effectively, which may cause us to lose market share or force us to reduce our prices. We also rely on trade secrets and other forms of unpatented intellectual property that may be difficult to protect.

Our success depends, in part, on our ability to protect and preserve the proprietary aspects of our technology and services. If we are unable to protect our intellectual property, including trade secrets and other unpatented intellectual property, our competitors could use our intellectual property to market and deliver similar services, decreasing the demand for our services. We rely on the patent, copyright, trademark, trade secret and other intellectual property laws of the United States and other countries, as well as contractual restrictions, such as nondisclosure agreements, to protect and control access to our proprietary intellectual property. These measures afford limited protection, however, and may be inadequate. We may be unable to prevent third parties from using our proprietary assets without our authorization or from breaching any contractual restrictions with us. Enforcing our rights could be costly, time-consuming, distracting and harmful to significant business relationships. Claims that a third party illegally obtained and is using trade secrets can be difficult to prove, and courts outside the United States may be less willing to protect trade secrets. Additionally, others may independently develop non-infringing technologies that are similar or superior to ours. Any significant failure or inability to adequately protect and control our proprietary assets may harm our business and reduce our ability to compete.

We may face claims for intellectual property infringement, which could subject us to monetary damages or limit us in using some of our technologies or providing certain services.

There has been substantial litigation in the United States regarding intellectual property rights in the information technology industry. We cannot be certain that we do not infringe on the intellectual property rights of third parties, including the intellectual property rights of third parties in other countries, which could result in a liability to us. Historically, patent applications in the United States and some foreign countries have not been publicly disclosed until eighteen months following submission of the patent application, and we may not be aware of currently filed patent applications that relate to our products or processes. If patents are later issued on these applications, we may be liable for infringement. In the event that claims are asserted against us, we may be required to obtain licenses from third parties (if available on acceptable terms or at all). Any such claims, regardless of merit, could be time consuming and expensive to litigate or settle, divert the attention of management and materially disrupt the conduct of our business, and we may not prevail. Intellectual property infringement claims against us could subject us to liability for damages and restrict us from providing services or require changes to certain products or services. Although our policy is to obtain licenses or other rights where necessary, we cannot provide assurance that we have obtained all required licenses or rights. If a successful claim of infringement is brought against us and we fail to develop non-infringing products or services, or to obtain licenses on a timely and cost-effective basis, our reputation, business, financial condition and results of operations could be adversely affected.

30

Risks Related to Our Growth Strategy

When we engage in acquisitions, investments in new businesses or divestitures of existing businesses, we face risks that may adversely affect our business.

We have acquired and may continue to acquire or make investments in businesses that offer complementary services and technologies. Acquisitions may not be completed on favorable terms and acquired assets, data or businesses may not be successfully integrated into our operations. Even if we devote substantial management attention and resources to integrating acquired businesses in order to fully realize the anticipated benefits of such acquisitions, the businesses and assets acquired may not be successful or continue to grow at the same rate as when operated independently or may require greater resources and investments than we originally anticipated. Acquisitions involve significant risks and uncertainties, including:

•failing to achieve the financial and strategic goals for the acquired business;

•paying more than fair market value for an acquired company or assets;

•failing to integrate the operations and personnel of the acquired businesses in an efficient and timely manner;

•disrupting our ongoing businesses, including loss of sales;

•distracting management focus from our existing businesses;

•assumption of unanticipated or contingent liabilities;

•failing to retain key personnel;

•incurring the expense of an impairment of assets due to the failure to realize expected benefits;

•damaging relationships with employees, customers or strategic partners;

•diluting the share value of existing stockholders; and

•incurring additional debt or reducing available cash to service our existing debt.

We have divested our Healthcare business and may in the future divest certain assets or businesses that no longer fit with our growth strategy. Divestitures involve significant risks and uncertainties, including:

•disrupting our ongoing businesses;

•failure to effectively transfer liabilities, contracts, facilities and employees to buyers;

•reducing our revenues;

•losing key personnel;

•distracting management focus from our existing businesses;

•the possibility that we will become subject to third-party claims arising out of such divestiture;

•indemnification claims for breaches of representations and warranties in sale agreements;

•damaging relationships with employees and customers as a result of transferring a business to new owners; and

•failure to close a transaction due to conditions such as financing or regulatory approvals not being satisfied.

These risks could harm our business, financial condition or results of operations, particularly if they occur in the context of a significant acquisition or divestiture. In addition, changes in laws and regulations following a significant acquisition or divestiture could adversely impact our business, financial condition, results of operations and growth prospects. Acquisitions of businesses having a significant presence outside the United States will increase our exposure to the risks of conducting operations in international markets.

Further, we are required to assess the effectiveness of the internal control over financial reporting for companies we acquire pursuant to the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”). In order to comply with the Sarbanes-Oxley Act, we will need to implement or enhance internal control over financial reporting at any company we acquire, and we may identify control deficiencies that require remediation as part of our evaluation and testing of internal controls. Companies we acquire may not have had previous public reporting obligations and therefore may not have instituted or evaluated internal controls in the context of the Sarbanes-Oxley Act. Implementing, enhancing, or remediating effective internal controls as part of our integration of acquired companies may be time-consuming and we may encounter difficulties assimilating or integrating internal controls. We may be required to hire or engage additional resources and incur substantial costs to implement the necessary new internal controls as part of our acquisition activities. Any failure to implement and maintain effective internal control over financial reporting could result in material weaknesses or significant deficiencies in our internal controls, and could result in a material misstatement of our financial statements or otherwise cause us to fail to meet our financial reporting obligations, which could have an adverse effect on our business, financial condition, results of operations, or stock price.

31

We depend, in part, on strategic alliances, joint ventures and acquisitions to grow our business. If we are unable to make strategic acquisitions and develop and maintain these strategic alliances and joint ventures, our growth may be adversely affected.

An important focus of our business is to identify business partners who can enhance our services and enable us to develop solutions that differentiate us from our competitors. We have entered into several alliance agreements or license agreements with respect to certain of our datasets and services and may enter into similar agreements in the future. These arrangements may require us to restrict our use of certain of our technologies among certain customer industries, or to grant licenses on terms that ultimately may prove to be unfavorable to us, either of which could adversely affect our business, financial condition or results of operations. Relationships with our alliance agreement partners may include risks due to incomplete information regarding the marketplace and commercial strategies of our partners, and our alliance agreements or other licensing agreements may be the subject of contractual disputes. If we or our alliance agreements’ partners are not successful in maintaining or commercializing the alliance agreements’ services, such commercial failure could adversely affect our business.

In addition, a significant strategy for our international expansion is to establish operations through strategic alliances or joint ventures with local financial institutions and other partners. We cannot provide assurance that these arrangements will be successful or that our relationships with our partners will continue to be mutually beneficial. If these relationships cannot be established or maintained, it could negatively impact our business, financial condition and results of operations. Moreover, our ownership in and control of our foreign investments may be limited by local law.

We also selectively evaluate and consider acquisitions as a means of expanding our business and entering into new markets. We may not be able to acquire businesses we target due to a variety of factors such as competition from companies that are better positioned to make the acquisition. Our inability to make such strategic acquisitions could restrict our ability to expand our business and enter into new markets which would limit our ability to generate future revenue growth. Additionally, given some of our equity interests in various companies, we may be limited in our ability to require or influence such companies to make acquisitions or take other actions that we believe to be in our or their best interests. Our inability to take such actions could have a material impact on our revenues or earnings.

Risks Related to Our Indebtedness

We have a substantial amount of debt which could adversely affect our financial position and prevent us from fulfilling our obligations under the debt instruments.

As of December 31, 2023, the book value of our debt was approximately $5,340.4 million consisting of outstanding borrowings under Trans Union LLC’s senior secured credit facility. We may also incur significant additional indebtedness in the future. Our substantial indebtedness may:

•make it difficult for us to satisfy our financial obligations, including with respect to our indebtedness;

•limit our ability to borrow additional funds for working capital, capital expenditures, acquisitions or other general business purposes;

•limit our ability to use our cash flow or obtain additional financing for future working capital, capital expenditures, acquisitions or other general business purposes;

•require us to use a substantial portion of our cash flow from operations to make debt service payments;

•expose us to the risk of increased interest rates as certain of our borrowings, including Trans Union LLC’s senior secured credit facility, are at variable rates of interest;

•limit our ability to pay dividends;

•limit our flexibility to plan for, or react to, changes in our business and industry;

•place us at a competitive disadvantage compared with our less-leveraged competitors; and

•increase our vulnerability to the impact of adverse economic and industry conditions.

32

In addition, the credit agreement governing Trans Union LLC’s senior secured credit facility contains restrictive covenants that may limit our ability to engage in activities that may be in our long-term best interest. Our failure to comply with those covenants could result in an event of default which, if not cured or waived, could result in the acceleration of substantially all of our debt.

Lastly, in the United States, the Secured Overnight Financing Rate (“SOFR”) has replaced the London Inter-Bank Offered Rate (“LIBOR”), as of June 2023 for U.S. dollar-denominated LIBOR-benchmarked obligations. Because SOFR is a backward-looking, fully secured overnight rate and LIBOR is a forward-looking, unsecured rate, SOFR is likely to be lower than LIBOR on most dates, and any spread adjustment applied by market participants to alleviate any mismatch during a transition period will be subject to methodology that remains undefined. The discontinuation of LIBOR and the transition to SOFR or other benchmark rates could have an unpredictable impact on contractual mechanics in the credit markets or result in disruption to the broader financial markets, including causing interest rates under our current or future agreements to perform differently than in the past, which could have an adverse effect on our results of operations.

Despite our current level of indebtedness, we may still be able to incur additional indebtedness. This could further the risks associated with our substantial indebtedness.

We and our subsidiaries may be able to incur substantial additional indebtedness in the future. The terms of the credit agreement govern our debt limit, but do not prohibit, us or our subsidiaries from incurring additional indebtedness, and any additional indebtedness incurred in compliance with these restrictions could be substantial. If we incur any additional debt, the priority of that debt may impact the ability of existing debt holders to share ratably in any proceeds distributed in connection with any insolvency, liquidation, reorganization, dissolution or other winding-up of us, subject to collateral arrangements. These restrictions will also not prevent us from incurring obligations that do not constitute indebtedness. We also have the ability to request incremental loans on the same terms under the existing senior secured credit facility up to the greater of $1.0 billion and 100% of consolidated EBITDA and may incur additional incremental loans so long as the senior secured net leverage ratio does not exceed 4.25 to 1.0, subject to certain additional conditions and commitments by existing or new lenders to fund any additional borrowings. If new indebtedness is added to our current debt levels, the related risks that we and our subsidiaries now face could intensify.

We may not be able to generate sufficient cash to service all of our indebtedness, and may be forced to take other actions to satisfy our obligations under our indebtedness, which may not be successful.

Our ability to make scheduled payments due on our debt obligations or to refinance our debt obligations depends on our financial condition and operating performance, which are subject to prevailing economic, industry and competitive conditions and to certain financial, business, legislative, regulatory and other factors beyond our control as discussed above. Our total scheduled principal repayments of debt made in 2023 and 2022 were $100.0 million and $114.5 million, respectively. Our total interest expense for 2023 and 2022 was $288.2 million and $230.9 million, respectively. We may be unable to maintain a level of cash flow from operating activities sufficient to permit us to pay the principal, premium, if any, and interest on our indebtedness.

If our cash flow and capital resources are insufficient to fund our debt service obligations, we could face substantial liquidity problems and could be forced to reduce or delay investments and capital expenditures or to dispose of material assets or operations, seek additional debt or equity capital or restructure or refinance our indebtedness. We may not be able to implement any such alternative measures on commercially reasonable terms or at all and, even if successful, those alternative actions may not allow us to meet our scheduled debt service obligations. The credit agreement governing Trans Union LLC’s senior secured credit facility restricts our ability to dispose of assets and use the proceeds from those dispositions and may also restrict our ability to raise debt or equity capital to be used to repay other indebtedness when it becomes due. We may not be able to consummate those dispositions or to obtain proceeds in an amount sufficient to meet any debt service obligations then due. In addition, under the covenants of the credit agreement governing our senior secured credit facility, TransUnion Intermediate Holdings, Inc. is restricted from making certain payments, including dividend payments to TransUnion, subject to certain exceptions.

Our inability to generate sufficient cash flow to satisfy our debt obligations, or to refinance our indebtedness on commercially reasonable terms or at all, would materially and adversely affect our financial position and results of operations and our ability to satisfy our obligations.

If we cannot make our scheduled debt payments, we will be in default and all outstanding principal and interest on our debt may be declared due and payable, the lenders under Trans Union LLC’s senior secured credit facility could terminate their commitments to loan money, Trans Union LLC’s secured lenders (including the lenders under Trans Union LLC’s senior secured credit facility) could foreclose against the assets securing their borrowings and we could be forced into bankruptcy or liquidation.

33

Risks Related to Ownership of Our Common Stock

Our stock price has recently been volatile and has declined, and may continue to be volatile and/or decline, regardless of our operating performance, and you may not be able to resell shares of our common stock at or above the price you paid or at all.

Our stock price has recently been volatile and has declined due to a number of factors, including the deteriorating macroeconomic environment, changing expectations about our future revenue and operating results, and softening of the forward-looking guidance we have provided. The financial markets have at various times experienced significant price and volume fluctuations that have impacted the stock prices of many companies in the broader markets and in our industry in particular. These broad market and industry-specific fluctuations, as well as deteriorating macroeconomic conditions, could have a material adverse effect on our results of operations, financial condition and stock price. We reconcile the fair value of our reporting units to our market capitalization during our annual goodwill impairment test, which we conduct more frequently if events or circumstances indicate that the carrying value of goodwill may be impaired. A further decrease in our market capitalization could be an indicator that one or more of our reporting units has a goodwill impairment. During the three months ended September 30, 2023, we identified a triggering event requiring an interim impairment assessment for our United Kingdom reporting unit, which resulted in a goodwill impairment of $414 million.

This market volatility, as well as general economic, market or political conditions, could adversely affect the market price of our common stock, regardless of our actual operating performance, and you may not be able to resell your shares at or above the price you paid. In addition to the risks described in this section, several factors that could cause the price of our common stock to fluctuate significantly include, among others, the following, most of which we cannot control:

•quarterly variations in our operating results compared to market expectations;

•guidance that we provide to the public, any changes in this guidance or our failure to meet this guidance;

•changes in preferences of our customers;

•announcements of new products or significant price reductions by us or our competitors;

•size of our public float;

•stock price performance of our competitors;

•publication of research reports about our industry;

•changes in market valuations of our competitors;

•fluctuations in stock market prices and volumes;

•default on our indebtedness;

•actions by our competitors;

•changes in senior management or key personnel;

•changes in financial estimates by securities analysts;

•negative earnings or other announcements by us or other credit reporting agencies;

•downgrades in our credit ratings or the credit ratings of our competitors;

•issuances of capital stock or future sales of our common stock or other securities;

•investor perceptions or the investment opportunity associated with our common stock relative to other investment alternatives;

•the public response to press releases or other public announcements by us or third parties, including our filings with the SEC;

•announcements relating to litigation;

•the sustainability of an active trading market for our stock;

•changes in accounting principles;

•global economic, legal and regulatory factors unrelated to our performance; and

•other events or factors, including those resulting from natural disasters, war, acts of terrorism or responses to these events.

In addition, price volatility may be greater if the public float and trading volume of our common stock is low, and the amount of public float on any given day can vary depending on whether our stockholders choose to hold their shares for the long term.

In the past, companies that have experienced volatility in the market price of their stock have been subject to securities class action litigation. We may be the target of this type of litigation in the future. Securities litigation against us could result in substantial costs and divert our management’s attention from other business concerns, which could seriously harm our business.

34

Our business and operations are exposed to risks arising from developments and trends associated with climate change and ESG, including risks associated with our own reporting.

There are inherent climate-related risks wherever business is conducted. Various meteorological phenomena and extreme weather events (including, but not limited to, storms, flooding, drought, wildfire, and extreme temperatures) may directly or indirectly disrupt our operations (including the productivity of our employees) or those of our suppliers or infrastructure on which we rely, require us to incur additional operating or capital expenditures or otherwise adversely impact our business, financial condition, or results of operations. Climate change may impact the frequency and/or intensity of such events, as well as contribute to chronic physical changes, such as shifting precipitation or temperature patterns or rising sea-levels, which may also impact our operations or infrastructure on which we rely. While we may take various actions to mitigate our business risks associated with climate change, this may require us to incur substantial costs and may not be successful, due to, among other things, the uncertainty associated with the longer-term projections associated with managing climate risks.Any significant failure, compromise, interruption or a significant slowdown of operations, whether as a result of climate change or otherwise, may impair the Company’s ability to deliver its products and services.Additionally, we expect to be subject to increased regulations, reporting requirements, standards or expectations regarding the environmental impacts of our business. Changing market dynamics and other global and domestic policy developments also have the potential to disrupt our business, the business of our suppliers and/or customers, or otherwise adversely impact our business, financial condition, or results of operations.

Finally, increased scrutiny regarding ESG practices and disclosures are likely to continue.With this increased focus, public reporting regarding ESG practices is becoming more broadly expected. Such increased scrutiny may result in increased costs, changes in demand, enhanced compliance or disclosure obligations, increased legal exposure or other adverse impacts on our business, financial condition or results of operations.While we have engaged and may engaged in the future in voluntary initiatives and reporting on ESG matters, such initiatives and reporting may be costly and may not have the desired effect.While we have established ESG practices, including climate-related targets and goals, these targets and goals, including our GHG emission reduction goals, are based on certain assumptions, estimates, calculation methodologies and third-party data, and we may not meet such targets or goals on our established timeline or at all, including due to a variety of factors that may be in or out of our control. In addition, we may decide in the future not to pursue certain targets or goals further if our Board or management determines that further pursuit of any such target or goal is no longer in the long-term best interests of our business or our stockholders and any such decision could have an adverse impact on our reputation or stock price. Expectations regarding our ESG initiatives and reporting are evolving quickly and are often subject to factors outside of our control. For example, there have also been targeted efforts by certain parties to reduce companies’ attention to EGS matters which may result in additional costs or complexities in navigating stakeholder expectations. Moreover, actions or statements that we may make based on expectations, assumptions, calculation methodologies or third-party information that we currently believe to be reasonable may subsequently be determined to be erroneous or be subject to misinterpretation. For example, there have been increasing allegations of greenwashing against companies making significant ESG claims due to a variety of perceived deficiencies in performance, including as stakeholder perceptions of sustainability continue to evolve. Our approach to measuring and assessing our GHG emissions and establishing targets for the reduction of our emissions may ultimately be deemed to be inconsistent with future regulatory requirements or best practices.Even if this is not the case, our current actions may subsequently be determined to be insufficient or not aligned to best practices by various stakeholders. Our disclosures on these matters, a failure to satisfy evolving stakeholder expectations for ESG practices and reporting, or a failure or perceived failure to meet our commitments or targets (including the manner in which we complete such initiatives) on our established timeline may potentially harm our reputation and impact relationships with investors. If our ESG practices, reporting and performance do not meet investor, consumer, or employee, or other stakeholder expectations, or are perceived as not meeting those expectations, our brand, reputation and customer retention may be negatively impacted, and we may be subject to investor or regulator engagement regarding such matters, which could adversely impact our business, financial condition or results of operations.

Anti-takeover provisions in our organizational documents might discourage, delay or prevent acquisition attempts for us that you might consider favorable.

Certain provisions of our third amended and restated certificate of incorporation (“Charter”) and fourth amended and restated bylaws may have an anti-takeover effect and may delay, defer or prevent a merger, acquisition, tender offer, takeover attempt or other change of control transaction that a stockholder might consider in its best interest, including those attempts that might result in a premium over the market price for the shares held by our stockholders.

These provisions provide for, among other things:

•the ability of our Board to issue one or more series of preferred stock;

•advance notice for nominations of directors by stockholders and for stockholders to include matters to be considered at our annual meetings; and

•certain limitations on convening special stockholder meetings.

35

The anti-takeover provisions discussed above could make it more difficult for a third party to acquire us, even if the third party’s offer may be considered beneficial by many of our stockholders. As a result, our stockholders may be limited in their ability to obtain a premium for their shares.

Our ability to pay cash dividends may be limited by the terms of our secured credit facility.

In February 2018, our Board approved a dividend policy pursuant to which we intend to pay quarterly cash dividends on our common stock. The terms of our senior secured credit facility impose certain limitations on our ability to pay dividends. We may, however, declare and pay cash dividends up to an unlimited amount unless a default or event of default exists under the senior secured credit facility. Any determination to pay dividends in the future will be at the discretion of our Board and will depend upon results of operations, financial condition, contractual restrictions, restrictions imposed by applicable law and other factors our Board deems relevant.

General Risks

Economic and other conditions may adversely impact the valuation of our assets resulting in impairment charges that could have a material adverse impact on our results from operations.

We have significant amounts of goodwill and intangible assets. On a regular basis, we evaluate our assets for impairment based on various factors, including actual operating results and expected trends of projected revenues, profitability and cash flows. As of December 31, 2023, our Consolidated Balance Sheet included goodwill of $5,176.0 million and other net intangibles of $3,515.3 million. We conduct a goodwill impairment test in the fourth quarter of each year, or more frequently if events or circumstances indicate that the carrying value of goodwill may be impaired. We have the option to first perform a qualitative analysis to determine if it is more likely than not that the fair value of a reporting unit is less than its carrying value. If the qualitative analysis indicates that an impairment is more likely than not for any reporting unit, we perform a quantitative impairment test for that reporting unit. Our quantitative impairment test consists of a fair value calculation for each reporting unit that combines an income approach, using the discounted cash flow method, and a market approach, using the guideline public company method. The quantitative impairment test requires the application of a number of significant assumptions, including estimates of future revenue growth rates, EBITDA margins, discount rates, and market multiples. The projected future revenue growth rates and EBITDA margins, and the resulting projected cash flows of each reporting unit are based on historical experience and internal operating plans reviewed by management, extrapolated over the forecast period. Discount rates are determined using a weighted average cost of capital adjusted for risk factors specific to each reporting unit.

We believe the assumptions that we use in our qualitative and quantitative analysis are reasonable and consistent with assumptions that would be used by other marketplace participants. However, such assumptions are inherently uncertain. During times of economic distress, declining demand and declining earnings could lead to us to have less favorable estimates of our future cash flows, discount rates or market multiples. Such changes could lead to lower estimated fair values of our reporting units, which could lead to a material impairment charge. In certain markets where we operate, macroeconomic conditions are unfavorable. If these unfavorable macroeconomic conditions persist longer than we currently expect, or are worse than we currently expect, our estimates of revenue growth rates and EBITDA margins would decline, which could lead to an impairment of goodwill.

During the three months ended September 30, 2023, we identified a triggering event requiring an interim impairment assessment for our United Kingdom reporting unit, which resulted in a goodwill impairment of $414 million. The worsening macroeconomic conditions during the third quarter from inflationary pressures and rising interest rates increasingly impacted our business for the third quarter and the near-term outlook. Due to these factors, management now believes the U.K. recovery will take longer, and will be at a slower pace, than previously expected. As a result, we revised our short-term and mid-term forecasts for revenue and EBITDA expectations for our United Kingdom. reporting unit. These factors have particularly impacted the online-only FinTech lenders that represent the largest vertical within our United Kingdom reporting unit. These lenders have seen significant declines in their access to capital impacting their ability to lend and in some cases leading to bankruptcies. Any future reduction to our forecasts of our United Kingdom reporting unit may result in a further impairment that could have a material adverse effect on our business and financial results.

Any change to the conclusion of our reporting units or the aggregation of components within our reporting units could result in a different outcome to our annual impairment test.See Part II, Item 7, “Management Discussion and Analysis of Financial Condition and Results of Operations - Critical Accounting Estimates - Goodwill” for further information.

Our efforts to execute any element of our business strategy, including our transformation plan to optimize our operating model and invest in our technology, could experience difficulties, delays, or unexpected costs and may not achieve anticipated benefits and savings.

In November 2023, our Board approved a transformation plan to optimize our operating model and continue to advance our technology. See Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Factors Affecting Our Results of Operations” for additional information. We may not realize, in full or in part, the anticipated

36

benefits and savings from this plan due to unforeseen difficulties, delays, or unexpected costs, which may adversely affect our business and results of operations. Even if the anticipated benefits and savings of the plan are substantially realized, there may be consequences or business impacts that were not expected.

Management has determined that our internal control over financial reporting and disclosure controls and procedures were not effective as of December 31, 2023. A failure to maintain effective internal control over financial reporting or disclosure controls and procedures could impact our ability to accurately and timely report our financial results and other material disclosures or otherwise cause us to fail to meet our reporting obligations, which could have a material adverse effect on our operations, investor confidence in our business, and the trading price of our common stock.

Our management is responsible for establishing and maintaining adequate internal control over financial reporting to provide reasonable assurance regarding the reliability of our financial reporting and the preparation of financial statements for external purposes in accordance with U.S. generally accepted accounting principles. A control system, no matter how well designed and operated, can provide only reasonable, not absolute, assurance that the control system’s objectives will be met. We determined that our internal control over financial reporting and disclosure controls and procedures were not effective as of December 31, 2023 as a result of the material weaknesses related to the interim goodwill impairment test and an error in the classification of certain expenses between cost of services and selling, general and administrative, as discussed in Part II, Item 9A of this Form 10-K. These material weaknesses have not been remediated and accordingly our internal control over financial reporting and disclosure controls and procedures remain ineffective. Management is actively engaged in the planning for, and implementation of, remediation efforts to address our material weaknesses but there can be no assurance that those efforts will be successful. Refer to Part II, Item 9A for further details of the material weaknesses and remediation efforts.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis.

As such, if we do not remediate these material weaknesses in a timely manner, or if additional material weaknesses in our internal control over financial reporting are discovered, they may adversely affect our ability to record, process, summarize and report financial information timely and accurately and our financial statements may contain material misstatements or omissions. Additionally, our internal control environment and remediation efforts do not provide absolute assurance with regard to timely detecting or preventing control deficiencies and thus do not insulate us from any failure to meet our financial reporting obligations.

It is possible that additional control deficiencies could be identified by our management or by our independent registered public accounting firm in the future or may occur without being identified. Such a failure could require us to incur the expense of remediation, result in regulatory scrutiny, investigations or enforcement actions, cause investors to lose confidence in our reported financial condition and have a negative effect on the trading price of our common stock, lead to a default under our indebtedness, and otherwise have a material adverse effect on our business, financial condition, results of operations, and cash flows.

Pandemics, epidemics, disease outbreaks and other public health crises, such as the COVID-19 pandemic, have disrupted our business and operations, and future public health crises could materially adversely impact our business, financial condition, liquidity and results of operations.

We face various risks related to health epidemics, pandemics and similar outbreaks. For example, the COVID-19 pandemic and the mitigation efforts by governments to attempt to control its spread adversely impacted the global economy, leading to reduced consumer spending and lending activities. Our customers, and therefore our business and revenues, are sensitive to negative changes in general economic conditions. Any new pandemic or other public health crises, or future public health crises, could have a material impact on our business, financial condition and results of operations going forward.

We may not be able to attract and retain the skilled employees that we need to support our business.

Our success depends on our ability to attract and retain experienced management, sales, research and development, analytics, marketing and technical support personnel. If any of our key personnel were unable or unwilling to continue in their present positions, it may be difficult to replace them and our business could be seriously harmed. If we are unable to find qualified successors to fill key positions as needed, our business could be seriously harmed. The complexity of our services requires trained customer service and technical support personnel. We may not be able to hire and retain such qualified personnel at compensation levels consistent with our compensation structure. Some of our competitors may be able to offer more attractive terms of employment. In addition, we invest significant time and expense in training our employees, which increases their value to competitors who may seek to recruit them. If we fail to retain our employees, we could incur significant expense replacing employees and our ability to provide quality services could diminish, resulting in a material adverse effect on our business.

37

We are subject to losses from risks for which we do not insure.

For certain risks, we do not maintain insurance coverage because of cost and/or availability. Because we retain some portion of insurable risks, and in some cases retain our risk of loss completely, unforeseen or catastrophic losses in excess of insured limits could materially adversely affect our business, financial condition and results of operations.

If we experience changes in tax laws or adverse outcomes resulting from examination of our tax returns, it could adversely affect our results of operations.

We are subject to federal, state and local income and other taxes in the United States and in foreign jurisdictions. From time to time the United States federal, state, local and foreign governments make substantive changes to tax rules and the application thereof, which could result in materially different corporate taxes than would be incurred under existing tax law or interpretation and could adversely impact profitability. Governments have strengthened their efforts to increase revenues through changes in tax law, including laws regarding transfer pricing, economic presence and apportionment to determine the tax base.

Consequently, significant judgment is required in determining our worldwide provision for income taxes. Our future effective tax rates and the value of our deferred tax assets could be adversely affected by changes in tax laws. In addition, we are subject to the examination of our income tax returns and other tax returns by the Internal Revenue Service and other tax authorities. We regularly assess the likelihood of adverse outcomes resulting from such examinations to determine the adequacy of our provision for income taxes and reserves for other taxes. Although we believe we have made appropriate provisions for taxes in the jurisdictions in which we operate, changes in tax laws, or challenges from tax authorities under existing tax laws could adversely affect our business, financial condition and results of operations.

38

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

Item 1C. CYBERSECURITY

Cybersecurity Risk Management and Strategy

We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

Our Information Security program is guided by the ISO/IEC 27001:2022 principles and led by a global-level Information Security Department that develops our security policies, standards and procedures. We seek to evolve our approach to protect against increasing and changing security threats around the world.

Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

Our cybersecurity risk management program includes the following key elements:

•risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology environment;

•monitoring and reporting of those risks to appropriate levels of management;

•a team comprised of information technology security, infrastructure, and compliance personnel principally responsible for directing our (1) cybersecurity risk assessment processes, (2) security operations processes, and (3) response to cybersecurity incidents;

•the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;

•global associates with access to information technology systems in more than 30 countries and territories across North America, Latin America, Europe, Africa, India, and Asia Pacific receive a combination of general and targeted training to help keep Information Security top of mind;

•a cybersecurity incident response plan and Security Operations Center to respond to cybersecurity incidents; and

•a third-party security risk management process for key service providers based on their respective roles and risk profiles.

We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, could be reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to Part I, Item 1A “Risk Factors” for risks related to cybersecurity.

Cybersecurity Governance

Key Information Security risks are overseen by our Security and Technology Risk Committee (the “STRC”), which reports to our Enterprise Risk Management Committee (“ERMC”). The STRC, which is co-chaired by the Chief Technology, Data & Analytics Officer and the Chief Information Security Officer (“CISO”), provides oversight of mitigation of key risks related to technology and information security. This oversight includes monitoring and approving relevant policies, projects, and programs for the enterprise risk assessments related to technology and information security. The STRC also serves as an escalation point to the ERMC with respect to technology and information security risks. The ERMC is chaired by the Chief Risk & Compliance Officer, and includes the Chief Executive Officer, his direct reports and other key function heads or senior subject matter experts, including the CISO.

The ERMC, which meets monthly, also monitors TransUnion’s risk and governance policies and procedures to ensure that TransUnion risks are within the Board-approved Global Risk Taxonomy, which is described below. The ERMC reviews the broader risk environment and provides direction to mitigate (to an acceptable level) identified risks that may adversely affect our ability to achieve strategic objectives. The ERMC stewards our Enterprise Risk Management Policy and additional enterprise policies in risk-related areas, such as privacy and information security and key issues are reported to the appropriate committee of the Board.

39

Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Risk and Compliance Committee of the Board. The Risk and Compliance Committee oversees the quality and effectiveness of our information security framework, including capabilities, policies and controls, and methods for identifying, assessing and mitigating information and cybersecurity risks. The Risk and Compliance Committee also assesses the effectiveness of the Company’s management of information security-related risks, including consulting with internal and external advisors as appropriate.

Our CISO reports quarterly to the Risk and Compliance Committee and leads the Company’s overall cybersecurity function. The Risk and Compliance Committee receives reports from our CISO on key security topics, which may include, among other things, the cybersecurity risk landscape, and briefings on our cyber risk management program and significant cybersecurity incidents. The Board receives quarterly reports from the Chair of the Risk and Compliance Committee with applicable updates on the Company’s cybersecurity risk landscape, and briefings on our cyber risk management program and significant cybersecurity incidents. The CISO and/or the Chief Legal Officer also periodically present to the Board on cybersecurity topics that impact public companies.

Our CISO supervises and assists the ERMC in staying informed about and monitoring efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the information technology environment.

Our CISO, along with the STRC, are responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant global experience in managing and leading information technology and cybersecurity teams. Our CISO has over 20 years’ experience in the technology and security fields, including over 10 years in executive security leadership roles. Our CISO and senior members of the cybersecurity team also participate in both private and public knowledge shares, including maintaining ongoing relationships with government and non-public entities.

ITEM 2. PROPERTIES

Properties

Our corporate headquarters and main data center are located in Chicago, Illinois in an office building that we own. As of December 31, 2023, we lease space in over 110 other locations, including office space and additional data centers. These locations are geographically dispersed to meet our sales and operating needs. We anticipate that suitable additional or alternative space will be available at commercially reasonably terms for future expansion.

ITEM 3. LEGAL PROCEEDINGS

See Part II, ITEM 8 “Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements,” Note 23, “Contingencies” for information regarding our legal proceedings.

ITEM 4. MINE SAFETY DISCLOSURES

Not Applicable.

40

INFORMATION ABOUT OUR EXECUTIVE OFFICERS

Our executive officers, and their positions and ages as of February 28, 2024, are set forth below:

Name Age Position

Christopher A. Cartwright 58 President & Chief Executive Officer and Director

Todd M. Cello 48 Executive Vice President, Chief Financial Officer

Steven M. Chaouki 51 President, U.S. Markets and Consumer Interactive

Timothy J. Martin 53 Executive Vice President, Chief Global Solutions Officer

R. Dane Mauldin 53 Executive Vice President, Chief Operations Officer

Susan W. Muigai 54 Executive Vice President, Chief Human Resources Officer

Heather J. Russell 52 Executive Vice President, Chief Legal Officer

Todd C. Skinner 54 President, International

Christopher A. Cartwright has served as the President & Chief Executive Officer of TransUnion and a member of the Board of Directors since May 2019. He joined the Company in August 2013, previously serving as Executive Vice President, U.S. Information Services, where he helped drive TransUnion’s transformation into a global information and insights company as the head of the largest business unit, including providing consumer reports, risk scores, analytical services and decision technology to customers in the U.S. across the financial services, insurance, tenant and employment screening and public sector industries.

Prior to joining TransUnion, Mr. Cartwright was the Chief Executive Officer of Decision Insight Information Group, a portfolio of independent businesses providing real property information, software and services to insurance, finance, legal and real estate professionals in the United States, Canada and Europe. Mr. Cartwright also spent almost 14 years at Wolters Kluwer, a global information services and workflow solutions company, where he held a variety of executive positions of increasing responsibility, culminating in CEO of the Corporate and Financial Services Division and Shared Services, North America. Prior to Wolters Kluwer, he was Senior Vice President, Strategic Planning & Operations for Christie’s Inc. and Strategy Consultant for Coopers and Lybrand.

Mr. Cartwright earned his bachelor's degree in business administration and a master's in public accountancy from The University of Texas at Austin. He serves on the Board of Directors of P33 Chicago and the Board of Trustees of the Museum of Science and Industry.

Venkat Achanta has served as Executive Vice President, Chief Technology, Data & Analytics Officer for TransUnion since July 2023. Along with leading a unified data strategy and data science across the organization, in this role, Mr. Achanta is responsible for all aspects of the company’s technology, including strategy, security, product engineering, operations, infrastructure and delivery of solutions that support TransUnion’s global information systems. He previously held the role of Executive Vice President, Chief Data & Analytics Officer from February 2022 to July 2023. Mr. Achanta previously served as Executive Vice President and Chief Data & Technology Officer of Neustar, Inc., where he led data science, data strategy and technology teams across the company. While at Neustar, he helped lead the creation of the OneID platform and technology transformation across all products.

Prior to joining Neustar in 2016, Mr. Achanta was Chief Data Officer and Head of Data and Analytics at Walmart, beginning in 2014, leading all data and analytics delivery platforms across the company globally. While at Walmart, he spearheaded the data fabric, advanced analytics platforms and decision services groups. Prior to Walmart, Mr. Achanta was Global Head of Analytics and Big Data at AIG. Mr. Achanta also has held senior leadership positions in technology and data & analytics at Capital One and Experian.

Mr. Achanta earned his Bachelor of Science degree in Computer Science and Engineering from Andhra University in India and his M.B.A. from UCLA’s Anderson School of Management.

Todd M. Cello joined the Company in October 1997 and has held numerous roles with increasing levels of responsibility in the corporate finance department. Mr. Cello has served as our Executive Vice President, Chief Financial Officer since August 2017. Prior to his current role, Mr. Cello served as Senior Vice President and International CFO from August 2015 to August 2017, overseeing financial operations for the International segment. Prior to that, Mr. Cello served as Vice President, Financial Planning and Analysis from January 2009 to August 2015, overseeing the enterprise financial planning and analysis function, where he played a lead role in the two leveraged buyouts of TransUnion in 2010 and 2012 and the initial public offering of TransUnion in 2015. Prior to that, Mr. Cello served as Vice President and U.S. Information Services CFO from October 2005 to

41

December 2008, overseeing financial operations of the U.S. Information Services segment. Mr. Cello also serves on the University of Illinois at Chicago’s College of Business Advisory Council.

Mr. Cello earned his bachelor’s degree in Accounting from University of Illinois at Chicago and is a certified public accountant.

Steven M. Chaouki is President, U.S. Markets and Consumer Interactive, overseeing two TransUnion business lines. U.S. Markets provides information and insights to business customers across financial services, insurance, public sector, media and diversified markets. Consumer Interactive provides credit, financial and identity protection services to consumers.

He previously held the role of Executive Vice President, Financial Services from 2013 until May 2019, responsible for the company’s financial services business, which provides solutions to banks, credit unions, capital markets, financial services resellers, auto lenders and other customers. Before joining TransUnion, Mr. Chaouki held roles at HSBC in card/retail services and auto finance. Mr. Chaouki serves on the board of MAIA Biotechnology, Inc. (NYSE American: MAIA).

Mr. Chaouki earned his bachelor’s degree from Boston University and his M.B.A. from the University of Chicago Booth School of Business.

Timothy J. Martin has served as Executive Vice President, Chief Global Solutions Officer since May 2019. In this role, Mr. Martin is responsible for managing revenue growth and profitability through the strategy, planning, innovation and commercialization of nearly all of TransUnion’s products and solutions globally. He previously held business management roles at TransUnion leading both a number of industry vertical-focused teams and a high growth horizontal solution called the Specialized Risk Group.

Prior to joining TransUnion in September 2009, Mr. Martin was President and Chief Operating Officer of HSBC Auto Finance where he had direct profit and loss responsibility for all strategy, business development, sales, marketing, pricing, risk management, underwriting operations, customer service and collections. Prior to joining HSBC, he was a consultant with Booz Allen Hamilton (now PWC Strategy&) from 1998 to 2003, and senior marketing analyst with American Airlines from 1992 to 1996. Mr. Martin serves on the board of Juvenile Diabetes Research Foundation of South Florida and the Child Rescue Coalition.

Mr. Martin earned his B.S. in Management from Purdue University and his M.B.A. from the University of Michigan Business School.

R. Dane Mauldin has served as Executive Vice President, Chief Operations Officer for TransUnion since May 2019. Mr. Mauldin leads the organization’s focus on operations across the enterprise, including the vision, planning and execution required throughout the customer journey. Previously, he was Chief Product Officer from February 2013 until May 2019, where he was responsible for content acquisition, analytic discovery, product development and product delivery across the company’s global footprint.

Mr. Mauldin has an extensive background in the information solutions industry. Prior to joining TransUnion, he served as Chief Executive Officer of Screening Solutions and Customer Operations for LexisNexis Risk Solutions, a division of Reed Elsevier. Other roles at LexisNexis were Vice President of Total Customer Experience and Vice President of Collections Market Planning. He also held management positions at Commercial Financial Services and Experian.

Mr. Mauldin earned his bachelor’s degree in Journalism from the University of Oklahoma.

Susan W. Muigai has served as Executive Vice President, Chief Human Resources Officer since 2021. She is responsible for leading TransUnion’s human resource strategy and function, and nurturing an inclusive, high-performance culture to help TransUnion achieve its vision and strategy.

Ms. Muigai brings deep expertise in talent strategy with an extensive background in global HR, human capital management, organizational leadership, diversity and inclusion, legal and compliance, business transformation and more. She previously spent 16 years at Walmart, based in the U.S., Canada and India, serving as Senior Vice President, People from March 2020 to September 2021, Executive Vice President People/Corporate Affairs, Walmart Canada from August 2016 to August 2020, Senior Vice President People, Walmart Canada from January 2016 to July 2016, Vice President People, Walmart Canada from February 2015 to December 2015, Vice President, International Real Estate and Vice President International Real Estate, Walmart International Real Estate from March 2014 to February 2015, Senior Vice President Legal, General Counsel & Chief Ethics Officer, Walmart India from November 2012 to March 2014, Vice President Audit, Walmart Canada from September 2009 to October 2012, and Senior Director, Risk Management, Walmart Canada from June 2005 to September 2009.

Ms. Muigai earned her Bachelor of Law from the University of Windsor in Canada, and her Master of Law in International Business from the University of London. She serves on the board of directors of Coursera, Inc. (NYSE: COUR) and Breakfast Club of Canada.

Heather J. Russell is Executive Vice President, Chief Legal Officer of TransUnion. Ms. Russell is an accomplished legal executive with more than 25 years of diverse experience across the global financial services and technology sectors. She is

42

responsible for legal, risk, compliance, government and regulatory relations, corporate governance, consumer privacy and ESG functions for TransUnion and its subsidiaries around the world. Prior to joining the Company in 2018, Ms. Russell was a partner at the law firm of Buckley, LLP, where she led the firm’s Financial Institutions Regulation, Supervision and FinTech practices. Previously, she served as Executive Vice President, Chief Legal Officer and Corporate Secretary at Fifth Third Bank. Prior to that, she served as Managing Director and Global Head of Public Policy and Regulatory Affairs at Bank of New York Mellon, and as Senior Vice President and Associate General Counsel at Bank of America. She also spent eight years at Skadden in Washington, D.C. and London focused on financial services, corporate finance, and mergers and acquisitions.

Ms. Russell earned her B.A. from the College of William & Mary and her J.D. with honors from American University’s Washington College of Law, where she received the Outstanding Graduate Award. Ms. Russell serves on the board of directors of the U.S. Chamber of Commerce, the world’s largest business organization, representing the interests of over three million businesses and organizations. She is also on the boards of Illinois Legal Aid Online and the Chicago Council on Global Affairs where she chairs the board’s Nominating and Governance Committee.

Todd C. Skinner has served as President, International since August 2021 and is responsible for leading TransUnion’s growth across international markets. Mr. Skinner has nearly 30 years of experience delivering information solutions at leading global companies. He joined TransUnion in 2014, previously serving as TransUnion’s Regional President of Canada, Latin American and Caribbean. Prior to joining TransUnion, Mr. Skinner was the President of First Canadian Title Default Solutions, a technology recovery business. Previously, he served as Chief Credit Officer and Chief Operations Officer for Retail Banking and Wealth Management at HSBC.He also served as President and Chief Executive Officer for HSBC Financial, an HSBC subsidiary that operated in consumer finance, private label credit card financing, MasterCard, wholesale mortgage lending, mortgage brokering and full spectrum auto finance.

Mr. Skinner earned his bachelor’s degree of commerce from St. Mary’s University and his M.B.A. from the Kellogg-Schulich Executive M.B.A. He serves as TransUnion’s representative on the Global Board of the U.S.-India Business Council (USIBC) and the board of directors for Trans Union de Mexico S.A., TransUnion International UK Ltd., TransUnion CIBIL Limited. He is also on the board of directors of Cliffside Capital.

Our executive officers are elected annually by our Board. There are no family relationships among any of the Company’s executive officers.

43

PART II

ITEM 5. MARKET FOR THE REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

Market Information

Our common stock has been listed on The New York Stock Exchange under the symbol “TRU” since June 25, 2015.

Holders of Record

As of January 31, 2024, we had 12 stockholders of record. We have a greater number of beneficial owners of our stock who own their shares through brokerage firms and other nominees.

Recent Sales of Unregistered Securities

None.

Issuer Purchases of Equity Securities

1.Represents shares that were repurchased from employees for withholding taxes for share-based awards pursuant to the Company’s equity compensation plans.

2.On February 13, 2017, our Board authorized the repurchase of up to $300.0 million of our common stock through February 13, 2020. Our Board removed the three-year time limitation on February 8, 2018. Prior to the fourth quarter of 2017, we had purchased approximately $133.5 million of common stock under the program and may purchase up to an additional $166.5 million. Additional repurchases may be made from time to time at management’s discretion at prices management considers to be attractive through open market purchases or through privately negotiated transactions, subject to availability. Open market purchases will be conducted in accordance with the limitations set forth in Rule 10b-18 of the Exchange Act and other applicable legal requirements. We have no obligation to repurchase additional shares, and the timing, actual number and value of the shares that are repurchased, if any, will be at the discretion of management and will depend on a number of factors, including market conditions, the cost of repurchasing shares, the availability of alternative investment opportunities, liquidity, and other factors deemed appropriate. Repurchases may be suspended, terminated or modified at any time for any reason. Any repurchased shares will have the status of treasury shares and may be used, if and when needed, for general corporate purposes.

Performance Graph

This performance graph shall not be deemed “soliciting material” or to be “filed” with the SEC for purposes of Section 18 of the Securities Exchange Act of 1934, as amended, or otherwise subject to the liabilities under that Section, and shall not be deemed to be incorporated by reference into any filing of TransUnion under the Securities Act of 1933, as amended, or the Exchange Act.

The following graph shows a comparison of cumulative total shareholder return for the Company’s common stock, the Russell 3000 and the Dow Jones U.S. Financials Index. The graph assumes that $100 was invested at market close on December 31, 2018, in each of the Company’s common stock, the Russell 3000 and the Dow Jones U.S. Financial Index. The cumulative total returns for the Russell 3000 and the Dow Jones U.S. Financial Index assume reinvestment of dividends. The stock price performance of the following graph is not necessarily indicative of future stock price performance.

44

ITEM 6. RESERVED

Reserved

45

ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

The following discussion and analysis of TransUnion’s financial condition and results of operations is provided as a supplement to, and should be read in conjunction with Part I, Item 1A, “Risk Factors,” and Part II, Item 8, “Financial Statements and Supplementary Information,” including TransUnion’s audited consolidated financial statements and the accompanying notes. In addition to historical data, this discussion contains forward-looking statements about our business, operations and financial performance based on current expectations that involve risks, uncertainties and assumptions. Our actual results may differ materially from those discussed in the forward-looking statements as a result of various factors, including but not limited to those discussed in “Cautionary Notice Regarding Forward-Looking Statements” and Part I, Item 1A, “Risk Factors.”

References in this discussion and analysis to the “Company,” “we,” “us,” and “our” refer to TransUnion and its direct and indirect subsidiaries, including TransUnion Intermediate Holdings, Inc.

Overview

TransUnion is a leading global information and insights company that makes trust possible between businesses and consumers, helping people around the world access opportunities that can lead to a higher quality of life. That trust is built on TransUnion’s ability to deliver safe, innovative solutions with credibility and consistency. We call this Information for Good.

Grounded in our heritage as a credit reporting agency, we have built robust and accurate databases of information for a large portion of the adult population in the markets we serve. We use our identity resolution methodology to link and match our expanding high-quality datasets. We use this enriched data and analytics, combined with our expertise, to continuously develop more insightful solutions for our customers, all while maintaining compliance with global laws and regulations. Because of our work, organizations can better understand consumers in order to make more informed decisions, and earn consumer trust through great, personalized experiences, and the proactive extension of the right opportunities, tools and offers. In turn, we believe consumers can be confident that their data identities will result in better offers and opportunities.

We provide solutions that enable businesses to manage and measure credit risk, market to new and existing customers, verify consumer identities, mitigate fraud, and effectively manage call center operations. Businesses embed our solutions into their process workflows to deliver critical insights and enable effective actions. Consumers use our solutions to view their credit profiles, access analytical tools that help them understand and manage their personal financial information, and take precautions against identity theft. We have deep domain expertise across a number of attractive industries, which we also refer to as verticals, including Financial Services and Emerging Verticals. Emerging Verticals consists of Technology, Commerce & Communications, Insurance, Media, Services and Collections, Tenant and Employment, and Public Sector. We have a global presence in over 30 countries and territories across North America, Latin America, Europe, Africa, India, and Asia Pacific.

Our addressable market includes the global data and analytics market, which continues to grow as companies around the world increasingly recognize the benefits of data and analytics-based decision making, and as consumers recognize the important role that their data identities play in their ability to procure goods and services. There are several underlying trends supporting this market growth, including the proliferation of data, advances in technology and analytics that enable data to be processed more quickly and efficiently to provide business insights, and growing demand for these business insights across industries and geographies. Leveraging our established position as a leading provider of information and insights, we have grown our business by expanding the breadth and depth of our data, strengthening our analytics capabilities, expanding into complementary adjacent and vertical markets, deepening our solution suite in fraud mitigation and marketing, building out our geographic portfolio, investing in technology infrastructure, and enhancing our global operating model. As a result, we believe we are well positioned to expand our share within the markets we currently serve and capitalize on the larger data and analytics opportunity.

Segments

We manage our business and report our financial results in three reportable segments: U.S. Markets, International and Consumer Interactive. See Part II, Item 8 “Financial Statements and Supplementary Data - Notes to Consolidated Financial Statement,” Note 21, “Reportable Segments” for additional information.

U.S. Markets

Our U.S. Markets segment provides consumer reports, actionable insights and analytics to businesses. These businesses use our services to engage and acquire customers, assess consumer ability to pay for services, identify cross-selling opportunities, measure and manage debt portfolio risk, collect debt, verify consumer identities and mitigate fraud risk.

46

International

The International segment provides services similar to our U.S. Markets segment to businesses in select regions outside the United States. Depending on the maturity of the credit economy in each country, services may include credit reports, analytics and technology solutions services and other value-added risk management services. We also have insurance, business and automotive databases in select geographies. These services are offered to customers in a number of industries including financial services, retail credit, insurance, automotive, collections, public sector and communications, and are delivered through both direct and indirect channels. The International segment also provides consumer solutions similar to those offered by our Consumer Interactive segment to help consumers proactively manage their personal finances.

Consumer Interactive

The Consumer Interactive segment offers solutions that help consumers manage their personal finances and take precautions against identity theft. Services in this segment include credit reports and scores, credit monitoring, identity protection and resolution, and financial management for consumers. The segment also provides solutions that help businesses respond to data breach events. Our products are provided through user-friendly online and mobile interfaces and are supported by educational content and customer support. With our acquisition of Sontiq, we have added to our foundational credit monitoring solutions with a comprehensive set of identity protection offerings.

Corporate

Corporate provides support services for each of the segments, holds investments, and conducts enterprise functions. Certain costs incurred in Corporate that are not directly attributable to one or more of the segments remain in Corporate. These costs are typically enterprise-level costs and are primarily administrative in nature.

Factors Affecting Our Results of Operations

The following are certain key factors that affect, or have recently affected, our results of operations:

Macroeconomic and Industry Trends

Our revenues and results of operations have been and can be significantly influenced by general macroeconomic conditions, including but not limited to, interest rates, inflation, housing demand, the availability of credit and capital, employment levels, and consumer confidence.

During 2022, the labor market remained strong and supply chain constraints began to ease, while persistent inflation, rapidly increasing energy prices, and consecutive interest rate increases by the Federal Reserve all contributed to constrained economic activity. In addition, a slowing housing market, coupled with lower GDP growth, softening consumer confidence and global geopolitical events added to the deterioration of global macroeconomic conditions and increasing recession fears compared to the post-pandemic rebound of 2021.

During 2023, the U.S. labor market remained steady with low unemployment and rising real wages. However, subsiding but still elevated inflation, increasing housing costs, and continued interest rate increases by the Federal Reserve all contributed to constrained economic activity. In addition, liquidity challenges within the banking sector, a slowing housing market, and global geopolitical events all added to the deterioration of global macroeconomic conditions compared with the post-pandemic rebound of 2021 and early 2022. These slowing macroeconomic conditions had a more pronounced impact in our developed markets, including the U.K., compared with our emerging markets. The U.K. experienced persistently unfavorable and worsening macroeconomic conditions, including rising interest rates, subsiding but still elevated inflation, and a slowing labor market. In addition, the impact of exchange rates continued to have a significant impact on our International segment. In the U.S., the impact of higher interest rates has slowed demand for consumer loans and auto loans, and has been particularly acute in the housing sector, where higher borrowing rates significantly impact both home affordability, driving down purchase activity, and demand for mortgage loan refinancing. The impact of higher interest rates on slowing aggregate demand is expected to result in increased unemployment levels over the next year, which is likely to reduce consumer credit activity. These dynamics impact the comparability of our results of operations, including our revenue and expense, between the periods presented below.

The ongoing uncertainty and the unpredictable nature of the macroeconomic environment could have a material adverse impact on various aspects of our business in the future, including our stock price, results of operations and financial condition, including the carrying value of our long-lived assets such as goodwill and intangible assets.

Effects of Inflation

We believe that inflation has had and we expect will continue to have a negative impact on our business and results of operations, including decreased demand for our services resulting from the Federal Reserve and other central banks raising rates throughout 2023. While central banks have paused rate increases and current conditions indicate that they may begin to

47

cautiously lower rates from the higher interest rates established to combat inflation, rates that remain higher may result in slowing consumer spending on non-essential goods and services, and consequently lower demand for credit. The impact of elevated but subsiding levels of inflation and the resulting response by the Federal Reserve and other central banks to maintain higher but decreasing interest rates could have a material adverse impact on various aspects of our business in the future.

Recent Developments

The following developments impact the comparability of our balance sheets, results of operations and cash flows between years:

On November 12, 2023, our Board approved a transformation plan to optimize our operating model and continue to advance our technology. We expect to recognize one-time pre-tax expenses associated with this transformation plan of $355.0 to $375.0 million from the fourth quarter of 2023 through the end of 2025, with the majority of costs to be incurred by the end of 2024. All pre-tax expenses will be cash expenditures, other than approximately $15.0 to $20.0 million of non-cash, facility exit costs. In addition, we anticipate capital expenditures to increase to approximately 9% of revenue in 2024 and then return to approximately 8% of revenue for 2025 due to investment in our technology infrastructure in connection with this transformation plan. Upon completion of this program, we expect to generate annual savings of $120.0 to $140.0 million and reduce our capital expenditures from 8% of revenue to 6%, based on 2023 revenue. The following summarizes initiatives under the transformation plan.

•The operating model optimization program will reduce our global workforce, transition certain job responsibilities to our Global Capability Centers, which we expect will improve productivity, reduce costs and fund growth, optimize business processes, and reduce our facility footprint. We expect to incur total one-time pre-tax expenses of $205.0 to $215.0 million, including employee separation expenses of approximately $110.0 million, facility exit expenses of approximately $45.0 million, and business optimization expenses of approximately $55.0 million.

•The incremental investment to advance our technology is the final phase of our accelerated technology investment. We expect to incur one-time pre-tax expenses of $150.0 to $160.0 million, including approximately $65.0 million in 2024 related to the final year of Project Rise, and approximately $90.0 million of incremental expenses during 2024 and 2025 to streamline our product delivery platforms, and leverage the cloud-based infrastructure being established with Project Rise. The accelerated technology investment will fundamentally transform our technology infrastructure by implementing a global cloud-based approach to streamline product development, increase the efficiency of ongoing operations and maintenance, enable a continuous improvement approach, and provide a single global platform for fulfillment of our product lines. Project Rise was announced in February 2020 and expanded in February 2022, and is expected to be completed in 2024 with a total estimated expense of approximately $240.0 million, including the approximately $65.0 million to be incurred in 2024, as discussed above.

For the year ended December 31, 2023, we incurred total expenses associated with this effort of $77.6 million. comprised of restructuring expenses of $71.9 million for employee separation and $3.4 million for non-cash impairment charges associated with leased facilities, as well as $2.3 million of other business optimization expenses. Employee separation costs and non-cash impairment charges are included in Restructuring expenses in our Consolidated Statements of Operations. We have accrued liabilities for the payment of employee separation costs of $64.9 million as of December 31, 2023.

On October 27, 2023, we executed Amendment No. 21 to the Senior Secured Credit Facility, pursuant to which we: (1) refinanced our existing revolving credit facility with a new tranche of revolving credit commitments in an aggregate principal amount of $600.0 million (an increase of $300.0 million); and (2) entered into Senior Secured Term Loan A-4 with an aggregate principal amount of $1.3 billion, the proceeds of which were used to repay Senior Secured Term Loan A-3 in full, prepay $300.0 million of Senior Secured Term Loan B-6, and pay the related financing fees and expenses. We also extended the maturity date on our Senior Secured Revolving Credit Facility from December 10, 2024 to October 27, 2028. In connection with the refinancing, we expensed $5.9 million of the unamortized original issue discount, deferred financing fees, and other related fees to other income and expense in the Consolidated Statements of Operations for the year ended December 31, 2023. Additionally, we recorded incremental deferred financing fees of $4.8 million that will be amortized over the new loan term.

In October 2023, we agreed to settle two matters with federal regulators for a total of $23.0 million. On October 5, 2023, we reached a settlement in the form of a Consent Order with the CFPB and the FTC pursuant to which we agreed to pay $11.0 million in redress and $4.0 million in civil money penalties in connection with alleged violations under the FCRA related to our tenant and employment screening business. On October 10, 2023, we reached a settlement with the CFPB in the form of a Consent Order pursuant to which we agreed to pay $3.0 million in redress and $5.0 million in civil money penalties in connection with alleged violations of law in connection with the placement and lifting of security freezes resulting from certain system issues. See Part II, Item 8, “Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements,” Note 23, “Contingencies,” for further information about these matters.

48

During the third quarter of 2023, we identified a triggering event requiring an interim impairment assessment for our United Kingdom reporting unit, which resulted in a goodwill impairment of $414.0 million, as discussed in Part II, Item 8, “Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements,” Note 6, “Goodwill.”

In each of the first three quarters of 2023 we prepaid $75.0 million, and in the fourth quarter of 2023 we prepaid $25.0 million, for a total of $250.0 million in 2023, of our Senior Secured Term Loan B-6, funded from cash on hand. During the first quarter of 2022 we prepaid $400.0 million, and in the fourth quarter of 2022 we prepaid $200.0 million, for a total of $600.0 million in 2022, of our Senior Secured Term Loan B-6, funded from cash-on-hand. During 2021, we prepaid $85.0 million of Senior Secured Term Loan B-5, funded with cash on hand. These transactions affect the comparability of interest expense between years, as further discussed in “Results of Operations – Non-Operating Income and (Expense) – Interest Expense” below.

Since December 1, 2021, we have completed the acquisition of three businesses that collectively materially affected our results of operations in 2022 and 2023, and the comparability of results to 2021. See Part II, Item 8, “Financial Statements and Supplementary Data - Notes to the Consolidated Financial Statements,” Note 2, “Business Acquisitions” for further information about these transactions.

On December 30, 2022, we completed the previously announced sale of the non-core businesses of VF, the financial services business unit we acquired from Verisk Analytics, Inc. We classified the results of operations of these non-core businesses as discontinued operations, net of tax, in the Consolidated Statements of Operations since the acquisition in April 2022. Upon the sale, we received total proceeds of $173.9 million, consisting of $103.6 million in cash, and a note receivable with a face value of $72.0 million and a fair value of $70.3 million on the date of sale. We finalized the purchase price in the third quarter of 2023 and recorded a $0.5 million reduction of the gain on sale included in discontinued operations, net of tax. For the year ended December 31, 2022, we recognized a $7.5 million gain on the sale of these businesses, which is included in discontinued operations, net of tax.

On November 16, 2022, we entered into interest rate swap agreements with various counterparties that effectively fix our variable interest rate exposure on a portion of our Senior Secured Term Loan or similar replacement debt. These swaps replaced other swaps that expired on December 30, 2022. The new swaps commenced on December 30, 2022, and expire on December 31, 2024, with a current aggregate notional amount of $1,300.0 million that amortizes each quarter. The swaps require us to pay fixed rates varying between 4.3380% and 4.3870% in exchange for receiving a variable rate that matches the variable rate on our loans. We have designated these swap agreements as cash flow hedges.

On April 12, 2022, after failed settlement negotiations with the CFPB regarding a certain regulatory matter, the CFPB filed a lawsuit against us, Trans Union LLC, TransUnion Interactive, Inc. and our former President of Consumer Interactive. During 2022, we recorded an incremental $29.5 million of expense related to this matter. As of December 31, 2023 and 2022, we have an accrued liability of $56.0 million in connection with this matter and there is a reasonable possibility that a loss in excess of the amount accrued may be incurred, and such an outcome could have a material adverse effect on our results of operations and financial condition. However, any possible loss or range of loss in excess of the amount accrued is not reasonably estimable at this time. In addition, we will incur increased costs litigating this matter. See Part II, Item 8, “Financial Statements and Supplementary Data - Notes to the Consolidated Financial Statements,” Note 23, “Contingencies,” for further information about this matter.

On January 24, 2022, we reached a tentative class settlement with the plaintiffs in Ramirez v. TransUnion LLC, which required court approval. Accordingly, we revised the amount of the probable loss that we previously estimated, resulting in a reduction of our estimated liability and partially offsetting insurance receivable, and a corresponding net reduction recorded in selling, general and administrative expense for the year-end December 31, 2021. On December 19, 2022, the court entered final approval of the class settlement and we paid the settlement amount to the plaintiffs on January 20, 2023, resulting in a full resolution of this matter.

On December 23, 2021, we entered into a tranche of interest rate swap agreements with various counterparties that effectively fix our LIBOR exposure on a portion of our Senior Secured Term Loan or similar replacement debt. The tranche commenced on December 31, 2021, and expires on December 31, 2026, with a current aggregate notional amount of $1,568.0 million that amortizes each quarter. The tranche requires us to pay fixed rates varying between 1.3800% and 1.3915% in exchange for receiving a variable rate that matches the variable rate on our loans. We have designated these swap agreements as cash flow hedges.

On December 17, 2021, we completed the sale of our Healthcare business. The Healthcare business met the criteria for discontinued operations at December 31, 2021, as the sale represented a strategic shift in our business that will have a major effect on our results of operations. The results of operations are classified as discontinued operations, net of tax, in our Consolidated Statements of Operations for all periods presented. Discontinued operations, net of tax, also includes a gain on the divestiture of the Healthcare business of $982.5 million, net of tax, in the Consolidated Statements of Operations for 2021. All tables and discussions below exclude the impact of the Healthcare business.

49

On December 1, 2021, we entered into an agreement to amend certain provisions of the Senior Secured Credit Facility and exercise our right to draw additional debt in an amount of $3,100.0 million, less original issue discount and deferred financing fees of $7.8 million and $43.6 million, respectively. Proceeds from the incremental loan on the Senior Secured Credit Facility were used to finance the acquisition of Neustar.

On December 1, 2021, we entered into a Second Lien Credit Agreement to obtain term loans in an aggregate amount of $640.0 million (the “Second Lien Term Loan”), less original issue discount and deferred financing fees of $3.2 million and $14.3 million, respectively, used to fund the acquisition of Sontiq. On December 23, 2021, we fully repaid the Second Lien Term Loan using a portion of the proceeds from our sale of the Healthcare business. As a result of the prepayment, we expensed the unamortized original issue discount and deferred fees to other income and expense in the Consolidated Statements of Operations.

Recent Acquisitions

We selectively evaluate acquisitions as a means to expand our business and to enter new markets. Since January 1, 2021, we have completed the following acquisitions, including those that impact the comparability of our results between periods:

•On April 8, 2022, we acquired 100% of the equity of the entities that comprised VF. We retained the core businesses of Argus, and divested the remaining non-core businesses on December 30, 2022. Argus provides financial institutions, payments providers, and retailers worldwide with competitive studies, predictive analytics, models, and advisory services. The results of operations of Argus are included in the U.S. Markets segment in our Consolidated Statements of Operations since the date of the acquisition. See Part II, Item 8, “Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements,” Note 2, “Business Acquisitions” and Note 3 “Discontinued Operations,” for additional information.

•On December 1, 2021, we acquired 100% of the equity of Neustar. Neustar, a premier identity resolution company with leading solutions in Marketing, Risk and Communications, enables customers to build connected consumer experiences by combining decision analytics with real-time identity resolution services driven by its OneID platform. The results of operations of Neustar are included in Financial Services and Emerging Verticals as part of our U.S. Markets segment in our Consolidated Statements of Operations since the date of the acquisition. See Item 8, “Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements,” Note 2, “Business Acquisitions.”