TRU US Equity☆

tru-20251231

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

For the fiscal year ended December 31, 2025

- OR -

For the transition period from to

Commission File Number 001-37470

TransUnion

(Exact name of registrant as specified in its charter)

(Address of principal executive offices) (Zip Code)

312-985-2000

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Title of each class Trading Symbol(s) Name of each exchange on which registered

Common Stock, par value $0.01 per share TRU New York Stock Exchange

Securities registered pursuant to Section 12(g) of the Act:

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

☒ Yes ☐ No

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.

☐ Yes ☒ No

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.

☒ Yes ☐ No

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).

☒ Yes ☐ No

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer”, “accelerated filer”, “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

☒ Large accelerated filer ☐ Accelerated filer

☐ Non-accelerated filer ☐ Smaller reporting company

☐ Emerging growth company

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act.

☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report.

☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements.

☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b).

☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act).

☐ Yes ☒ No

The aggregate market value of the voting and non-voting common equity held by non-affiliates of the registrant was approximately $17.1 billion as of June 30, 2025 (based on the closing stock price of such stock as quoted on the New York Stock Exchange).

As of January 30, 2026, there were192.6 million shares of TransUnion common stock outstanding, par value $0.01 per share.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the Proxy Statement of TransUnion for the Annual Meeting of Stockholders to be held May 12, 2026 are incorporated by reference to the extent specified in Part III of this Form 10-K.

TRANSUNION

ANNUAL REPORT ON FORM 10-K

YEAR ENDED DECEMBER 31, 2025

TABLE OF CONTENTS

PART I 1

ITEM 1. BUSINESS 1

ITEM 1A. RISK FACTORS 20

ITEM 1B. UNRESOLVED STAFF COMMENTS 38

ITEM 1C. CYBERSECURITY 38

ITEM 2. PROPERTIES 39

ITEM 3. LEGAL PROCEEDINGS 39

ITEM 4. MINE SAFETY DISCLOSURES 39

INFORMATION ABOUT OUR EXECUTIVE OFFICERS 40

ITEM 6. RESERVED 44

ITEM 7A. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK 74

ITEM 8. FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA 75

Consolidated Balance Sheets 78

Consolidated Statements of Operations 79

Consolidated Statements of Comprehensive Income (Loss) 80

Consolidated Statements of Cash Flows 81

Consolidated Statements of Stockholders’ Equity 82

Notes to Consolidated Financial Statements 85

ITEM 9A. CONTROLS AND PROCEDURES 117

ITEM 9B. OTHER INFORMATION 118

ITEM 9C. DISCLOSURE REGARDING FOREIGN JURISDICTIONS THAT PREVENT INSPECTIONS 118

ITEM 10. DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE 119

ITEM 11. EXECUTIVE COMPENSATION 119

ITEM 14. PRINCIPAL ACCOUNTING FEES AND SERVICES 120

ITEM 15. EXHIBITS AND FINANCIAL STATEMENT SCHEDULES 121

Cautionary Notice Regarding Forward-Looking Statements

This Annual Report on Form 10-K, including the exhibits hereto, contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. These statements are based on the current beliefs and expectations of TransUnion’s management and are subject to significant risks and uncertainties. Actual results may differ materially from those described in the forward-looking statements. Any statements made in this report that are not statements of historical fact, including statements about our beliefs, expectations and outlook, are forward-looking statements. Forward-looking statements include information concerning possible or assumed future results of operations, including descriptions of our business plans and strategies. These statements often include words such as “anticipate,” “expect,” “guidance,” “suggest,” “plan,” “believe,” “intend,” “estimate,” “target,” “project,” “should,” “could,” “would,” “may,” “will,” “forecast,” “outlook,” “potential,” “continues,” “seeks,” “predicts,” or the negatives of these words and other similar expressions.

Factors that could cause actual results to differ materially from those described in the forward-looking statements, or that could materially affect our financial results or such forward-looking statements include:

•macroeconomic effects and changes in market conditions, including the impact of tariffs, inflation, risk of recession, trade policy, and industry trends and adverse developments in the debt, consumer credit and financial services markets, including the impact on the carrying value of our assets in all of the markets where we operate;

•our ability to provide competitive services and prices;

•our ability to retain or renew existing agreements with large or long-term customers;

•our ability to maintain the security and integrity of our data;

•our ability to deliver services timely without interruption;

•uncertainty related to Fair Isaac Corporation’s (“FICO”) new Mortgage Direct License Program;

•our ability to maintain our access to data sources;

•government regulation and changes in the regulatory environment;

•litigation or regulatory proceedings;

•our approach to the use of artificial intelligence;

•our ability to effectively manage our costs;

•our ability to maintain effective internal control over financial reporting or disclosure controls and procedures;

•economic and political stability in the United States and risks associated with the international markets where we operate;

•our ability to effectively develop and maintain strategic alliances and joint ventures;

•our ability to timely develop new services and the market’s willingness to adopt our new services;

•our ability to manage and expand our operations and keep up with rapidly changing technologies;

•our ability to acquire businesses, successfully secure financing for our acquisitions, timely consummate our acquisitions, successfully integrate the operations of our acquisitions, control the costs of integrating our acquisitions and realize the intended benefits of such acquisitions;

•our ability to protect and enforce our intellectual property, trade secrets and other forms of unpatented intellectual property;

•our ability to defend our intellectual property from infringement claims by third parties;

•the ability of our outside service providers and key vendors to fulfill their obligations to us;

•further consolidation in our end-customer markets;

•the increased availability of free or inexpensive consumer information;

•losses against which we do not insure;

•our ability to make timely payments of principal and interest on our indebtedness;

•our ability to satisfy covenants in the agreements governing our indebtedness;

•our ability to maintain our liquidity;

•stock price volatility;

•share repurchase plans;

•dividend rate;

•our reliance on key management personnel; and

•changes in tax laws or adverse outcomes resulting from examination of our tax returns.

There may be other factors, many of which are beyond our control, that may cause our actual results to differ materially from the forward-looking statements, including factors disclosed under the sections entitled “Risk Factors” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in this report. You should evaluate all forward-looking statements made in this report in the context of these risks and uncertainties.

The forward-looking statements contained in this report speak only as of the date of this report. We undertake no obligation to publicly release the result of any revisions to these forward-looking statements to reflect the impact of events or circumstances that may arise after the date of this report.

Table of Contents

PART I

Unless the context indicates otherwise, any reference to the “Company,” “we,” “us” and “our” refers to TransUnion and its direct and indirect subsidiaries.

ITEM 1 BUSINESS

Overview

TransUnion is a leading global information and insights company that makes trust possible between businesses and consumers, helping people around the world access opportunities that can lead to a higher quality of life. That trust is built on TransUnion’s ability to deliver safe, innovative solutions with credibility and consistency. We call this Information for Good.

We have built robust data and analytics assets for a large portion of the adult population in the markets we serve. We use our OneTru solution enablement platform to centralize data management, identity resolution and Artificial Intelligence (“AI”) powered analytics, enabling more persistent identity resolution with sharper, more contextualized insights. We use these insights, combined with our industry expertise, to develop relevant solutions to solve customers’ needs, including credit risk, marketing and fraud mitigation. Because of our work, customers can better understand consumers in order to make more informed decisions, earn consumer trust through personalized experiences, and extend the appropriate opportunities, tools and offers. In turn, we believe consumers can be confident that their data identities will result in better offers and opportunities.

Our solutions enable businesses to manage and measure credit risk, market to new and existing customers, verify consumer identities, and mitigate fraud. We have deep domain expertise across a number of attractive industries, which we also refer to as verticals, including our Financial Services and Emerging Verticals, which includes Insurance, Technology, Retail and E-Commerce, Telecommunications, Media, Tenant & Employment Screening, Collections and Public Sector. In addition, consumers use our solutions to view their credit profiles, access analytical tools that help them understand and manage their personal financial information, and take precautions against identity theft. We have a global presence in over 30 countries and territories across North America, Latin America, Europe, Africa, India and Asia Pacific.

Our addressable market includes the global data and analytics market, which continues to grow as companies increasingly recognize the benefits of data and analytics-based decision making, and as consumers recognize the important role that their data identities play in their ability to procure goods and services and prevent fraud. There are several underlying trends supporting this market growth, including the proliferation of data, advances in technology such as AI that enable data to be processed more quickly and efficiently to provide business insights, and growing demand for these business insights across industries and geographies. We have grown our business by expanding the breadth and depth of our data, strengthening our analytics capabilities, expanding into complementary vertical markets, deepening our solution suites in areas such as fraud mitigation and marketing, building out our geographic portfolio, investing in technology infrastructure, and enhancing our global operating model. As a result, we believe we are well positioned to expand our share within the markets we currently serve.

Our solutions are based on a foundation of data assets, including financial, credit, fraud, alternative credit, identity, phone activity, digital device information, marketing, bankruptcy, lien, judgment, insurance claims, automotive and other relevant information obtained from thousands of sources including financial institutions, private databases and public records repositories. We refine, standardize and enhance this data using sophisticated algorithms to create proprietary databases. We are migrating these databases into the OneTru solutions enablement platform, which allows us to efficiently manage data collection, identity resolution, model development, decisioning, delivery and measurement to provide better insights to customers. OneTru is being used by a number of customers across credit, fraud and marketing solutions for identity resolution and is accelerating the pace of innovation.

We leverage our differentiated capabilities to serve a global customer base across multiple geographies and industry verticals. We offer our solutions to business customers across industries, and our customer base includes many of the largest companies in the industries we serve. We sell our solutions to leading consumer lending banks, credit card issuers, alternative lenders, online-only lenders (“FinTechs”), Point of Sale (“POS”)/Buy Now Pay Later (“BNPL”) lenders, auto lenders, auto insurance carriers, cable and telecom operators, retailers, media companies, and federal, state and local government agencies. We have also built a leading presence in several high-growth international markets. Millions of consumers across the globe use our data and tools to manage their personal finances and take precautions against identity theft.

We believe we have an attractive business model that has recurring and diversified revenue streams, low capital requirements, significant operating leverage and strong and stable cash flows. The proprietary and embedded nature of our solutions and the integral role that we play in our customers’ decision-making processes have historically translated into high customer retention and revenue visibility. We deliver organic growth by growing our transactional volume, increasing our sales to existing customers, developing new solutions and gaining new customers. We have a diversified portfolio across the markets we serve, reducing our exposure to cyclical trends in any particular vertical, product or geography. We operate primarily on contributory data models in which we typically obtain updated information at little or no cost.

1

Table of Contents

Our Evolution

We have established a track record of providing innovative solutions to businesses and consumers. Since our founding in 1968 as a provider of regional credit reporting services, we have built a comprehensive and unique database of United States (“U.S.”) consumer information. We also strengthened our data, analytics and technology delivery capabilities and acquired complementary businesses to enhance our solutions. Leveraging our strengths in credit risk-oriented products and identity data, we also expanded our solution sets into adjacent solutions such as fraud mitigation and marketing.

Globally, we have built and acquired credit reporting agencies in new geographies, establishing strong international footholds across both emerging and mature markets while expanding the verticals we serve and solutions offered in these markets. We also expanded the reach of our consumer solutions both directly and by partnering with other market leaders and innovators.

As part of our continued evolution, we invested in several strategic initiatives to better serve our customers. These initiatives include:

•Growing our Data: We continue to invest in the breadth and depth of our data. We introduced the concept of trended data to provide the trajectory of a consumer’s risk profile, used public records data to enhance the scope of business issues we can address, incorporated alternative data into our databases to allow for a more comprehensive risk assessment of banked and unbanked consumers, and expanded our data assets to solve fraud mitigation and marketing use cases. We continue to improve the quality of our data, with a particular focus on foundational identity data, to provide deeper insights and create differentiated solutions for our customers.

•Expanding into New Verticals and Geographic Markets: We established and grew our presence in diversified verticals, including Insurance, Technology, Retail and E-Commerce, Telecommunications, Media, Tenant & Employment Screening, Collections and Public Sector. We expanded the reach of our consumer offerings by partnering with traditional and emerging providers, as well as adding identity protection and breach remediation offerings. We also diversified geographically by establishing a presence in attractive high-growth markets such as the Philippines and India, as well as investing in strategically important markets such as the United Kingdom (“U.K.”), Canada and our previously announced agreement to acquire majority ownership of Trans Union de Mexico, S.A., S.I.C. (“Trans Union de Mexico”), the consumer credit business of Mexico's largest credit bureau, Buró de Crédito, which we expect to close in the first quarter of 2026.

•Broadening our Suites of Solutions: Building on our foundation in the credit space, we continue to expand our presence in adjacent solution areas, including fraud and marketing, by leveraging our differentiated data assets, AI capabilities, and modular platform architecture. Our solutions are increasingly developed globally and deployed locally, allowing for scalable innovation and faster time-to-market. We continue to rationalize our portfolio and invest in new products and enhancements aligned with customer needs.

•Strengthening our Analytics and Identity Resolution Capabilities: We strengthened our analytics capabilities by leveraging modern technology and differentiated data assets, utilizing more advanced tools and expanding our analytics team to deliver AI-powered insights. Our strengthened analytics capabilities also shortened our time-to-market to create and deliver these solutions to our customers. We also have comprehensive identity data assets across traditional offline identity and emerging digital identity attributes, core competency in identity data acquisition, AI and Machine Learning (“ML”) based entity resolution and attribute linking, and leading expertise in identity services, especially identity matching. Over the last two years we have brought significant enrichment to our identity data assets, mostly focused on digital attributes, optimization of our entity resolution, expansion of identity attributes and standardization of services on our OneTru platform.

•Investing in our Technology: Technology is at the core of the solutions we provide to our customers. We continue to make significant investments to evolve our technology infrastructure by leveraging both internal and external resources. Our technology modernization transforms our technology infrastructure by implementing a global cloud-based approach to streamline product development, increase the efficiency of ongoing operations and maintenance, and enable a continuous improvement approach. We also leverage the latest data and analytics technologies, enabling us to improve speed and increase our operational efficiency. Our investments allow us to organize and handle high volumes of disparate data, improve delivery speeds, provide better availability, strengthen product development capabilities and continuously enhance our information security measures.

•Enhancing our Global Operating Model: We continue to strengthen our global operating model to enable scalable growth and accelerate innovation. In 2025, our Global Solutions Organization introduced cross-functional leadership teams aligned with a refreshed global product development lifecycle, streamlining decision-making, empowering teams, and fostering stronger partnership across the organization. Our go-to-market approach now incorporates specialized sellers and refreshed multi-year planning processes to improve sales effectiveness. At the same time, our Global Technology, Data & Analytics Organization is advancing our platform modernization, with solutions

2

Table of Contents

increasingly built on OneTru and deployed globally. These initiatives are complemented by targeted hiring of industry experts to foster vertical-specific innovation and by a tiered global sales structure designed to deepen engagement across strategic accounts, mid-market, and small and medium sized businesses.

As part of our global operating model, we established our award-winning Global Capability Centers (“GCCs”) in 2018 to centralize, standardize and automate common work in locations with deep talent pools, which currently include India, South Africa and Costa Rica. At the end of 2025, we completed the transformation plan to optimize our operating model that our Board of Directors (“Board”) approved in November 2023. As a part of our transformation plan, we transitioned additional job responsibilities to the GCCs, resulting in productivity improvements, cost reductions, and optimized business processes. Our GCCs represent approximately 42% of our global workforce supporting a wide range of functions.

We believe that our ongoing focus on evolving with the market and with our customers’ needs ensures continued improvement in our overall services to businesses and consumers. Leveraging our trusted brand, global scale and strong market position in the verticals we serve will allow us to capitalize on business opportunities worldwide and contribute to our long-term growth.

Our Market Opportunity

We believe we are well-positioned to capitalize on the long-term trend of businesses and consumers using data and analytics to make more informed decisions. As worldwide spending on data and analytics increases, we believe there are several trends that will create increasing demand for our solutions:

•Rapid Growth in Data Creation and Application: Larger and more diversified data assets are now assembled faster while the breadth of analytical applications and solutions has expanded. Companies are increasingly relying on business analytics and data technologies to help process this data in a cost-efficient manner.

•Proliferation of Digital Commerce: Increases in online commerce activity are creating new challenges and opportunities for businesses and consumers. Businesses seek data, analytics and insights to improve targeting precision and identity verification in these digital environments, in order to enable better consumer experiences. Additionally, consumers are seeking more frictionless digital experiences, while also facing heightened risk of identity theft.

•Advances in Technology and Analytics Unlocking the Value of Data: Ongoing advances in data collection, storage and analytics technology, along with ongoing advancements in AI and ML, have contributed to the greater use and value of data and analytics in decision making. Businesses increasingly expect access to real-time data and analytics as well as solutions that fully integrate into their workflows. We believe sophisticated technology is critical for gaining and retaining business in the risk and information services industry.

•Leveraging AI to Enhance Solutions and Drive Productivity: Advancements in AI over the last three years, particularly in generative AI, agentic systems, and knowledge graphs, have created significant opportunities for businesses in the data and analytics sector. With OneTru, we are positioned to take advantage of these advancements in AI. We have started leveraging AI for product innovation, including our TruIQ suite of products and knowledge graphs underpinning our fraud and marketing solutions. We are also integrating agentic AI capabilities in TruIQ to automate the end-to-end data and analytics value chain. In addition, we have built and started using proprietary AI tools such as OneTru AI Assist to drive productivity across the software development lifecycle.

•Greater Adoption of Data Solutions Across New and Existing Industry Verticals: We believe companies across industry verticals recognize the value of tailored risk information and analytical tools.

▪Financial Services: There is strong competition in the financial services space, with traditional financial services companies and consumer lenders competing against an increasing number of FinTechs and POS/BNPL lenders. FinTechs and POS/BNPL lenders provide access to credit in a fast and efficient manner by utilizing sophisticated risk assessment tools that leverage data, such as behavioral data, transactional data and employment and credit information. Traditional lenders are also increasing their use of these new solutions to grow their businesses, lower operating costs and better serve customers while addressing regulatory requirements.

▪Insurance: Consumers increasingly obtain quotes from multiple insurers in an effort to lower their costs. In response, insurers are seeking to improve the accuracy of their risk assessments and initial quotes. For example, insurance carriers use driver violation data to uncover offenses that will impact pricing earlier in the quoting process.

▪Other Emerging Verticals: In the Technology, Retail and E-Commerce, and Telecommunications verticals we offer data-driven solutions that address the entire customer lifecycle. In the Media vertical, our highly accurate consumer data helps companies improve their marketing investments, providing identity and audience solutions to help our customers reach the right consumers across digital channels. Our Tenant &

3

Table of Contents

Employment Screening vertical provides data and insights to make informed hiring and rental decisions. In the Collections vertical, our solutions improve third-party collectors’ bottom line and help provide a quality customer experience by delivering actionable consumer insights and services. Our suite of solutions in the Public Sector vertical gives government agencies the superior data assets, analytics and security they need to manage compliance and boost services for the constituents they serve.

•Increasing Lending Activity in Emerging International Markets: Credit penetration, as measured by the proportion of credit active adults, is relatively low in emerging markets, such as India. As emerging market economies develop and mature, we expect favorable socio-economic trends, such as a growing middle class and a significant increase in the use of financial services by previously under-banked consumers. We expect the populations in emerging markets to continue to become more credit active, resulting in increased demand for our services.

•Increased Management and Monitoring of Personal Financial Information and Identity Protection by Consumers: We expect demand for consumer solutions to rise with the increasing availability of real-time, free credit information as well as greater consumer awareness of the importance of understanding and monitoring their credit information and protecting their identity. We believe these trends will drive growth for our consumer business.

Our Competitive Strengths

Comprehensive and Unique Data Assets

Our long operating history and thought leadership in the industry have allowed us to build comprehensive and unique data assets that would be difficult for a new market entrant to replicate. Our solutions are based on a foundation of financial, credit, alternative credit, fraud, marketing, identity, bankruptcy, lien, judgment, automotive and other relevant information obtained from thousands of sources including financial institutions, private databases, public records repositories and other alternative data sources. We refine, standardize and enhance this data using sophisticated algorithms to create proprietary databases. We are constantly updating our data to keep it current, and we continue to identify opportunities to acquire additional data. We believe that our data is unique and differentiates us from our competitors. We own several proprietary data assets such as consumer credit information, driver violation history, phone activity, digital device identifiers, business data and rental payment history. Our global data assets encompass alternative data, such as the voter registry in India, a vehicle information database in South Africa and a mobile device database. We believe we are the largest provider of scale in the United States to possess both nationwide consumer credit data and comprehensive, diverse public records data, which allows us to better predict behaviors, assess risk and address a broader set of business issues for our customers.

Innovative and Differentiated Solutions

We consistently focus on innovation to develop new and enhanced solutions that meet the evolving needs of our customers. We believe our specialized data, analytics, and solutions, our collaborative approach with our customers, and our ability to serve the needs of different buyers across nearly all industries differentiates us from our competitors. Our solutions are often scalable across different customers, geographies and verticals. Several examples of our innovative and differentiated solutions include:

•TruVision: Risk management products that more precisely balance risk and opportunity to identify and manage customer risk across the account lifecycle. This solution line includes all TransUnion risk products, including those formerly known as CreditVision, CVLink and DriverRisk. This line also includes insurance risk products, risk products for tenant and employment, and more. We continue to enhance our credit data by including new data fields, enriching values in existing data fields and expanding account history. Our enhanced credit data has been combined with hundreds of algorithms to produce TruVision Trended and TruVision Blended, the market-leading trended data and alternative data solutions that provide greater granularity and evaluate consumer behavior patterns over time. This results in a more predictive view of the consumer, increases the total population of consumers who can effectively be scored, and helps consumers gain improved access to services and better pricing. We have also completed development of POS and BNPL credit reporting solutions, delivering reporting capabilities and operational guidance, expanding attributes for future adoption, and continuing collaboration with regulators and industry partners to drive standards and innovation. We continue to focus on driving TruVision penetration globally with a distinct opportunity for growth internationally.

•TruIQ: Advanced analytics products provide custom insights to help our customers make better data-driven decisions faster through consulting services and technology solutions. This solution line includes products formerly known as Prama and Innovation Lab, as well as other custom analytic services. Notable products include:

◦TruIQ Data Enrichment (“TDE”): proprietary linking application to connect businesses’ first- and third-party data with TransUnion credit data within the customer’s preferred environment

◦TruIQ Analytics Studio: provides self-service access to TransUnion’s depersonalized archive credit data for portfolio valuation and risk management

4

Table of Contents

•TruValidate: Identity and fraud products that help secure trust across channels and deliver seamless experiences for consumers. TruValidate Integrated Solutions combines our fraud solutions including ML/AI models and delivery via a single application program interface (“API”), all built on a modernized tech stack. Notable products include:

◦TruValidate Device Risk: identifies suspicious consumer transactions and accelerates legitimate transactions through powerful device recognition technology

◦TruValidate IP Intelligence: validates the origin and legitimacy of web traffic to support geo-compliance and fraud prevention

◦TruValidate Credit Washing: helps financial institutions detect and prevent credit washing by identifying relevant patterns of credit report changes using proprietary data and advanced analytics

•TruAudience: Marketing products that power the next generation of privacy focused identity data enrichment, omnichannel audience targeting, and advanced analytics to transform marketing and media performance. Notable products include:

◦TruAudience Identity: enables identity resolution across devices and environments for more precise targeting and measurement

◦TruAudience Data Marketplace: provides access to over 130,000 audience segments for scalable, cross-channel activation

◦TruAudience Marketing Mix Modeling and Multi-Touch Attribution: marketing measurement and media attribution solutions that provide advertisers with insights to optimize campaign performance and allocate spend effectively across channels

•TruEmpower: Credit and identity products that help organizations provide their customers with tools, education and actionable insights so they can understand, protect and take control of their financial health and digital identities. This solution line includes all products from our TU Indirect business, including what was formerly known as CreditView Dashboard.

•TransUnion Credit Essentials: Our new direct-to-consumer product, offered in both free and paid tiers. The free tier provides consumers with access to a daily TransUnion credit report and score, credit monitoring, score insights, and personalized financial offers. The paid tier includes additional features such as quarterly three-bureau credit reports and scores, enhanced monitoring and alerts, and identity protection services.

•TruLookup: Investigative products that deliver actionable information to help organizations conduct faster due diligence or issue resolution. This solution line includes TLOxp® as a platform for delivery.

•TruContact: Communications and contact center products that help restore trust in communications, enhance customer outreach with authoritative identity and streamline delivery of telecom connectivity services. Trusted Call Solutions, our flagship product suite, enables customers to transform the call experience to improve engagement, ensure legitimate calls get through and protect customers against fraud by enabling enterprises to manage their brand identity and business information displayed to consumers.

Technology Infrastructure

We continue to evolve our infrastructure and our capabilities to efficiently meet the needs of our customers and have expanded and evolved our enterprise approach to technology and have made strides in shifting our infrastructure to a hybrid, multi-cloud environment. Our technology infrastructure allows us to continually improve our overall services to global businesses and consumers, while also increasing throughput, improving data matching, creating efficiencies, enhancing information security and lowering operating costs. Our technology gives us the ability to process, organize and analyze high volumes of data across multiple operating systems, databases and file types as well as to deal with both structured and unstructured data that changes frequently. We process billions of transactions on a daily basis. Because our data matching technology is able to interrelate data across disparate sources, industries and time periods, we believe that we are able to create differentiated data assets and provide our customers with comprehensive insights that allow them to better evaluate risk.

In February 2020, we announced Project Rise, a multi-phase initiative to fundamentally transform our technology infrastructure by implementing a global cloud-based approach. In November 2023, we announced our plans to leverage Neustar’s technology to standardize and streamline our product delivery platforms and build a single global platform for fulfillment of our product lines.

OneDev - Hybrid Public-Private Multi Cloud Infrastructure

Using the foundations of Neustar’s OneID platform, and cloud infrastructure from both Neustar and Project Rise, this architecture has consolidated platforms acquired through past business acquisitions to unlock additional value from these assets.

5

Table of Contents

We are also reducing the number of applications that we built over the last decade of expansion and acquisitions, allowing for an enhanced security posture to meet all of our regulatory demands. By creating a single infrastructure operating system across on-premise private cloud and public cloud providers, we have created a single control plane that allows us to optimize our data center posture. This will allow us to drive operational efficiency through services rationalization to provide a consistent and standardized set of global services and capabilities across our technology landscape, creating capacity for product innovation. OneDev is our infrastructure layer beneath our solutions enablement platform, OneTru, ensuring technology is delivered securely and efficiently across complex environments. It delivers an improved developer experience through a unified operational control plane and self-service in the public and private clouds, and provides a greater foundation for teams to manage their operational, security and financial risks.

OneTru - Solutions Enablement Platform

OneTru, our solutions enablement platform, enables us to efficiently activate our assets and unlock value in a single, multilayered ecosystem. OneTru helps TransUnion create a unified approach that makes rapid innovation possible by enabling three key outcomes:

•Concentration of our expertise, allowing us to accelerate product development and deployment;

•Improvement of scale and reusability by better utilizing our configurable computing power and eliminating data exchange across platforms; and

•Increased efficiencies and reduction of total cost by bringing together disparate data and product platforms.

It also allows us to deliver a more accurate picture of consumers faster than ever before. That means more accurate identity resolution, complete and contextualized insights, and compliant use of data, all delivered through our portfolio of business and consumer products via a single implementation.

OneTru has become our centralized innovation hub. The platform standardizes key steps in transforming raw data into actionable intelligence, allowing our product specialists to focus on the last mile of customization needed to build innovative new products.

Key processes that OneTru is standardizing:

•At the data management layer, OneTru integrates our data assets in credit risk, marketing and fraud prevention into a unified environment. We embed compliance controls to separate our credit and non-credit data, with strong permissioning, providing data scientists with rapid access to our stores of proprietary and public data.

•At the identity layer, our identity graphs link and match our offline and online data together for a consistent view of consumer identity, helping customers to reliably resolve identities across product lines and workflows. By participating in client workflow, we also receive a consistent feedback loop to strengthen our identity signal.

•At the analytics layer, we are utilizing common, next generation analytic tools both internally and to solve specific customer challenges. As new capabilities emerge – including evolving tools like AI – OneTru will allow us to deploy those capabilities rapidly and at scale.

•Finally, at the delivery layer, we are emphasizing consistent and more seamless delivery to our customers, providing easier upgrade, cross-sell and upsell cycles.

OneTru powers several of our solutions, including our integrated identity graphs, innovation labs and internal analytics environments, and new products like TruIQ Advanced Acquisition, TDE and TruValidate Integrated Solutions. We have made significant progress down a two-year path to migrate, refine and scale the platform. Over the course of 2024, we also modernized FactorTrust, our short-term lending credit bureau, to OneTru. The FactorTrust modernization serves as an end-to-end example of how OneTru can bolster our credit bureau capabilities across batch, online and analytics. In 2025, we substantially completed building the internal capabilities required to modernize our U.S. credit business and started migrating our first customers to OneTru, enabling our clients to experience faster processing and streamlined access to newer innovations, such as our TruIQ analytics suite. In 2026, we intend to complete the U.S credit business migration and start delivering OneTru capabilities in International markets.

We will continue to refine and evolve OneTru capabilities in 2026 and beyond with embedded AI, real-time processing, integrated decisioning and modular-based configurable components across the data analytics life cycle to provide scalability and flexible deployment options for our customers.

Deep and Specialized Industry Expertise

We have deep expertise in a number of attractive industry verticals including Financial Services and Insurance. Our expertise has allowed us to develop sophisticated solutions that play an integral role in our customers’ decision-making processes and are often embedded into their workflows. Our team includes industry experts with significant experience in the verticals that we target and relationships with leading companies in those verticals. We also have regulatory compliance expertise across the

6

Table of Contents

industries that we serve. Together, this expertise provides us with a comprehensive understanding of business trends and insights for customers in these verticals, allowing us to build solutions that cater to these customers’ specific requirements. We have been able to apply our industry knowledge, data assets, technology and analytics capabilities to develop new solutions and revenue opportunities within key verticals. For example, in Financial Services, our differentiated position allowed us to anticipate the increased demand from alternative consumer lending providers, including the prevalence of POS/BNPL lending, to create solutions that cater to these emerging providers. In Insurance, we partnered with a vehicle history data provider to launch a vehicle history score that helps insurance carriers further segment risk based on the attributes of a specific automobile.

Leading Presence in Attractive International Markets

We have been operating internationally for over 30 years and have strong global brand recognition. Our strategic focus on attractive international markets spans both developed and emerging economies, resulting in a diversified global presence. We have a significant footprint in Canada, Latin America, the U.K., Africa, India and the Asia Pacific region. Our local senior management teams provide deep market insights and foster strong customer relationships. We have leveraged our brand, operating history, global footprint and technology infrastructure to establish new credit bureaus in several international markets, such as Canada in 1989, India in 2001 and the Philippines in 2011, and in 2024, we launched our credit bureau in Brazil. Once we establish a foothold in a region, our model involves expanding our service offerings within these markets and moving into adjacent emerging markets. For example, we have used our operations in Hong Kong to expand into other countries in the Asia Pacific region and to provide analytic scoring models in the Philippines, Singapore, Malaysia and Thailand. We have used our operations in South Africa to expand into neighboring African countries. We have also entered new markets through strategic acquisitions, including Brazil in 2011, Colombia in 2016, and the U.K. in 2018, and expect to expand our presence in Mexico following the consummation of our pending acquisition of a majority ownership interest in Trans Union de Mexico.

Proven and Experienced Management Team

Our senior management team has a proven track record of strong performance and significant expertise in the markets we serve, with decades of industry experience. We continue to attract and retain experienced management talent for our businesses. Our team has deep knowledge of the data and analytics sector and expertise across the various industries that we serve. Our team has overseen our expansion into new industries and geographies, while managing ongoing strategic initiatives including our significant technology investments and acquisition integrations. As a result of the sustained focus of our management team, we have been successful in consistently driving revenue and earnings growth, both organically and through acquiring and integrating businesses.

Our Growth Strategy

Enhance Underlying Data, Technology and Analytics Capabilities to Develop Innovative Solutions

As the demand for data and analytics solutions grows across industries and geographies, we will continue to expand the scope of our underlying data, including consumer identity, improve our tools and technology and enhance our analytics and technology solutions capabilities to provide innovative solutions that address this demand. With our insights and information, our customers can explore connections between people, businesses, assets and locations; identify assets, uncover inconsistencies and identify misrepresentations; and uncover evidence of financial distress.

With the unification of systems into OneTru, our solutions enablement platform, we continue to help our customers meet their challenges more quickly and efficiently. We are also continuing to explore the use of ML, AI and deep learning in our data and analytics strategies.

Our continuous technology investments have also reduced the time to market for new solutions, accelerating the pace of innovation and allowing us to react quickly to customer requirements. In addition, these investments have improved and, we believe, will continue to improve efficiency, reliability, security and performance. One of our innovative, quickly enabled customer solutions is TDE, discussed further above, which enables customers to securely leverage TransUnion’s data matching and identity linking technology in their own data infrastructure. TDE enables customers to compliantly link their sensitive first-party data to TransUnion’s depersonalized consumer credit data and any additional third-party data to support a wide range of analytics use cases. This can all be done without requiring the customer’s data to leave their environment, increasing speed to actionable insights in a privacy compliant manner.

7

Table of Contents

Further Penetrate Existing Industry Verticals with Current and New Solutions

We are a leading provider of risk and information solutions in several industry verticals today, including Financial Services and within our Emerging Verticals, which consist of Insurance, Technology, Retail and E-Commerce, Telecommunications, Media, Tenant & Employment Screening, Collections, and Public Sector. We believe there is significant opportunity for further growth within these industries by expanding the number of customers to whom we sell our current solutions and by creating innovative new solutions that we can use to grow our presence in these industries. We focus on developing new solutions that address evolving customer needs within our industry verticals. For example, we continue to combine related point solutions into end-to-end product suites to enable deeper penetration into customer workflows and improve retention. In order to effectively address these opportunities, we have redeployed and reallocated our sales resources to focus either on new customer opportunities or on selling additional services and solutions to existing customers. In addition, we continue to selectively increase our number of specialized sellers with deep industry expertise. With our leading market positions, existing strong relationships across our verticals and with our consumer partners, we believe we can further penetrate our existing customer base and capture a higher proportion of their spending across the consumer lifecycle.

Extend Into New, Adjacent Industry Verticals

In addition to increasing penetration in industries where we have a substantial presence, we continue to extend our solutions to address customer needs across a variety of attractive industries. We believe that our capabilities allow us to quickly create and deliver solutions across industries and geographies, thereby driving scalable growth based upon our foundational information and analytics. We continue to target other verticals where we see opportunities to leverage our existing capabilities, including those acquired and expanded through our recent acquisitions, as discussed below.

Extend Further Into Fraud, Marketing and Identity Solutions

From our heritage in the credit risk space, we have expanded into adjacent solution areas that can leverage our data assets and competencies, most notably fraud, marketing, and identity. These solutions have wide applicability across the customers that we serve. We have expanded these capabilities over the past several years through various acquisitions to build out our Media vertical and broaden the scope of our fraud and marketing solutions. Both fraud and marketing are critical to our expansion and diversification internationally and we have seen growth in fraud over the last few years in multiple markets.

Expand Our Presence in Attractive International Markets

We believe international markets present a significant opportunity for growth. We have significant scale in some of the world’s fastest growing markets, such as India and Latin America, which positions us to take advantage of the favorable dynamics in these regions as their populations become more credit active. We develop scalable solutions and then localize and deploy them to targeted markets to meet each market’s specific requirements. For example, after launching CreditVision in the U.S., we have expanded our offerings with similar solutions globally. In markets where we have established a presence, we are expanding further into adjacent verticals, such as Insurance and Consumer Interactive, as well as complementary solutions, such as marketing and fraud. We intend to continue to expand into new geographic markets by forming alliances with financial services institutions, industry associations and other local partners, and by pursuing strategic acquisitions. Across all our international expansion initiatives, we will continue to leverage our technology infrastructure to drive speed to market, scale and differentiation.

Broaden Our Reach in Consumer Market through Direct and Indirect Channels

Our consumer business focuses on helping consumers shape their financial future and protect their identity, delivering innovative solutions to consumers both directly and indirectly through a collaborative partnership model that has expanded the market for these services, along with greater consumer awareness of the value of their credit information and increased risk of identity theft. With our acquisition of Sontiq, we added to our foundational credit monitoring solutions with a comprehensive set of identity protection offerings. In 2025, we launched a new direct‐to‐consumer product with free and paid tiers designed to expand our presence in the consumer market and deliver more comprehensive services across a wider range of customer needs. Across both channels, our focus is on delivering value-added solutions and features while continuing to improve the consumer experience with more user-friendly interfaces and better customer service and educational tools. Within our indirect channel, we will continue to leverage and enhance our flexible technology platform to expand our relationships with existing partners and develop relationships with new partners and enter new verticals. We believe that partnerships not only enable us to grow our own business, but also expand the overall market and provide us access to new consumer segments. We will also continue to leverage our approach in the U.S. consumer market to further expand our consumer operations globally.

Pursue and Integrate Strategic Acquisitions

We have a strong track record of identifying and integrating our acquisitions and driving long-term value creation, and we will continue to maintain a disciplined approach to pursuing acquisitions.

On January 15, 2025, we signed a definitive agreement to acquire majority ownership of Trans Union de Mexico. We currently own approximately 26% of Trans Union de Mexico, and have agreed to acquire an additional 68% from selling shareholders,

8

Table of Contents

including several of the largest banks operating in Mexico. After the transaction closes, which we expect will be in the first quarter of 2026, we intend to leverage our global operating model to strengthen Trans Union de Mexico’s services in the Mexican market, including additional efforts to enhance technology, operations and information security. Mexico will also be added to our long-term roadmap to align our global technology under our OneTru solutions enablement platform.

On April 1, 2025, we exercised our call option to acquire the remaining 70% of the outstanding equity of Monevo Limited (“Monevo”). Our initial investment for 30% equity interest of Monevo was made in October 2021. Monevo is a credit prequalification and distribution platform that empowers lenders to deliver highly personalized credit offers to consumers via comparison websites and other third parties, predominantly in the U.K. and U.S. markets.

On December 31, 2025, we signed a definitive agreement to acquire the mobile division of RealNetworks LLC (“RealNetworks”). After the transaction closes, this acquisition is expected to augment our capabilities with advanced AI and ML technologies and real-time analytics of text, multi-media messages and phone calls.

Through our acquisitions, we have significantly broadened our geographic footprint, increased the breadth and depth of our data assets, enhanced our services and deepened our industry expertise in our key verticals.

In addition to our acquisitions, we have also made several strategic minority investments over the years, which typically are accompanied by commercial agreements that allow us to develop, expand, and deepen relationships with innovative companies with promising technologies and capabilities. At times, our strategic investments have resulted in us acquiring controlling financial interests that we consolidate, including our initial investment in TransUnion CIBIL Limited (“CIBIL”), which is the core of our India region operations, our 2025 acquisition of Monevo and our previously announced pending acquisition of a majority ownership interest in Trans Union de Mexico.

Segment Overview

We manage our business and report our financial results in two reportable segments: U.S. Markets and International. We also report expenses for Corporate, which provides shared services and conducts enterprise functions. See Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” Part II, Item 8 “Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements,” Note 1, “Significant Accounting Polices” and Note 18, “Reportable Segments,” for further information about our reportable segments.

U.S. Markets

Our U.S. Markets segment provides data, analytics and actionable insights to businesses and consumers. These businesses use our services to engage and acquire customers, assess consumer ability to pay for services, identify cross-selling opportunities, measure and manage debt portfolio risk, collect debt, verify consumer identities and mitigate fraud risk.

We deliver our solutions across multiple industry vertical markets and report disaggregated revenue as follows:

Financial Services: The Financial Services vertical consists of our Mortgage, Card and Banking, Consumer Lending, and Auto lines of business. Our Financial Services customers consist of most banks, credit unions, finance companies, auto lenders, mortgage lenders, FinTechs, and other consumer lenders in the United States. We also distribute our solutions through most major resellers, secondary market players and sales agents. Beyond traditional lenders, we work with a variety of credit arrangers, such as auto dealers and peer-to-peer lenders. We provide solutions across every aspect of the lending lifecycle; customer acquisition and engagement, fraud and ID management, retention and recovery. Our core products are focused on mitigating risk and include credit reporting, credit marketing, analytics and consulting, identity verification, and authentication and debt recovery solutions.

Emerging Verticals: Emerging Verticals include Insurance, Technology, Retail and E-Commerce, Telecommunications, Media, Tenant & Employment Screening, Collections, and Public Sector.Our solutions in these verticals are also data-driven and address the entire customer lifecycle. We offer onboarding and transaction processing products, scoring and analytic products, marketing solutions, fraud and identity management solutions and customer retention solutions, as well select market-specific solutions in Insurance and Telecommunications.

Consumer Interactive: The Consumer Interactive vertical provides solutions that help consumers manage their personal finances and take precautions against identity theft. Services include paid and free credit reports, scores and freezes, credit monitoring, identity protection and resolution, and financial management for consumers. The vertical also provides solutions that help businesses respond to data breach events. Our products are provided through user-friendly online and mobile interfaces and are supported by educational content and customer support. Our Consumer Interactive vertical serves consumers directly through our own websites, as well as through channels.

9

Table of Contents

International

The International segment provides services similar to our U.S. Markets segment to businesses in select regions outside the United States. Depending on the maturity of the credit economy in each country, services may include credit reports, analytics and technology solutions services and other value-added risk management services. In addition, we have insurance, business and automotive databases in select geographies. These services are offered to customers in a number of industries including financial services, insurance, automotive, collections, public sector, gaming, and communications, and are delivered through both direct and indirect channels. The International segment also provides consumer solutions similar to those offered by our Consumer Interactive vertical in our U.S. Markets segment that help consumers proactively manage their personal finances and take precautions against identity theft. We report disaggregated revenue of our International segment for the following regions:

Canada: We have operated in Canada since 1989 and are one of only two nationwide consumer reporting agencies in the Canadian market. We operate across multiple verticals in Canada with leading positions in financial services, insurance and consumer interactive and a strong and growing presence in emerging verticals like FinTech and telecom. Our Canadian customer base encompasses some of the largest companies in their verticals, including a majority of the top banks, credit card issuers, insurance companies and auto manufacturer lenders.

Latin America: We have been active in Latin America since 1985 when we entered the Puerto Rican market, and now operate in numerous Central and South American countries, including a strong presence in two major markets - Colombia and Brazil. We also have significant credit bureau businesses in the Dominican Republic and Chile, and have approximately a 26% ownership interest in Trans Union de México, which will increase to 94% upon the closing of our pending acquisition. In Guatemala, we maintain a centralized database that services Guatemala, Nicaragua and Costa Rica.

U.K.: In June 2018, we entered the world’s second largest credit market, the U.K., when we acquired Callcredit, the second largest consumer credit bureau in the U.K. Our U.K. business provides data, analytics and technology solutions to help businesses and consumers make informed decisions across a diverse group of industries and serves a broad set of customers including leading financial institutions and customers in other attractive, high-growth industries such as gaming, which serves online sports betting customers by offering identification and fraud and affordability solutions, FinTech and consumer interactive solutions consistent with those offered by our Consumer Interactive vertical within the U.S. Markets segment.

Africa: We launched our operations in Africa by entering South Africa in 1993 and have since expanded into many surrounding countries. We are highly diversified and serve a variety of industries through traditional consumer credit reporting services, insurance solutions, auto information solutions, and commercial credit information services. We provide risk and information solutions in Africa to many of the leading banks, retailers, auto dealer groups, and insurance companies.

India: In 2001, we partnered with prominent Indian financial institutions to create CIBIL, the first consumer and business credit reporting agency in India. We have since launched the country’s first generic credit score, which is the most widely used credit score across the financial services industry in India. In the absence of a comprehensive national ID, we created an innovative matching algorithm that allowed us to create the most extensive consumer credit database in India. We also own or have access to several non-credit data sources that we use to enhance our solutions, including the national voters’ registry, the confirmed and suspected fraud registry, property registry and tax ID database. We offer a suite of risk and information solutions across the credit lifecycle for banks, telecommunication companies and insurance companies, as well as consumer solutions such as online credit reports and scores.

Asia Pacific: Our operations in Asia Pacific include markets such as Hong Kong, the Philippines, Thailand, and Singapore. Asia Pacific is a growing market with increasing demand for credit driven by a rising middle class that offers significant growth potential in analytics and technology solutions. We do business with many of the top financial institutions in the countries we serve. We have had a majority ownership interest in the principal consumer credit reporting company in Hong Kong since 1998. In partnership with leading credit card issuers in the Philippines, we launched the first consumer credit reporting agency in that market in 2011. We have also built credit risk scores for the National Credit Bureau of Thailand, in which we have a 12.25% ownership interest, the Credit Bureau of Singapore and the Credit Bureau of Malaysia. Our acquisitions of Argus and Neustar provided us an opportunity to grow our business footprint in the region.

Corporate

Corporate provides support services to each segment, holds investments and conducts enterprise functions. Certain costs incurred in Corporate that are not directly attributable to either of the segments remain in Corporate. These costs are typically enterprise-level costs and are primarily administrative in nature.

Markets and Customers

We have a highly diversified customer base that includes companies across multiple industries, including Financial Services and Insurance. A substantial portion of our revenue is derived from companies in the financial services industry and from sales in the United States.

10

Table of Contents

We leverage our comprehensive data assets, industry expertise and our technology infrastructure, allowing us to build solutions once and deploy them multiple times across the different verticals and regions. Our evolution to a hybrid public-private cloud infrastructure augments this capability. We provide services to our customers through real-time, online delivery for services such as credit reports and predictive scores, in batch form for services that help our customers proactively acquire new customers, cross-sell to existing customers and help them monitor and manage risk, and through our software-as-a-service offerings, which include a number of solutions that help businesses interpret data, maximize reimbursements, visualize insights, predict model results and apply their customer-specific criteria to facilitate real-time automated decisions at the time of customer interaction, and through our websites to consumers, for various subscription-based and transaction-based products in the United States and in other regions we serve.

We market our services globally, primarily through our own sales force. We have dedicated sales teams for our largest customers focused by industry group and geography. These dedicated sales teams provide strategic account management and direct support to customers. We use shared sales teams to sell our services to mid-size customers. Smaller customers’ sales needs are serviced primarily through call centers. We also market our services through indirect channels such as resellers, who sell directly to businesses and consumers. Our interactive direct-to-consumer services are sold primarily through our website.

Seasonality

Seasonality in the U.S. Markets segment is correlated to volumes of online credit data purchased by our financial services and mortgage customers, and our sales have generally been higher during the second and third quarters. Seasonality in our International segment is driven by local economic conditions and relevant macroeconomic market trends.

Competition

The market for our services is highly competitive. We compete primarily on the basis of differentiated solutions, data assets, analytics capabilities, ease of integration with our customers’ technology, stability of services, customer relationships, innovation and price. We believe that we compete favorably in each of these categories. Our competitors vary based on the business segment, industry vertical and geographical market that our solutions address.

In our U.S. Markets segment, our competition generally includes Equifax, Experian and LexisNexis, in addition to certain competitors with whom we only compete in specific industry verticals. For example, we compete with FICO in the Financial Services vertical, with Verisk Analytics, Inc. in the Insurance vertical, and with LiveRamp and Experian in the marketing solutions space. We also compete with LifeLock as well as personal finance websites in the Consumer Interactive vertical, some of whom offer free credit information.

In our International segment, we generally compete with Equifax and Experian directly or indirectly through their subsidiaries or investments. We also compete with other companies that may focus on a particular vertical, country or region.

In addition to these competitors, we also compete with a number of other companies that may offer niche solutions catering to more specific customer requirements.

We believe the services we provide to our customers reflect our understanding of our customers’ businesses, the depth and breadth of our data and the quality of our analytics and technology solutions capabilities. By integrating our services into our customers’ workflows, we ensure efficiency, continuous improvement and long-lasting relationships.

Information Technology

Technology

The continuous operation of our information technology systems is fundamental to our business. Our information technology systems collect, refine, access, process, deliver and store the data that is used to provide our solutions. Our technology is at the core of our innovative solutions, and we continually invest in our technology and thought leaders to be a market leader. There are four critical elements to our global technology enablement strategy:

Hardware + Cloud: Our technology infrastructure gives us the ability to organize and handle high volumes of disparate data, maintain and improve our delivery speeds, increase availability and enhance our product development capabilities, while at the same time lowering our overall cost structure. Since November 2023, we have been investing in our technology to standardize and streamline our product delivery platforms and build a single global solutions enablement platform, OneTru, for fulfillment of our product lines. OneTru is already powering several solutions in the U.S. business and we plan to roll out OneTru capabilities in International markets starting in 2026.

Our environment is built upon strategic partnerships. Our technology relies on several third-party solutions as well as proprietary software and tools which we integrate into our platforms. Our control of our technology and infrastructure allows us to prioritize any changes and manage the roll-out of any upgrades or changes. We contract with various third-party providers to help us maintain and support our systems.

11

Table of Contents

Software: Our market-facing solutions are designed for global deployment, such as our Brazil bureau, our first cloud-native credit bureau where we deploy best in class components. Our software is built on a common set of components, tools and practices. With the ongoing migration to OneTru, our software applications will also be deployed on the same software operating platform.

Operating Model: We have established a core set of global operating principles built on common practices, community, tools and training.We have established technology Centers-of-Excellence that utilize similar tools and technology in order to provide scale and efficiency in modifying existing applications and developing new applications for our businesses. We deploy new development methodologies globally to enable rapid delivery of solutions and increase our speed-to-market. Our technology team includes both our own employees as well as additional resources from third-party providers. We hire top talent from global hubs, like India, where we are expanding our resources at all levels, including senior and executive leadership.

Digital Associate Experience: We are also investing in our digital employee experience. We believe that to attract and retain talent we need to ensure an efficient and productive environment. We conducted a thorough needs analysis of our employees to ensure that our platforms are enabling the most effective work environment, facilitating productivity and the hybrid workspace, and providing a world-class technology foundation that enables our employees to innovate.

Data Centers and Business Continuity

In order to create redundancy and increase resiliency, we utilize a hybrid public-private cloud infrastructure in all of our major markets. We generally employ similar technologies and infrastructures at backup sites to enable the optimal sharing of technical resources across geographies.

We maintain a governance framework for business continuity that includes a written policy and procedures requiring each business unit to identify and prepare continuity plans for critical functions. Our business units have procedures in place that are designed to maintain such processes in the event of a disruption. We also have specific disaster recovery plans that will take effect if critical infrastructure or systems fail or become disabled.

As part of our business continuity program, each business unit’s continuity plan is updated annually and stored in a centralized database. These plans are monitored and reviewed by our compliance team and tested annually using exercise scenarios in response to actual events. We also periodically confirm the state of preparedness of our most critical disaster recovery procedures. We maintain systems redundancy plans for our primary U.S. data centers that allow for the transfer of capacity between geographically disbursed environments in the event there is a failure of computer hardware or a loss of our primary telecommunications lines or power sources. On an enterprise basis, our systems are designed to recover most of our operational capacity in a scenario where our primary data centers become inoperable.

Security

The security and protection of personal data is our highest priority. Our written information security program focuses on managing risk and is guided by global information security regulations and standards, including ISO/IEC 27001:2022, NIST CSF, PCI-DSS (as defined below), HIPAA (as defined below), and other international regulatory requirements in locations where we operate. Our information security program follows a risk-based approach that continuously evaluates threats, industry events and asset values to introduce enhancements when necessary. We deploy a wide range of physical and technical safeguards that are intended to provide security around the collection, storage, use, access and delivery of information we have in our possession or with our partners. These safeguards include firewalls, intrusion protection and monitoring, anti-virus and malware protection, vulnerability threat analysis, control validation, advanced persistent threat monitoring, forensic tools, encryption technologies, data transmission standards, contractual provisions, customer and partner credentialing, identity and access management, data loss prevention, access and anomaly reports and training programs for associates. We, along with other global financial services organizations, including U.S. nationwide consumer credit reporting companies, share cyber threat and attack information that may be targeted at our industry through our participation in forums such as the Financial Information Sharing and Analysis Council. These forums allow us to better understand and monitor our systems and our connectivity to our customers and partners, as well as how specific solutions that were implemented to protect against such attacks are performing. We undergo SSAE 18 and SOC2 reviews annually, and many of our major customers routinely audit our security controls. We conduct an annual Payment Card Industry Data Security Standard (“PCI-DSS”) compliance program and remain PCI-DSS certified for environments that have cardholder data. We regularly engage independent third-party organizations to evaluate our security program to conduct independent security assessments. See Part I, Item 1C, “Cybersecurity” for additional information.

12

Table of Contents

Intellectual Property and Licensing Agreements

Our intellectual property is a strategic advantage and protecting it is critical to our business. Because of the importance of our intellectual property, we treat our brand, software, technology, know-how, concepts and databases as proprietary. We attempt to protect our intellectual property rights under the trademark, copyright, patent, trade secret and other intellectual property laws of the U.S. and other countries, as well as through the use of licenses and contractual agreements, such as nondisclosure agreements. While we hold various patents, we do not rely primarily on patents to protect our core intellectual property. Through contractual arrangements, disclosure controls and continual associate training programs, our principal focus is to treat our key proprietary information and databases as trade secrets. Also, we have registered certain trademarks, trade names, service marks, logos, internet URLs and other marks of distinction in the United States and foreign countries, the most important of which is the trademark TransUnion name and logo. This trademark is used in connection with most of the services we sell and we believe it is a known mark in the industry.

We own proprietary software that we use to maintain our databases and to develop and deliver our services. We develop and maintain business-critical software that transforms data furnished by various sources into databases upon which our services are built. We also develop and maintain software to manage our consumer interactions, including providing disclosures and resolving disputes. In all business segments, we develop and maintain software applications that we use to deliver services to our customers, through a software-as-a-service model. In particular, we develop and maintain analytics and technology solutions infrastructure that we host and make available for our customers to develop and deploy analytics to improve business performance.

We license certain data and other intellectual property to other companies on arms-length terms that are designed to protect our rights to our intellectual property. We generally use standard licensing agreements and do not provide our intellectual property to third parties without a nondisclosure and license agreement in place.

We also license certain intellectual property that is important for our business from third parties. For example, we license credit-scoring algorithms and the right to sell credit scores derived from those algorithms from third parties for a fee.

Legal and Regulatory Matters

Compliance with legal and regulatory requirements is a top priority. We are subject to numerous laws governing the collection, protection, dissemination and use of non-public personal information, credit information and other types of information. These laws are enforced by U.S. federal, state and local regulatory agencies, foreign regulatory authorities and, in some instances, through private civil litigation. Our failure to comply with applicable legal and regulatory requirements could have a negative impact on our financial condition, results of operations, reputation and overall operations.

We proactively manage our compliance with laws and regulations through a global legal, risk and compliance framework that is designed to ensure that enterprise standards are followed. Through the legal, risk and compliance functions, we provide training to our associates, monitor applicable and material laws and regulations, establish compliance policies, routinely review internal processes to determine whether business practice changes are warranted, assist in the development of new products and services, and regularly meet with principal regulators and legislators to ensure transparent engagement regarding our operations.

13

Table of Contents

U.S. Data and Privacy Protection

Our U.S. operations are subject to numerous laws and regulations governing privacy, data security, consumer protection and the use of consumer credit and consumer report information. Some of these laws provide for civil and criminal penalties for the unauthorized release of, or access to, this protected information. The laws and regulations that affect our U.S. business include, but are not limited to, the following:

•Fair Credit Reporting Act, as amended by the Economic Growth, Regulatory Relief, and Consumer Protection Act (the “FCRA”): The FCRA applies to consumer reporting agencies, including ours, as well as data furnishers and users of consumer reports. The FCRA promotes the accuracy, fairness and confidentiality of information in the files of consumer reporting agencies that engage in the practice of assembling and evaluating consumer credit and other information relating to consumers for certain specified purposes. The FCRA limits what information may be reported by consumer reporting agencies, limits the distribution and use of consumer reports, establishes consumer rights to access and dispute their own credit files, includes additional credit protections and services to veterans and active-duty U.S. military consumers, includes provisions designed to prevent identity theft and assist fraud victims with placing free fraud alerts or national security freezes and assist victims of human trafficking, requires consumer reporting agencies to make a free annual credit report available to consumers, notify consumers of their rights under the FCRA and imposes many other requirements on consumer reporting agencies, data furnishers and users of consumer report information. Violation of the FCRA can result in civil and criminal penalties. Regulatory enforcement of the FCRA is under the purview of the Federal Trade Commission (the “FTC”), the Consumer Financial Protection Bureau (the “CFPB”) and state attorneys general, acting alone or in concert with one another. Many states have their own regulatory agencies and fair credit reporting laws, which may include more exacting requirements, if not preempted by the FCRA.

•The Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”): The Dodd-Frank Act prohibits unfair, deceptive or abusive acts or practices (“UDAAP”) with respect to consumer financial products or services and provides the CFPB with authority to enforce those provisions. Many states have enacted statutes and promulgated rules that prohibit unfair, deceptive or abusive acts and practices, relating to, among other things, marketing, disclosures, subscriptions and billing practices within the state.

•Federal Trade Commission Act (the “FTC Act”): The FTC Act prohibits unfair methods of competition and unfair or deceptive acts or practices. We must comply with the FTC Act when we market certain products, such as consumer credit monitoring and identity protection services. Our data collection, use and disclosure practices and the security measures we employ to safeguard the personal data of consumers could also be subject to the FTC Act, and our data practices or our failure to safeguard data adequately may subject us to regulatory scrutiny or enforcement action.

•Gramm-Leach Bliley Act (the “GLBA”): The GLBA regulates, among other things, the receipt, use and disclosure of non-public personal information of consumers held by or received from financial institutions. Several of our data assets are subject to GLBA provisions, including limitations on the use or disclosure of the underlying data and rules relating to the technological, physical and administrative safeguarding of non-public personal information. Violation of the GLBA can result in civil and criminal liability.

•Drivers’ Privacy Protection Act (the “DPPA”): The DPPA requires all states to safeguard certain personal information included in licensed drivers’ motor vehicle records from improper use or disclosure. The DPPA limits the use of this information sourced from U.S. state departments of motor vehicles to certain specified purposes and does not apply if a driver has consented to the release of their data. The DPPA imposes criminal fines for non-compliance and grants individuals a private right of action, including actual and punitive damages and attorneys’ fees. The DPPA provides a federal baseline of protections for individuals, and is only partially preemptive, meaning that except in a few narrow circumstances, state legislatures may pass laws to supplement the protections made by the DPPA. Many states’ laws are more restrictive than the federal law.

•Data security breach laws: All states and some territories have adopted data security breach laws that may require notice be given to affected consumers in the event of a breach of personal information, and in some cases the provision of additional benefits such as free credit monitoring to affected individuals. Some of these laws require additional data protection measures over and above the GLBA data safeguarding requirements. If data within our system is compromised, we may be subject to provisions of various state security breach laws, including regulatory investigations or enforcement actions from state attorneys general, who enforce state data breach or unfair and deceptive practices laws.

•The Credit Repair Organizations Act (“CROA”): CROA regulates companies that claim to be able to assist consumers in improving their credit standing. Some courts have applied CROA to credit monitoring services offered by consumer reporting agencies and others. CROA allows for a private right of action and permits consumers to recover all money paid for alleged “credit repair” services in the event of violation.

14

Table of Contents

•The Health Insurance Portability and Accountability Act of 1996, as amended by the American Recovery and Reinvestment Act of 2009 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act (“HITECH”): HIPAA and HITECH require companies to implement reasonable safeguards to prevent intentional or unintentional misuse or wrongful disclosure of protected health information. We obtain protected health information under a “business associate” agreement that is subject to the privacy, security and transactional requirements imposed by HIPAA and HITECH. As a business associate, we are obligated to limit our use and disclosure of health-related data to certain statutorily permitted purposes, HIPAA regulations, as outlined in our business associate agreements, and to preserve the confidentiality, integrity and availability of this data. HIPAA and HITECH also require, in certain circumstances, the reporting of breaches of protected health information to affected individuals and to the United States Department of Health and Human Services. A violation of any of the terms of a business associate agreement or noncompliance with HIPAA or HITECH data privacy or security requirements could result in administrative enforcement action and/or imposition of statutory penalties by the United States Department of Health and Human Services or a state attorney general. HIPAA and HITECH requirements supplement but do not preempt state laws regulating the use and disclosure of health-related information; state law remedies, which can include a private right of action, remain available to individuals affected by an impermissible use or disclosure of health-related data.

•Comprehensive State Privacy Laws: Over a dozen states have enacted comprehensive privacy legislation, currently in effect, intended to provide consumers with greater transparency and control over their personal information by providing consumers in these states with certain rights regarding their personal information and by requiring businesses to make certain disclosures and take certain other acts in furtherance of those rights. These laws exempt practices and activities regulated by the FCRA, the GLBA, HIPAA and the DPPA, including our credit reporting business, but apply to other portions of our business that are not regulated by these laws. California, Colorado, and New Jersey have rulemaking authority, enabling them to build upon their laws. California also recently passed regulations going into effect on a rolling basis starting January 1, 2026, covering cybersecurity audits, risk assessments, automated decision-making technology, insurance companies and updates to existing California Consumer Privacy Act regulations.

•State Consumer Health Data Privacy Law: Washington’s My Health My Data and similar laws in Nevada, Connecticut, and Virginia impose broad requirements on collecting, using, and selling consumer health information. These laws took effect in 2024 and 2025. New York and California passed laws relating to the use of precise location relating to healthcare facilities or family planning centers, respectively. New York’s law went into effect in 2023, and California’s law went into effect January 1, 2026.

•Requirements for government contractors: Special requirements may apply to TransUnion when providing services to U.S. federal, state and local government agencies. For example, and without limitation, TransUnion may need to abide by the Privacy Act of 1974, the Internal Revenue Service’s Publication 4812, and various Federal Acquisition Regulation and associated supplemental contract clauses. Each of these laws, regulations and contract clauses dictates particular measures for the protection of personal information or information that is otherwise categorized as sensitive by the government. Government agencies frequently modify or supplement these requirements, and consequences for violations of applicable requirements may include penalties, civil liability and for severe infractions, criminal liability.

•State Data Broker Laws: Four states — California, Oregon, Vermont, and Texas — have enacted state data broker registration laws. These laws regulate businesses that collect, sell, license, or transfer personal information about consumers with whom they have no direct relationship. These laws generally require such “data brokers” to register with a state agency, disclose their data practices, and in some states to maintain specific security measures. Notably, California’s updated data broker law creates the most expansive regulatory framework in the country by requiring all registered data brokers to participate in a single state-run Deletion Request and Opt-Out Platform, enabling California residents to request deletion of their personal data from all data brokers through one unified mechanism. Similar data broker legislation is advancing in other states.

We are also subject to U.S. federal and state laws that are generally applicable to any U.S. business with national or international operations, such as antitrust laws, the Foreign Corrupt Practices Act, the Americans with Disabilities Act, climate-related regulations and various employment laws. We continuously monitor U.S. federal and state legislative and regulatory activities that involve credit reporting, data privacy and security, and other relevant subjects to identify issues in order to remain in compliance with applicable laws and regulations.

International Data and Privacy Protection

We are subject to data protection, privacy and consumer credit laws and regulations in other jurisdictions where we conduct business. These laws and regulations include, but are not limited to, the following:

•Canada: The Personal Information Protection and Electronic Documents Act of 2000 (“PIPEDA”) and substantially similar provincial laws govern how private sector organizations collect, use and disclose personal information in the course of commercial activities. The PIPEDA gives individuals the right to access and request correction of their

15

Table of Contents

personal information collected by such organizations. The PIPEDA requires compliance with the Canadian Standard Association Model Code for the Protection of Personal Information. Most Canadian provinces also have laws dealing with consumer reporting. These laws typically impose an obligation on credit reporting agencies to have reasonable processes in place to maintain the accuracy of the information, place limits on the disclosure of the information and give consumers the right to have access to, and challenge the accuracy of, the information. Quebec’s privacy law, which went into effect over the course of 2023 and 2024, made a number of notable changes to the province’s privacy laws, most notably increasing requirements on organizations seeking to transfer personal information outside of Quebec.

•Colombia: The Colombian Financial Data Protection Regime (Law 1266 of 2008) regulates the collection, use and transfer of personal data pertaining to financial services, including credit reporting. The Colombian General Data Protection Regime (Law 1581 of 2012 and Decree 1377 of 2013) covers regulation of all other personal data. Both of these regimes have applicability to credit reporting services in Colombia and together address obligations of information furnishers, database owners, consumer right of access, consumer consent and permitted information disclosures.

•European Union (“EU”): Our data management activities and the commercial solutions we make available to the European market are subject to the General Data Protection Regulation (“GDPR”). This law establishes significant data protection and privacy standards that empower European Union consumers to exercise significant control over their personal data. In addition to a litany of substantive provisions empowering consumers to limit how data may be used, GDPR also imposes operational, data processing, and other technical requirements with which we must comply. Failure to comply with any provision of GDPR could result in significant regulatory or other enforcement penalties.

•U.K.: Our U.K. operations are subject to the UK General Data Protection Regulation (the “UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulation (the “PECR”), which together govern the processing of personal data pertaining to U.K. citizens. Enforcement of data regulation and consumer privacy matters in the U.K. resides with the Information Commissioner’s Office, an independent body set up to uphold the rights of individuals in relation to the use of their personal data. The provision of credit referencing services in the U.K. is also a regulated activity that is authorized by the Financial Conduct Authority.

Under the Financial Conduct Authority’s Open Banking policy, consumers can share transaction data with third parties via APIs to identify best products and take up multi-bank products. As part of Open Banking, the Second Payment Services Directive allows merchants to retrieve a customer’s account data from their bank with their consent. The implementation of Open Banking platforms has increased the number of payment service providers available to consumers beyond traditional banks. TransUnion U.K. is an authorized information services provider under this regime.

•South Africa: The National Credit Act of 2005 (the “NCA”) and its implementing regulations govern credit bureaus and consumer credit information. The NCA sets standards for filing, retaining and reporting consumer credit information. The NCA also defines consumers’ rights with respect to accessing their own information and addresses the process for disputing information in a credit file. The NCA is enforced by The National Credit Regulator who has authority to supervise and examine credit bureaus. In addition, the Protection of Personal Information Act (“POPIA”) regulates the processing of personal information of legal and juristic persons, and imposes compliance obligations and sanctions.

•India: The Credit Information Companies Regulation Act of 2005 requires entities that collect and maintain personal credit information to ensure that it is complete, accurate and protected. Entities must adopt certain privacy principles in relation to collecting, processing, preserving, sharing and using credit information. The Digital Personal Data Protection Act was passed by the Indian Parliament in 2023. The implementing rules (the “DPDPA Rules”) were issued in November 2025 and are subject to an 18-month phased implementation. The DPDPA Rules protect individual rights related to digital data, mandating mechanisms for accessing, correcting and erasing data, redressing grievances and appointing a consent manager. The DPDPA Rules require “Data Fiduciaries”, such as CIBIL, to provide notices of data processing, define purpose-based retention timelines, implement reasonable security safeguards, provide breach notification within 72 hours and obtain verifiable parental consent prior to processing child data.

•Hong Kong: Personal Data (Privacy) Ordinance (“PDPO”) and The Code of Practice on Consumer Credit Data regulate the operation of consumer credit reference agencies. They prescribe the methods and security controls under which credit providers and credit reference agencies may collect, access and manage credit data. The PDPO was amended in 2021 to provide new powers to the Privacy Commissioner and to make criminal the act of publicly releasing information identifying an individual or organization – a practice known as “doxxing.”

•Brazil: The Brazilian General Data Protection Law (“LGPD”) regulates the processing of personal information and imposes compliance obligations and sanctions comparable to those of GDPR.

16

Table of Contents

Artificial Intelligence Regulatory Framework

We use AI, ML, and automated decision-making technologies, including proprietary AI and ML algorithms and models (collectively, “AI Technologies”) for both internal business and in certain product offerings, and are therefore subject to a comprehensive set of laws and regulations governing the use and development of such technologies. These laws and regulations are rapidly evolving as many states and jurisdictions introduce new laws to ensure that AI is deployed responsibly. As we continue to enhance our capabilities, these laws and regulations impose additional compliance burdens on and guide our efforts to integrate AI Technologies into our business processes. The laws and regulations that affect our AI Technologies include the following:

•U.S. Federal Artificial Intelligence Executive Orders: Executive Order 14365 (“Ensuring a National Policy Framework for Artificial Intelligence”) was signed in December 2025, taking multiple actions to discourage states from enacting and enforcing state AI regulation.

•State AI Legislation: As of January 31, 2026, 46 states have passed at least one law relating to AI Technologies. The Colorado Artificial Intelligence Act, which will take effect on June 30, 2026, will establish a comprehensive governance framework for high-risk AI systems, imposing requirements related to transparency, algorithmic discrimination, AI risk assessments, and adverse decisions. Texas’s Responsible Artificial Intelligence Governance Act (“TRAIGA”) prohibits manipulative, unconstitutional, and discriminatory practices with respect to AI Technologies. Utah, California, Colorado, and Maine passed laws requiring companies to make certain generative AI and chatbot disclosures. Additionally, certain states have laws governing frontier AI models, deepfakes, deception, legal personhood, automated employment decision tools, insurance, healthcare, and companion chatbots.

•EU Artificial Intelligence Act (“EU AI Act”): The EU AI Act establishes a comprehensive governance framework for AI within the European Union and applies to companies that develop, use, and/or provide AI in the EU, imposing requirements related to transparency, conformity assessments, risk management, human oversight, and security. The majority of the substantive requirements will apply beginning in August 2026.

•Intellectual Property Laws: The protection of intellectual property, particularly in the context of AI and ML, is governed by a complex and evolving set of laws. These laws address issues such as patent rights for AI algorithms and the protection of proprietary technologies. Jurisdictions worldwide are grappling with how to apply traditional intellectual property laws to AI innovations, leading to ongoing discussions and litigation.

Other International Laws

Credit information and credit information companies have also become subject to, directly or indirectly, further governance regulations, such as those historically reserved for banks.We are also subject to various laws and regulations generally applicable to all businesses in the other countries where we operate.

Sustainability

We are dedicated to making meaningful, positive contributions to the world and the communities we serve. We are making an impact through our commitments to enabling life-changing access to credit in mature and emerging markets, and using trended data to help consumers improve their access to credit while doing good for people and the planet.

We focus our sustainability efforts on issues that we believe are important to our business and to our key stakeholders and conduct assessments from time-to-time to help us identify and assess the relative importance of various topics to our business. We plan to report our current efforts in our upcoming 2025 Global Impact Report, which for the avoidance of doubt, is not incorporated herein by reference and should not be considered part of this report.

Climate Change

Climate change continues to be a key issue for companies worldwide. In 2021, we set two targets, to achieve operational net zero Scope 1 and Scope 2 market-based greenhouse gas (“GHG”) emissions by 2025 and 30 percent reductions on leased real estate Scope 3 emissions by 2030, using 2019 as a baseline. We achieved our 2025 goal through a combination of actual emission reductions, through the purchase of renewable energy (including market instruments such as renewable energy certifications), real estate consolidation and the use of carbon offsets to address certain residual GHG emissions. More information on our emissions calculations and associated methodology will be provided in our Global Impact Report (which for the avoidance of doubt is not incorporated herein by reference).

We define Scope 1 emissions as direct emissions from company operations. Currently, we consider our Scope 2 GHG emissions to be those indirect emissions from our owned (as distinct from our leased) properties and leased sites within our operational control as determined by an operational control survey. We consider leased sites where TransUnion has sufficient influence over facilities to impact energy consumption and/or sourcing, as determined by an internal survey we conducted, to generally fall within operational control. We currently consider Scope 3 GHG emissions within our Scope 3 climate target to

17

Table of Contents

include leased real estate, other than leased real estate within our operational control and captured in our Scope 2 GHG emissions, but our methodology may evolve in the future.

Human Capital Management

We employed approximately 13,500 employees as of December 31, 2025. Central to our long-term strategy is attracting, developing and retaining the best talent globally with the right skills to drive our success. Our Board receives regular updates on human capital topics such as employee retention, engagement and survey results, enterprise compliance, investigations and associate health and safety.

Other than certain employees in Brazil, none of our employees are currently represented by a labor union or have terms of employment that are subject to a collective bargaining agreement. We consider our relationships with our employees to be good and have not experienced any work stoppages.

We see our people as a source of strength and know that they are essential to our mission, innovation and growth. At TransUnion, we know that being able to draw from the largest feasible pools of talent helps us find the best people for our company’s needs.We strive to cultivate an exceptional workplace culture of belonging, respect and accountability, where everyone feels empowered to succeed.

Talent Acquisition and Retention

Our talent acquisition and retention strategy is multi-faceted. We aim to recruit the most qualified candidates and strive for a varied and well-balanced workforce.

We reward and support employees through competitive pay, benefits, and perquisite programs that allow employees and their families to thrive. Our benefit offerings are designed to meet the various and evolving needs of our workforce tailored to the businesses and geographies in which we operate.

We continue to support our employees and their families, including by providing child and adult care benefits that provide access to onsite or community centers, enhanced back-up care choices that include personal caregivers, child care and adult referral assistance and child and adult care provider discounts. In addition, we offer on-demand tutoring along with a specialist who can consult, research and provide referral services for a host of services such as child and parenting needs (e.g., pregnancy, adoption, and special needs), senior care, pets, home services, education (including college), to name a few of the options provided to our employees. We also provide our employees with access to free mental and behavioral health resources, including on-demand access to the Employee Assistance Program for employees and their dependents. We continue to look for new ways to support our employees and their families.

Employee Engagement, Training and Development

We prioritize and invest in helping our employees grow and build their careers through several training and development programs. These include online, instructor-led and on-the-job learning formats as well as executive talent and succession planning paired with an individualized development approach.

Safety and Wellness

We take our efforts to maintain a safe work environment seriously, and the health and well-being of associates, customers and visitors remains a top priority. We continue to follow important health and safety guidelines, and implement effective practices to minimize workplace risks.

Available Information

Through our corporate website under the heading “About - Investor Relations,” at http://www.transunion.com,you can access electronic copies of our governing documents free of charge, including our Corporate Governance Guidelines and the charters of the committees of our Board. In addition, through our website, you can access the documents we file with the U.S. Securities and Exchange Commission (“SEC”), including our annual reports on Form 10-K, quarterly reports on Form 10-Q and current reports on Form 8-K, and all amendments thereto, as soon as reasonably practicable after we file or furnish them. Investors and others should note that we routinely announce material information to investors and the marketplace using SEC filings, press releases, public conference calls, webcasts and the TransUnion Investor Relations website. While not all of the information that we post to our Investor Relations website is of a material nature, some information could be deemed to be material. Accordingly, we encourage investors, the media and others interested in TransUnion to review the information that we share on www.transunion.com/tru. You also may request printed copies of our SEC filings or governance documents, free of charge, by writing to our Corporate Secretary at the address on the cover of this report. Information contained on our website is not incorporated herein by reference and should not be considered part of this report.

In addition, the SEC maintains an Internet site (www.sec.gov) that contains reports, proxy and information statements and other information regarding issuers that file electronically with the SEC.

18

Table of Contents

Our corporate headquarters are located at 555 West Adams Street, Chicago, Illinois 60661, and our telephone number is (312) 985-2000.

19

Table of Contents

ITEM 1A. RISK FACTORS

You should carefully consider the following risks as well as the other information included in this report, including “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our financial statements and related notes. Any of the following risks could materially and adversely affect our business, financial condition or results of operations. However, the selected risks described below are not the only risks facing us. Additional risks and uncertainties not currently known to us or those we currently view to be immaterial may also materially and adversely affect our business, financial condition or results of operations.

Risk Factors Summary

The following is a summary of the principal risks and uncertainties described in more detail in this report:

•Our revenues are concentrated in the U.S. financial services and consumer credit industries. When these industries or the broader financial markets experience a downturn, demand for our services and revenues may be adversely affected.

•We are subject to significant competition in the markets in which we operate, and we may face significant competition in the new markets that we plan to enter.

•To the extent the availability of free or relatively inexpensive consumer information increases, the demand for some of our services may decrease.

•Our relationships with key long-term customers may be materially diminished or terminated.

•If we are unable to develop successful new services in a timely manner, or if the market does not adopt our new services, our ability to maintain or increase our revenue could be adversely affected.

•If our outside service providers and key vendors are not able to or do not fulfill their service obligations, our operations could be disrupted and our operating results could be harmed.

•There may be further consolidation in our end-customer markets, which may adversely affect our revenues.

•Data security and integrity are critically important to our business, and cybersecurity incidents, including cyberattacks, breaches of security, unauthorized access to or disclosure of our intellectual property or confidential information, business disruption, or the perception that confidential information is not secure, could result in a material loss of business, regulatory enforcement, substantial legal liability and/or significant harm to our reputation.

•If we experience system failures, personnel disruptions or capacity constraints, or our customers do not modify their systems to accept new releases of our distribution programs, the delivery of our services to our customers could be delayed or interrupted, which could harm our business and reputation and result in the loss of revenues or customers.

•We could lose our access to data sources which could prevent us from providing our services.

•If we fail to maintain and improve our systems, our data matching technology, and our interfaces with data sources and customers, demand for our services could be adversely affected.

•The CFPB has supervisory and examination authority over our business and may initiate enforcement actions with regard to our compliance with federal consumer financial laws. Actions by the CFPB or other regulators against us or our executives could result in increased operating costs, reputational harm, payment of damages and civil money penalties, injunctive relief and/or restitution, any of which could have a material adverse effect on our business, results of operations and financial condition.

•Our business is subject to various governmental regulations, laws and orders, compliance with which may cause us to incur significant expenses or reduce the availability or effectiveness of our solutions, and the failure to comply with which could subject us to civil or criminal penalties or other liabilities.

•Regulatory oversight of our contractual relationships with certain of our customers may adversely affect our business.

•The outcome of litigation, inquiries, investigations, examinations or other legal proceedings in which we are involved, in which we may become involved, or in which our customers or competitors are involved could subject us to significant monetary damages or restrictions on our ability to do business.

•We currently use, and will continue to invest in the use of, AI Technologies, which use is subject to a continuously evolving regulatory landscape. The evolving regulatory landscape may impact our use of AI Technologies, require additional compliance measures and changes to our operations and processes, which could result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition.

•Our ability to expand our operations in, and the portion of our revenue derived from, markets outside the United States is subject to economic, political and other inherent risks, which could adversely impact our growth rate and financial performance.

•We face geopolitical and other risks associated with our international operations, which could materially adversely impact our results of operations and our financial condition.

•We may be unable to protect our intellectual property adequately or cost-effectively, which may cause us to lose market share or force us to reduce our prices. We also rely on trade secrets and other forms of unpatented intellectual property that may be difficult to protect.

20

Table of Contents

•We may face claims for intellectual property infringement, which could subject us to monetary damages or limit us in using some of our technologies or providing certain services.

•When we engage in acquisitions, investments in new businesses or divestitures of existing businesses, we face risks that may adversely affect our business.

•We depend, in part, on strategic alliances, joint ventures and acquisitions to grow our business. If we are unable to make strategic acquisitions and develop and maintain these strategic alliances and joint ventures, our growth may be adversely affected.

•We have a substantial amount of debt which could adversely affect our financial position and prevent us from fulfilling our obligations under the debt instruments.

•Despite our current level of indebtedness, we may still be able to incur additional indebtedness. This could increase the risks associated with our substantial indebtedness.

•We may not be able to generate sufficient cash to service all of our indebtedness and may be forced to take other actions to satisfy our obligations under our indebtedness, which may not be successful.

•Our inability to generate sufficient cash flow to satisfy our debt obligations, or to refinance our indebtedness on commercially reasonable terms or at all, would materially and adversely affect our financial position and results of operations and our ability to satisfy our obligations.

•Our stock price has recently been volatile, and may continue to be volatile and/or decline, regardless of our operating performance, and you may not be able to resell shares of our common stock at or above the price you paid or at all.

•Our business and operations are exposed to risks arising from developments and trends associated with climate change and other sustainability matters, including risks associated with our own reporting or other initiatives.

•Anti-takeover provisions in our organizational documents might discourage, delay or prevent acquisition attempts for us that you might consider favorable.

•Our ability to pay cash dividends may be limited by the terms of our secured credit facility.

•There can be no assurance that we will repurchase shares pursuant to our share repurchase program consistent with historical amounts or at all.

•Economic and other conditions may adversely impact the valuation of our assets resulting in impairment charges that could have a material adverse impact on our results from operations.

•If we fail to implement and maintain proper and effective internal controls over financial reporting, our ability to produce accurate financial statements on a timely basis could be impaired, which could cause investors to lose confidence in our reported financial information and have a negative effect on our stock price.

•Natural disasters, pandemics, terrorist acts, war, actions by governments, and other geopolitical activities could disrupt our operations.

•We may not be able to attract and retain the skilled employees that we need to support our business.

•We are subject to losses from risks for which we do not insure.

•If we experience changes in tax laws or adverse outcomes resulting from examination of our tax returns, it could adversely affect our results of operations.

Risks Related to Our Business

Our revenues are concentrated in the U.S. financial services and consumer credit industries. When these industries or the broader financial markets experience a downturn, demand for our services and revenues may be adversely affected.

Our largest customers, and therefore our business and revenues, are influenced by macroeconomic conditions and are impacted by the availability of credit, the level and volatility of interest rates, inflation, employment levels, consumer confidence and housing demand. In addition, a significant amount of our revenue is concentrated among certain customers, industries, product offerings and in distinct geographic regions, primarily in the United States. Our 2025 revenue in our U.S. Markets Financial Services and Consumer Interactive verticals accounted for approximately 37% and 13%, respectively, of consolidated gross revenues, respectively. If businesses in these industries experience economic hardship, we cannot assure you that we will be able to generate future revenue growth. Our customer base suffers when financial markets experience volatility, liquidity issues and disruption, which has occurred in the past and which could reoccur, and the potential for increased and continuing disruptions going forward, present considerable risks to our business and revenue. Changes in the macroeconomic environment have resulted, and may continue to result, in fluctuations in volumes, pricing and operating margins for our services. In addition, if consumer demand for financial services and products and the number of credit applications decrease, the demand for our services could also be materially reduced. High inflation levels have a negative impact on our business by decreasing demand for credit due to slower consumer spending on non-essential goods and services and due to the Federal Reserve raising interest rates to combat inflation. Continued inflation and additional interest rate increases could further materially impact our business. These types of disruptions could lead to a decline in the volumes of services we provide our customers and could negatively impact our revenue and results of operations.

21

Table of Contents

We are subject to significant competition in the markets in which we operate, and we may face significant competition in the new markets that we plan to enter.

The markets for our services are highly competitive, and we may not be able to compete successfully against our competitors, which could impair our ability to sell our services. We compete on the basis of differentiated solutions, data assets, analytics capabilities, ease of integration with our customers’ technology, stability of services, customer relationships, innovation and price. Our regional and global competitors vary in size, financial and technical capability, and in the scope of the products and services they offer. Some of our competitors may be better positioned to develop, promote and sell their products. Larger competitors may benefit from greater cost efficiencies and may be able to win business simply based on pricing. We consistently face downward pressure on the pricing of our products, which could result in reduced prices for certain products, or a loss of market share. Our competitors may also be able to respond to opportunities before we do, by taking advantage of new technologies, changes in customer requirements or market trends.

For example, our Consumer Interactive vertical experiences competition from emerging companies. In the past several years, there has been an influx of other companies offering similar services to ours, free of charge. In response, we launched a new direct-to-consumer product that is offered in both free and paid tiers in 2025.

Many of our competitors have extensive customer relationships, including relationships with our current and potential customers. New competitors, or alliances among competitors, may emerge and gain significant market share. Existing or new competitors may develop products and services that are superior to ours or that achieve greater market acceptance. If we are unable to respond to changes in customer requirements as quickly and effectively as our competition, our ability to expand our business and sell our services may be adversely affected.

Our competitors may be able to sell services at lower prices than we do, individually or as part of integrated suites of several related services. This ability may cause our customers to purchase from our competitors rather than from us. Price reductions by our competitors could also negatively impact our operating margins or harm our ability to obtain new long-term contracts or renewals of existing contracts on favorable terms. Additionally, some of our customers may develop products of their own that replace the products they currently purchase from us, which would result in lower revenue.

We also expect that there will be significant competition in the new markets that we enter. We cannot assure you that we will be able to compete effectively against current and future competitors. If we fail to successfully compete, our business, financial condition and results of operations may be adversely affected.

To the extent the availability of free or relatively inexpensive consumer information increases, the demand for some of our services may decrease.

Public and commercial sources of free or relatively inexpensive consumer information have become increasingly available and this trend is expected to continue. Public and commercial sources of free or relatively inexpensive consumer information, including free credit information from lead generation companies and from banks, may reduce demand for our services. Beginning in April 2020, we began offering free credit reports on a weekly basis. To the extent that our customers choose not to obtain services from us and instead rely on information obtained at little or no cost from these public and commercial sources, our business, financial condition and results of operations may be adversely affected.

Our relationships with key long-term customers may be materially diminished or terminated.

We have long-standing relationships with a number of our customers, many of whom could unilaterally terminate their relationship with us or materially reduce the amount of business they conduct with us at any time. Our customer agreements relating to our core credit reporting service offered through our U.S. Markets segment are terminable upon advance written notice (typically ranging from 30 days to six months) by either us or the customer, which provides our customers with the opportunity to renegotiate their contracts with us or to award more business to our competitors.

We also provide our services to business partners who may combine them with their own or other branded services to be offered as a bundle to consumers, governmental agencies and businesses in support of fraud or credit protection, credit monitoring, identity authentication, insurance or credit underwriting, and collections. Some of these partners are the largest providers of credit information or identity protection services to the U.S. consumer market.

Market competition, business requirements, financial condition and consolidation through mergers or acquisitions, could adversely affect our ability to continue or expand our relationships with our customers and business partners. There is no guarantee that we will be able to retain or renew existing agreements, maintain relationships with any of our customers or business partners on acceptable terms or at all, or collect amounts owed to us from insolvent customers or business partners. The loss of one or more of our major customers or business partners could adversely affect our business, financial condition and results of operations.

22

Table of Contents

If we are unable to develop successful new services in a timely manner, or if the market does not adopt our new services, our ability to maintain or increase our revenue could be adversely affected.

In order to keep pace with customer demands for increasingly sophisticated service offerings, to sustain expansion into growth industries and to maintain our profitability, we must continue to innovate and introduce new services to the market. The process of developing new services is complex and uncertain. Our industry solutions require extensive experience and knowledge from within the relevant industry. We must commit significant resources to this effort before knowing whether the market will accept new service offerings. Additionally, our business strategy is dependent on our ability to expand into new markets and to bring new products to market. We may not successfully enter into new markets or execute on our new services because of challenges in planning or timing, technical hurdles, difficulty in predicting market demand, changes in regulation or a lack of appropriate resources. Additionally, even if we successfully develop new products, our existing customers might not accept these new products or new markets might not adopt our products due to operational constraints, high switching costs or general lack of market readiness. Failure to successfully introduce new services to the market could adversely affect our reputation, business, financial condition and results of operations.

If our outside service providers and key vendors are not able to or do not fulfill their service obligations, our operations could be disrupted and our operating results could be harmed.

We depend on a number of service providers and key vendors such as telecommunication companies, software engineers, data processors, software and hardware vendors and providers of credit score algorithms, who are critical to our operations. These service providers and vendors are involved with our service offerings, communications and networking equipment, computer hardware and software and related support and maintenance. Although we have implemented service-level agreements and have established monitoring controls, our operations could be disrupted if we do not successfully manage relationships with our service providers, if they do not perform or are unable to perform agreed-upon service levels, or if they are unwilling to make their services available to us at reasonable prices. If our service providers and vendors do not perform their service obligations, it could adversely affect our reputation, business, financial condition and results of operations.

There may be further consolidation in our end-customer markets, which may adversely affect our revenues.

There has been, and we expect there will continue to be, merger, acquisition and consolidation activity in our customer markets. If our customers merge with, or are acquired by, other entities that are not our customers, or that use fewer of our services, our revenue may be adversely impacted. In addition, industry consolidation could affect the base of recurring transaction-based revenue if consolidated customers combine their operations under one contract, since most of our contracts provide for volume discounts. In addition, our existing customers might leave certain geographic markets, which would no longer require them to purchase certain products from us and, consequently, we would generate less revenue than we currently expect.

Risks Related to Technology and Cybersecurity

Data security and integrity are critically important to our business, and cybersecurity incidents, including cyberattacks, breaches of security, unauthorized access to or disclosure of our intellectual property or confidential information, business disruption, or the perception that confidential information is not secure, could result in a material loss of business, regulatory enforcement, substantial legal liability and/or significant harm to our reputation.

As a global consumer credit reporting agency and provider of risk and information solutions, we collect, store and transmit a large amount of sensitive and confidential consumer information on over one billion consumers, including financial information, personally identifiable information and protected health information. As such, we rely heavily on computer systems, hardware, software and technology infrastructure for both internal and external operations that are critical to our business. We face significant and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our systems and data including unintentional events and deliberate attacks by third parties or insiders, such as the exploitation of “bugs” or security vulnerabilities in software and hardware and sophisticated attack methods such as ransomware. Cyberattacks can take many forms, but they typically have one or more of the following objectives, among others:

•obtain unauthorized access to confidential data such as personal information;

•manipulate or destroy data;

•disrupt, sabotage or degrade service on our systems; or

•affect our operations or data through attacks on third-party business partners or service providers.

We experience numerous attempts to access our computer systems, software, networks, data and other technology assets on a daily basis. We have also experienced cyberattacks and other security incidents, and expect that such attacks and incidents will continue in varying degrees in the future. To date, none of these attacks or incidents has had a material impact on our business, operations or financial results. However, there can be no assurance that future attacks will be immaterial and even immaterial incidents may adversely impact us. For example, in July 2025, TransUnion was affected by a cyberattack in which a third party gained unauthorized access through social engineering to a third-party application used in our customer support operations that

23

Table of Contents

exposed certain personal data of 4.4 million consumers. While this incident was not material to TransUnion and did not affect our core credit database or related credit report products and services, we have incurred and expect to continue incurring costs associated with, among other things, responding to regulatory inquiries and class action lawsuits.

The security and protection of non-public consumer information is our top priority. However, there can be no guarantee that the cybersecurity risk management program and processes for any company, including us and our service providers, will be fully implemented, complied with and effective at all times. We cannot assure you that our systems, databases and services will not be compromised or disrupted in the future, whether as a result of deliberate attacks by malicious actors, breaches due to employee error or malfeasance, or other disruptions during the process of upgrading or replacing computer software or hardware, power outages, computer viruses, telecommunication or utility failures, or natural disasters or other catastrophic events.

We have acquired, and may continue to acquire, companies with cybersecurity vulnerabilities and/or unsophisticated security measures, which exposes us to significant cybersecurity, operational, and financial risks. While we execute security due diligence in these transactions, neither the acquired company nor TransUnion can identify every issue in a timely manner, which could create material risk to us during the integration effort.

Highly publicized cybersecurity incidents have heightened consumer, legislative and regulatory awareness of cybersecurity risks. These events continue to embolden individuals or groups to target our systems more aggressively.

The preventive actions we take to address cybersecurity risk, including protection of our systems and networks, cannot sufficiently account for all threats or repel or mitigate the effects of all cyberattacks in the future as it is not possible to anticipate, detect or recognize all threats to our systems, or to implement comprehensive preventive measures against all cybersecurity risks. This is because, among other things:

•the techniques used in cyberattacks change frequently and are increasingly sophisticated, including due to attackers’ increasing use of AI, and may not be recognized until after the attacks have succeeded;

•cyberattacks can originate from a wide variety of sources, including sophisticated threat actors involved in organized crime, sponsored by nation-states, or linked to terrorist or hacktivist organizations; or

•third parties may seek to gain access to our systems either directly or using equipment or security passwords belonging to employees, customers, third-party service providers or other users (such as through social engineering and phishing attacks), similar to the tactics used in our cyber incident in July 2025.

In addition, given the nature of complex systems and services like ours, we have a large and ever-growing global attack surface comprised of numerous interconnected components, each with their own vulnerabilities and risks. While we have many security tools that we deploy across our infrastructure that actively scan our products and identify and track security vulnerabilities, we are unable to comprehensively guarantee that we can apply patches or ensure measures are in place to mitigate all such vulnerabilities before vulnerabilities can be exploited by a threat actor.

Unauthorized disclosure, loss or corruption of our data or inability of our customers to access our systems could materially disrupt our operations, subject us to substantial regulatory and legal proceedings (including class actions) and liability (such as penalties, fines and required changes to business practices), result in a material loss of business and/or significantly harm our reputation and competitiveness.

We may not be able to timely address the consequences of a cybersecurity incident because a successful breach of our computer systems, software, networks or other technology assets could persist for an extended period of time before being detected due to, among other things:

•the breadth and complexity of our operations and the high volume of transactions that we process;

•the large number of customers, counterparties and third-party service providers with which we do business;

•the proliferation and increasing sophistication of cyberattacks;

•the possibility that a malicious third party compromises the software, hardware or services that we procure from a service provider unbeknownst to both the provider and to TransUnion; or

•the possibility that a third party, after establishing a foothold on an internal network without being detected, might obtain access to other networks and systems.

The extent of a particular cybersecurity incident and the steps that we may need to take to investigate it may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed and full and reliable information about the incident is known. While such an investigation is ongoing, we may not necessarily know the extent of the

24

Table of Contents

harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, any or all of which could further increase the costs and consequences of a cybersecurity incident.

Due to concerns about data security and integrity, a growing number of legislative and regulatory bodies around the world have adopted consumer notification, public disclosure and other requirements in the event that consumer information is accessed by unauthorized persons and additional regulations regarding the use, access, accuracy and security of such data are possible. For example, in the United States alone, we are subject to federal and state laws that provide for more than 50 disparate notification regimes, some of which also provide for statutory damages and private rights of action for plaintiffs who experience certain types of data breaches. Jurisdictions outside the U.S., including in Europe, have strict notification and reporting requirements that are time sensitive and subject to large penalty provisions. Any failure to comply with the complexities of these various global regulations could subject us to regulatory scrutiny and substantial liability.

If we experience system failures, personnel disruptions or capacity constraints, or our customers do not modify their systems to accept new releases of our distribution programs, the delivery of our services to our customers could be delayed or interrupted, which could harm our business and reputation and result in the loss of revenues or customers.

Our ability to provide reliable service largely depends on our ability to maintain the efficient and uninterrupted operation of our computer network, systems and data centers, some of which have been outsourced to third-party providers. In addition, we generate a significant amount of our revenues through channels that are dependent on links to telecommunications providers. Our systems, personnel and operations could be exposed to damage or interruption from fire, natural disasters, pandemic illness, power loss, war, terrorist acts, civil disobedience, telecommunication failures, computer viruses, DDoS attacks or human error. We may not have sufficient redundant operations to cover a loss or failure of our systems in a timely manner. Any significant interruption could severely harm our business and reputation and result in a loss of revenue and customers. Additionally, from time to time we send our customers new releases of our distribution programs, some of which contain security updates. Any failure by our customers to install these new releases could expose our customers to computer security risks.

We could lose our access to data sources which could prevent us from providing our services.

Our services and products depend extensively upon continued access to and receipt of data from external sources, including data received from customers, strategic partners and various government and public records repositories. In some cases, we compete with our data providers. Our data providers could stop providing data, provide untimely data or increase the costs for their data for a variety of reasons, including a perception that our systems are insecure as a result of a data security incidents, budgetary constraints, a desire to generate additional revenue or for regulatory or competitive reasons. We could also become subject to increased legislative, regulatory or judicial restrictions or mandates on the collection, disclosure or use of such data, in particular if such data is not collected by our providers in a way that allows us to legally use the data. If we were to lose access to this external data or if our access or use were restricted or were to become less economical or desirable, our ability to provide services could be negatively impacted, which would adversely affect our reputation, business, financial condition and results of operations. We cannot provide assurance that we will be successful in maintaining our relationships with these external data source providers or that we will be able to continue to obtain data from them on acceptable terms or at all. Furthermore, we cannot provide assurance that we will be able to obtain data from alternative sources if our current sources become unavailable.

If we fail to maintain and improve our systems, our data matching technology, and our interfaces with data sources and customers, demand for our services could be adversely affected.

In our markets, there are continuous improvements in computer hardware, network operating systems, programming tools, programming languages, operating systems, data matching, data filtering and other database technologies and the use of the internet. These improvements, as well as changes in customer preferences or regulatory requirements, may require changes in the technology used to gather and process our data and deliver our services. Our future success will depend, in part, upon our ability to:

•internally develop and implement new and competitive technologies;

•migrate our U.S. credit business to OneTru;

•deliver OneTru capabilities in international markets;

•use leading third-party technologies effectively;

•respond to changing customer needs and regulatory requirements, including being able to bring our new products to the market quickly; and

•transition customers and data sources successfully to new interfaces or other technologies.

We cannot provide assurance that we will successfully implement new technologies, cause customers or data furnishers to implement compatible technologies or adapt our technology to evolving customer, regulatory and competitive requirements. If

25

Table of Contents

we fail to respond, or fail to cause our customers or data furnishers to respond, to changes in technology, regulatory requirements or customer preferences, the demand for our services, the delivery of our services or our market reputation could be adversely affected. Additionally, our failure to implement important updates could affect our ability to successfully meet the timeline for us to generate cost savings resulting from our investments in improved technology. Failure to achieve any of these objectives would impede our ability to deliver strong financial results.

Risks Related to Laws, Regulations and Government Oversight

The CFPB has supervisory and examination authority over our business and may initiate enforcement actions with regard to our compliance with federal consumer financial laws. Actions by the CFPB or other regulators against us or our executives could result in increased operating costs, reputational harm, payment of damages and civil money penalties, injunctive relief and/or restitution, any of which could have a material adverse effect on our business, results of operations and financial condition.

The CFPB has broad authority over our business. This includes authority to issue regulations under federal consumer financial protection laws, such as under the FCRA and other laws applicable to us and our financial customers. The CFPB is authorized to prevent “unfair, deceptive or abusive acts or practices” through its regulatory, supervisory and enforcement authority.

The CFPB conducts examinations and investigations and may issue subpoenas and bring civil actions in federal court for violations of the federal consumer financial laws including the FCRA. In these proceedings, the CFPB can seek relief that includes: rescission or reformation of contracts, restitution, disgorgement of profits, payment of damages, limits on activities and civil money penalties of up to $1.0 million per day for knowing violations. The CFPB conducts periodic examinations of us and the consumer credit reporting industry, which could result in new regulations or enforcement actions or proceedings. Actions by the CFPB could result in requirements to alter or cease offering affected products and services, making them less attractive and restricting our ability to offer them.

For example, in January 2017, as part of a Consent Order (“2017 Consent Order”) entered into with the CFPB, we agreed among other things, to implement certain practice changes in the way we advertise, market and sell products and services offered directly to consumers. On April 12, 2022, the CFPB filed a lawsuit against us, Trans Union LLC, TransUnion Interactive, Inc. (collectively, the “TU Entities”) and the former President of our Consumer Interactive business, John Danaher, seeking restitution, civil money penalties, and injunctive relief, among other remedies, and alleging that the TU Entities violated the 2017 Consent Order and engaged in deceptive acts and practices in marketing the TransUnion Credit Monitoring product, among other allegations. On February 28, 2025, the CFPB, the TU Entities and Mr. Danaher filed with the Court a joint stipulation to voluntarily dismiss the lawsuit with prejudice, and the Court dismissed the lawsuit on March 21, 2025. During the first quarter of 2025, we adjusted the $56.0 million accrual previously recorded for this matter to zero, as the loss was no longer probable.

In March 2024, we received a Notice and Opportunity to Respond and Advise (“NORA”) letter from the CFPB, informing us that the CFPB’s Enforcement Division was considering whether to recommend that the CFPB take legal action against us related to our dispute handling practices and procedures. The NORA letter alleged that Trans Union LLC violated the FCRA’s requirements to conduct a reasonable reinvestigation of disputed information and follow reasonable procedures to assure maximum possible accuracy of the information in consumer reports, and the Consumer Financial Protection Act’s prohibition of unfair, deceptive, and abusive acts or practices. On July 12, 2024, the CFPB Enforcement Division advised us that it had obtained authority to pursue an enforcement action against us seeking specific injunctive relief provisions and civil money penalties. We were previously engaged in active discussions with the CFPB regarding this matter, but given recent changes in CFPB leadership, our engagement with the agency on this matter has paused. We cannot provide an estimate of when, or if, such engagement will resume. We further cannot provide assurance that the CFPB will not ultimately commence a lawsuit against us in this matter, nor are we able to predict the likely outcome of this matter.

See Part II, Item 8, “Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements,” Note 20, “Contingencies” for information regarding the CFPB matter.

Additionally, on October 5, 2023, we entered into a Consent Order with the CFPB and the FTC to resolve alleged violations of the FCRA relating to our Tenant and Employment screening business, TransUnion Rental Screening Solutions, Inc., and Trans Union LLC. Pursuant to the Consent Order, we paid $11.0 million in redress and $4.0 million in civil money penalties and implemented certain business process changes. We remain subject to and in compliance with the Consent Order, and any failure to adhere to its requirements could result in additional regulatory action or penalties.

In recent years, the consumer reporting industry has been subject to heightened scrutiny. If this trend continues, it could result in more regulatory and legislative scrutiny of the practices of our industry and additional regulatory enforcement actions and litigation, which could adversely affect our business and results of operations.

Our compliance costs and legal and regulatory exposure could increase materially if we are targeted by the CFPB for additional enforcement actions, or if the CFPB or other federal, state or local regulators enact new regulations, change regulations that

26

Table of Contents

were previously adopted, modify through supervision or enforcement past regulatory guidance, or interpret existing regulations in a manner different or stricter than have been previously interpreted. For example, the CFPB recently issued guidance that indicates increased focus on consumer reporting agencies’ compliance with the accuracy and dispute obligations under the FCRA with respect to rental information. Although we have committed resources to enhancing our risk and compliance programs, actions by the CFPB or other regulators against us or our current or former executives could result in increased operating costs, reputational harm, payment of damages and civil monetary penalties, injunctive relief and/or restitution, any of which could have a material adverse effect on our business, results of operations and financial condition.

Our business is subject to various governmental regulations, laws and orders, compliance with which may cause us to incur significant expenses or reduce the availability or effectiveness of our solutions, and the failure to comply with which could subject us to civil or criminal penalties or other liabilities.

Our businesses are subject to regulation under the FCRA, the GLBA, the DPPA, HIPAA, HITECH, the Dodd-Frank Act, the FTC Act and various other international, federal, state and local laws and regulations. See “Business-Legal and Regulatory Matters” for a description of select regulatory regimes to which we are subject. These laws and regulations, which generally are designed to protect the privacy of the public and to prevent the misuse of personal information available in the marketplace, are complex, change frequently and have tended to become more stringent over time. We already incur significant expenses in implementing programs designed to ensure compliance with these laws.

Currently, public concern is high with regard to the operation of consumer reporting agencies in the United States, as well as the collection, use, accuracy, correction and sharing of personal information, including Social Security numbers, dates of birth, financial information, medical information, department of motor vehicle data and other personal data.