Morningstar

United States · www.morningstar.com · 11 vendors

Morningstar, Inc. is an American financial services firm that provides independent investment research, data, and analytics. It offers a wide array of products and services, including investment management, credit ratings, and software platforms, to individual investors, financial advisors, asset managers, and institutional investors globally.

Resilience scores

Disruption prediction

Morningstar has an estimated 11% probability of disruption in the next 6 months.

4 of Morningstar's 11 vendors monitored for disruptions.

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 11 sub-vendors.

Insights

Last updated 2026-09-13 · revision 2

11 direct vendors, 150 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Morningstar exhibits exceptionally high migration readiness, largely driven by its highly modern and cloud-native internal tech stack. The extensive use of Amazon Web Services (AWS) and Microsoft Azure indicates a strong existing cloud presence and potentially a multi-cloud strategy, which significantly enhances portability and reduces single-cloud vendor lock-in. The adoption of Kubernetes and Docker demonstrates a mature approach to containerization and orchestration, making applications highly portable and scalable across different cloud environments. Furthermore, the use of GraphQL and REST APIs, alongside distributed systems like Apache Kafka, suggests a microservices-oriented architecture that is inherently modular and well-suited for incremental migration. The modern data stack, including Apache Spark, Snowflake, Elasticsearch, and PostgreSQL, further supports a cloud-compatible and flexible data infrastructure. Despite these strengths, certain challenges and unknowns exist. Specific details on the regulatory environment are not provided, meaning potential compliance requirements for data migration and operations in new environments are unknown. Similarly, data residency requirements are not specified, which can be a critical factor influencing migration strategies and target regions. The absence of data on revenue concentration or growth history prevents an assessment of the company's financial capacity to fund a large-scale migration effort. While the tech stack inherently reduces infrastructure vendor lock-in, the contradictory vendor data ("Total Vendors: 0" vs. 22 services from 3 countries) makes it difficult to fully assess application or service-level vendor lock-in beyond the infrastructure layer. The "Vendor Lock-in Risk" remains unknown for specific services.

Compliance

11 in-scope frameworks identified; showing 3.

ISAE 3000 (source) — Compliant

Morningstar provides ESG ratings, sustainability data, and investment research that are used by institutional investors for regulatory reporting (e.g., SFDR, EU Taxonomy). ISAE 3000 (Revised) — Assurance Engagements Other than Audits or Reviews of Historical Financial Information — is directly relevant to Morningstar's ESG and sustainability assurance services. Morningstar's Sustainalytics subsidiary (acquired 2020) provides ESG research and ratings that are subject to assurance reporting. The risk is Low because Morningstar has strong commercial incentives to maintain ISAE 3000 compliance for its ESG data products, and its institutional clients require assured data for their own regulatory reporting.

Evidence: https://www.sustainalytics.com/esg-research, https://www.morningstar.com/company/esg, https://www.esma.europa.eu/supervision/credit-rating-agencies

MiFID II — Compliant

Morningstar operates regulated investment services in the EU through its subsidiary Morningstar Investment Management Europe Ltd, which is authorized and regulated by the FCA (UK) and passported/registered with EU regulators. Morningstar also provides investment research and data services subject to MiFID II unbundling rules (research payment requirements). The risk is Medium because MiFID II compliance is an ongoing operational requirement with regular supervisory oversight, and the complexity of research payment rules (RPA/CSA arrangements) creates compliance risk. ESMA and national competent authorities actively supervise MiFID II compliance.

Evidence: https://www.esma.europa.eu/regulation/trading/mifid-ii-and-mifir, https://register.fca.org.uk/s/firm?id=001b000000MfbxEAAR, https://www.morningstar.com/company/regulatory-disclosures

SEC Regulations — Compliant

Morningstar, Inc. is a publicly traded company on NASDAQ (MORN) and is subject to SEC reporting requirements including annual (10-K), quarterly (10-Q), and current (8-K) reports. Morningstar Investment Management LLC is registered as an Investment Adviser with the SEC. The risk is Medium because SEC enforcement is active and Morningstar's investment advisory and data services are subject to ongoing SEC examination. Historical SEC inquiries into Morningstar's ratings practices have been resolved.

Evidence: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=MORN&type=10-K&dateb=&owner=include&count=40, https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=MORN&type=&dateb=&owner=include&count=40&search_text=, https://adviserinfo.sec.gov/firm/summary/160621

Financials

Three-year financials

Financial Resilience Score: 8/10

Morningstar exhibits strong financial resilience underpinned by a predominantly subscription- and license-based revenue model spanning Morningstar Data, Direct, Advisor Workstation, PitchBook, and DBRS Morningstar credit ratings. This recurring revenue base delivers high visibility and stability, while a diversified portfolio across Data & Analytics, PitchBook, Wealth, Credit, Retirement, Sustainalytics, and Indexes reduces single-product concentration risk. The company's deep integration into advisor and institutional workflows creates meaningful switching costs and brand equity. Financial performance has been robust, with revenue growing from ~$1.87B in 2022 to ~$2.28B in 2024 and operating income expanding dramatically from ~$111M to ~$415M over the same period, reflecting significant operating leverage after 2023 restructuring. Historical cash generation has been strong, enabling debt paydown from the DBRS acquisition and steady dividend growth since 2010. Founder Joe Mansueto's continued large ownership stake aligns long-term interests. Key risks include market sensitivity of asset-based fees, concentration risk in PitchBook as private capital markets slow, elevated leverage from prior acquisitions (peaked above $1B), regulatory scrutiny of NRSRO credit ratings and ESG/sustainability ratings, FX exposure with ~1/3 of revenue international, and competitive pressure from S&P Global, MSCI, Moody's, FactSet, Bloomberg, and Preqin.

Key strengths: High recurring/subscription revenue base with strong visibility, Diversified product portfolio across five reportable segments, Deep customer switching costs and strong brand embedded in workflows, Strong historical free cash flow generation, Founder/insider ownership aligns long-term interests, Dramatic 2024 margin expansion (operating margin from 5.9% to 18.2% over 3 years), 20-year revenue CAGR of ~12% (10x growth since 2005 IPO)

Risk factors: Market sensitivity of asset-based fees in Investment Management, Indexes, and Wealth, PitchBook concentration risk if private capital markets slow, Elevated leverage from DBRS Morningstar and Sustainalytics acquisitions, Regulatory scrutiny of NRSRO credit ratings and ESG/sustainability ratings in US and EU, FX exposure with ~1/3 of revenue international, Intense competition from S&P Global, MSCI, Moody's, FactSet, Bloomberg, Preqin

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report