Not a Financial Stock, a Data Empire: The Monopoly Truth Behind Risk-Pricing Infrastructure
Moody's, S&P Global, FICO, Equifax -- these companies don't make loans and don't bear asset losses, yet they have sustained operating margins above 30% for decades. They aren't financial companies; they are infrastructure suppliers for the entire financial system.
I. Why the Label "Financial Stock" Makes You Misread These Companies
To most Taiwanese investors, Moody's, S&P Global, FICO, and Equifax probably register as "American financial companies." That classification isn't wrong, but it has almost no explanatory power for investing purposes.
The real question is this: these companies don't make loans, don't bear asset losses, and don't broker transactions — yet they've generated operating margins above 30% for the past two decades, with ROE consistently more than double their peers'. If they're financial companies, why do their risk characteristics look nothing like a financial company's? And if they aren't financial companies, what exactly are they?
The answer: they are infrastructure providers for the financial markets. What they control isn't capital, but the entire set of standards and data behind "how risk gets defined, quantified, and priced." Put more bluntly: every bond issuance, every bank loan, and every investment decision made anywhere in the world has to pass through some checkpoint controlled by one of these companies. They don't participate in the transaction, but they collect a toll.
This series will analyze eight companies in this industry one by one: the ratings duopoly S&P Global and Moody's; the three credit-data giants Equifax, TransUnion, and Experian; the scoring-standard monopolist FICO; and the gatekeepers of investment decision-making systems, MSCI and FactSet. Before diving into individual company analyses, this overview's job is to build a framework: what is this industry's power structure, where does its moat come from, and why is it harder to break than it looks on the surface.
II. Four Layers: A Closed Loop of Risk Pricing
The information flow across the entire financial market can be broken into four layers, each controlled by a small handful of companies, forming a closed loop with each other.
The Gateway to Capital Markets — Rating Agencies
When a company or government wants to issue bonds in the international market, it must first obtain a credit rating. That sounds like a service, but it's really closer to institutional gatekeeping.
The reason is a system called NRSRO — Nationally Recognized Statistical Rating Organization — a qualification framework established by the U.S. Securities and Exchange Commission (SEC). In simple terms: only ratings issued by SEC-recognized rating agencies are accepted by regulated institutional investors such as regulators, pension funds, and insurance companies.
The consequence of this system: even if a more accurate AI model exists in the market, a bond issuer still has to obtain a rating from an NRSRO-recognized agency, because regulation requires it. There are currently ten NRSRO-recognized agencies globally, but in practice only three control the market: S&P Global Ratings, Moody's Investors Service, and Fitch Ratings, together holding over 95% market share.
Fitch Ratings is one of the three, but its parent, Hearst Corporation, is privately held and falls outside the scope of the individual-company analyses in this series. Understanding Fitch's existence is still essential to grasping the competitive structure of this layer — the coexistence of three oligopolists maintains just enough appearance of competition that regulators find it hard to intervene directly, while also making it nearly impossible for a new entrant to break the existing arrangement.
Worth noting: after the 2008 financial crisis, the Dodd-Frank Act explicitly required regulators to reduce their statutory reliance on NRSRO ratings. What was the actual effect of this reform? Fifteen years later, the market share of the three major rating agencies has risen, not fallen. This isn't because the reform failed — it's because no one has been able to answer a more fundamental question: if not NRSRO ratings, then what? The difficulty of loosening this structure isn't a matter of political will, but the absence of a ready-made alternative. The structure's very existence is its own best protection.
Personal Credit Data — Credit Bureaus
When a bank decides whether to lend to an individual, it needs that person's credit history: past repayment behavior, number of prior defaults, current debt load. Where does this data live? In the databases of three companies: Equifax, Experian, and TransUnion.
These three companies' business is commonly known as the "credit bureau." Through long-standing partnerships with banks, lenders, and credit card companies, they've continuously accumulated hundreds of millions of records of individual financial behavior. This data isn't publicly available, is tightly regulated by privacy laws in every country, and is the result of decades of accumulation.
The key point: this is an unreconstructable asset. Any new entrant, no matter how capable technically, cannot replicate these databases in a short period of time — because the data itself takes time to accumulate, and financial institutions' willingness to share data is built on long-term trust relationships and a regulatory compliance framework.
Some readers may ask: Amazon and Google hold consumer behavior data at a scale far larger than the credit bureaus — why can't they become an alternative source of credit risk assessment? Or: does Taiwan have an equivalent institution to the credit bureaus? Detailed answers to both questions appear in the Q&A at the end of this article.
The Standard for Quantifying Risk — FICO
Once the data exists, the next question is: how is it used?
When banks make lending decisions, they don't each build their own model or define their own risk standard — at least in the U.S. market, most banks rely on the same scoring system: the FICO Score. This credit scoring model, developed by Fair Isaac Corporation, is now used by over 90% of major U.S. lenders, and is designated as the mortgage underwriting standard by government-sponsored entities like Fannie Mae and Freddie Mac.
FICO's moat comes from a counterintuitive piece of logic: it's not because it's the most accurate — it's because it is the standard. Once a standard forms, it generates a self-reinforcing network effect. Banks use FICO because other banks use FICO; regulators accept FICO because the entire market uses FICO; and borrowers themselves start managing their own FICO score, because that's the number that lending decisions are based on.
This cycle is now being challenged. Rival VantageScore was jointly developed by the three major credit bureaus, and in 2023 Fannie Mae and Freddie Mac announced they would accept both FICO 10T and VantageScore 4.0. This is genuine competitive pressure and shouldn't be waved away. But it's important to understand: this is "coexistence," not "replacement." The fact that regulators chose to introduce a second standard rather than retire the first one is itself proof of how high the cost of replacing an existing standard is. FICO's market position has shifted from "the only standard" to "one of the primary standards" — that's a narrowing of the moat, not the disappearance of it.
Investment Decision Systems — MSCI and FactSet
The first three layers serve "providers and borrowers of capital" — bond issuers, banks, and borrowers. Layer four serves a different audience: the institutions that manage capital — funds, insurance companies, pension funds, and other asset managers.
MSCI controls the world's most widely used equity index systems, including MSCI World and MSCI Emerging Markets, with over $17 trillion in global assets benchmarked against MSCI indexes. FactSet provides portfolio analytics, financial data integration, and research workflow tools, serving investment banks and asset managers worldwide.
The moat at this layer comes from workflow embedding. When a fund manager's daily research, performance evaluation, and risk management are all built on a particular system, the cost of switching providers isn't just the license fee — it's rebuilding the entire investment process, migrating historical data, and the time cost of retraining the team. This depth of embedding keeps customer churn extremely low, giving the revenue structure the character of a SaaS subscription model.
III. Why This Structure Won't Be Broken
This is the question investors raise most often, and it's the single most critical step to understanding this industry.
Fintech disrupts the front end, not the back end.
Companies like Affirm and Klarna are indeed using their own models for credit assessment, bypassing part of the traditional credit-bureau inquiry process. But once these companies need to securitize their loan receivables or raise financing in the capital markets, they have to come back to the rating agencies' framework. Fintech disrupts "front-end lending decisions," but it hasn't disrupted the institutional structure of "back-end capital markets financing." In other words, fintech companies are customers of these infrastructure companies, not their replacements.
AI needs data, and the data sits with these companies.
It's true that AI models are getting more and more accurate at predicting credit risk. But an accurate model needs data to run on. A credit bureau isn't just a scoring agency — it's the original holder of the data. A new AI company can build a better model, but without a data license from the credit bureau, that model is an empty shell. In fact, these companies are integrating AI into their own products — they aren't AI's competitors, they're the data source AI needs. The same logic applies to the rating agencies: institutional status is the moat, and AI is just a tool.
Blockchain bypasses credit assessment but can't build an enforcement mechanism.
Mainstream decentralized finance (DeFi) lending protocols use an over-collateralization model, which fundamentally bypasses credit assessment rather than replacing it. On-chain credit scoring still faces two fundamental problems: on-chain behavioral data isn't yet sufficient to build a meaningful credit history, and real-world default-enforcement mechanisms are hard to execute on-chain. Without an enforcement mechanism, a credit score loses its meaning. Blockchain is a genuine long-term variable, but there are still unresolved structural obstacles between it and posing a real threat to these companies' core businesses.
New entrants face not just a technical challenge, but time itself.
The most fundamental barrier to entry in this industry is the compound lock-in of first-mover advantage and network effects. A rating agency's standing is built on decades of historical rating data and market trust; a credit bureau's database is the accumulation of decades of financial behavior; FICO's moat is the settled consensus of the entire market. None of this can be bought directly with capital — it's a structure built up over time. Breaking it doesn't require better technology; it requires the entire market to switch simultaneously, collectively, and in coordination — something that's nearly impossible in an industry as risk-averse as finance.
IV. Where the Real Risk in This Industry Lies
Having laid out the moat, it's also necessary to be honest about the risks. The most real risk in this industry isn't competition — it's the business cycle and geopolitics.
A rating agency's ratings revenue is highly dependent on bond issuance volume, and bond issuance is closely tied to the interest rate environment. When rates rise and issuance slows, rating agencies' transactional revenue declines — this was the main reason these companies' stock prices were under pressure between 2022 and 2023. They're building out subscription-based data businesses to offset this cyclicality, but the risk still exists. Credit bureaus face a different risk: the health of the housing market and consumer credit directly affects inquiry volume.
On the geopolitical front, China began building its own domestic rating system back in 2017, and some emerging markets are also pushing to de-Americanize their rating systems. The working language of international capital markets is still the dollar-denominated ratings system, and the more likely outcome of geopolitical fragmentation is "two systems running in parallel," not "the American system being replaced." The impact on S&P and Moody's is marginal, but worth tracking over the long term.
None of these risks change the industry's structural advantages, but they explain why these companies' stock prices come under pressure in certain cycles — and they're important background for the valuation discussions in the individual company analyses that follow.
V. How to Read This Series
The eight individual-company analyses in this series will unfold in order across the four-layer structure: first the ratings duopoly controlling the gateway to capital markets, SPGI and MCO; then the three credit bureaus holding personal credit data; then FICO, which defines the standard for quantifying risk; and finally MSCI and FactSet, which serve institutional investors.
Each article will answer the same four questions: exactly where this company's moat lies, how its revenue is structured, what its main risks are, and what framework should be used to think about its valuation.
But before reading the individual analyses, you need to accept this premise: these companies shouldn't be understood using the traditional financial-stock framework. They take no deposits, make no loans, and broker no trades — what they do is define the rules, hold the data, and set the standard — then collect a toll from the entire financial system.
Banks think they're doing risk management, but the data they use comes from a credit bureau, the score they apply comes from FICO, the rating on the bonds they issue comes from S&P or Moody's, and the benchmark for their portfolio comes from MSCI. Behind every decision is an invisible tollbooth.
An investor who can't see this layer will only ever understand the financial markets at the surface level.
Q&A: Detailed Answers to Advanced Questions
This question touches on a fundamental difference between "predictive power" and "regulatory acceptance." Retail big data does have a marginal contribution to credit risk prediction, and academic research supports this. But the U.S. Fair Credit Reporting Act (FCRA) explicitly requires that data used in credit decisions meet specific transparency and dispute-rights requirements — consumers have the right to know what data was used in a credit decision and the right to dispute it. Amazon's purchase history and Google's search behavior currently fall outside this compliance framework; entering it would require a complete overhaul of how they collect and use data legally.
An even more fundamental issue is commercial incentive. Credit-bureau margins are high, but so are compliance costs, litigation risk, and privacy-regulation pressure. Apple's and Google's business models are built on an image of "not looking like a bank, not looking like a government." Entering the credit-bureau business means accepting a completely different kind of regulatory scrutiny. This isn't a question of technical capability — it's a business strategy choice.
Yes — Taiwan's Joint Credit Information Center (JCIC) functionally corresponds to the three major U.S. credit bureaus, and querying a JCIC report is standard practice for banks before lending. But there are three key structural differences.
First, ownership is different. JCIC is a foundation jointly funded by Taiwan's financial institutions, regulated by the FSC, and is essentially shared infrastructure for the financial industry rather than a profit-maximizing entity. The three major U.S. credit bureaus are publicly traded commercial companies — a difference that directly shapes the expansion logic of their business models.
Second, the scope of data is different. U.S. credit bureau data has already expanded to include rental history, utility bills, and alternative data; JCIC's data scope is still mainly centered on lending and repayment data provided by financial institutions.
Third — and most directly relevant to Taiwanese investors — JCIC cannot be invested in. The U.S. trio's monopoly position translates directly into shareholder returns, while JCIC's structure means it's simply not an investable asset. This is the best possible contrast for understanding the commercial value of the U.S. credit bureaus.
They can, but only partially, and there are three inherent limitations. First, it only applies to existing customers. A bank genuinely has deep internal judgment about a corporate client it's worked with for twenty years, but for new customers, unfamiliar customers, or cross-region customers, no internal historical data exists, and the bank still has to rely on external credit data.
Second, regulation requires external verification. For capital adequacy calculations and stress tests, regulators require the use of standardized external ratings, not a bank's own internal assessment. This is a result of institutional design, not a choice banks make voluntarily.
Third, the cost structure doesn't support building it in-house. Building the capability to assess credit for hundreds of millions of borrowers requires enormous fixed costs. For a bank, paying for a credit bureau's service is far more economical than building the infrastructure itself. So a bank's own internal assessment and a credit bureau's service are complementary, not substitutes: internal assessment is used for deep judgment on core clients, while the credit bureau is used for standardized screening at scale.
The threat exists, but it's currently overstated. Mainstream DeFi lending protocols (Aave, Compound, etc.) use an over-collateralization model — the borrower must post collateral worth more than the loan amount. This bypasses the need for credit assessment, but it also severely limits who can be served — only people who already have assets can borrow, while the people who most need credit-based lending are precisely those with limited assets.
On-chain credit scoring (Spectral, ARCx, etc.) is trying to solve this problem, but faces two fundamental difficulties: first, the current volume of on-chain behavioral data is far from sufficient to build a meaningful long-term credit history; second, real-world default-enforcement mechanisms — collections, legal recourse, credit-record damage — are hard to execute on-chain. Without a credible enforcement mechanism, a credit score loses its binding power. Blockchain's more likely long-term impact isn't replacing the credit assessment system, but becoming one supplementary data source for the credit bureaus.
This is the structural risk most worth tracking over the long term. S&P Global and Moody's have long since obtained local regulatory recognition in every major global market, and under the EU's ESMA framework, the two remain the dominant players there too. But geopolitical fragmentation is genuinely carving up this market — the establishment of China's domestic rating system and the push toward de-Americanization in some emerging markets are gradually shifting this industry from "one single global system" toward "parallel regional systems."
The key point: the outcome of this fragmentation is "two systems running in parallel," not "the American system being replaced." A Chinese company that wants to issue dollar-denominated bonds in the international market still needs a rating from S&P or Moody's. For these two companies, the impact of regulatory fragmentation is a marginal loss of revenue, not a structural collapse of the moat. But if this trend continues for twenty years, the cumulative effect is worth factoring in as a discount in individual-company valuations.
This is currently the most concrete and most persuasive competitive threat to FICO, and it shouldn't be waved away. VantageScore was jointly developed by the three major credit bureaus, and in 2023 Fannie Mae and Freddie Mac announced they would accept both FICO 10T and VantageScore 4.0 — this is a real change to the market structure.
But two things need to be clearly distinguished. First, this is "coexistence," not "replacement" — the fact that regulators chose to introduce a second standard is itself proof of how high the political and market cost of replacing an existing standard really is. Second, FICO is simultaneously rolling out new versions and expanding its revenue base through data analytics services. The precise description is: FICO's moat has narrowed from "the only standard" to "one of the primary standards" — that's a reduction in the height of the moat, not its disappearance. The individual-company piece on FICO will discuss the specific valuation implications of this in detail.
📚 Data Empire Series | Full Guide
- Overview: Not a Financial Stock, a Data Empire — The Monopoly Truth Behind Risk-Pricing Infrastructure (This Article)
- Part 1: S&P Global (SPGI) — The Invisible Tollbooth of the Capital Markets (Coming Soon)
- Part 2: Moody's Corporation (MCO) — The Ratings Empire's Moat and Cyclicality (Coming Soon)
- Part 3: Equifax (EFX) — Custodian of Hundreds of Millions of Personal Financial Records (Coming Soon)
- Part 4: TransUnion (TRU) — The Third Pole of Credit Data (Coming Soon)
- Part 5: Experian (EXPN) — The Business Logic of the World's Largest Credit Bureau (Coming Soon)
- Part 6: Fair Isaac Corporation (FICO) — The Standard Is the Moat (Coming Soon)
- Part 7: MSCI Inc. (MSCI) — Definer of $17 Trillion in Assets (Coming Soon)
- Part 8: FactSet Research Systems (FDS) — Infrastructure for the Investment Workflow (Coming Soon)