EU Commission proposes authorisation and new rules for ESG rating providers: expect tight timeframes, especially if you’re outside the EU

Following the publication of the UK’s proposal for the supervision of UK and third country ESG rating providers in March 2023, the European Commission has now published its awaited legislative proposal on the same topic as part of a wider package of measures on EU sustainable finance.

Whilst overall the proposals will not be a surprise, some of the provisions relating to the requirements for third country ESG rating providers (for example the sub EUR 12m turnover threshold to avoid the authorisation net and move into the lighter touch “recognition” framework), and the currently projected timetable and transitional periods will prove challenging for those having to grapple with the new regulatory framework.

Overview of the proposal:

There is an obligation for EU entities wishing to provide ESG ratings in the EU to become authorised to do so by ESMA. 

For third country ESG rating providers, the proposals allow for entities authorised or registered in their home state to provide ESG ratings in the EU, but this route is contingent upon the home state having been granted equivalence. Given most other jurisdictions do not regulate ESG ratings, equivalence could therefore be limited. So as alternative routes there are:

• “recognition” of third country ESG rating providers – however this is only available for those providers with an annual net turnover below EUR 12m on their ESG rating activities; or
• “endorsement” of ESG ratings of third country ESG rating providers by an affiliate EU authorised ESG rating provider – but this will not help existing ESG rating providers who will need to wait for their EU affiliate to obtain authorisation before endorsements can be made.

Transitional provisions give existing EU ESG rating providers a lead-in time to obtain authorisation (but it isn’t long and applications for authorisation will nevertheless need to be submitted within 12 months of the regulation’s in force date). EU SMEs will have longer. The transitional provisions do not cover third country ESG rating providers – these entities will therefore have only 6 months from the date of entry into force of the regulation to obtain recognition or use endorsement. Given the turnover limit for recognition, and the transitional provisions around authorisation of EU entities, it is not clear that recognition or endorsement will initially be a practical option for many third country ESG rating providers.

ESG rating providers are prohibited from undertaking conflicting activities – such as consulting, banking, insurance or reinsurance activities or other activities that create risks of conflicts of interest - with the risk of hefty fines (of up to 10% of annual net turnover) being imposed if conflicts of interest persist.

And some more on the detail:

Scope

The proposal covers all ESG rating providers in the EU and those from third countries that provide ratings within the EU. There is a carve-out for, among other things:

• private ESG ratings not intended for public disclosure;
• ESG ratings produced by EU regulated financial undertakings that are used for internal purposes or for providing in-house financial services and products;
• credit ratings;
• ESG ratings by national authorities;
• products or services that incorporate an element of an ESG rating;
• second-party opinions on sustainability bonds;
• the onward provision by a third party of an ESG rating from an authorised ESG rating provider; and
• subject to meeting certain conditions, ESG ratings produced by central banks. 

Unlike the IOSCO recommendations on the same topic, the Commission is not proposing to regulate raw data at the same time as ESG ratings - there is also a carve-out for the provision of raw ESG data that does not contain an element of rating or scoring, and is not subject to any modelling or analysis resulting in the development of an ESG rating (raw data is also outside of the scope of the UK HMT consultation on the topic). 

Unlike the UK HMT consultation, there is no carve out for academic research or journalism or ratings by not-for-profit entities.

“ESG rating” 

“ESG rating” is defined as an “opinion” or “score” (or combination of the two) to be “based on an established methodology and defined ranking system of rating categories”. This is narrower than the UK HMT proposed definition which includes any “assessments” (and could therefore include certain things we might think of as “ESG data”). The Commission’s proposal appears to be drawing on the rules for credit rating agencies which contain similar definitions. Unsurprisingly, ratings will be caught regardless of how they are badged (i.e. whether they are called “ratings” “scores” or anything else).

Authorisation 

1. EU ESG rating providers

ESG rating providers established in the EU will need to apply for authorisation to ESMA - an RTS (yet to be developed) will specify further information that will need to be provided as part of this application - and the proposal sets out the process for approval once an application has been submitted. Where authorisation is granted, the ESG rating provider will be included on a public ESMA register, and ongoing obligations will apply.  These ongoing obligations include:

• the use of rating methodologies for ESG ratings they provide;
• the review of those rating methodologies on an ongoing basis, and at least annually; and
• the disclosure on their website of the methodologies, models and key rating assumptions they use in their ESG rating activities.

Note the proposal does not intend to harmonise the methodologies used for the calculation of ESG ratings – simply to increase their transparency, similar to other regulatory regimes such as the Benchmarks Regulation.

The proposal also provides for authorised EU ESG rating providers to endorse the ESG ratings of a third country ESG rating provider belonging to the same group (subject to the satisfaction of certain conditions including (i) authorisation of this endorsement by ESMA and (ii) there being an objective reason why the third country ESG rating provider has to provide the ESG rating and why that ESG rating has to be endorsed for their use in the EU).

2. Third country ESG rating providers – a draconian proposal

It is clear from the proposal that the Commission intends to capture the cross border provision of ratings into the EU (this is similar to the HMT’s proposal in the UK). However, the Commission’s proposals are very narrow.

Provision is made for equivalence with third countries – but the availability of this route will largely be determined by the timeline for development of a framework for the regulation of ESG rating providers in those third countries - and whether the framework is such that the Commission (having regard to compliance of the third country framework with the IOSCO recommendations for ESG Ratings published in November 2021) grants equivalence.

An alternative route for “recognition” of third country ESG rating providers envisages those providers submitting an application for recognition to ESMA and complying with the requirements set out in the regulation. However, this route, as currently drafted, is only available for those third country providers whose annual net turnover on their ESG rating activities is below EUR 12 million for 3 consecutive years – this is very restrictive (such turnover thresholds for third countries do not, for example, apply in other similar regimes such as in the context of benchmarks).

For third country ESG rating providers that exceed the annual turnover threshold, the routes under the proposal are either to establish an ESMA authorised affiliate to issue the ratings or to establish an EU affiliate and get it authorised as an EU ESG rating provider to be able to endorse the ratings of that third country provider, and to continue to meet the conditions for such endorsement (being compliance with the regulation’s ongoing conditions for authorisation). For existing third country ESG rating providers seeking to take this route, there will inevitably be a timing issue in terms of an EU ratings provider obtaining its own ESMA authorisation and then submitting an endorsement application for the relevant ratings, and meeting the conditions for endorsement.

Transitional provisions

1. EU ESG rating providers

For EU ESG rating providers that are already providing services at the date of entry into force of the regulation, transitional provisions provide for a period of adjustment – but they don’t give providers long.  If the intention is to continue providing ESG ratings after the regulation enters force, a notification of such intention must be made to ESMA within 3 months of that in force date. An application for authorisation must then be submitted within 1 year of the in-force date.

EU SMEs have longer – whilst the same obligation applies to notify ESMA of their intentions within 3 months of the regulation's in force date, SMEs will have 2 years from the regulation’s application date (i.e. within 30 months of the in-force date) to submit their applications for authorisation. SMEs entering the market after the entry into force of this regulation will also benefit from a more relaxed timetable for authorisation – whilst a notification must be provided to ESMA prior to commencing offering their services, the SME would have 12 months from the date of that notification to submit its authorisation application.

2. Third country ESG rating providers

The transitional provisions do not cover third country ESG rating providers applying for recognition – such entities will therefore have only 6 months from the date of entry in force of the regulation to obtain recognition if they wish to continue providing ESG ratings in the EU. Given that an RTS will need to be developed after the regulation enters force to determine the form and content of such an application for recognition, this may prove problematic for those wishing to take this route.

An entity seeking to take the route of endorsement will in effect be unable to provide ESG ratings in the EU until its EU affiliate has obtained its own authorisation under the new regime so that it is able to act as the endorser (and there is an up to 90 day period for the rating endorsement application/authorisation process).

Conflicts of interest  

The proposal lays down requirements for the management of potential conflicts of interest. In particular, ESG rating providers shall be prohibited from offering a number of other services including consulting services, credit ratings, benchmarks, investment activities, audit, or banking, insurance and reinsurance activities. They will also need to ensure that the provision of any other services does not create risks of conflicts of interest within its ESG rating activities. 

Existing ESG rating providers will therefore need to scrutinise their other activities to avoid falling foul of these rules. There are also proposals for robust governance arrangements to manage potential conflicts of interest within their structure or from employees.   

Entities risk being fined if conflicts persist (fines for infringement of the Regulation could amount up to 10% of total annual net turnover, and periodic penalties could additionally be imposed).

Timing and next steps 

The proposal will go through the EU legislative process, which generally takes at least one year to complete, and which may be delayed due to the European Parliament elections in May 2024.

The regulation will enter into force on the 20th day following its publication in the Official Journal, and shall apply from 6 months after that date.

The proposals for third country ESG rating providers will be a particular point to watch as the proposal begins its passage through the legislative process. 

The Commission legislative proposals can be found here.

Contacts 

If you would like to discuss any of the above proposals, please reach out to the contacts on this post, or to your usual Linklaters contact.