EU: ESMA consults on rules for ESG rating providers with important details for those seeking authorisation

ESMA has published its consultation paper on draft RTS under the ESG Rating Regulation (“ERR”). These will be important RTS for any groups planning on establishing a new ESG rating provider, which will need to be authorised and regulated by ESMA. Overall, ESMA is proposing introducing extensive requirements for ESG rating providers, so any EU entities wishing to become authorised will need to take these into account as part of their ERR implementation plans.

In addition, the RTS will still be of interest to users of ESG ratings, to understand what the transparency and authorisation landscape will look like for ESG ratings providers.

ESMA has proposed three separate draft RTS, covering the following obligations that apply to ESG rating providers:

• The information that should be provided in the applications for authorisation and recognition.
• The measures and safeguards that should be put in place to mitigate risks of conflicts of interest within ESG rating providers who carry out activities other than the provision of ESG ratings.
• The information that they should  disclose to the public, rated items and issuers of rated items, as well as users of ESG ratings.

Next steps

The consultation closes on 20 June 2025. ESMA expects to publish a final report in Q4 2025 and submit the draft standards to the European Commission by 2 October 2025. 

ESMA’s press release is here.

Applications for authorisation and recognition

Under the ERR, any EU entities intending to operate as ESG rating providers must apply to be authorised as such by ESMA (“Authorisation Application”). In addition, any non-EU entities which meet certain conditions (such as having a turnover under certain thresholds) may apply to ESMA to be recognised (“Recognition Application”, together with the Authorisation Application, the “Applications”), which would permit them to provide ESG ratings into the EU.

The first RTS sets out various requirements for the Applications and other applications which ESG rating providers may make to ESMA. The requirements and information required are extensive, indicating that ESMA will conduct robust diligence on any entities applying for authorisation/recognition and that any entities wishing to submit Applications will likely need to put aside material resources to do so and to leave sufficient time to prepare before the deadlines.

Information required to be submitted to ESMA

The RTS sets out the information which entities must submit to ESMA:

• for the purposes of Authorisation Applications and Recognition Applications;
• if an authorised ESG ratings provider wishes to endorse ESG ratings provided by a non-EU ESG rating provider within the same group (under Article 11, ERR); and
• if an authorised ESG ratings provider wishes to be authorised by ESMA to provide benchmarks (under Article 16(3), ERR).

Other requirements for applications

In addition, the RTS sets out various other requirements for Applications:

• Format: the Applications have to be submitted in a machine-readable format and accompanied by a document reference list. Each submitted document must be assigned a unique reference number.
• Letter: The Applications must include a letter signed by a member of senior management of the ESG ratings provider, attesting that the submitted information is accurate and complete (to the best of their knowledge).
• Number of employees: The RTS provides a standardised manner in which to calculate the number of employees.

Separation of activities

Under the ERR, ESG rating providers are prohibited from carrying out certain activities, such as consulting, credit rating, audit/assurance, investment, credit, insurance and benchmark services. The ERR contains certain exemptions from this prohibition for investment, credit, insurance and benchmark services, where specific safeguards are met to avoid conflicts of interest.

This RTS sets out further details on the exemption and safeguards to be met. These safeguards are fairly extensive and will require ESG rating providers to make changes to existing business models, if they intend to carry out the other activities.

• Safeguards relating to all prohibited activities: All ESG rating providers must ensure any employees carrying out rating activities are not involved in carrying out the prohibited activities by establishing Chinese walls (including physical separation measures in office spaces). This is intended to ensure that where entities within the same group share office space or maintain common reporting lines, analysis who carry out ESG rating activities still work independently from other employees carrying out the prohibited activities, to avoid any conflicts of interest arising.
• Safeguards for ESG rating providers carrying out investment services or insurance/reinsurance activities: Where ESG rating providers do intend to provide investment services or insurance/reinsurance activities, they are not required to establish a separate entity to do so. However, they must implement various measures (such as regular employee training on information barriers, information controls, policies on confidential information management, compliance monitoring activities, etc.), which are intended to mitigate conflicts of interest. ESG rating providers must also perform an annual assessment of the appropriateness of those measures, to be approved by the management body.
• Safeguards for ESG rating providers providing benchmarks: ESG rating providers which will also provide benchmarks are not required to establish a separate entity to do so. However, they must comply with various other safeguards, such as ensuring:
  • employee compensation remains unaffected by conflicts of interest related to benchmark activities;
  • ESG ratings are not solely reliant on the output of benchmarks; and
  • any actual/potential conflicts of interest are assessed and documented before entering into a contract for the provision of ESG ratings.

Disclosure to the public, users of ESG ratings, rated items and issuers of rated items

The ERR requires ESG rating providers to disclose information on their ESG rating methodologies to the public and to their users, intended to encourage transparency. This RTS sets out further details of the elements to be disclosed by ESG rating providers. These disclosure requirements are extensive and will mean ESG rating providers will have to provide full transparency on the process for preparing ESG ratings. Various of the disclosures are specific to the product lines of ESG ratings, and so ESG rating providers will need to prepare these every time they wish to launch a new ESG ratings product line.

• Rating product disclosures: ESG rating providers must disclose information on the exact scope of the ESG rating, including which specific risks/impacts are being assessed, how risk/impact materiality has been determined and whether the rating takes into account the Paris Agreement.
• General methodological disclosures: ESG rating providers will need to disclose specific information on their methodology, such as the time horizon of the data used for the rating, how new information is taken into account, a description of the ranking system used, an explanation of the relevance of scientific evidence to the methodology and the risks and limitations of any AI technologies employed. Significantly, the drafting suggests that this information will need to be disclosed for every different methodology used by the ESG rating provider.
• Limitations in data sources, methodologies and information: ESG rating providers must disclose any limitations in the methodologies, such as the use of assumptions or the availability of data.
• Organisational disclosures: ESG rating providers must disclose information on risks of conflict of interest, such as how they mitigate such risks and in which areas the risks occur. They must also disclose a chart showing the ownership links with other group entities, and details on how they ensure they meet the requirement to charge fees in a fair, reasonable, transparent and non-discriminatory manner. This is one of the most challenging requirements for ESG rating providers, given it impacts their pricing models.
• Specific methodological disclosures: ESG rating providers must disclose how they collect non-public data, and the means and frequency of engagement with rated items/issuers of rated items.
• Revision of data and methodologies: ESG rating providers must disclose the process and frequency for revisiting methodologies.