UK: FCA publishes PS26/22, finalising its regime for the regulation of ESG rating providers

In the next step in its work to improve transparency, reliability and comparability in the ESG ratings market (thereby helping investors make better-informed decisions), the FCA has now finalised its tailored regulatory framework for ESG ratings providers.  The FCA’s final policy statement (PS26/22), published on 3 November 2026, follows a consultation launched in December 2025 (see our blog post here) and Treasury legislation to formalise the FCA’s remit over such ratings providers.  From 29 June 2028, when the new framework takes effect, firms providing ESG ratings in the UK will need FCA authorisation and the relevant permission before carrying on that activity, unless an exemption applies.  Already authorised firms should consider whether they need a variation of permission. The authorisation gateway will open on 24 June 2027, with separate application windows based on firms’ forecast revenue from ESG ratings activities. Firms should begin preparing now and apply as early as reasonably practicable within their applicable window. The FCA’s pre-application support service (PASS) will be available from February 2027. 

The headlines

The FCA has maintained most of the proposals consulted on and has made limited changes – with its main updates being to the transparency and stakeholder engagement proposals, to improve clarity, proportionality and support practical implementation. In other areas, the FCA has sought to provided further clarification as guidance in the PS, including illustrative good- and poor-practice examples for managing conflicts of interest. 

The immediate task for firms is to assess whether their products and services fall within scope, identify the entity requiring authorisation or a variation of permission, and carry out a gap analysis against the final requirements. Preparations should address governance, resources, systems and controls, disclosures, conflicts management and stakeholder engagement.

The detail

Baseline standards: the FCA is proceeding broadly as consulted on: 

• Applying relevant existing Handbook requirements, including the Threshold Conditions, Principles for Businesses, Systems and Controls requirements, General Provisions and financial crime provisions and guidance. These requirements will apply proportionately, reflecting the nature, scale and complexity of a firm’s activities. 

• The FCA is not introducing bespoke prudential requirements. 

• ESG rating providers will be subject to the Senior Managers and Certification Regime as Core firms, including the Senior Managers Regime, Conduct Rules, fitness and propriety requirements, and the Certification Regime where applicable. The FCA expects relatively few employees, if any, to perform existing Certification Functions and is not introducing a bespoke ESG ratings Certification Function or prescribed responsibility. 

• The Consumer Duty will not apply to ESG rating activities. However, the framework includes Duty-aligned measures, such as requiring disclosures to be clear and understandable for their intended audience. That audience may include firms in the distribution chain which are themselves subject to the Duty; responsibility for complying with the Duty remains with those firms.

Transparency: The FCA is proceeding with a tiered transparency framework as consulted on, with some key updates intended to improve clarity and proportionality. This will comprise:

• minimum public disclosure requirements – here the FCA has made targeted additions to the disclosure requirements as previously consulted on, including policies and processes on data quality and verification, and the use of estimates, rating review frequency, methodology versioning (and factors relevant to material methodology changes)

• additional disclosures for direct users – here the FCA has refined its approach, including by adding specific disclosure requirements for peer groups and for what firms consider to be a material change to their ESG rating or its data.  Certain other disclosure requirements have also been modified: (i) at rating‑level, the rules clarify that firms must only disclose the data that materially influence an ESG rating, not all underlying data (ii) at product‑level, the rules now require a detailed rather than full explanation of the methodology.  The FCA’s expectations on the level of detail expected (e.g. on data and inherited ratings) has been clarified, and the final rules remove the previously proposed disclosures of unresolved factual challenges and the expected timeframe for the next rating review. Finally the FCA has introduced guidance clarifying that rating‑level disclosures can be provided at product‑level where they apply across that entire product. Rating‑level disclosures are still required where information is specific to an individual rating

• disclosure on request for rated entities – here, responding to feedback from some ESG rating providers that providing detailed disclosures and notifications to rated entities would create significant operational burden, the FCA is changing its approach.  Rated entities that are not ESG rating users will now be entitled to receive additional detailed disclosures upon request rather than by default (with an obligation for providers to make clear how rated entities can request those disclosures both publicly and when notifying them that they plan to make available a new ESG rating

The rules retain protections for qualifying trade secrets and certain third-party proprietary information. They also address onward sharing: where a provider permits a user to share a rating, relevant explanatory disclosures must generally be capable of accompanying it, or be provided directly to the third party, subject to the applicable conditions and exceptions.

Governance and systems and controls: the FCA has retained its governance approach (including a requirement to have an appropriate UK presence to support effective oversight and accountability) and outsourcing and oversight as consulted on. For systems and controls, targeted refinements aim to reduce operational burden. Providers must keep records that will enable them to explain and evidence how an ESG rating was produced and how the final outcome was determined, rather than reproduce the rating. Providers must also give users advance notice of material changes to methodologies (with new guidance setting out examples of factors that firms may consider when assessing whether a methodology change is ‘material’), but they will not be required to provide advance notice to rated entities. 

Conflicts of interest: The FCA is retaining a principles-based approach to identifying, preventing, managing and, where necessary, disclosing conflicts. Chapter 5 includes illustrative examples covering consulting services, group structures and issuer-pays models. These are not a prescriptive checklist: firms remain responsible for assessing the risks arising from their own business models and implementing appropriate controls.

Disclosure is a last resort. Where controls are insufficient to ensure, with reasonable confidence, that material risks of damage to a rating’s integrity or independence will be prevented, the provider must publish the required information about the conflict and its mitigation. Disclosure does not replace the obligation to maintain effective prevention and management arrangement.

For personal transactions, the FCA has replaced the proposed application of COBS 11.7 with tailored requirements. Providers must maintain proportionate preventive arrangements and a written policy identifying transaction restrictions and the persons to whom they apply. Active monitoring of employee trading is not universally required, but firms should assess whether it is an appropriate control for their risks.

Stakeholder engagement and complaints: the FCA is proceeding as consulted on for complaints (including that the jurisdiction of the Financial Ombudsman will not be extended, and there will be no FSCS protection, to cover ESG rating activities). The rules have been refined for stakeholder engagement. In particular, the FCA has:

• Updated the timelines for ESG rating providers to notify rated entities, to provide more clarity

• Removed the requirement for providers to wait for feedback from rated entities before publishing a rating

• Clarified how the stakeholder engagement rules apply to different product types.

Currently regulated products and services involving ESG ratings

The Treasury’s legislation to bring ESG ratings into the FCA’s regulatory perimeter excludes ratings produced in the course of carrying on another regulated activity, except where they are provided as a standalone product or service. In its 2025 CP, the FCA said it would assess whether existing standards in its Handbook adequately address potential harms arising from the provision of ESG ratings as part of other regulated activities and consult on any changes if needed. With having received mixed consultation feedback, the FCA intends to continue to assess whether further action might be needed in certain areas:

• Asset managers: The FCA plans a targeted desk-based review of proprietary ESG ratings used in fund marketing materials. It has not concluded that additional requirements are necessary, but further intervention remains possible.

• Benchmark administrators: As the Treasury’s Benchmark Regime reform is ongoing, further action is not necessary at this stage, but the FCA intend to keep this in review. 

• Investment research: The FCA intend to monitor for any emerging harms relating to the use of ESG ratings in this market. 

• Investment consultants (who may produce and provide ESG ratings to clients and potential investors): the FCA are continuing to engage with relevant designated professional bodies (DPBs) to consider whether changes to the Handbook or DPB rules are needed to achieve equivalent outcomes. 

The Authorisation Process

Under an official FCA direction the FCA has set two application windows, based on forecast revenue from providing ESG ratings during the 12 months following submission:

• £500,000 or more (larger firms): apply between 24 June and 29 July 2027.

• Less than £500,000: apply between 30 July and 31 August 2027.  

Transitional arrangements and run-off

Firms applying within their relevant application period whose applications remain undetermined on 29 June 2028 may continue business, including taking on new business, subject to the statutory conditions and any relevant FCA direction. This protection is not indefinite: the statutory saving and transitional provisions expire on 29 June 2029.

Missing the relevant application window does not prevent a later application. However, late applicants who have not obtained the required permission when the regime takes effect, and applicants whose applications are refused or withdrawn, may qualify only for a limited run-off exemption. This permits activity necessary to perform pre-existing contracts or maintain pre-existing public ratings, rather than taking on new business, and is subject to statutory conditions and the same 29 June 2029 expiry. Firms which never apply cannot rely on these transitional arrangements and, unless another exclusion or exemption applies, must cease providing in-scope ESG ratings by 29 June 2028.