The Next Regulatory Layer for ESG Rating Providers: ESMA Consults on Draft RTS

Building on our earlier analysis of the ESG Rating Regulation (February 2024), we now turn to its implementation phase: The European Securities and Markets Authority (ESMA) has published its consultation on draft Regulatory Technical Standards (Draft RTS) under the ESG Rating Regulation (EU) 2024/3005 (ESGRR). Released on 2 May 2025, these Draft RTS translate the Regulation’s high-level provisions into operational requirements.

This blogpost provides insight on the key provisions under consultation, covering market access (I), separation of activities (II), and disclosure (III), as well as remaining open questions (IV) and the timeline for the Draft RTS.

I. Market Access: Information requirements with only few specifications

The Draft RTS specify the information requirements for applications for authorisation (EU ESG rating providers), recognition (non-EU ESG rating providers) and endorsement (ESG ratings provided by non-EU ESG rating providers). This aims to ensure that relevant applications include sufficient information on how applicants comply with the requirements for the provision of ESG ratings set out in ESGRR.

As all applications must contain the information listed in Annex I of ESGRR, the Draft RTS specify the common information in a general part and the additional information required for applications for recognition and endorsement in separate parts, as is the case for applicants who also wish to provide benchmarks.

• Annex II: enumerates 14 categories of information (along with the information listed in Annex I of ESGRR) to be submitted for authorisation and recognition purposes (Art. 6 and 12 ESGRR), including information on the legal status and ownership structure, senior management, analytical resources, expected market coverage, activities, expected endorsements and specific measures implemented by the applicant to mitigate conflicts of interest. Applicants may satisfy documentation requirements by providing copies of internal policies and procedures;
• Annex III: contains additional information to be provided in an application for recognition (Art. 12 ESGRR);
• Annex IV: details further the information to be submitted for endorsement of ESG ratings issued by providers established outside the EU (Art. 11 ESGRR); and
• Annex V: details further information to be provided in a request to be authorised to provide benchmarks (Art. 16(3) ESGRR).

Overall, the Draft RTS contain few specifications that go beyond what already results from the ESGRR itself. This applies in particular to Annex II, which specifies the information that must be submitted with an application for authorisation as an ESG rating provider. Most noteworthy are perhaps the specifications with regard to information to be provided on procedures and methodologies of ESG ratings. In this regard, the Draft RTS provide that for each ESG rating product, a description of applicable procedures and methodologies, models and key assumptions must be provided, as well as the procedures for the review of each ESG rating product and the review of ESG rating methodologies, models and key rating assumptions. Noteworthy specifications are also made with regard to conflicts of interest policies, which shall contain or be accompanied, among others, by a description of the internal whistleblowing processes as well as the review and approval process for the onboarding of new clients.

II. Separation of Activities: Organisational and physical separation required

The Draft RTS on the separation of activities specify the measures and safeguards in relation to the separation requirements in Art. 16 ESGRR. Art. 16(1) ESGRR lays down the overarching principle that ESG rating providers shall not provide, in the same legal entity, consulting, credit rating, audit or assurance, investment, credit, insurance and benchmark services, to which Art. 16(2), (3) and (4) ESGRR set out partial derogations.

In ESMA’s view, the establishment of Chinese Walls through organisational and physical measures is key to enabling the segregation of functions and information barriers. Hence, all ESG rating providers should put in place separate organisational structures and working environments for employees and other persons involved in the rating process from any of the activities listed in Art. 16(1) ESGRR, and subject them to regular self-declarations attesting employees’ non-involvement in such activities.

With regard to the strict separation requirement in relation to consulting, credit ratings and audit and assurance activities, which must be carried out in a separate legal entity without exception, ESMA is concerned that a superficial separation may occur, wherein analysts from affiliated companies would continue to share office space, maintain common reporting lines or engage in intra-group outsourcing arrangements that undermine true independence of the ESG rating provider. Thus, ESMA believes that it is important that the Draft RTS go beyond mere legal formalities, explicitly requiring the implementation of physical separation measures that provide for segregated office space and secure access for employees and other persons directly involved in the rating process.

For ESG rating providers intending to provide investment services or credit, insurance and reinsurance activities through the same legal entity (Art. 16(2) ESGRR), the Draft RTS specify additional technical and internal control measures that must be implemented, including information security and network controls, internal policies and procedures, training, contractual measures and compliance monitoring checks. In addition, ESMA proposes an annual assessment of the appropriateness and sufficiency of such measures.

Moreover, for ESG rating providers intending to engage in the provision of benchmarks through the same legal entity (Art. 16(3) ESGRR), the Draft RTS specify organisational, physical, technical and internal control measures that must be implanted, including with regard to compensation and performance evaluation arrangements, the independent production and offering of ESG rating products and conflicts of interest assessment to be carried out before entering into contracts with clients.

III. Disclosures: Specifications particularly for public website disclosure

The Draft RTS on disclosures specify in greater detail the information that is disclosed by EGS rating providers under Art. 23 and 24 ESGRR in conjunction with Annex III of ESGRR.

ESMA proposes to consolidate all disclosures to be made to the public (website disclosure under Art. 23 ESGRR), users of ESG ratings, rated items and issuers (disclosures under Art. 24 ESGRR that are specific to each rating distributed) into one single RTS specifying further the information to be disclosed.

ESMA considers it important in this respect to highlight that disclosures to be made in accordance with point 1 of Annex III ESGRR (as part of the website disclosure under Art. 23 ESGRR) are additional to the disclosure of the ESG rating provider’s methodology, models and key rating assumptions. For the disclosures to be made to the public, ESMA considers that the added value of the RTS is to provide information supplementary to that, that is contained within methodologies, models and key rating assumptions.

In addition, ESMA proposes a common sequence for the information to be disclosed to the public. For this purpose, Table 1 in the Annex of the Draft RTS specifies a sequence and structure according to which the public website disclosures should be made, whereby disclosure items are grouped by topic including:

• Rating Product Disclosures
• Basic Methodological Disclosures
• Limitations in Data Sources, Methodologies, and Information
• Organizational Disclosures

For example, as regards the limitations, ESG rating providers must publish information on:

• The availability or consistency of data used in the rating process;
• Engagement with rated entities and issuers;
• Completeness, timeliness, and accuracy of information;
• Use of assumptions, proxy reference points, and data estimation;
• Other restrictions in the data or methodologies used.

It is worth noting that ESMA has not specified further the disclosure requirements for each item under points 1 and 2 of Annex III ESGRR. Where ESMA has assessed that the ESGRR is sufficiently detailed, no further specification is provided in the Draft RTS and ESG rating providers should simply disclose the information as per the item under point 1 or point 2 of Annex III ESGRR. Where the Draft RTS specifies further the information to be disclosed, ESG rating providers should disclose the information required by the relevant item of Annex III and also disclose the information required by the Draft RTS.

Most of the items under point 2 of Annex III ESGRR (disclosures under Art. 24 ESGRR that are specific to each rating distributed) have not been specified further by ESMA. In contrast, ESMA has specified further almost all items under point 1 of Annex III ESGRR (public website disclosure under Art. 23 ESGRR), except the overview of data sources (lit. c), the weighting of the three overarching E, S and G categories of factors in case of aggregated ESG ratings (lit. h) and, within the ESG factors, specification of the topics covered by the ESG rating, and whether they correspond to the topics from the sustainability reporting standards developed in accordance with the non-financial reporting (lit. i).

IV. Open questions: Navigating ESGRR Implementation

While the Draft RTS bring some more clarity on the implementation of the ESGRR, many interpretation and implementation questions remain unresolved. This is mainly due to the fact that ESMA has been commissioned to develop further specifications in the form of RTS or guidelines only for a few provisions of the ESGRR. While the Draft RTS are now available, a draft of the guidelines on the application of the endorsement regime under Art. 11 ESGRR, which ESMA is tasked to issue in cooperation with EBA and EIOPA by 2 October 2025 (see Art. 29(2) ESGRR) is still outstanding.

For areas which are not further specified by RTS or guidelines, such as the organisational requirements under Art. 15 ESGRR, which are formulated in an open and abstract manner, market participants are required to develop their own solutions. In this regard, the Credit Rating Agencies Regulation (EC) No 1060/2009 (CRAR) and the Benchmark Regulation (EU) 2016/1011 (BMR), including related supervisory guidance, may serve as useful points of reference for interpretation, given that the ESGRR is derived from these two regulations. However, it must be borne in mind that the ESGRR, CRAR and BMR requirements, even if addressing the same issue, may differ in scope and/or wording, so that conclusions for the interpretation of the ESGRR requirements should be drawn only with caution.

Open implementation questions remain also in areas that have now been addressed by the Draft RTS, including the supervisory expectations with regard to the specific content and level of detail of the policies and procedures to be submitted with the application for authorisation, the issue of how to balance the requirement for transparency with the need to protect proprietary methodologies, how to define acceptable thresholds for disclosing data limitations without undermining confidence in ratings, or how the required separation of functions should be implemented in practice, particularly within groups. In this respect, market participants have room to navigate, but also the uncertainty whether the approach chosen may need to be adapted at a later stage in light of additional supervisory guidance and/or supervisory expectations.

V. Timeline

Stakeholders have until 31 July 2025 to provide comments. The final Draft RTS are due for submission to the European Commission by 2 October 2025.