With the rulebook now settled, the countdown to the new regime begins for in-scope ESG ratings providers.
By Nicola Higgs, Betty M. Huber, Michael D. Green, Anne Mainwaring, and Charlotte Collins
Key Points:
- The FCA has finalised its rules for ESG ratings providers operating in the UK, largely maintaining the rules as consulted on but making more notable changes in relation to requirements around transparency and stakeholder engagement.
- The new framework will take effect on 29 June 2028, with providers able to apply for authorisation from 24 June 2027.
- The FCA encourages in-scope ESG ratings providers to start preparing for authorisation now, as they will only have a short window in which to submit their application.
On 3 November 2026, the FCA published its final rules (PS26/22) for ESG ratings providers. It previously consulted on the new framework in December 2025 (see this Latham blog post), shortly before the relevant legislation, which sets the scope of the new regulated activity, was finalised by the government. Therefore, the FCA’s Policy Statement represents the final stage in the creation of the new regime.
The FCA reports that it received 90 responses to its consultation, with most respondents supportive of the proposed regime. As such, the FCA has made limited changes to its framework, including the following:
- The FCA has mostly added further clarifications in selected areas, particularly in relation to proportionality, which was a key theme of the feedback given that many stand-alone ratings providers requiring authorisation for the first time may be smaller businesses which are not accustomed to detailed regulatory standards.
- The FCA also received considerable feedback on the proposed rules around transparency and stakeholder engagement, and so it has made more substantive changes in these areas (which are set out in more detail below).
- Another key area of stakeholder feedback was the need for international alignment, particularly with the EU ESG Ratings Regulation, which took effect earlier this year. The FCA explains that the final regime “is designed to be proportionate to firms’ size and activities and is informed by international and existing standards”. While the FCA has aligned further with the EU on certain aspects of the regime, ultimately the UK and EU regimes are separate frameworks. Ratings providers should check carefully whether they are caught under both regimes, as the parameters and exemptions under each are not directly aligned, and providers in scope of both will need to ensure they meet the requirements of each on a stand-alone basis.
It should also be noted that, in the US, various US federal and state governmental officials have initiated inquiries or investigations of proxy advisors (some of whom provide or consult on ESG ratings) as well as credit ratings providers relating to their ESG activities or positions. This “regulation by enforcement” should also be factored into the global mix of regulation affecting ESG ratings providers.
Scope of the Regime
Although scope is not part of the FCA’s consultation, as it is set in the legislation, by way of reminder the UK ESG ratings regime is intended to capture:
- UK firms: providing ESG ratings to UK and non-UK users by any means.
- Overseas firms: providing ESG ratings to UK users by way of a business relationship. “Business relationship” is framed broadly to cover paid subscriptions and other contractual arrangements, including where the rating is bundled with wider services.
In this context, an “ESG rating” is defined as an assessment regarding one or more ESG factors, which is produced in the form of an opinion, a score, or a combination of both, and is prepared using an established methodology and a defined ranking system of rating categories, whether or not it is characterised as an ESG rating.
There are a number of detailed exemptions provided for in the regime. The FCA highlights that, although most ratings produced in the course of carrying on another regulated activity are out of scope, it will continue to monitor ESG ratings activity by asset managers, benchmark administrators, providers of investment research, and investment consultants, to consider whether a different approach might be required in future.
The New Framework
The FCA has confirmed that authorised ESG ratings providers will be subject to a number of existing FCA rules (referred to as the “Baseline Standards”), as well as new rules specific to the provision of ESG ratings, as summarised in the table in the Annex below.
Transparency
This was one of the areas in which the FCA received the most feedback. The regulator reports that feedback was mixed, with respondents expressing differing views as to what disclosures should be required of ESG ratings providers. The FCA has made some notable changes to its proposals by:
- Making targeted additions to the public disclosure requirements, including policies and processes on data quality and verification, ESG rating review frequency, methodology versioning, and the factors relevant to material methodology changes.
- Adding new guidance on its expectations for public disclosures, including disclosures concerning peer groups, approach to engagement, AI oversight, and material limitations.
- Clarifying its approach to disclosures for ESG rating users and rated entities, including adding specific disclosure requirements for peer groups and for what firms consider to be a material change to their ESG rating or the rating’s data, and removing the proposed disclosures of unresolved factual challenges.
- Allowing certain information to be disclosed at product level, rather than at individual rating level, when disclosures apply across an entire product. Rating‑level disclosures are still required when information is specific to an individual rating.
- Making disclosures to rated entities on demand only (rather than by default). However, ratings providers will need to make clear how rated entities can request these disclosures.
Stakeholder Engagement and Complaints
This was the other area in which the FCA received the most extensive feedback. It reports that concerns were raised about the burden of the proposals, differences from the EU regime, and the application of the rules to different product types.
In response to the feedback received, the FCA has updated the timeline for ESG ratings providers to notify rated entities, such that providers must notify rated entities sufficiently in advance of an ESG rating being made available for the first time. The notification period must be a minimum of two business days, but also long enough to allow rated entities to read and understand the information provided. This outcome aligns more closely with the EU regime, which has a notification period of at least two working days. However, the FCA stresses that it does not expect two business days to be long enough in all cases.
The FCA has also removed the requirement for providers to wait for feedback from rated entities before publishing a rating, as some respondents highlighted that allowing rated entities time to review data before the ESG rating is made available could lead to uncertainty and delays in issuing ratings. Therefore, providers may make a rating available while a rated entity reviews the underlying data.
Finally, the FCA has clarified how the stakeholder engagement rules apply to different product types. For example, for controversy products, it would expect rated entities to be notified before coverage begins. It stresses that notification obligations apply irrespective of whether the ESG rating is produced under an issuer‑pays or user‑pays approach, although it acknowledges that, if there is an existing relationship, a shorter notification period may be appropriate.
Governance
Although the FCA has not changed its rules on governance, it received feedback on areas of uncertainty, particularly around what is meant by having a “sufficient UK presence” in practice. Consequently, the FCA has clarified that having a clear point of accountability in the UK does not require firms to locate all elements of the ESG rating process, operational functions, or all senior personnel in the UK. Instead, the FCA expects providers to make sure they have sufficient senior management presence, oversight capability, and access to relevant information, in a manner appropriate to their size, scale, and complexity.
Further, the ESG ratings provider must retain responsibility for the ratings it provides in the UK and be able to require changes to any part of the ESG rating process, for example, to ensure that methodologies and processes comply with UK regulatory requirements. Providers must also be able to show that they have sufficient authority and involvement in governance arrangements to identify, assess, and address risks related to ESG rating activities, including if functions are performed elsewhere within group structures.
Linked to this, the FCA reports that respondents to the consultation also asked about expectations for global firms, particularly as, unlike the EU regime, the UK framework does not provide for explicit market access routes for non-UK based ratings providers.
The FCA explains that the appropriateness of any particular operating structure would be assessed on a case-by-case basis, in light of the specific circumstances of the firm. However, it indicates that a UK‑incorporated subsidiary, rather than a UK branch, is most likely to meet regulatory expectations, particularly if the firm is based in a jurisdiction without a similar regime for ESG ratings providers.
The FCA also confirms that the Senior Managers and Certification Regime (SMCR) will apply to authorised ESG ratings providers. While respondents questioned whether application of the SMCR should be delayed due to ongoing reforms, the FCA intends to have its Phase 2 reforms in place by the end of 2027 (see this Latham article for details of the SMCR reforms) so the revised regime will be in place in time for when the ESG ratings regime takes effect, albeit not before providers have to apply for authorisation. It is also worth noting that ESG ratings providers will be Core Firms under the SMCR, and the Phase 2 changes will have a more limited impact on such firms.
Systems and Controls
Some respondents disagreed with the proposed requirement that providers keep the data used to produce an ESG rating, such that it could be reproduced. Consequently, the FCA has amended its approach to require providers to only retain records to enable them to explain and evidence how an ESG rating was produced and how the final outcome was determined.
The FCA has also amended the proposed rules on advance notification of material methodology changes. Under the final rules, providers must give users advance notice of material changes to methodologies, but they will not be required to provide advance notice to rated entities. The FCA has also provided some guidance on factors that firms may consider when assessing whether a methodology change is material.
Conflicts of Interest
The FCA has made an important change in this area regarding the approach to personal transactions. It will no longer require ESG ratings providers to apply the COBS 11.7 rules on personal transactions. Instead, providers will need to implement controls around personal transactions that are proportionate to the nature, scale, and complexity of their business, and that are designed to mitigate the risk that an employee who can materially influence an ESG rating could benefit from a personal transaction linked to that rating. There is no positive requirement for providers to actively monitor employee trading, although the FCA expects firms to assess whether monitoring would be an appropriate control given the risks in their business.
In addition, the FCA has included some examples of good and poor practice in the Policy Statement to help providers understand its expectations on conflicts of interest more generally.
Reporting
The FCA notes that it plans to develop its regulatory reporting requirements for ESG ratings providers once the regime has gone live, in order to calibrate those requirements effectively and proportionately. Consequently, it plans to issue mandatory information requests to authorised ESG ratings providers from 29 June 2028. It will then seek feedback and refine the reporting requirements as appropriate. Once it has settled on an appropriate approach, it will consult on and finalise the regulatory reporting rules in the FCA Handbook.
Perimeter Guidance
In light of the feedback received, the FCA has included some additional clarifications and examples concerning the scope of the regime in its Perimeter Guidance Manual (PERG). In particular, it has provided further guidance on the concept of “likely to influence a decision to make a specified investment” and the application of certain exclusions, including the exclusion for regulated products and services.
Further, the FCA has added examples to illustrate the difference between an ESG rating and an ESG data product, and examples of factors a provider may consider when assessing whether a product falls within scope.
Next Steps
The new framework will take effect on 29 June 2028, and the FCA will start accepting applications for authorisation from 24 June 2027. Firms that reasonably expect to generate £500,000 or more in annual revenue from ESG ratings activities in the UK during the 12‑month period following submission of their application will need to submit their application by the end of July 2027. Other firms will need to submit their application by the end of August 2027. Firms that have applied for authorisation within the relevant window but have not had their application determined by 29 June 2028 will be able to continue their business as usual until their application is determined, including taking on new business. However, any firms that do not apply within the relevant window, have their application refused, or withdraw their application will not be able to continue their business from 29 June 2028 and will need to wind down their ESG ratings activities in the UK.
The FCA will open its Pre-Application Support Service to firms from February 2027, to allow them to engage with the regulator prior to the authorisation process, and will also ensure that the relevant forms and materials are available before the authorisation gateway opens. Further, the FCA is hosting two webinars: one on 7 December 2026 on the final rules, and one on 26 January 2027 on the authorisation process.
Ratings providers that operate in the UK should confirm (if they have not done so already) whether or not they will be in scope of the new regime. Those that will need to be authorised for the first time should then:
- Familiarise themselves with the new framework
- Decide which group entity should apply for authorisation (if relevant)
- Plan for how they are going to meet the FCA’s regulatory requirements, including being able to satisfy the Threshold Conditions and who will need to be approved as Senior Managers
- Carry out a gap analysis to consider which arrangements, processes, systems, and controls will need strengthening and adapting under the new regime
- Familiarise themselves with the authorisation process, and the application forms once available
- Consider when they will need to submit their application for authorisation, and whether they intend to make use of the FCA’s Pre-Application Support Service. Early engagement may be particularly important for entities or groups without a physical presence in the UK
Firms that are already authorised but that will need to add ESG ratings permissions should consider whether their existing governance arrangements, systems, and controls are sufficient to meet the new regulatory requirements that are specific to ESG ratings providers.
ESG data providers are not caught by the new framework, but should note that the International Capital Markets Association (ICMA) Code of Conduct remains relevant to their activities.
Annex — Outline of the Regulatory Framework for ESG Ratings Providers
| Rules | Explanation | Handbook Reference |
| Baseline Standards | Relevant FCA Handbook rules and guidance apply, including:
|
COND, PRIN, SYSC, SUP, GEN, FCG |
| Transparency | ESG ratings providers are required to:
|
ESG 6 |
| Governance | ESG ratings providers are required to:
|
ESG 6, SYSC, COND |
| Systems and Controls | ESG ratings providers are required to:
|
SYSC, ESG 6 |
| Conflicts of Interest | ESG ratings providers are required to:
|
ESG 6 |
| Stakeholder Engagement | ESG ratings providers are required to:
|
ESG 6 |
| Complaints | ESG ratings providers are required to:
|
ESG 6 |
Recent Comments