FCA finalises UK regime for ESG ratings providers

What does this mean?

The Policy Statement includes final rules, expanded perimeter guidance and illustrative examples of good and poor practice on conflicts of interest.

Scope and definition

The definition of an ESG rating and the exclusions are set by the Order and were summarised in a prior 'At a glance'. To be in scope, a provider must both produce and make available a rating that is likely to influence a decision to make a specified investment. 

The territorial scope captures UK providers supplying ESG ratings to UK or overseas persons, and overseas providers supplying ESG ratings to persons located in the UK.

The FCA’s expanded perimeter guidance confirms that a product need not be described as an ESG rating to qualify. ESG data products, transition scores or resilience assessments may fall within scope where they meet the statutory criteria. ESG data without a defined ranking system is outside scope.

Firms carrying on the regulated activity as defined by the Order will require FCA authorisation or, if already authorised, a variation of permission. Overseas applicants must demonstrate arrangements that support effective FCA supervision, including appropriate UK oversight, governance and accountability.  The FCA says that many will likely find a UK-incorporated subsidiary the clearest route to demonstrating accountability and facilitating effective supervision.

Regulatory framework: existing FCA requirements and new ESG rules

Providers will be subject to relevant existing FCA requirements, including:

• the Threshold Conditions and guidance on the threshold conditions (COND); 

• Principles for Businesses (PRIN); 

• relevant systems and controls (SYSC) requirements; 

• the Senior Managers and Certification Regime (SM&CR) as core firms;

• General provisions (GEN); and 

• Financial Crime Guide (FCG).

There will also be tailored ESG sourcebook rules covering transparency, governance and systems and controls, conflicts of interest, stakeholder engagement and complaints. 

The FCA has not introduced bespoke prudential requirements. The Consumer Duty will not apply to providers given the wholesale nature of the ESG ratings market. However, the transparency rules include Duty-aligned measures and the FCA will continue to monitor market developments. Additionally, ESG ratings complaints will fall outside the Financial Ombudsman Service (FOS) and the Financial Services Compensation Scheme (FSCS).

Key features of the FCA’s regime

The FCA finalised the proposals largely as consulted on, with targeted changes. We summarise the key changes below, followed by an overview of the final requirements by topic.

Changes from CP25/34 include:

• Definitions: The FCA has amended the definition of “notifiable person”, resulting in less overlap with ESG rating users. 

• Transparency: Several changes have been introduced in the final rules. Rating-level disclosures may be provided at product level where the information applies across the product. Rated entities will also receive detailed disclosures ‘on request’ rather than by default, while minimum public and user disclosures will continue to apply automatically. Proposed disclosures on unresolved factual challenges and next review dates have been removed, while public disclosure requirements have been refined, including on data quality, estimates, methodology versioning, AI oversight and material methodology changes.

• Methodology changes: Providers must give users, but not rated entities, advance notice of material methodology changes. 

• Stakeholder engagement: Providers must notify rated entities sufficiently in advance (at least two business days) before a new rating is first made available, but do not need to wait for feedback before publishing.

• Record keeping: Providers’ records must explain and evidence how a rating was produced and determined, rather than enable its reproduction. No specific retention period is prescribed.

• Personal transactions: COBS 11.7 will not apply. Providers must instead maintain proportionate arrangements and a policy aimed at preventing personal transactions that could breach the Market Abuse Regulation or damage rating integrity or independence.

Transparency obligations

The FCA has retained a tiered disclosure framework with varying levels of detail required dependent on whether the disclosure is for the public, for ESG rating users or for rated entities.

• Public disclosures include information on methodology, objectives, coverage, rated universe, data approach, limitations and the engagement model. 

• ESG rating users will automatically receive additional product-level information and individual-rating information, as well as advance notification of material methodology changes. Users must also receive any further information that could reasonably help them understand a rating.

• Rated entities can request additional product and individual-rating information and the underlying data. Providers must notify them at least two business days before a new rating is first published, and offer routes for factual corrections, feedback and complaints.

All disclosures must be easily accessible, clearly presented, accurate, fair and not misleading. Trade-secret protection can apply, but providers must then say what they cannot disclose.

Governance, systems and controls

The requirements are predominantly unchanged from the Consultation Paper and require providers to maintain robust governance and controls protecting the integrity, independence and reliability of ratings and underlying data. They must retain operational responsibility for the ESG rating process, ensure methodologies are defined, applied systematically and reviewed periodically, and maintain sufficient UK oversight and accountability. The FCA notes this is most likely to be achievable for overseas firms through the establishment of a UK subsidiary. 

Outsourcing will be permitted, but providers remain responsible for compliance and cannot outsource operational responsibility for the rating process. Core governance and methodology obligations can be outsourced only within the group, and any outsourcing requires a written agreement.

Conflicts of interest

PS22/26 largely retains the conflicts of interest framework proposed in CP25/34. Providers must identify, prevent and manage conflicts arising from their organisational and group structure, charging model, other services, methodology, and employee incentives and performance evaluation. They must maintain, publish (or summarise) and annually review a conflicts policy and report relevant conflicts to the governing body. 

Public disclosure is required where controls do not provide reasonable confidence that material risks to rating integrity or independence will be prevented.

Stakeholder engagement and complaints 

Notifiable persons can request the data used to assess them and submit factual corrections.

As per the Consultation Paper, providers must publish their complaints-handling policy, investigate complaints fairly and free of charge, and deal with complaints raised within three years.

Areas to watch

The FCA identified several areas not subject to additional ESG ratings-specific requirements under the final rules, but where it will monitor developments and/or undertake further work:

• Proprietary ESG ratings produced by asset managers: The FCA plans a targeted desk-based review of firms’ practices when producing proprietary ESG ratings for use in fund marketing materials.

• ESG ratings used by benchmark administrators: Ratings used to produce, or incorporated in, a benchmark are excluded from the regime, but ratings provided on a standalone basis which are separate from the firm’s other regulated products and services, would be in scope. The FCA does not intend to take further action at this stage but will assess whether further action is needed as the UK Benchmark Regime reform progresses.

• ESG ratings used in investment research: The FCA will monitor for emerging harms and consider further action if concerns arise.

• ESG ratings produced by investment consultants: The FCA is continuing to engage with relevant designated professional bodies to consider whether changes to FCA Handbook or professional-body rules are needed to achieve equivalent outcomes.

• FOS and FSCS: ESG rating activities will sit outside both. However, the FCA says it will watch how market participants and consumers use ratings and consider whether any action may be needed.

What do firms need to do?

The FCA expects firms that may be in scope to begin preparing now ahead of the regime's authorisation window opening next June. Prospective providers should work backwards from the application timetable and resolve perimeter, legal-entity and governance questions early, using the PASS where helpful.  

As part of this preparation, firms already providing ESG ratings in the UK should consider which application window will apply to them. Larger providers, meaning those that reasonably expect to generate £500,000 or more in annual UK ESG ratings revenue in the 12 months after applying, must apply by end-July 2027, and others by end-August 2027. Firms that miss their window, withdraw their applications or have their applications refused will need to wind down their business.

Firms already authorised by the FCA should assess whether they are in scope, and whether they need a variation of permission. The definition of an ESG rating and the exclusions in the Order will be central to this assessment.

Providers who are authorised, or applying in the EU, should consider how to leverage the work done to prepare for UK authorisations. For example, areas such as UK presence expectations, outsourcing restrictions and transparency requirements are not fully aligned with the EU's regime.  

Providers should establish clear senior management responsibility for methodologies, data, outsourcing and conflicts. The wider reform of SM&CR should be considered as an input but should not be a blocker to developing a proportionate accountability framework. Firms should prepare to evidence their UK presence and approach to overseeing the ratings process in practice.

Ahead of the regime taking effect in June 2028, users of ESG ratings should consider how they will use the new disclosures to test their understanding of the ratings they rely on, focusing on those that materially influence investment decisions, risk controls, product design or external communications. They may also want to assess how certain requirements, such as onward sharing, could affect their current approach to using ESG ratings.

Asset managers should be ready to engage with the FCA's planned desk-based review and identify where proprietary or third-party ratings, regardless of rating provider location, flow into fund documentation, marketing and investor communications.

Next steps

The FCA's Pre-Application Support Service opens in February 2027. The authorisation gateway opens on 24 June 2027, with different application periods for larger and other providers.  Larger providers must apply by end-July 2027 and others by end-August 2027. 

The regime takes effect on 29 June 2028.