Any firm that is established in the EU and that carries out credit rating activities in the EU without being registered or certified with ESMA is operating in breach of Articles 2(1) and 14(1) of the CRA Regulation. ESMA systematically takes action, including supervisory measures and fines, against firms that conduct credit rating activities without registration or, where appropriate, certification in the EU.
To ensure compliance with the CRA Regulation, any firm intending to issue credit ratings in the EU must apply for registration or, where applicable, certification with ESMA.
Perimeter assessment explained
Under its perimeter strategy, ESMA uses a variety of sources to identify firms potentially providing credit rating activities without registration or certification, such as internal and external referrals, and desk-based reviews of the publicly available information.
Credit Ratings
A credit ratingis an opinion on creditworthiness expressed using a ranking system of rating categories. Further, a credit rating:
- Is issued on a professional basis.
- Is linked to a specific financial instrument or obligation, or issuer of such an instrument or obligation.
- Require analytical input from rating analysts.
- Should be publicly disclosed or distributed by subscription.
Unless explicitly excluded, any activity involving the issuance and distribution of credit ratings, regardless of their intended use, falls within the scope of the CRA Regulation. When assessing a firm’s activities, ESMA considers the exclusions listed inArticle 2(2) of the CRA Regulation.
The following exclusions define activities and products that are outside the scope of the CRA Regulation and that are not supervised by ESMA:
- Private credit ratings:Credit ratings produced pursuant to an individual order, provided exclusively to the person placing the order, and not intended for public disclosure or distribution by subscription.
- Credit scores, scoring systems or similar assessmentsrelated to obligations arising from consumer, commercial or industrial relationships.
- Credit ratings produced by export credit agencies, subject to specific conditions.
- Credit ratings produced by central banks, subject to specific conditions.
Private Credit Ratings
The ESMAGuidelines on the scope of the CRA Regulation (revised in 2022 and applicable since 1 May 2024) clarify important aspects of private credit ratings. They also help ESMA identify the activities of private credit rating providers that fall outside the scope of the CRA Regulation.
Further, private credit ratings are:
- Produced pursuant to an individual order: The private credit rating should only be produced following an explicit order, formalised through a bilateral written agreement.
- Provided exclusively to the person who placed the order: The agreement should contain a provision on the exclusive issuance of the private credit rating only to the person who placed the order. Therefore, the private credit rating shall be provided only to the person who placed the order.
- Notintended for public disclosure or distribution by subscription:
A rating which is provided to different persons belonging to a list of subscribers does not fall within the definition of “private credit rating”.
However, the recipient of a private credit rating is allowed to share the rating with “a limited number of third parties” on a confidential basis. The revised Guidelines clarify thatthese third parties may be either natural or legal persons and that the cumulated number of persons cannot exceed 150.
This sharing must be strictly confidential, and the recipient should implement appropriate controls to monitor the adherence to the 150-person limit, ensuring the private credit rating does not become public.
Credit Scores
A credit score is a measure of creditworthiness and not an opinion on creditworthiness. A credit score derives solely from the assessment of data based only on a pre-established statistical system or model, without substantial rating-specific analytical input from a rating analyst.
Regardless of how firms choose to market their credit scores (e.g. using terms like “rating” or similar), this product does not fall under the scope of the CRA Regulation and is, consequently, not supervised by ESMA.
ESMA recommends firms (including credit rating agencies) distributing credit scores in the EU to clearly and prominently disclose that these products are not credit ratings issued in accordance with the CRA Regulation and are, consequently, not supervised by ESMA.
Further information
For further information, please refer to the Guidelines on the scope of the CRA Regulation and to the Report accompanying these Guidelines.
If you have any information which may assist ESMA’s perimeter strategy or if you are a firm seeking clarification about whether your activities fall within the definition of credit rating activities under Articles 2, 3(1) and 14(1) of the CRA Regulation please contact the Conduct Supervision and Convergence Department at CRA-info@esma.europa.eu.
