CP25/34: ESG ratings: proposed approach to regulation

Consultation Paper CP25/34*** ESG (Environmental, Social, Governance) ratings: Proposed approach to regulation December 2025

How to respond We are asking for comments on this Consultation Paper (CP) by 31 March 2026. You can send them to us using the form on our website. Or in writing to: Sustainable Finance Policy Financial Conduct Authority 12 Endeavour Square London E20 1JN Email: cp25-34@fca.org.uk Disclaimer When we make rules, we are required to publish: • a list of the names of respondents who made representations where those respondents consented to the publication of their names • an account of the representations we receive • an account of how we have responded to the representations In your response, please indicate: • If you consent to the publication of your name. If you are replying from an organisation, we will assume that the respondent is the organisation and will publish that name, unless you indicate that you are responding in an individual capacity (in which case, we will publish your name). • If you wish your response to be treated as confidential. We will have regard to this indication but may not be able to maintain confidentiality where we are subject to a legal duty to publish or disclose the information in question. By responding to this publication, you are providing personal data to the FCA including your name, contact details (including, if provided, details of the organisation you work for), and any opinions expressed in your response. The FCA will use this data to inform regulatory policy and rulemaking, in the public interest and in the exercise of official authority under the Financial Services and Markets Act 2000 (FSMA) and other applicable legislation. The FCA may share personal data where necessary to perform our public tasks and to support regulatory cooperation and joint policy development. Further information about how the FCA uses personal data, including our legal basis for doing so, can be found here. Please note that we will not regard a standard confidentiality statement in an email message as a request for non-disclosure. Irrespective of whether you indicate that your response should be treated as confidential, we are obliged to publish an account of all the representations we receive when we make the rules. Questions 18 and 19 are part of a joint consultation by the FCA and the Financial Ombudsman. By responding to questions 18 and 19 in this consultation paper, you are providing personal data to the Financial Ombudsman. We will process personal data to inform our work as regulator and in reviewing and developing complaints handling rules and policy, both in the public interest and in the exercise of our official authority under FSMA. Any information you provide in response to questions 18 and 19 of this publication will be shared with the Financial Ombudsman to assess your response, support FCA’s ongoing regulatory policy development, and enable cooperation between the FCA and the Financial Ombudsman. In addition, any information you provide in response to this publication which relates to question 20 will be shared with Financial Services Compensation Scheme (FSCS) to help assess your response, support the FCA’s ongoing regulatory policy development and enable cooperation between the FCA and FSCS. The Financial Ombudsman will use CoPilot to summarise responses to this consultation. For context Copilot utilises large language models (LLMs), a type of artificial intelligence (AI) algorithm that uses deep learning techniques to understand, summarise, predict, and generate content. Any output generated by CoPilot will be reviewed by a human to ensure accuracy. Please indicate in your response if you object to the use of AI to review your submission. Please note that we will not regard a standard confidentiality statement in an email message as a request for non‑disclosure. All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 0207 066 1000 Sign up for our news and publications alerts See all our latest press releases, consultations and speeches.

3 Contents Chapter 1 Executive Summary Page 4 Chapter 2 Baseline standards Page 10 Chapter 3 Transparency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 16 Chapter 4 Governance and systems and controls Page 23 Chapter 5 Conflicts of interest Page 28 Chapter 6 Stakeholder engagement, complaints, and dispute resolution Page 31 Chapter 7 Senior Managers and Certification Regime . . . . . . . . . . . . . . . . Page 37 Chapter 8 Authorisations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 42 Chapter 9 After authorisation Page 46 Annex 1 Questions in this paper Page 50 Annex 2 Cost benefit analysis Page 53 Annex 3 Compatibility statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 101 Annex 4 Abbreviations used in this paper . . . . . . . . . . . . . . . . . . . . . . . . Page 108 Appendix 1 Draft Handbook text

4 Chapter 1 Executive Summary We are consulting on rules to improve transparency and trust in the ESG ratings market. 1.1 The Government has identified sustainable finance as a growth-driving sector of the UK economy in its Modern Industrial Strategy. It is legislating to bring Environmental, Social and Governance (ESG) rating providers into our remit, after 95% of respondents to its government consultation supported the move. 1.2 Total global spending on ESG data is estimated to reach around $2.2 billion in 2025, with growth expected to continue beyond that (source paywalled). The market is supported by ESG ratings, which usually assess the ESG characteristics of companies and products. Investors and others use these ratings to inform capital allocation decisions, manage risk, build and update indexes, portfolios and funds, and report to clients and regulators. There is demand for regulation to ensure that this growth can be underpinned by trust. 1.3 With regulatory frameworks and initiatives emerging internationally to set standards for ESG rating providers, we are aiming for a consistent and compatible approach, grounded in the International Organization of Securities Commissions (IOSCO) recommendations published in 2021. These recommendations identified the key risk of harms in the market as: a lack of transparency in methodologies, independence, quality and reliability of ESG ratings. What we want to achieve 1.4 ESG ratings are widely used in decision making. Where the products are not reliable, this leads to potential harm in financial markets. Our research shows that those who use ESG ratings think there are improvements to be made: • 48% raised concerns about transparency, including unclear or excessively complex information on ratings’ objectives, methodologies, and data sources. • 55% cited weaknesses in ESG rating providers’ systems and controls, such as use of outdated or inaccurate data and estimates. • 40% were worried by inadequate governance arrangements to promote the delivery of high-quality, independent and reliable ESG ratings. • 26% had concerns about how existing or potential conflicts of interest could impact ratings. 1.5 We want to make ESG ratings more transparent, reliable and understandable. We want ratings users to better understand why ratings may vary between providers so they can make more confident decisions. We want rated entities to better understand how they are assessed and be able to engage more effectively with rating providers. This will increase trust and confidence in the market. It will also foster innovation and competition based on quality.

5 1.6 Our proposed rules will help ensure ESG ratings are underpinned by credible and transparent methodologies. This will support effective price formation and contribute to the fair and orderly operation of UK financial markets. We expect a well-regulated ESG ratings market will enhance the UK’s reputation as a global hub for sustainable finance and attract investment in ESG-related services and innovation, in line with Government ambitions. Figure 1: Outcomes we are seeking to achieve 1 Will lead to… Clearer information on ESG ratings Improved governance and controls Better management of conflicts New requirements for… Transparency Systems and controls Governance Conflicts of interest HARM REDUCED OUTCOMES Which will support… Enhancing market integrity Consumer protection and competition to improve quality Sustainable growth and international competitiveness 1.7 For further detail on how our proposals link to our statutory objectives and how we have assessed compatibility, see the Compatibility Statement in Annex 3. Our approach 1.8 The Government is responsible for setting the scope of our regulatory perimeter and we are responsible for developing the rules for firms. The legislation depends on final parliamentary approval and will be in force by the time we publish our final rules. 1.9 We have taken a proportionate, evidence-based approach to developing the regime, building on the IOSCO recommendations. This complements industry initiatives like the International Capital Market Association (ICMA) Code of Conduct for ESG ratings and data products providers, which we helped initiate. We have also used our experience of regulating benchmark administrators and credit rating agencies to inform our approach.

6 1.10 We propose targeted and more detailed rules to address areas of greater harm, such as transparency, where users and rated entities need consistent and comparable information. In other areas we have taken a more principles-based approach, such as managing conflicts of interest and stakeholder engagement. 1.11 This will ensure the regime is effective in this market which is complex and rapidly evolving. The proposed regime should provide clear rules that address key risks of harm, but allow flexibility for the wide range of products and business models. 1.12 Although rating providers will come under our regulation, we still expect users to undertake due diligence to assess products’ relevance and suitability. The scope of regulation will be complex, so this may involve distinguishing between regulated and unregulated products. We will monitor whether further guidance for firms on using ESG ratings will be useful. Summary of the regime 1.13 As this will be a newly regulated sector, we propose to: • Apply many existing baseline rules to rating providers that apply to most other FCA-regulated firms, taking a consistent approach. • Introduce tailored rules where existing requirements are either not appropriate or not proportionate to address the risks of harm. These rules focus on transparency, governance, systems and controls, conflicts of interest and stakeholder engagement. 1.14 The existing baseline standards are set out in the following sections of our Handbook: • Threshold Conditions (COND): The minimum conditions, set out in the Financial Services and Markets Act 2000 (FSMA), that a firm must satisfy, and continue to satisfy, to get and keep its permissions. We provide guidance on these conditions in COND. • Principles for Businesses (PRIN): A general statement of the fundamental obligations that firms must comply with at all times. • Systems and Controls (SYSC): How firms must organise their businesses, manage risk and maintain effective internal systems and controls. • Senior Managers and Certification Regime (SM&CR): How firms must allocate responsibilities, certify key staff and apply conduct rules to promote accountability and good governance. • General Provisions (GEN): General rules that apply to all firms, including statutory disclosure statements and use of the FCA name or logo. 1.15 Our proposed tailored rules for rating providers include: • Transparency: Minimum disclosure requirements for methodologies, data sources and objectives, so users better understand the ratings and rated entities understand how they are assessed.

7 • Systems and Controls: Requirements for robust arrangements to ensure the integrity of the ratings process, including quality control, data validation and methodology reviews. • Governance: Requirements to maintain operational responsibility over the ratings process, including any outsourcing, to ensure appropriate oversight and compliance with the regime. • Conflicts of interest: Requirements to identify, prevent, manage, and disclose conflicts of interest at the organisational and personnel level, to maintain the ratings’ independence and integrity. • Stakeholder engagement: Requirements to provide rated entities with the opportunity to correct factual errors, procedures to allow other stakeholders to provide feedback and a fair complaints-handling procedure. 1.16 The regime applies across the ESG ratings process, including the product’s design, methodology development and application, data collection and analysis, quality assurance, monitoring and review, and stakeholder engagement. Figure 2: Overview of proposed regime 2 Our proposed regime builds on FCA rules and international best practice  FCA rules Baseline + Outlined in Chapter 2 Tailored rules informed by IOSCO Transparency Chapter 3 Stakeholder engagement Chapter 6 Governance, systems and controls Chapter 4 Conflicts of interest Chapter 5 Next steps and timelines 1.17 We welcome feedback on the draft rules and questions in this CP. Please respond by completing the form on our website or by sending a response to CP25-34@fca.org.uk by 31 March 2026. 1.18 We will continue to engage with rating providers, users (including asset managers and asset owners), trade associations and other stakeholder groups throughout the consultation process.

8 1.19 Figure 3 sets out the next steps on our regulatory roadmap. Figure 3: Timeline overview Policy Roadmap Draft Statutory Instrument published Consultation Paper published Consultation closes Policy Statement and rules published Authorisations Gateway Opens Statutory Regime goes live Instrument laid 2024 November 2025 October 2025 1 December 2026 31 March 2026 Q4 2027 June 2028 29 June 4-month consultation period FCA finalises the rules 6-month Pre-gateway support period 12-month application window

9 1.20 Following the consultation period from 1 December to 31 March 2026, we will use the feedback received to inform the final rules. 1.21 We will publish this feedback and our final rules in a Policy Statement (PS) in Q4 2026. 1.22 After we publish the PS, firms will have a period to familiarise themselves with the rules. The gateway refers to our authorisations assessment period. We will open our authorisations gateway in June 2027, a year before the regime comes into effect. We will support firms through this process as outlined in our approach to engagement. Firms in scope of the regulation must be authorised to carry out ESG ratings activity after 29 June 2028. See Chapter 8 for more information on the authorisations assessment, application fees and perimeter guidance.

10 Chapter 2 Baseline standards 2.1 This chapter sets out the baseline standards we propose to apply to rating providers. These are general rules that apply across all FCA regulated firms. 2.2 Our Handbook contains rules and other provisions made under powers given to us by FSMA. It is divided into sections called sourcebooks, which this CP refers to with abbreviations (for example ‘COND’ and ‘PRIN’). For more information, please see our Handbook Readers Guide. 2.3 We propose to apply these rules to rating providers, as well as the specific rules in later chapters. These will give providers a clear statement of the standards of behaviour we expect. Threshold Conditions (COND) 2.4 FSMA specifies that firms must satisfy, and continue to satisfy, the Threshold Conditions (TCs) to be authorised. The TCs are set out in schedule 6, Part 1B of FSMA. COND sets out our expectations in relation to the TCs. 2.5 Rating providers should familiarise themselves with the TCs and COND to fully understand how the TCs apply to them. The TCs are not part of this consultation, but we welcome comments on the application of COND to rating providers. Principles for Business (PRIN) 2.6 Table 1 explains the Principles, which all regulated firms must follow. 2.7 The Principles also underpin other more detailed rules and guidance. PRIN also contains rules and guidance on how the Principles apply. Table 1: The Principles Principles 1 Integrity A firm must conduct its business with integrity. 2 Skill, care and diligence A firm must conduct its business with due skill, care and diligence. 3 Management and control A firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems. 4 Financial prudence A firm must maintain adequate financial resources.

11 Principles 5 Market conduct A firm must observe proper standards of market conduct. 6 Customers’ interests A firm must pay due regard to the interests of its customers and treat them fairly. 7 Communications with clients A firm must pay due regard to the information needs of its clients, and communicate information to them in a way which is clear, fair and not misleading. 8 Conflicts of interest A firm must manage conflicts of interest fairly, both between itself and its customers and between a customer and another client. 9 Customers: relationships of trust A firm must take reasonable care to ensure the suitability of its advice and discretionary decisions for any customer who is entitled to rely upon its judgment. 10 Clients’ assets A firm must arrange adequate protection for clients’ assets when it is responsible for them. 11 Relations with regulators A firm must deal with its regulators in an open and cooperative way, and must disclose to the FCA appropriately anything relating to the firm of which that regulator would reasonably expect notice. 12 Consumer Duty A firm must act to deliver good outcomes for retail customers. 2.8 We propose that ESG rating providers must always comply with Principle 7 – including when dealing with professional clients. We also propose that ESG rating providers cannot treat their clients as ‘eligible counterparties’ for the purposes of PRIN 3.4.1R and PRIN 3.4.2R. Eligible counterparties are clients, usually large financial institutions, who get less investor protection as it is assumed they have a high level of knowledge. The anti-greenwashing rule, which complements Principle 7, applies to all authorised firms and so will also apply to rating providers. 2.9 We consider all the Principles are broadly relevant to rating providers. However, some may be less relevant in practice. For example, Principle 10 covers client assets, and firms that only undertake ESG ratings activity do not tend to hold client assets. 2.10 We do not propose applying the Consumer Duty (the Duty) to ESG ratings activity. ESG ratings provision is typically a wholesale activity and there is limited direct use of ESG ratings by retail consumers. Retail consumers use ESG ratings indirectly, through ratings in financial products, as one element of a product they may consider. Therefore, the wider Duty rules have limited relevance as, for example, retail consumers would rarely pay for an ESG rating themselves. 2.11 Rating providers should however, recognise that the Duty may apply to other firms in the distribution chain. So, we encourage providers to consider the Duty when they conduct their business.

12 2.12 Instead, we have developed a Duty-aligned approach to ensure retail consumers get the information they need when they need it. Under our proposed transparency rules, firms must give all stakeholders disclosures that are easily accessible, clear and easy to understand, as well as accurate, fair and not misleading. Where a client is supplying the ESG rating onwards, for example to a retail consumer, the provider must allow them to share this information onwards, to help the ultimate customer understand the ESG rating. 2.13 In September 2025, we published a letter to the Chancellor. This discussed our approach to applying the Duty to firms primarily undertaking wholesale activity. This proposal is in line with our wider position, while still ensuring that relevant firms comply with the Duty when dealing with retail customers. Question 1: Do you agree with the proposed approach not to apply the Duty to rating providers? If not, please specify what you disagree with and why. Prudential 2.14 We do not propose to introduce bespoke prudential requirements for rating providers. Our view is that existing requirements – Threshold Condition 2D (Appropriate resources), COND 2.4 and Principle 4 (a firm must maintain adequate financial resources) — provide a proportionate baseline. 2.15 Our assessment suggests the risk of harm to consumers and markets from financial failure is relatively low, particularly given the absence of client assets or liabilities. Engagement with users of ESG ratings shows they commonly source their ratings from more than one provider. This may limit the potential impact from any single provider’s failure. 2.16 Firms must assess and maintain adequate financial resources in line with our guidance (FG20/1). To meet these requirements, we also expect firms to have robust arrangements for orderly wind-down, as outlined in our Wind-down Planning Guide (WDPG). 2.17 We do not consider it proportionate to introduce additional prudential rules at this stage. We will keep this position under review as the market matures or if new risks emerge. As part of our broader strategy for consistency in our prudential framework, we will consider how rating providers should fit within this in the longer term. Senior Management Arrangements, Systems and Controls (SYSC) 2.18 SYSC sets out how firms should organise and manage their affairs. One of its purposes is to underline Principle 3: ‘A firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems’.

13 2.19 SYSC contains a broad set of rules. The chapters within SYSC we propose to apply to rating providers include rules focused on: • Robust governance arrangements • Staff competence and suitability for their roles • Adequate compliance arrangements and controls for countering financial crime • Managing risks • Outsourcing • Record keeping 2.20 This is only a summary of what these chapters cover. Firms should review the full detail of SYSC and its requirements. 2.21 The table in SYSC 1.1A.1G provides a summary of the chapters in SYSC that apply to rating providers – see the row “Any other SMCR firm”. SYSC 1 Annex 1 3.3R explains how we propose SYSC 4-9 will apply to rating providers. Column B of Table A (the column that applies to “all other firms...”) in SYSC 1 Annex 1 sets out the detailed application of SYSC 4-9 for rating providers. 2.22 We have amended SYSC 1 Annex 1 3.3R and SYSC 10 to reflect that we are not proposing to apply SYSC 10 on conflicts of interest to rating providers. Instead, we propose bespoke rules on conflicts of interest in ESG 6 (see Chapter 5). 2.23 We propose making two further changes to how SYSC 4-9 normally applies to most other firms. Firstly, we propose amending SYSC 8.1.1R (outsourcing requirements) so that it applies to rating providers as a rule, rather than guidance. This is because ESG rating providers often rely heavily on outsourcing. Secondly, we propose that SYSC 6.3.9R will not apply to rating providers so that they are not required to have a Money Laundering Senior Manager Function. 2.24 To note, the SM&CR rules form part of the broader SYSC framework. For clarity and completeness, we address our proposals for SM&CR in a standalone chapter (see Chapter 7). General provisions (GEN) 2.25 We propose applying our General Provisions (GEN) to rating providers. GEN includes rules covering the administrative duties of the firms we regulate. These rules are designed to make sure consumers are not misled and that firms are transparent about their regulatory status. 2.26 GEN contains: • A ban on firms claiming or implying we have endorsed their business. • Steps firms should take in emergency situations when they are unable to comply with our rules. • Guidance on how to interpret our Handbook. • Rules on how firms authorised by us must disclose their regulatory status. • Restrictions on using our name and logo.

14 • A ban on taking out indemnity insurance against the risk of having to pay financial penalties. 2.27 This is not a complete list, and we expect rating providers to familiarise themselves with GEN more broadly. Financial crime and market abuse 2.28 We propose to apply the financial crime provisions of SYSC 6 to ESG rating providers to ensure robust systems and controls are in place to prevent, detect, and manage financial crime risks. 2.29 We also propose applying the Financial Crime Guide (FCG) to ESG rating providers. The FCG sets out good practice on governance and systems and controls to prevent financial crime. The FCG complements UK Market Abuse Regulation (UK MAR) obligations and will help firms identify, monitor and manage risks such as market manipulation or misuse of non-public information in the ESG ratings process. 2.30 As the UK MAR applies to unauthorised firms, ESG rating providers already come under this regulation. ESG ratings can influence trading activity. We consider that UK MAR, supported by our general guidance in the Market Conduct Sourcebook (see MAR 1 only), sufficiently addresses key market abuse risks with ESG ratings. These include market manipulation, insider dealing and unlawful disclosure. 2.31 Our proposals in Chapter 4 on personal transactions will also help firms comply with UK MAR. The Money Laundering Regulations (MLRs) do not apply to ESG rating providers, as this is a matter for Government. Question 2: Do you agree with our approach to applying the high-level standards to rating providers? If not, please specify what you disagree with and why. Regulated products and services 2.32 As set out in the legislation, where firms are providing ESG ratings as part of an existing activity we already regulate (or as part of other arrangements in the legislation), they are excluded from the scope of the ESG ratings regime. Examples include: • Asset managers producing proprietary ESG ratings solely to use in their fund marketing materials. • Investment firms producing ESG ratings as an integral part of their investment research. • Benchmark administrators developing ESG ratings that they use solely in their index methodologies.

15 2.33 This approach aims to minimise burden for these firms, so they do not need to seek another permission. However, we plan to assess whether we need to improve standards in existing regulatory regimes to address the risk of harm. 2.34 If we consider there are significant gaps in standards with the current regulatory framework for existing regulated products and services, then we will consult on any proposed changes to the existing regimes. Question 3: Do you think existing regulatory regimes sufficiently address the risk of harm? If not, which areas do you think need to be addressed and why? Terminology in this Consultation Paper 2.35 The following chapters outline our approach to transparency, governance and systems and controls, conflicts of interest and stakeholder complaints and dispute resolution. 2.36 We have drafted our proposed rules (see Appendix 1) to be technically precise. We have simplified the terminology from these rules for ease of understanding within this CP. For example, ESG ratings may be assigned not only to corporates or other issuers of securities but also to different types of securities, assets (eg real estate) and other items (eg funds). In our rules, we use ‘notifiable persons’ to cover the range of different legal persons to whom disclosures or communications must be directed (beyond direct users). For the purposes of this CP, we have simplified this to ‘rated entities’.

16 Chapter 3 Transparency 3.1 This chapter sets out our proposed approach to improving transparency from ESG rating providers. We plan to introduce clear minimum disclosure requirements for product lines and individual ratings. Some disclosures must be made public, while others must be made to ESG rating users and rated entities – with the option for ESG rating providers to make those public. We also set out general expectations on how disclosures must be made. Background and risks of harm 3.2 Users and rated entities have told us it is difficult to get the information they need about ESG ratings. Areas of concern range from methodologies and data to governance processes and conflicts of interest. Even when information is available, users may struggle if it is unclear or vague. 3.3 This lack of transparency makes it difficult for users and rated entities to understand ratings, carry out proper due diligence, or engage meaningfully with providers. Users report confusion about what a rating is meant to measure and find it hard to assess whether a given methodology and processes meet their needs and expectations. Rated entities struggle to understand how they are being assessed and how to respond to, or challenge, ratings or underlying data in a meaningful way. This can result in inaccurate or outdated ratings. 3.4 Some users get ratings directly from the provider. Others access ratings through third￾party distribution platforms or other intermediaries. And others see ESG ratings only as part of financial products, such as funds that use ratings as part of their design. All users need core information, but some may find it harder to get than others. 3.5 Rated entities, meanwhile, may have no obvious means of access at all, except where they are also users. Our policy intention 3.6 We aim to improve transparency and clarity in ESG ratings, without undermining or compromising firms’ intellectual property. We want users and rated entities to be able to access clear and appropriately tailored information in a timely way. We know some stakeholders require more detailed and technical information than others. We also recognise that what ESG rating providers can disclose may differ by stakeholder type. We have developed our proposed requirements with this in mind.

17 3.7 We want ESG rating providers to: • Provide direct users (those who get ratings directly from the provider) with clear and detailed information on the rating product lines and individual ratings they use, to help these users be fully informed. • Help indirect users (those who get ratings through intermediaries) to get sufficient information to understand the ratings they, or their products, rely on. Where these are retail consumers, our approach is broadly aligned to the Duty, as explained in Chapter 2. • Make it easy for prospective users to compare ESG rating product lines across providers and identify those that best meet their needs. • Ensure rated entities can get appropriate information about how they are assessed, including in cases of unsolicited ratings, to support constructive engagement. Our general approach 3.8 We have developed tailored rules to improve transparency in the market (Figure 4). We propose to introduce: • Minimum public disclosures. • Additional disclosures for direct users and rated entities, at both product and individual rating level. These build on the public disclosures, with additional rules to ensure the information provided is complete and can be shared onwards. We cover notification requirements in Chapter 4 and 6. • General expectations, including on: – How and when information should be disclosed and updated. – The tailoring of information for each disclosure. – Trade secret considerations.

18 Figure 4: Overview of proposed policy approach 4 Public Direct users and rated entities What? Minimum disclosures at both product and provider level Required disclosures General expectations: 1.  Disclosures must be easily accessible, prominent and free to relevant stakeholders; in a clear and easily-understandable written format; accurate, fair and not misleading; and shared as required and updated as soon as practicable. 2.  When making each disclosure, providers should consider what information could be reasonably expected to help recipients’ understanding. 3.  Where information qualifi es as trade secrets, providers must set out what they cannot disclose and why. What? • Additional minimum disclosures at both product and individual rating level • Any further information beyond the minimum disclosures listed that would be reasonably expected to help direct users or rated entities’ understanding l Where a direct user is allowed to share ESG ratings with a third party, it must also be able to share relevant disclosures if the information would reasonably help the third party’s understanding. Summary of proposals 3.9 Our summary of proposals is not exhaustive. ESG 6.4 in the draft rules, in Appendix 1, provides our proposed rules on transparency in full. Minimum public disclosures 3.10 These minimum public disclosures aim to set a clear baseline of information for direct and indirect users, prospective users, rated entities and other interested stakeholders – such as advocacy groups or journalists – to understand how ESG ratings work. 3.11 They give providers clear regulatory expectations on what minimum public transparency looks like in practice. They are also intended to help information become more consistent across the market.

19 Table 2: Overview of minimum public disclosures Objectives, characteristics of rating assessment and coverage universe • The product’s objective(s), including whether it assesses ESG risks, impacts or other dimensions. • The scope of the ratings, that is which ESG factors are assessed (eg a wide range across E, S, and G or a subset, such as biodiversity or transition risk). • The meaning of the rating scale and categories, including what a higher or lower ranking means. • Whether ratings are given as absolute values, or relative to a peer group and how the peer group is selected (if applicable). • How rated items are selected, that is, how the coverage universe of the product is decided. Approach to engagement • Where applicable, a summary of the approach to engaging with rated entities (as required under the proposed Stakeholder Engagement rules), including means and process for such engagement. Methodology A summary of the methodology, covering at a minimum: • A summary of the model and how the ratings are determined, including how factors, inputs or data are weighted or aggregated. • A breakdown of the factors assessed. • A summary of the types of data used, including whether it is forward- or backward-looking. • A summary of the sources of data and whether they are public or not. • Whether the assessment is forward- or backward￾looking and the timeframe considered. • The main assumptions (eg, on financial materiality). • A summary of the main data policies and processes, including on data gaps, corrections and updates (including frequency). • How AI is used in data collection or the rating process (if applicable). • How often the methodology is reviewed and the process for making material changes (as set out in the proposed Systems and Controls rules). • The date and nature of the last material methodology change. Risks • How and why any aspect of the methodology or rating process could materially affect the accuracy of ratings.

20 Conflicts of interest (see Chapter 5) • Summary of or full conflicts of interest policy. • Information about any conflict of interest if steps taken to prevent or manage the conflict are not sufficient to prevent the risk of undermining the integrity or independence of a rating. Complaints handling (see Chapter 6) • Information on: • how to raise a complaint • how it will be handled (including expected timeline) • contact details of the complaints lead or team. Question 4: Do you agree with the proposed minimum public disclosures listed in Table 2? If not, please specify what you disagree with and why. Question 5: Are there any key minimum public disclosures missing from the proposed list in Table 2? If so, please specify which disclosures and why they should be included. Disclosures to direct users and rated entities 3.12 We recognise that stakeholders have different information needs and levels of knowledge. Two groups – direct users and rated entities – require more detailed information than the public. We know these groups can overlap, as some rated entities may also act as direct users. 3.13 We propose further minimum disclosures for these two groups to enable them to fully understand why an individual rating is what it is, what factors influence it, and how the overall rating process and product are governed. Without this information, ESG rating users cannot make fully informed decisions. Likewise, rated entities cannot ensure that correct information is being used or understand how their rating might affect financial decisions that could have an impact on them. 3.14 To help them understand more complex, targeted or new products, we also propose that providers disclose any other information beyond the listed minimum disclosures that would be reasonably expected to help users or rated entities’ understanding. 3.15 A provider may allow a direct user to share one or more ESG ratings with a third party, such as via a distribution platform or in a report explaining investment decisions. In these circumstances, that user must also be able to share any relevant accompanying information with the third party. Providers are not responsible for deciding whether this information is ultimately passed on, but they should not restrict its onward sharing.

21 Table 3: Overview of additional disclosures to direct users and rated entities Product-level disclosures • A full explanation of the methodology. This may include a more complete overview of the ESG factors, data sources, types of data and assumptions underpinning the product. • Information on methodology reviews, including: • The policy on methodology review, including what triggers a revision and, where applicable, how relevant stakeholders are engaged in the process. • The outcome of the latest methodology review, required under Systems and Controls rules. • Steps taken to address risks from material limitations in the rating process. • An overview of the steps taken to implement required quality control measures (see Systems and Controls rules), including the remediation process if quality issues arise. Individual rating-level disclosures • Where relevant: • Which business activities and group entities are covered by the rating. • If the rating was inherited from another group entity, the rules and conditions for this decision. • The factors (and related weights, where applicable), criteria and data used to assess the relevant characteristics of the rated item. • A detailed explanation of the sources of specific data points used in the rating. • How data is estimated (if applicable). • How gaps in data are handled where no estimation is made. • Where applicable, any unresolved material challenge by a relevant rated entity to the factual accuracy of the rating’s underlying data. • When the rating was last updated and when it is next expected to be reviewed. • The reason for any material change to the rating or its underlying data. Question 6: Do you agree with the proposed disclosures for direct users and rated entities and approach to onward sharing? If not, please specify what you disagree with and why. Question 7: Are there any key minimum disclosures missing from the proposed list in Table 3? If so, please specify which disclosures and why they should be included.

22 General expectations 3.16 We expect rating providers to ensure disclosures are: • Easily accessible, prominent and free to obtain for the relevant stakeholders. • In a written format that is clear and easy to understand. • Accurate, fair, and not misleading. • Shared as required and updated as soon as practicable. 3.17 Disclosures must be easily accessible and prominently shown. For example, a provider may think about how users access and use the ratings, to decide on a logical place to put the disclosures. 3.18 Disclosures must be free to obtain, so providers cannot charge an additional cost for stakeholders to get this information. In the context of paid-for ratings, this means that direct users – who have already paid for access to the ratings – must be able to access these disclosures without paying more. Rated entities that are not direct users must also be able to access these disclosures at no charge. 3.19 Disclosures must be clear and easy to understand, tailored to the needs and technical understanding of the intended audience. This could include a mix of written formats, such as text or video with transcripts or subtitles, to improve clarity and understanding. 3.20 In addition: • When making the required disclosures, providers should consider what information could be reasonably expected to help the recipient’s understanding. • Providers would not be required to disclose information that qualifies as a trade secret under Trade Secrets Regulations. But, if they use that exemption, they need to explain where and why that would prevent compliance with any of the minimum disclosure requirements. We would expect providers to rely on this exemption only rarely. 3.21 Our proposed rules aim to give ESG rating providers clarity on minimum expectations for what they must disclose and to whom. However, providers would keep the flexibility to tailor disclosures appropriately for different ESG rating products. This approach supports proportionate transparency, while protecting commercially sensitive information where absolutely necessary. Question 8: Do you agree with our general expectations for transparency? If not, please specify what you disagree with and why. Question 9: Overall, do you expect any significant challenges in implementing the proposed approach to transparency and minimum disclosures? If so, please specify which elements and the nature of the challenges.

23 Chapter 4 Governance and systems and controls 4.1 This chapter explains our proposed approach to the requirements for governance and for systems and controls for rating providers. We propose rules to ensure firms have robust processes and effective systems across the ESG ratings process, to support high-quality ESG ratings. These tailored rules build on the baseline rules in the FCA Handbook (Chapter 2 contains more detail). 4.2 Governance and systems and controls are closely related. Measures taken to ensure good governance often depend on underlying systems and controls, and vice versa. This is particularly relevant given the global nature of many ESG rating providers’ structures and processes. We propose rules that allow for flexibility to accommodate global structures. But the rules for governance and systems and controls must be coherent to ensure the approach is robust. For that reason, we have grouped our proposals for governance and systems and controls together within this CP and draft legal instrument. Background and risks of harm 4.3 When governance is effective, firms are well organised, accountable and have clear and transparent structures. 4.4 Poor governance risks serious harm to ESG rating users, rated entities, other stakeholders and to rating providers themselves. For example, unreliable ESG ratings that result in misallocation of capital or the risk that rating providers are exposed to undue influence, undermining the credibility of ESG ratings. Governance failures can also hamper our regulatory supervision and engagement, further increasing the risks. 4.5 These concerns are particularly relevant for providers with complex global structures. The production chains for ESG ratings can involve numerous intra-group entities in different countries. Without strong governance processes to ensure regulatory compliance across the whole production process, there is a greater risk that ratings used in the UK market may not meet the standards required. 4.6 For ESG rating providers, effective systems and controls are important for ensuring that the methodologies, policies, and processes underpinning their ESG ratings are robust, consistently applied and properly tested. 4.7 If systems and controls are weak, this may cause a range of harms, including: • Methodologies that are not fit-for-purpose, or which are not applied in a way that is fair and consistent. • Ratings that may be based on misrepresentative or inaccurate data. • Inadequate processes for quality assuring ratings.

24 4.8 These harms carry a risk to the market as a whole. Inaccurate and unreliable ratings can reduce trust and engagement with the ESG ratings market and lead to misinformed financial decision making. Our rules for systems and controls aim to bring in a set of minimum standards for all providers to reduce these risks across the ESG ratings market. Our policy intention 4.9 We want to ensure that ESG rating providers have robust governance and systems and controls in place to support the quality, reliability and independence of ESG ratings. 4.10 We propose to require that ESG rating providers: • Have robust governance arrangements that are proportionate to their size and complexity and uphold high standards. • Keep operational responsibility and influence over the entire ESG rating process, including outsourced functions. • Implement systems and controls that ensure ratings are based on thorough analyses of relevant and up-to-date information, and that methodologies are consistently applied. • Establish appropriate quality assurance processes and maintain internal records to support the ratings issued. • Have clear policies and procedures for reviewing methodologies and managing data quality. • Ensure that personnel producing ESG ratings are competent, professional and act with integrity. • Have an appropriate UK presence to support effective supervision and accountability. Our general approach 4.11 We propose to apply baseline rules on governance and systems and controls from the FCA Handbook. Alongside this, we plan to add new, bespoke rules in the ESG Sourcebook to cover risks of harm specific to ESG rating providers. 4.12 We have developed our proposals after in-depth engagement with market participants and incorporated the good practices we have seen from firms. 4.13 Our approach aims to be proportionate. It also recognises the global and complex structures of many firms in the market and aims to encourage access to the UK market for overseas providers. These rules will apply to FCA-authorised rating providers and are designed to ensure accountability, operational integrity and regulatory compliance. 4.14 The broader governance requirements are complemented by our proposals for the SM&CR (see Chapter 7), which focus on individual accountability. Our systems and controls requirements are designed to complement the baseline requirements we intend to apply through our Handbook (see Chapter 2 for more detail on our proposals to apply specific high-level FCA rules).

25 Summary of proposals 4.15 Our summary of proposals is not exhaustive. ESG 6.2 in the draft rules, in Appendix 1, provides our proposed rules in full. Governance 4.16 We propose to apply the existing outsourcing requirements from SYSC (see Chapter 2). We also propose to require that the FCA-authorised firm is the one with operational responsibility for the ESG rating process. This means that, even where that provider outsources elements of the process, as the authorised entity it must remain able to oversee, review, and make any necessary change in any part of the ESG rating process. 4.17 We propose that an ESG rating provider must not outsource its responsibility, except to a member of its group, for the following activities: • The governance arrangements, and systems and controls required to ensure the integrity, independence and reliability of the ESG ratings it provides and the data it uses. • The process for ensuring that each ESG rating methodology meets the requirements of the UK regulatory regime. 4.18 Where functions are outsourced, there must be a written agreement clearly setting out each party’s responsibilities. This includes members of the provider’s group. 4.19 This approach aims to support the way rating providers operate, continuing to outsource activities to other members of their group or to third parties as needed, while still keeping responsibility for compliance with the regime. 4.20 Rating providers will need to have a sufficient presence and accountability in the UK, ie individuals with genuine operational responsibility and capability to exert control over the ESG rating process. Rating providers should familiarise themselves with our expectations on UK presence in the Authorisations chapter of this CP (Chapter 8). Systems and Controls 4.21 We expect rating providers’ internal arrangements to be appropriate to the nature, scale, and complexity of their business. These arrangements should help ensure effective quality assurance and appropriate oversight of all stages of the rating process. 4.22 This builds on our proposed baseline Handbook requirements in SYSC 5 on the competency, professionalism, honesty and oversight of personnel involved in producing ESG ratings.

26 Quality control and methodology 4.23 We propose to require rating providers to conduct quality assessments of their ESG rating processes, ensuring each ESG rating is produced in line with the provider’s methodology and processes. 4.24 We also propose that rating providers must ensure the methodologies used to produce ESG ratings are defined, thorough and applied systematically and consistently. We also plan to require rating providers to review their methodologies periodically and notify users and rated entities of material methodology changes before they come into effect. Rating providers need to consider the appropriate notice period for this, to give the users and rated entities enough time to consider the information. 4.25 The intention of these proposals is to ensure that ESG ratings are produced in a structured and consistent manner. This should reduce the risk of inconsistent assessments and support transparency around changes. Data quality and accuracy 4.26 We propose that rating providers must ensure ESG ratings are based on accurate and up-to-date information, supported by systems that promote reliability, independence and integrity of the data used. 4.27 This aims to reduce the impact that ESG ratings based on outdated or incorrect data could have on users and markets. Record keeping 4.28 Robust record keeping and documentation can support accountability and enables effective supervision and oversight of rating providers’ practices. 4.29 We propose that providers must keep records of the data used in ratings, governance and decision-making processes, conflicts of interest, and any changes to methodologies, including the rationale for those changes. The records of information about the ESG rating should be sufficient to reproduce that rating. 4.30 This proposal builds from the baseline record keeping requirements in SYSC 9 in our Handbook. It will also include additional requirements to tailor the application of this rule to rating providers. For example, requiring that the records kept include areas such as governance processes and decision-making involved in the rating process, details and reasons for any changes to methodologies and steps taken to manage significant conflicts of interest that cannot be managed by the proposed requirements in Chapter 5. Personal transactions 4.31 To prevent risks from conflicts of interest (see Chapter 5) and to support the application of UK MAR (see Chapter 2), we propose that firms must have policies and procedures to

27 stop relevant employees making personal transactions that meet one of the following criteria: • It would contravene Market Abuse Regulation. • It would involve the improper use or disclosure of confidential information. • It could, or is likely to, create a conflict of interest that damages an ESG rating’s independence or integrity. This would prohibit, for example, employees directly involved in rating an entity from trading in the securities of that entity. 4.32 We propose that firms should have systems to identify and record personal transactions and ensure their employees know their firm’s policies around personal transactions. These expectations are based on the rules for investment firms in COBS 11.7. We have proposed modifying the rules in relation to transactions in funds, as we have identified that there is a technical issue with the current COBS 11.7 rules in this area, which we are considering consulting on to address. Question 10: Do you agree with the proposed governance approach for rating providers? If not, please specify what you disagree with and why. Question 11: Do you agree with the proposed approach to systems and controls, including: a. Quality control and methodology b. Data quality and accuracy c. Record keeping d. Personal transactions If not, please specify which elements you disagree with, what alternative approach you would suggest and why. Question 12: Do you agree with the proposed requirement to give rated entities and users notice of material changes to a methodology? Should any other stakeholders also be given this notice?

28 Chapter 5 Conflicts of interest 5.1 This chapter outlines our proposed approach to addressing conflicts of interest in the ESG rating process. We set expectations for rating providers to have policies and procedures in place to identify, prevent, manage and, where appropriate, disclose conflicts of interest. Background and risks of harm 5.2 Conflicts of interest can lead to biases in the ESG rating process. For example, they may lead providers and their staff to make judgements that differ from their stated methodology. This can create ratings that unfairly favour or disadvantage certain business models. Users may not know how these conflicts have influenced ratings. 5.3 Common conflicts of interest in the sector can occur at both the organisational and personnel level, and between providers, their clients and rated entities. They can happen in both user and issuer pay charging structures, although the latter is less common in the market. Examples of potential conflicts of interest include: At organisational level • Charging structures – Where investors pay for ratings, a provider may feel incentivised to provide ratings that align with investors’ preferences, rather than based purely on the methodology. – Where issuers pay for ratings, a rating provider may be incentivised to give an issuer a higher rating to secure more business. • Where a rating provider is paid separately by a rated entity for other services like consulting or advisory services, or for access to a rating product subscription, while also providing an ESG rating for that entity • Where rating providers have inadequate separation controls between the ESG rating business line and a consulting line and there is potential to share non‑public information about competitors between business lines. At personnel level: • Where an ESG rating analyst takes advantage of information they have as part of their role to trade the securities/derivatives of an entity they are rating. • Where employee remuneration is linked to the revenue earned from a specific rated entity (in the case of an issuer-pays model). • Where an analyst has a relationship with the entity they are rating, including where they have regular correspondence with them as part of their role.

29 5.4 Where conflicts of interest are not appropriately managed, they can erode the integrity or independence of an ESG rating. When conflicts are not disclosed, users may lack the information needed to assess an ESG rating’s credibility. This can impair their ability to make informed choices about which provider to use and how much a user can rely on a rating. Our policy intention 5.5 Users of ESG ratings, and wider market participants, should be able to trust that ESG ratings are produced with integrity and independence and are free from political and economic interference. 5.6 We aim to ensure that rating providers have robust systems and controls and policies and procedures to identify, prevent, manage and disclose conflicts of interest during the course of providing an ESG rating. This is particularly important in complex business models or where sensitive, non-public information is handled. 5.7 Where a firm isn’t reasonably confident it can prevent the risks of damage to a rating’s integrity or independence, it will need to publicly disclose certain information about the conflict. 5.8 As mentioned in Chapter 4, we are also proposing rules to prevent conflicts of interest in certain types of employee personal transactions. 5.9 We know it may not always be possible for a firm to make a full disclosure about its conflicts. For example, commercial confidentiality may mean it cannot disclose which rated entities it provides other services to, and how significant those revenues are. However, in these cases, we still expect firms to make disclosures that explain the nature of the conflict and provide sufficient detail to enable users to understand its potential impact. 5.10 Overall, transparent disclosure of conflicts of interest policies and how specific conflicts are managed can help users understand the nature and potential impact of conflicts. This should help them assess the credibility of a rating and understand if it meets their needs. Our general approach 5.11 We propose applying a combination of tailored rules and guidance to rating providers. Our tailored rules will be set out in the ESG Sourcebook. 5.12 We have chosen not to apply our existing conflicts of interest rules in SYSC 10 to ESG rating providers. Instead, we will align with the approach to conflicts outlined by IOSCO and developed in the Code of Conduct. This approach is tailored to the nature of conflicts of interest in this market that could result in damage to the integrity or independence of an ESG rating.

30 Summary of proposals 5.13 Our summary of proposals is not exhaustive. ESG 6.5 in the draft rules, in Appendix 1, provides our proposed rules in full. • Take appropriate steps to identify actual or potential conflicts of interest during the ESG rating process that present a material risk of damage to the integrity or independence of an ESG rating or a firm’s operations. Examples include the firm’s organisational structure, charging model, employee relationships or incentives. • Maintain effective systems and controls to take all reasonable steps to prevent or manage conflicts of interest. This includes for employees entering into personal transactions (as outlined in Chapter 4). • Keep records of conflicts of interest and ensure their senior management is given a written report on these records at least once a year. • Publish certain information related to a conflict of interest if a firm is not reasonably confident that the steps it has taken will prevent damage to a rating’s integrity or independence. Disclosures should be made as soon as practicably possible. Rating providers should consider the disclosure only as a final measure, they must take adequate steps to address these conflicts first. • Have an effective and transparent conflicts of interest policy. This should be appropriate to the nature, scale and complexity of its business and be reviewed at least annually. Question 13: Do you agree with our proposed approach to conflicts of interest? If not, please specify what you disagree with and why. Question 14: Do you expect any challenges in implementing the proposed rules? If so, please specify which rules and the nature of the challenges.

31 Chapter 6 Stakeholder engagement, complaints, and dispute resolution 6.1 This chapter sets out our proposed rules on stakeholder engagement and handling complaints. It explains why we propose to introduce bespoke requirements for rating providers, rather than the standard complaints and redress framework under FSMA and our Handbook. This includes the Financial Ombudsman Service (Financial Ombudsman) and the Financial Services Compensation Scheme (FSCS). Background and risks of harm 6.2 ESG ratings are primarily used by institutional investors, asset managers and other financial market participants to inform investment decisions. They are not typically marketed or sold directly to retail consumers. However, the impact of these ratings extends across the real economy, affecting a wide range of rated entities, including small companies, who may have limited capacity to engage with rating providers. 6.3 Rated entities and users of ESG ratings have raised concerns about limited engagement with rating providers. Examples include: • Failure to notify rated entities that they are the subject of a rating or giving them limited opportunities to correct factual inaccuracies. • Failure to act on valid feedback (such as factual errors). • Inconsistent feedback-handling by ESG rating providers, where larger firms may benefit from more tailored engagement and faster resolution of issues, compared to smaller firms. 6.4 Where rating providers do not have sufficient procedures to receive feedback or complaints from stakeholders, this means errors are left unresolved. This has an impact on the quality of ESG ratings. It can increase the time users spend on due diligence and following up with rating providers. Our policy intention 6.5 Our aim is to ensure that stakeholders, including users and rated entities, can engage meaningfully with providers and access fair and transparent complaints procedures. Rating providers should deal with valid feedback and complaints appropriately to improve the quality and reliability of ESG ratings. 6.6 This includes appropriate engagement with rated entities, so they have advance notice when a rating is first issued and the opportunity to correct factual errors. We also want broader stakeholders to have opportunities to provide feedback and raise issues, regardless of their size or profile. Rating providers should also have a procedure for receiving and processing feedback from broader stakeholders.

32 6.7 We want stakeholders to be able to escalate issues and raise complaints where appropriate, if this has caused a material impact on them. This might be where they do not think their feedback has been adequately addressed through the usual engagement channel. The rating provider should consider these complaints in a fair and timely manner, which should build accountability and trust in the ESG ratings market. 6.8 We also want to ensure that rating providers maintain their independence, and we expect them to consider the appropriate response to feedback and complaints. For example, they should correct factual errors in data or take action where they have applied the methodology incorrectly. However, there may be feedback that is not appropriate to address, such as where the stakeholder seeks to influence the outcome of the rating in a way that is unrelated to the relevant methodology, or where a complaint is unfounded. Our general approach 6.9 We plan to introduce a set of tailored rules in the ESG Sourcebook to address the risks of harm, as outlined above. Our proposed rules will require rating providers to have appropriate engagement with stakeholders and an effective and transparent complaints-management approach. As outlined in Chapter 3, firms will need to publish their approach to engagement and their complaints-handling procedure. 6.10 We have taken a principles-based approach. For example, we are not proposing set timeframes for rating providers to respond to feedback or complaints. We expect them to consider the most appropriate timeframe, taking a proportionate approach for their business model, which is suitable for the relevant stakeholders. Providers will need to make the process for raising a complaint publicly available. Summary of our proposals 6.11 Our summary of proposals is not exhaustive. ESG 6.3 in the draft rules, in Appendix 1, provides our proposed rules in full. 6.12 We propose introducing the following rules to strengthen rating providers’ procedures for engagement and complaints. 6.13 For engagement, we propose requiring rating providers to: • Notify rated entities that they will be rated in advance of issuing the ESG rating for the first time and give them an opportunity to correct factual errors, before and after issuing the ESG rating. It is important that rated entities know an ESG rating is going to be issued and have the chance to provide feedback, in case there are any errors. To support this, we are proposing that rated entities should be allowed to request the data that is being used to produce a rating. This means being able to request this before the rating is published, to check for factual accuracy. Rating providers should consider how long would be sufficient to allow for correcting factual errors. For example, considering factors like the amount of information they are providing and the rated entity’s size.

33 • Have a procedure for receiving and processing stakeholder feedback. Rating providers may get a broad range of feedback, from users, rated entities, or other stakeholders, such as those accessing ratings made available for free. They should have processes for considering feedback and assessing the appropriate response, either about the accuracy of the ESG rating or other aspects of the rating process. Table 4: Overview of proposed rules for stakeholder engagement Engagement Notification Notify the rated entity that they will be rated, before issuing an ESG rating for the first time. This notification should also include information on: • Appropriate contact details for the rating provider. • An explanation of the nature of the rating, the methodology that will be used, and a summary of the main types of data that the ESG rating will be based on. • An explanation of a rated entity’s right to request the data used within the rating, and an explanation of how the rating provider can be informed of any factual errors in the ESG rating. Data • Provide rated entities free of charge, on request, with the data used in the ESG rating process. • If a rating provider is requesting data from a rated entity, it must: • Make clear what data is being requested, and provide sufficient time for the rated entity to complete the request • Make the request as easy as possible for the rated entity to complete. For example, by pre-populating requests with data from public sources or previous requests, where available. Factual errors Give rated entities sufficient time to correct factual errors before the rating is issued, and the opportunity to do so after publication. Procedures Maintain procedures for receiving and processing stakeholder feedback about the accuracy of ESG ratings or other aspects of the ESG rating process. 6.14 For the purposes of our rules, a complaint is defined as any written expression of dissatisfaction made by or on behalf of a relevant party, including ESG rating users and rated entities, concerning any aspect of the ESG rating process, and which alleges that the complainant has suffered (or may suffer) financial loss, material distress, or material inconvenience. 6.15 For complaints, we propose requiring rating providers to: • Have an effective and transparent complaints management policy and procedures for handling complaints promptly. Providers must be able to deal with complaints promptly and provide public information on the policy and how to raise a complaint. It is important this is a trusted process and stakeholders understand how it works.

34 • Assess complaints in a fair, timely way and respond to the complainant in a reasonable time period. It is for rating providers to assess the appropriate time period for assessing and responding to the complaints. They should include this information in their complaints handling policy. Table 5: Overview of proposed rules for complaints Complaints Policy and procedures Establish effective and transparent complaints management policy procedures to promptly handle and record complaints from relevant stakeholders. These include users of ESG ratings and rated entities. The policy and procedures should be embedded within the firm’s governance and operational frameworks, and they must be set out in writing and be available to all relevant staff. Public information Provide clear and accessible information on their website about how to raise a complaint, how they handle complaints (including timelines) and contact details of the complaint management function. Complaint handling Handle complaints in a timely and fair way, communicating outcomes to the complainant within a reasonable timeframe. Systemic issues Use complaints data proactively to identify and address recurring or systemic issues. Time period Accept complaints raised within 3 years of the date on which the matter giving rise to the complaint occurred. A complaint submitted after this period does not have to be investigated.  Question 15: Do you agree with the proposed approach for stakeholder engagement? If not, please specify what you disagree with and why, and if you have identified any gaps. Question 16: Do you agree with the proposed approach for complaints handling? If not, please specify what you disagree with and why. Question 17: Do you expect any significant challenges in implementing the proposed approach for stakeholder engagement or complaints? If so, please specify which elements and the nature of the challenges. Dispute Resolution 6.16 We do not propose extending the FCA’s existing complaints and redress frameworks in DISP or COMP to complaints about providing an ESG rating, nor expanding the remit of the Financial Ombudsman or FSCS.

35 The Financial Ombudsman 6.17 The Financial Ombudsman is an independent body set up by Parliament to resolve certain complaints between eligible complainants and financial services firms, free of charge and decided by the circumstances of each case. 6.18 The FCA is responsible for setting the rules for the complaints under the compulsory jurisdiction of the Financial Ombudsman. Rules in DISP cover (among other things) what kinds of complaints the Financial Ombudsman can consider under the compulsory jurisdiction and who is eligible to complain. 6.19 Users of ratings – primarily institutional clients – would generally not qualify as eligible complainants. Retail consumers are unlikely to deal directly with rating providers, so the risk of harm is low. We are proposing that if a consumer does access a rating and wishes to complain, they should use the provider’s complaints process. Complaints about other regulated activities would still fall under the Financial Ombudsman’s compulsory jurisdiction. For example, if a firm provides regulated investment advice that includes an ESG rating, and the consumer complains about the advice rather than the rating methodology, that complaint would fall within the Financial Ombudsman’s jurisdiction. 6.20 Instead, we propose to introduce bespoke engagement and complaints-handling requirements on rating providers and retain supervisory and enforcement powers. We believe this strikes the right balance: proportionate regulation that supports a competitive market while ensuring adequate consumer protection. Question 18: Do you agree with our proposal to not extend the Financial Ombudsman’s compulsory jurisdiction to enable complaints about providing an ESG rating to be considered by it? If not, please specify what you disagree with and why. The Voluntary Jurisdiction 6.21 The Financial Ombudsman also operates a voluntary jurisdiction, which allows financial services firms to opt in so that the Financial Ombudsman can consider certain types of complaints not covered by the compulsory jurisdiction. 6.22 For the same reasons as set out above, including, in particular, that the category of eligible complainants in the compulsory jurisdiction is mirrored in the voluntary jurisdiction, the Financial Ombudsman is not proposing to extend its voluntary jurisdiction to cover complaints about providing ESG ratings. To achieve this, we propose amendments to DISP 2.5 and DISP 2 Annex 1G as set out in the draft instrument (Appendix 1). 6.23 As such, this part of the consultation is issued jointly by the FCA and the Financial Ombudsman.

36 Question 19: Do you agree with the Financial Ombudsman’s proposal to not extend its voluntary jurisdiction to cover complaints about providing an ESG rating? If not, please explain why. The Financial Services Compensation Scheme 6.24 The FSCS provides compensation to eligible claimants when an authorised firm has failed because it is, or is likely to be, unable to pay claims against it (ie is ‘in default’). 6.25 FSCS coverage is limited to certain protected claims under the Compensation (COMP) sourcebook. As rating providers do not hold client money or provide personal investment advice, we do not propose to extend FSCS cover to ESG ratings. Question 20: Do you agree with the proposal to not provide FSCS cover? If not, please explain why.

37 Chapter 7 Senior Managers and Certification Regime 7.1 This chapter sets out our proposals for applying the Senior Managers and Certification Regime (SM&CR) to rating providers. These proposals align with our broader governance requirements but focus specifically on individual accountability, conduct, and fitness and propriety. We propose applying the existing SM&CR framework to rating providers and classifying them as Core firms. Branches of overseas rating providers will be subject to the third country branch application of the regime. 7.2 While the SM&CR sits within the broader SYSC framework, we are setting out our proposals in this separate chapter to provide a comprehensive explanation of the regime and an overview of the SM&CR Review. Background and risks of harm 7.3 Clear accountability and high standards of personal conduct are essential to maintain the integrity and reliability of ESG ratings. Without these, significant risks can arise, including: • Lack of clarity about roles and responsibilities, which can result in poor decision making and weak governance and oversight. • Failure to ensure fitness and propriety, leading to individuals in senior roles lacking the necessary competence or integrity. • Reduced ability to identify and address misconduct. 7.4 Below we set out our proposals for applying the SM&CR to rating providers. Providers might also want to consult our guide for FCA solo-regulated firms which contains helpful and practical information, as well as the overview of the SM&CR regime in SYSC 23.3. Key components of the Senior Managers and Certification Regime 7.5 The SM&CR is a set of rules and guidance that sets standards on professionalism, conduct and governance, and holding senior members of a firm to account. It aims to help create a healthier culture in financial services by creating clear accountability, promoting personal responsibility and improving conduct in firms. 7.6 There are 3 key parts to the SM&CR: • The Senior Managers Regime – rules that apply to individuals in certain senior roles, to ensure that they are fit and proper to perform these roles, and that the firm allocates certain prescribed responsibilities to these Senior Management Functions (SMFs). • The Certification Regime – rules that require firms to ensure that individuals who perform certain functions in the firm (and are not ‘Senior Managers’), are fit and proper to do their jobs.

38 • The Conduct Rules – these are high-level standards of behaviour that apply to almost all employees within firms. This guide gives more information on these standards and who they apply to. 7.7 Each of these parts are explained in more detail below. 7.8 The existing regime is designed so that the SMFs, categorisation criteria and certification functions apply across all sectors and different business models. Our policy intention 7.9 We want rating providers to maintain high standards of personal conduct and ensure the fitness and propriety of individuals in senior roles. By making individuals more accountable for their conduct and competence, firms and regulators can hold people to account if things go wrong. This will help reduce harm to users and strengthen market integrity. Summary of our proposals SM&CR categorisation 7.10 We propose to apply all the existing elements and rules of SM&CR to rating providers, in line with the current approach for authorised firms. This includes applying the existing SM&CR classification framework. We expect all rating providers will be classified as Core firms, as this is the regime’s default categorisation. 7.11 A regulated firm that undertakes other activities which mean it becomes categorised as an Enhanced firm will keep this Enhanced status, even if it also provides ESG ratings. 7.12 Some firms may choose to be categorised as Enhanced (‘opt up’), even if our rules don’t automatically categorise them as such. A firm does not need a specific reason to opt up, but this may happen if, for example, a Core firm is a subsidiary of an Enhanced firm and both firms want the SM&CR to apply consistently. Opting up will mean the firm must meet all requirements of the higher category; it cannot choose which requirements apply. For instance, a Core firm that opts up to Enhanced will be treated in the same way as a firm that is automatically Enhanced.

39 Application of SM&CR elements 7.13 We propose the following elements would apply to all rating providers: Senior Managers Regime The SMFs are listed and defined in SUP10C of the Supervision Manual. The main elements are: • Firms need to identify ‘Senior Management Functions’ (SMFs). These are roles held by the most senior people in a firm that have the greatest potential to cause harm or affect market integrity. Firms must assign these functions to Senior Managers. They include executive roles, such as chief executives and executive directors, as well as chairs of boards and chief compliance officers. Senior Managers may hold one or more roles designated as SMFs. • Senior Managers must be approved by us before carrying out their role. • Firms must assess whether the Senior Managers are fit and proper before approval, and on an ongoing basis. • All Senior Managers need to have a Statement of Responsibilities that clearly sets out the Senior Manager’s role and what they are responsible for. The firm needs to allocate Prescribed Responsibilities (explained below) to its most appropriate Senior Managers. Certification Regime  These rules apply to individuals whose job meets the definition of being a ‘Certification Function’. SYSC 27 covers functions at a firm that are not SMFs but may have a material impact on risks to customers, markets, and the firm’s risk profile. Under the Certification Regime: • Firms would need to make sure those performing Certification Functions are fit and proper to do their job. • These individuals would not need FCA approval (unlike Senior Managers). • Firms must ensure individuals conducting Certification Functions are fit and proper to perform their role. The Fit and Proper test for Employees and Senior Personnel (FIT) guide in our Handbook sets out detailed guidance about the types of things firms should consider when assessing a person’s fitness and propriety. We do not expect many employees of ESG rating providers, if any, will meet the definition of being a Certification Function. However, it is the providers’ responsibility to decide if and which employees would meet the requirements. Conduct Rules  Our conduct rules in the Code of Conduct for Staff sourcebook (COCON) in our Handbook set minimum standards of conduct for most employees of FSMA authorised firms. These standards apply to almost all employees who carry out both regulated and unregulated financial services activities, except those in ancillary roles. There are additional rules in COCON applicable to Senior Managers. Prescribed Responsibilities We have defined a list of responsibilities that must be allocated to appropriate Senior Managers. We call these Prescribed Responsibilities. We prescribe these responsibilities to make sure a Senior Manager is accountable for key conduct and prudential risks and potential harms. In addition to these, firms must still identify other responsibilities Senior Managers hold and set these out clearly on their Statement of Responsibilities. In most cases, a Prescribed Responsibility should be allocated to a single individual. However, they can be divided or shared in limited circumstances, such as a job share (see SYSC 24.3). Core firms must decide which senior managers should be responsible for the Prescribed Responsibilities. SYSC 24 of our Handbook explains this in more detail.

40 Senior Management Functions for Core firms 7.14 We propose that SMFs required for rating providers should be consistent with those applicable to other Core SM&CR firms operating in other markets. This means we expect rating providers to have SMFs that fall under the category of ‘governing functions’. The SM&CR does not require firms to change their existing governance structure to meet these requirements, eg the SMF27 would only apply to partnerships. Our guide gives a list of required SMF roles. 7.15 ESG rating providers will also be required to comply with the Compliance Oversight requirements outlined in SYSC 6 of our Handbook. These require firms to have the following corresponding SMF: • SMF16 – Compliance Oversight: This individual is responsible for overseeing the firm’s compliance function, ensuring it maintains effective policies and procedures to meet its regulatory obligations. 7.16 Rating providers are not required to have an SMF17 – Money Laundering Reporting Officer, because of the limited risk of harm for this business model. Territoriality of SM&CR 7.17 ESG rating providers should consider the following: • Senior Managers: The Senior Managers Regime does not have a territorial limitation. It will apply to anyone who performs a Senior Manager role, whether they are based in the UK or overseas. • Certification Regime: For UK firms, the Certification Regime is limited to people performing a Certification Function who are either based in the UK or, if based outside the UK, have contact with UK clients. We call this the ‘territorial limitation’. This means that if a person based overseas does not deal with UK clients but would otherwise have been carrying out one of the functions listed in our rules, the Certification Regime may not apply to them. • Conduct Rules: The Conduct Rules apply on a worldwide basis to certain senior individuals, including SMF holders, non-executive directors, and executive directors. For all other employees, the Conduct Rules only apply if it is performed by a person in the UK. Third country branches 7.18 Providers who consider their business model makes it appropriate to apply for authorisation using a third country branch structure should familiarise themselves with Chapter 8 of The Senior Managers and Certification Regime: Guide for FCA solo￾regulated firms. This explains how the regime applies to third country branches and the 8 prescribed responsibilities that must be given to Senior Managers. For third country branches, there are bespoke roles such as SMF19 (Head of Third Country Branch). The Certification Regime applies to individuals based in the UK branch and, where relevant, those overseas who have direct interaction with UK clients.

41 Handbook application 7.19 The table below also sets out the specific Handbook areas we propose to apply to all rating providers for SM&CR. To note, SYSC refers to the Senior Management Arrangements, Systems and Controls (SYSC) chapters, as outlined in Chapter 2. SYSC 25 and 26 do not apply to Core firms, and so we do not intend to apply these to ESG rating providers. Handbook reference  Title  SYSC 22  Getting, giving and receiving references  SYSC 23  Introduction and firm classification  SYSC 24  Allocating prescribed responsibilities  SYSC 27  Certification Regime  SUP10C  Definitions of Senior Management Functions (SMFs)  DEPP 6.2.9 Duty of responsibility for Senior Managers COCON  Conduct rules for firm staff  FIT Fit and proper test for employees and senior personnel  Ongoing reform 7.20 In July 2025, we consulted on proposed changes to the SM&CR, alongside the Government’s consultation on reforming the regime. The proposals aim to make the SM&CR more efficient and effective. Both consultations have now closed. 7.21 If these proposals are implemented, they would apply to all authorised firms, including rating providers when authorised. We know the proposed changes in both consultations are likely to affect how rating providers respond to this CP and will ultimately need to implement the SM&CR. Notably, the Government proposed to remove the Certification Regime and replace it with a more proportionate regime. 7.22 Given that no changes to SM&CR have been finalised, we are consulting on applying the existing SM&CR to rating providers as it is. Subject to reforms being finalised, we will reflect the up-to-date position on SM&CR at the time of making final rules for rating providers. Question 21: Do you agree with our approach of applying the standard (Core) SM&CR to ESG rating providers as it applies to most other FCA regulated firms? If not, what alternative approach would you propose?

42 Chapter 8 Authorisations 8.1 This chapter outlines our perimeter guidance and approach to authorising rating providers. Perimeter Guidance 8.2 If approved, government legislation will bring the activity of providing an ESG rating into FCA regulation. This legislation is complex and covers a wide range of products. 8.3 We propose new perimeter guidance (PERG in the FCA Handbook) to help firms understand the scope of the activity we will regulate. PERG gives guidance on when firms may need our authorisation or, for those already FCA-authorised, a variation of their Part 4A permission. PERG represents the FCA’s view of the legislation, it is not legally binding. 8.4 This guidance covers what qualifies as an ESG rating and what constitutes the regulated activity of providing an ESG rating. We also cover activities that are excluded. The draft perimeter guidance is in Annex H of Appendix 1. Question 22: Does the proposed perimeter guidance provide sufficient support to help firms understand when FCA authorisation might be required? If not, what else should the guidance cover? Authorisation 8.5 Firms seeking authorisation in the UK will need to apply to us. We will use the information in the application form, and associated documents submitted with it, to assess the firm’s readiness for authorisation. Our aim is to have decided the outcome of applications by the time our regime comes into force. We will create a tailored application form for rating providers to make it simpler for firms to provide the information we need to assess applications. 8.6 We have designed the Authorisations gateway to allow enough time for us to assess applications before the rules come into force. If a firm has not received authorisation by the time providing an ESG rating becomes a regulated activity on 29 June 2028, the firm will no longer be able to carry out any ESG ratings activity. 8.7 We know that firms, particularly those which have not been regulated before, can find the authorisation process a challenge. If we receive poor quality applications, that costs firms and us time and resource. That is why we provide a free to use pre-application service which allows those planning to apply to discuss their plans and ask questions. It

43 also allows us to provide feedback to help them make a good quality application. We’d strongly encourage firms to use this service. Any delays or poor-quality applications may prolong our assessment. We will provide more details on application timelines and transitional arrangements in due course. 8.8 We cannot guarantee we will approve an application for authorisation. This will depend on firms submitting good quality applications and demonstrating they meet our minimum standards and final rules. Our minimum standards are set out in the Threshold Conditions (TCs) schedule 6, Part 1B of FSMA. COND sets out our expectations on the TCs. The fundamental obligations that FCA authorised firms must meet at all times are set out in the Principles for Business (PRIN). See Chapter 2 for more information. 8.9 As part of our decision to grant authorisation to rating providers, we will assess information, including: • The firm’s business plan. • Its resources, including financial resources (‘appropriate resources’ are one of the Threshold Conditions) and any relevant outsourcing arrangements. • Resolution arrangements (if the firm should fail). • How firms meet our core requirements for transparency, systems and controls, governance and conflicts of interest. 8.10 As set out in Chapter 7, we intend for the Senior Managers and Certification Regime (‘SM&CR’) to apply to rating providers. Under the SM&CR, those who hold senior manager positions in the firm will need our individual approval, as part of the application for authorisation. The firm should make these applications at the same time as its application for authorisation. 8.11 Once authorised, if a firm wants to carry out additional regulated activities that it doesn’t have the necessary permission for, it will need to submit a Variation of Permission application. 8.12 Our How to apply for authorisation or registration webpage provides more information about the authorisation assessment. Overseas rating providers seeking authorisation 8.13 International firms seeking authorisation should assess if establishing a third-country branch or a UK incorporated subsidiary would best support their ability to meet the Threshold Conditions and their operational objectives. We will assess the authorisation application in line with the FCA’s Approach to International Firms. This is part of our standard authorisation assessment, including the Threshold Condition requirements and overall compliance with the regime. It also assesses factors such as the provider’s business model and the risk of harm it may pose to the UK market. The ESG rating provider’s UK presence should be proportionate to their size, complexity and risk profile. 8.14 We must assess the provider’s UK presence as sufficient to allow us to supervise it effectively. The entity, when authorised, must remain clearly accountable and able to make changes across the rating process where needed. Where we assess an overseas ESG rating provider poses a high risk of harm to the UK market, we would expect it

44 to establish as a UK-incorporated subsidiary. In comparison, we may permit a smaller overseas provider to operate through a branch structure, if it has managed all other risks factors appropriately. This approach is in line with our aim to create a proportionate regulatory regime. 8.15 To support providers to prepare for the authorisation assessment and the expected physical UK presence, we intend to publish information on our website alongside the final Policy Statement, ahead of the gateway opening. We will also set our expectations to overseas providers in Pre-application Support Service meetings. Application fees 8.16 We recover our costs from the firms we regulate, including the costs of processing applications for authorisation. To keep the structure of application fees simple, we use 10 standard pricing categories. Accordingly, existing ESG rating providers will need to pay an application fee at the gateway when they apply for permission to undertake this new regulated activity. 8.17 We estimate that reviewing applications from larger ESG rating providers will cost us at least twice as much as those from smaller ones, due to their more complex business models and wider volume of current activity. 8.18 Based on this analysis, we propose to apply 2 of the standard pricing categories for application fees at the gateway, as shown at Table 6. Table 6  Type of firm  Proposed application fee  At the gateway  Firms with relevant annual revenue forecast under £250,000 before the gateway opens  Category 4 (£2,790)  Firms with relevant annual revenue forecast £250,000 and above before the gateway opens  Category 6 (£11,150)  After the gateway  All firms  Category 4 (£2,790)  8.19 We only expect to incur higher costs processing applications from larger ESG rating providers when the gateway opens. So, we propose a Category 4 application fee for any new applications submitted after this period. 8.20 We consider a forecast annual revenue of £250,000 from providing ESG ratings in the UK is an appropriate threshold for defining larger providers. We have based this threshold on market analysis and engagement with stakeholders.

45 8.21 This application fee structure represents a reasonable contribution towards our costs and avoids creating an undue barrier to entry for ESG rating providers. Once the rules come into force, we will start recovering our ongoing supervision costs from ESG rating providers through their annual fees. We will consult on these annual fees in November 2026. Question 23: Do you agree with our proposed application fee structure for ESG rating providers? If not, please explain why you disagree. Question 24: Do you agree that the threshold to define larger ESG rating providers should be a forecast annual revenue of £250,000 or more? If not, please explain why you disagree.

46 Chapter 9 After authorisation Supervision and Enforcement 9.1 Once authorised, we will supervise rating providers to ensure they continue to meet our standards and take enforcement action where necessary. This section sets out our approach to this, including our powers and processes. We expect rating providers to familiarise themselves with relevant sections of the Supervision Manual (SUP) and the Enforcement Guide (ENFG) in our Handbook. Supervision 9.2 In line with the supervisory approach set out in SUP, we will analyse available information from firms to identify poor conduct and areas where they could cause harm to consumers and markets. Where we see indicators of systematic harm, we will take action. 9.3 As part of our strategy to become a smarter regulator, we will develop proportionate regulatory reporting requirements for ESG rating providers. We will only collect the information we need and will use. In the longer term, we will develop our approach through firm engagement and testing. 9.4 In line with this, we will pilot and test our regulatory reporting requirements before they become mandatory. At this stage, we do not intend to introduce mandatory regulatory reporting for rating providers (except for SUP 16.10 – verification of firm details). Instead, we will engage with market participants on a voluntary basis to explore data availability and accessibility, including access to non-public datasets. We will consult on our proposals in due course. 9.5 The table below summarises the key sections of SUP we propose to apply to rating providers. It highlights the main chapters likely to be relevant but is not exhaustive. Firms should familiarise themselves with the full detail of SUP to ensure compliance. SUP Chapter Key rule and references SUP 2 Information gathering by the FCA or PRA on its own initiative We can get information in many ways including meetings with firms, visits, information requests or mystery shopping. SUP 2 explains our expectations of firms in providing information and the limitations of our powers when accessing protected or confidential information. A firm must take reasonable steps to ensure that outsourced suppliers are open and co‑operative with our information-gathering work.

47 SUP Chapter Key rule and references SUP 5 Reports by skilled persons We may appoint or require the firm to appoint a skilled person to provide a report or collect and update information. If a firm appoints a skilled person, they must require that person to cooperate with us and waive any duty of confidentiality. SUP 6 Applications to vary and cancel Part 4A permission and to impose, vary or cancel requirements This chapter explains: • How a firm can apply to vary or cancel its permissions. • How a firm can apply to have us impose a new requirement on it or to vary or cancel a requirement. • How we will assess these applications. SUP 6B Imposition of requirements and varying or cancelling of a firm’s permission on the FCA’s own initiative This chapter explains how the FCA will use its “own initiative” powers to impose requirements or vary or cancel a firm’s permission. SUP 7 Individual requirements We can vary or cancel a firm’s permission to carry out a regulated activity and we can set individual requirements and limitations on the FCA’s own initiative. This chapter sets out our approach to using these powers. SUP 8 Waiver and modification of rules We can waive or modify rules for firms if they have applied for or consented to those changes and the firm has met certain conditions. SUP 8 explains the procedure for this. SUP 9 Individual guidance We can give individual guidance to a firm. This chapter sets out the procedure for firms to get this guidance. SUP 10C FCA Senior Managers Regime for approved persons in SM&CR firms This describes what each SMF under the SM&CR covers and which kind of function applies to which kind of firm. It also sets out how a firm must apply for our approval for someone to perform a senior management function and other SMF procedures and requirements. SUP 11 Requirements for firms to notify us of changes to their controllers or close links. SUP 15 Notifications to the FCA This chapter provides guidance on which types of events or changes firms should notify us about, including those required under Principle 11. We propose to apply all of SUP 15, except SUP 15.10. SUP 16 Reporting requirements At this stage, we are proposing to apply the requirement to check the accuracy of firm’s details and report changes to us. Question 25: Do you agree with our proposed application of certain existing SUP rules and guidance to rating providers? If not, please specify what you disagree with and why.

48 Enforcement Our proposals 9.6 We propose to apply the same approach to rating providers as we do to all other regulated firms when carrying out enforcement investigations. FSMA sets out our enforcement powers, so we are not consulting on them. 9.7 We intend to apply the following areas of our Handbook to ESG rating providers: • Enforcement Guide (ENFG) • Decision Procedure and Penalties Manual (DEPP) Our Enforcement Guide 9.8 Our recently updated ENFG explains our approach to enforcement and how we use our investigation powers, gather information and conduct an investigation. It also sets out our approach to applying disciplinary sanctions, varying or cancelling a firm’s permissions, making prohibition orders on individuals, seeking injunctions and getting redress. Investigations 9.9 We will open an investigation if we suspect there has been serious misconduct. Our Investigations Opening Criteria webpage provides more information on this. When we open an investigation, the burden of proof is on us to show there has been serious misconduct or that anyone involved in the investigation is guilty. 9.10 Based on whether we find there has been misconduct, we will then consider any appropriate action. We can use a range of measures to best address a firm’s or individual’s wrongdoing. How we make decisions and impose penalties 9.11 Our DEPP sourcebook sets out our policy and decision-making procedure for giving statutory notices. These are warning notices, decision notices and supervisory notices, and they set out our reasons for proposing and deciding to take action. 9.12 DEPP also sets out the framework we use to decide whether to impose a financial penalty and, if so, how we calculate the amount. 9.13 Chapters 6 and 6A of DEPP give more detail on these topics. Resolving and contesting cases 9.14 We resolve many enforcement cases by settlement, and we explain the settlement process in Chapter 5 of DEPP. We also have a process by which a firm can contest some aspects of our case, which may allow them to reduce the proposed penalty amount. 9.15 This involves the firm entering into a ‘focused resolution agreement’, which is explained further in Chapter 5 of DEPP.

49 9.16 Our Regulatory Decisions Committee (the RDC) will decide any contested issues. The RDC is a committee of the FCA’s Board but is separate from our executive management structure. If the firm or individual wishes to challenge the RDC’s decision, they can refer a case to the Upper Tribunal (Tax and Chancery Chamber). That Tribunal is entirely independent from us and will consider it afresh. Chapter 3 of DEPP gives more information about the RDC. Question 26: Do you have any comments on our proposal to apply the same approach to enforcement investigations and actions to rating providers as we do to other regulated firms, as set out in ENFG? If yes, please specify. Question 27: Do you have any comments on our proposal to follow the same procedures for decision-making and imposing penalties in relation to rating providers and their personnel as set out in DEPP? If yes, please specify. Additional questions Question 28: Do you have any additional comments on our proposed rules and guidance set out in this CP, including where we could take an alternative approach, or think there are any other topics we should consider? If yes, please specify. Question 29: We have aimed to make the proposed rules in Appendix 1 as clear and straightforward as possible. Are there any specific areas you found difficult to interpret or apply? If so, please identify the relevant rule(s) and explain the difficulty.

50 Annex 1 Questions in this paper Question 1: Do you agree with the proposed approach not to apply the Duty to rating providers? If not, please specify what you disagree with and why. Question 2: Do you agree with our approach to applying the high-level standards to rating providers? If not, please specify what you disagree with and why. Question 3: Do you think existing regulatory regimes sufficiently address the risk of harm? If not, which areas do you think need to be addressed and why? Question 4: Do you agree with the proposed minimum public disclosures listed in Table 2? If not, please specify what you disagree with and why. Question 5: Are there any key minimum public disclosures missing from the proposed list in Table 2? If so, please specify which disclosures and why they should be included. Question 6: Do you agree with the proposed disclosures for direct users and rated entities and approach to onward sharing? If not, please specify what you disagree with and why. Question 7: Are there any key minimum disclosures missing from the proposed list in Table 3? If so, please specify which disclosures and why they should be included. Question 8: Do you agree with our general expectations for transparency? If not, please specify what you disagree with and why. Question 9: Overall, do you expect any significant challenges in implementing the proposed approach to transparency and minimum disclosures? If so, please specify which elements and the nature of the challenges. Question 10: Do you agree with the proposed governance approach for rating providers? If not, please specify what you disagree with and why.

51 Question 11: Do you agree with the proposed approach to systems and controls, including: a. Quality control and methodology b. Data quality and accuracy c. Record keeping d. Personal transactions If not, please specify which elements you disagree with, what alternative approach you would suggest and why. Question 12: Do you agree with the proposed requirement to give rated entities and users notice of material changes to a methodology? Should any other stakeholders also be given this notice? Question 13: Do you agree with our proposed approach to conflicts of interest? If not, please specify what you disagree with and why. Question 14: Do you expect any challenges in implementing the proposed rules? If so, please specify which rules and the nature of the challenges. Question 15: Do you agree with the proposed approach for stakeholder engagement? If not, please specify what you disagree with and why, and if you have identified any gaps. Question 16: Do you agree with the proposed approach for complaints handling? If not, please specify what you disagree with and why. Question 17: Do you expect any significant challenges in implementing the proposed approach for stakeholder engagement or complaints? If so, please specify which elements and the nature of the challenges. Question 18: Do you agree with our proposal to not extend the Financial Ombudsman’s compulsory jurisdiction to enable complaints about providing an ESG rating to be considered by it? If not, please specify what you disagree with and why. Question 19: Do you agree with the Financial Ombudsman’s proposal to not extend its voluntary jurisdiction to cover complaints about providing an ESG rating? If not, please explain why. Question 20: Do you agree with the proposal to not provide FSCS cover? If not, please explain why.

52 Question 21: Do you agree with our approach of applying the standard (Core) SM&CR to ESG rating providers as it applies to most other FCA regulated firms? If not, what alternative approach would you propose? Question 22: Does the proposed perimeter guidance provide sufficient support to help firms understand when FCA authorisation might be required? If not, what else should the guidance cover? Question 23: Do you agree with our proposed application fee structure for ESG rating providers? If not, please explain why you disagree. Question 24: Do you agree that the threshold to define larger ESG rating providers should be a forecast annual revenue of £250,000 or more? If not, please explain why you disagree. Question 25: Do you agree with our proposed application of certain existing SUP rules and guidance to rating providers? If not, please specify what you disagree with and why. Question 26: Do you have any comments on our proposal to apply the same approach to enforcement investigations and actions to rating providers as we do to other regulated firms, as set out in ENFG? If yes, please specify. Question 27: Do you have any comments on our proposal to follow the same procedures for decision-making and imposing penalties in relation to rating providers and their personnel as set out in DEPP? If yes, please specify. Question 28: Do you have any additional comments on our proposed rules and guidance set out in this CP, including where we could take an alternative approach, or think there are any other topics we should consider? If yes, please specify. Question 29: We have aimed to make the proposed rules in Appendix 1 as clear and straightforward as possible. Are there any specific areas you found difficult to interpret or apply? If so, please identify the relevant rule(s) and explain the difficulty. Question 30: Do you have any comments on our cost benefit analysis?

53 Annex 2 Cost benefit analysis Executive summary

1. Environmental, Social and Governance (ESG) ratings are part of a growing market for ESG data and analysis. They typically aim to offer standardised, digestible assessments of exposure to and management of ESG factors using a mix of data and informed opinions.
2. In the UK, we estimate that 5,400 of our regulated firms (‘users’ in the context of the survey findings) use ESG ratings from a total of 80 ESG rating providers (‘rating providers’). Most users rely on a small number of the largest providers. Usage is concentrated in certain financial services sectors, with the highest proportions observed in asset management, pensions and retail investment. In the year up to November 2024, we estimate users spent £622m on data products that included ESG ratings.
3. Limitations in rating providers’ internal processes are creating risks of harm in the market. Insufficient transparency makes it harder for users to understand, compare and choose the right products for their needs. Limitations in engagement and complaints handling for users and rated entities to resolve issues, such as errors or omissions. Ineffective identification, prevention and management of conflicts of interest can lead to biased ratings. Lack of robust systems and controls and governance arrangements can lead to poor quality ratings.
4. These limitations mean users may need to spend additional resources to assess the ratings’ quality and reliability for due diligence. We estimate that 63% (approximately 3,400) of firms who purchase and use ratings conduct these assessments, spending £495m a year doing so. Of this, we estimate that £104m is due to resolving issues or requesting information that is not readily available.
5. These limitations can lead to poor market outcomes through the following: • Misinformed financial decisions, such as buying products relying on inaccurate ESG ratings, and inefficient prices of financial products. • Buying unsuitable ESG ratings due to lack of transparency. • Lack of trust, confidence and participation in the ESG ratings market.
6. To address this, in October 2025, the Government published legislation to define an ESG rating and bring the provision of ESG ratings into regulation.
7. Drawing from the International Organization of Securities Commission’s (IOSCO) recommendations, we are proposing a new regulatory regime to reduce the risk of harm through supporting high-quality, reliable, and clearly understood ESG ratings.

54 8. Without our intervention, we assume that: • The current practices of the rating providers will not change (eg by increasing the adoption of the IOSCO’s recommendations or the International Capital Market Association’s industry-led voluntary code of conduct). • We do not account for the impact on costs and benefits from future regulatory interventions in other jurisdictions. So, these will not reduce the costs and benefits of our proposals for the ESG ratings market. 9. Overall, we expect the proposals to deliver a net benefit, with the present value (PV) of benefits exceeding the PV of costs by approximately £577.78m over our 10- year period in our central scenario. Our sensitivity analysis found that altering the assumptions underpinning the central estimates did not materially change the outcome of our cost benefit analysis. 10. The estimated PV cost of our proposals over a 10-year period is approximately £91.85m (£69.51m – £169.25m). This is made up of direct compliance costs to rating providers to comply with our baseline requirements for authorised firms and tailored rules specific to the risks of harm in the market. We expect that a proportion of these costs will be passed on to users of ESG ratings. 11. We expect our regime to reduce the harms described in paragraph 5 by making ESG ratings more transparent, reliable and understandable. We also expect indirect benefits to approximately 3,400 users due to efficiencies in getting information and resolving issues. We estimate these to be £669.62m (£108.00m – £4,320.15m) over the 10-year period in PV terms. This is based on the assumption our proposals will reduce by 75% the part of the due diligence cost of resolving issues or requesting information that is not readily available. 12. We expect our proposals to have indirect economic impacts. By strengthening the reliability of and confidence in ESG ratings, the regime could enable more capital to be allocated to sustainable growth, supporting the UK’s transition to net-zero emissions. 13. Following implementation, we intend to monitor the participation of smaller rating providers to assess the proportionality of our approach. Evaluating the quality and reliability of ESG ratings could be done through thematic reviews, post-impact evaluations, industry engagement and surveys of users and providers.

55 Introduction 14. Section 138l of the Financial Services and Markets Act 2000 (FSMA) requires us to publish a cost benefit analysis (CBA) of our proposed rules. A CBA is defined as ‘an analysis of the costs, together with an analysis of the benefits that will arise if the proposed rules are made’. 15. This CBA sets out our assessment of the significant impacts arising from our proposals. Where reasonably practicable, we have provided quantitative estimates of the costs and benefits. Where quantification is not feasible, we have set out a qualitative assessment. In developing our proposals, we have considered all relevant impacts and exercised judgement to determine the appropriate level of regulatory intervention. 16. In October 2025, the Government published legislation to bring the provision of ESG ratings into regulation. The market comprises a wide range of ESG ratings, scores and rating-like products. The Government’s legislation sets out which of these products will fall within the scope of the ESG ratings regime. 17. There is some minor double-counting between the Treasury’s Impact Assessment (IA) and our CBA on the costs to the FCA. The Treasury’s IA includes an estimate of the likely FCA authorisation application fee and the annual fees for rating providers to cover the ongoing costs of maintaining and supervising the proposed regime. These fees aim to recover part of the costs set out in section ‘Costs to the FCA’. The Treasury’s IA also qualitatively describes some of the anticipated benefits from the proposed extension of our regulatory perimeter but does not quantify them. 18. The remainder of the CBA has the following structure: • The UK ESG ratings market. • Problem and rationale for intervention. • Our proposed intervention (including alternative policy options considered). • Counterfactual and key assumptions. • Summary of impacts. • Benefits. • Costs. • Sensitivity analysis. • Wider economic impacts. • Monitoring and Evaluation. • Consultation with the CBA Panel.

56 The UK ESG ratings market 19. Environmental, Social and Governance (ESG) ratings are part of a growing market for ESG data and analysis. 20. They are typically presented as either aggregate scores or separate E, S and G components, usually on corporates or financial instruments. Rating providers use different methodologies tailored to the aim of the product and to varied and evolving user needs. These ratings may cover broad ESG concerns or focus on specific issues such as climate risk or controversial activities. They may also be more backward￾looking or forward-looking. The data underpinning these ratings is typically sourced from companies’ reports, direct questionnaires or third-party data providers. Because listed companies have to meet disclosure requirements, coverage tends to favour these companies. 21. A company’s ESG characteristics may directly affect its resilience to risks, its profitability or both, as well as its external impacts. As a result, market participants, particularly asset managers, rely on third-party data analysis or ratings to inform their capital allocation decisions, manage risks or construct other financial products (such as benchmarks). For example, the manager of a fund seeking specifically to track companies that are more resilient to climate risks may be strongly influenced to pick shares in companies with positive ESG ratings. 22. ESG ratings are provided primarily by data and analytics companies. The global ESG data provider market, which includes ESG rating providers, shows signs of relative concentration. In 2024, the top 5 providers collectively accounted for an estimated 73% of total market share, according to Opimas (paywalled). The UK ESG ratings market comprises almost the same list of providers as the broader market for ESG data, showing similar concentration with a tail of small providers. 23. To further understand the UK ESG ratings market (referred to as the ‘ESG ratings market’ hereafter) and assess the impact of regulation, we surveyed a sample of users in our regulated firm population in Q4 2024 (our ‘user survey’). Through this, we collected data from 111 ESG ratings users in the financial services sector. All the estimates we report in the CBA from the user survey are weighted (unless explicitly stated otherwise). We used sampling weights that ensure estimates are representative of the users in our regulated firm population. We also issued a voluntary survey to providers of ESG ratings in Q2 2025 (our ‘provider survey’), through which we collected data from 26 ESG rating providers. We summarise the details of the data collection process, analysis and findings from these surveys in our Research Note, ‘Understanding the UK ESG Ratings Market: Findings from Our Surveys’. 24. Figure 1 sets out the key features of the UK ESG ratings market, based on analysis of our user and provider surveys.

57 Figure 1: Our findings on the UK ESG ratings market The UK ESG Ratings Market The real economy ESG rating providers Corporates in the real economy generate data on the Environmental, Social and Environmental (ESG) characteristics of their company, typically via reporting. ESG rating providers transform corporate data into ratings based on analysis and judgement. Their products typically vary along three main dimensions: weightings, scope and coverage. ESG ratings users An estimated 5,400 UK financial services firms spent a total of £622m on data products that included ESG ratings in 2024. 22% 26% 47% 50% Retail Lending General Insurance & Protection Retail Banking Wholesale Financial Markets Retail Investments Pensions & Retirement Income Investment Management <1% 13% 64% 1% 1% 6% 10% 16% 21% 42% 84% Insurance underwriting Commercial and retail lending decisions Non-retail investment advice Retail investment or pension advice Benchmark and index construction Other Reporting and marketing Investment Management The sectors with the highest proportion of users were investment management, pensions and retirement income, and retail investments ESG ratings were predominantly used for investment management and reporting and marketing. We estimate there are between 75 and 150 providers in the UK market. The market consists of a small number of large providers, with a long tail of smaller providers. 22 out of 26 providers also offered wider data products, consulting services, and Second Party Opinions to rated entities. A small number of providers also offered indices linked to their ESG ratings. Market structure Half of users purchased ESG ratings from 4 of the largest providers. Providers typically operated user-pays model with ESG ratings often sold as part of data subscription. ESG ratings products All 26 providers in our survey offered paid ratings, with a small number offering free ratings too. Other services and products (Re)insurers Asset owners/managers Platforms and financial advisers Issuers of financial instruments Retail investors Benchmark administrators and proxy advisors Wholesale banks ESG rating products The median asset base ESG ratings can influence, across a wide range of financial instruments, was £22 billion.

58 Problem and rationale for intervention 25. In this section, we describe how limitations in rating providers’ internal processes can lead to harm and explain the drivers of these limitations. We summarise this in Figure 2. Figure 2: How rating process limitations lead to harm and wider economic impacts 5 HARM Limitations in providers’ processes Impact of limitations Harm Wider economic and societal impacts Insuffi cient transparency Limitations in identifying, preventing, managing and disclosing confl icts of interest Insuffi cient procedures to receive feedback or complaints Insuffi cient governance and insuffi cient or opaque systems and controls More costly and time consuming for users to access or understand relevant information and to resolve issues Purchase of unsuitable ESG rating products Misinformed fi nancial decisions and ineffi cient prices of fi nancial products Loss of revenue and reduced innovation in the fi nancial services Relevant markets do not function well (eg capital misallocation) Resources not used in the most productive way (eg assessment) Lower growth and productivity in the fi nancial services and/or the wider economy Lack of trust, confi dence and participation in the ESG rating market Poor quality, integrity and/or reliability of ESG ratings

59 Limitations in rating providers’ processes 26. As noted in FS22/4, the same rated entity can receive a different ESG rating from different providers (‘low correlation of ESG ratings’). Berg et al., (2024) found this to be mostly driven by differences in measurement (a component of the methodology) and differences in scope (what the ESG ratings capture). This divergence reflects the natural dynamics of a market catering to different user preferences through a variety of products. 27. We do not see differences in ratings or methodologies as a problem, as long as certain standards are met. These include: • Clear and transparent objectives, methodologies, data and data sources. • Sufficient procedures for stakeholder engagement, complaints handling, and dispute resolution. • Effectively identifying and preventing, or managing and disclosing conflicts of interest. • Robust systems and controls, and governance arrangements. 28. Industry stakeholders have clear concerns about the ESG ratings market, particularly on the transparency and quality of ESG ratings, and the difficulty in resolving issues identified (UK Finance, 2025; Environmental Resources Management, 2024; Financial Times, 2024; Financial Times, 2023). These concerns were also reflected in responses to our user survey. Feedback from our roundtables and wider engagement also indicated support for proportionate regulatory intervention. Insufficient transparency 29. Insufficient transparency can make it more difficult for users to understand, compare and choose the right products for their needs. This can be due to incomplete or unclear disclosures by rating providers or lack of available information to address requests for clarification. 30. According to our user survey, approximately a third of users found it difficult to understand what an ESG rating was supposed to measure (33% of users) and access the underpinning methodology or data sources (38%), due to a lack of information. Users required information that was not easily accessible about the underlying data (27%), the methodology (19%), and governance and management of (potential) conflicts of interest (24%). Similar findings were observed in BaFin’s (Germany’s Federal Financial Supervisory Authority) 'Market study on the collection and handling of ESG data and ESG rating procedures by asset management companies’. 31. However, even when this information was provided, some users found it difficult to understand due to its complexity. From our user survey, 13% of users found it difficult to understand information about the measurement objective, and 19% about the methodology and data sources. 32. As well as users, rated entities have also highlighted challenges in understanding the methodology underpinning the ratings they receive (IOSCO, 2021).

60 Limitations in engagement and complaints handling 33. Users and rated entities also face difficulties in resolving issues, such as errors or omissions, with the ESG ratings they receive. This may further hinder their ability to make timely and informed decisions. In our survey, approximately a quarter (22%) of users were unable to resolve issues of transparency, accuracy, validity, weighting or other methodological issues within a satisfactory timeframe. A third (30%) were unable to resolve issues about governance, systems and controls, or management and disclosure of (potential) conflicts of interest within a satisfactory timeframe. Other limitations affecting the quality of ESG ratings 34. Weaknesses or limitations in rating providers’ internal processes also present problems. Our user survey highlighted a lack of trust in the market, particularly around systems and controls (55% of users), managing and mitigating conflicts on interests (26%) and with governance arrangements (40%). In our Research Note we provide more details about the challenges users face. 35. Inefficient and opaque systems, controls and governance can lead to poor-quality ratings. For instance, unresolved errors in applying the methodology can mean the rating is not produced as intended. During our engagement, some asset managers said they identified factual inaccuracies in ratings they used to make investment decisions and had had difficulties engaging with rating providers to resolve these issues. 36. Potential problems from conflicts of interests may arise from commercial ties between rating providers and rated entities, which can lead to inflated ratings (Li et al., 2024). Based on our provider survey, approximately three quarters of providers offered products and services to entities they rated, including data products (12 providers) and advisory or consulting services (6 providers). They also offered other services like Second Party Opinions or sustainability courses. 37. Additionally, several rating providers license ESG indices based on their ESG ratings to asset managers as benchmarks. This creates an incentive to give higher ESG ratings to stocks with higher stock returns to raise the overall performance of an index (Agrawal et al.,2024). Description of harm 38. These limitations in rating providers’ processes can in turn weaken the integrity of financial markets, making them less effective, efficient and reliable. 39. Although we cannot directly measure the scale of the harm, we can approximate it based on users’ implicit willingness to pay to overcome the challenges that contribute to harm. We estimate this using data from our user survey on overall costs that users in the financial sector incur to assess the suitability and reliability of the ESG ratings (£495.20m per year in aggregate), and on what proportion of these costs is attributed to requesting information not readily available and to resolving issues. The latter equates to, on average, £23,000 a year for each user who assesses the ratings. This is a sizable cost burden, particularly for smaller firms and start-ups. These costs aggregate to £103.72m a year for the entire financial services sector, which could be used for more productive activities. In the ‘Benefits’ section, we describe how we obtained these estimates.

61 Misinformed financial decisions and inefficient prices of financial products 40. ESG ratings are used directly or indirectly by financial market participants. Based on our survey, regulated firms directly used ESG ratings mainly to inform their investment management decisions (84% of users) and for reporting and marketing to their stakeholders, such as clients (42%). Some market participants also develop financial products or services that are more closely linked to, or incorporate, ESG ratings, such as indices or other financial derivatives (International Swaps and Derivatives Association, 2021). We also found that over three quarters of ESG ratings users indirectly used ESG ratings by using products and services that incorporated ESG ratings. 41. If users rely on ratings that are inaccurate, biased, inconsistent with their stated methodology or open to misinterpretation, they might make misinformed financial decisions. They may invest in products and/or companies that do not align with their preferences, representing capital misallocation. Where capital misallocation persists, it may also lead to inefficient prices. Evidence in academic literature suggests ESG information is a meaningful pricing factor that can affect investor returns and the cost of capital. Pedersen et al. (2021) demonstrated how ESG information is incorporated into the prices of financial assets (also see Pástor et al., 2021). These effects were additionally corroborated by the findings of Luo (2022) and Bolton and Kacperczyk (2021) in relation to equity securities; and, Huyn and Xia (2021), Kleimeier and Viehs (2021), and Jung et al. (2018) in relation to debt. 42. As well as leading to inefficient prices, capital misallocation can also hamper the transition of companies to net-zero. This is because it may limit their ability to attract the necessary capital to fund their transition or increase the cost of the funding through a higher cost of capital. 43. Finally, there is some limited evidence that rated entities may face increased cost of capital from the uncertainty in ESG ratings (Avramov et al., 2022; Gibson Brandon et al., 2021). When investors are faced with very different ratings for the same rated entity or item, limited transparency around methodologies can prevent them from understanding the underlying drivers of these differences. This creates uncertainty, which can lead investors to demand higher returns as compensation when investing in companies with more divergent ESG ratings. Purchase of unsuitable ESG ratings products 44. There is a broad range of ESG rating products with different types of information measured in different ways. To choose the product most suited to their needs, users must first understand what each rating product available in the market aims to measure and how. 45. The wide range of ESG rating products, combined with the complexity and variation in measures and definitions, can make it difficult for users to compare products or select the most appropriate one without sufficient information. This creates a risk that users purchase an unsuitable ESG rating product. In such cases, the rating product may not provide the information needed to make informed investment decisions or to construct a reliable product that incorporates it.

62 46. In practice, some users (eg, sophisticated investors) can reduce the risk of buying unsuitable ESG rating products and making misinformed financial decisions. Evidence from our user survey found that most users (63%) of externally produced ESG ratings – representing approximately 3,400 regulated firms – relied on in-house staff-time and expertise (‘internal resources’) to assess the suitability and reliability of the ratings they receive. However, the remaining 37% of the users were potentially more exposed to this harm. Lack of trust, confidence and participation in the ESG ratings market 47. Challenges in the market are likely to have contributed to the significant proportion of investors and rated entities that have low or very low trust in rating providers (Environmental Resources Management, 2023). Our user survey identified several concerns reflecting a lack of trust in the market (see also our Research note): • 55% of users considered there were shortcomings in the systems and controls. • 26% had concerns about actual and potential conflicts of interest. • 40% had concerns about governance. 48. Lack of trust and confidence could lead to reduced participation in the ESG ratings market or in the ESG investment product market, resulting in harm for several potential reasons. First, some market participants indicate an interest in incorporating ESG ratings into their financial decisions but do not currently do so. Academic literature indicates investors value and use ESG ratings (Giglio et al., 2025; Baker et al., 2024). Where ESG ratings are not considered, investors may miss relevant ESG-related information, including risk factors, which could affect outcomes in monetary and non-monetary terms. Second, ESG rating providers lose revenue from potential users not participating in the market. Third, an institutional investor survey by BNP Paribas (2023) found that some firms would like to incorporate ESG ratings into their existing products and services or to develop new ones but do not, citing a lack of trust in the ESG ratings market. These firms could be losing revenue by not providing such products and services. 49. Lack of participation in the ESG ratings market can also hinder the transition towards a more sustainable economy and the achievement of the UK’s net-zero targets. Investors use ESG ratings to inform their investment decisions and to influence their sustainability characteristics and environmental impact (see Kräussl et al. (2024)) and references therein). This could have wider societal and economic impacts. There is some academic evidence suggesting the transition to net-zero has the potential to foster innovation and improve productivity and living standards (Stern and Valero, 2021). 50. A lack of trust and confidence in the ESG ratings market can disproportionately undermine the ability of smaller rated entities to raise capital. Our user survey found users chose providers for many reasons, such as reputation, data coverage and integration with existing systems. These preferences can contribute to users and other market participants, such as lenders, favouring ratings by well-established, larger rating providers. For instance, lenders may rely on the information ESG ratings provide to reduce information asymmetry between themselves and rated entities. This, in turn, can lower the cost of capital for those entities (Campanella et al., 2025; Alves and Meneses, 2024). Our stakeholder engagement indicated that smaller entities generally find it easier to obtain an ESG rating from smaller providers. However, where investors or other market participants prefer ratings from larger providers, this may increase funding costs or create additional challenges for smaller entities.

63 Drivers of harms 51. We consider that asymmetric information and conflicts of interests drive the harms described in the previous section, and that the market cannot correct these harms without intervention. Asymmetric information 52. Asymmetric information typically describes instances where the buyer of a product or a service has less information about their key characteristics compared to the provider or supplier they transact with. 53. Information asymmetries may emerge partly because of insufficient transparency on ESG ratings or because it is costly for users to get this information. This leads to a risk of users buying unsuitable products, to misinformed financial decisions and inefficient prices (see ‘Description of harm’). As information asymmetries can also limit the understanding of how ESG ratings are constructed, they can, in turn, exacerbate the lack of trust and confidence in the ESG ratings market. 54. Based on our user survey, 63% of users spent internal resources to assess the suitability and reliability of the ratings they received (see ‘Description of harm’), which suggests that there are indeed information asymmetries. Conflicts of interest 55. Conflicts of interest may arise from commercial ties between rating providers and rated entities, which can lead to biases in developing the ESG ratings (see ‘Limitations in rating providers’ processes’). They can undermine the quality of the ratings, leading to misinformed financial decisions and to lack of trust and confidence in the ESG ratings markets (see ‘Description of harm’). Our proposed intervention 56. Our approach to regulation is principles-based, with guidance to make our expectations clear. It is designed to be proportionate, recognising the range of providers in the market. 57. As a newly regulated sector, we propose to adopt the following approach: • Apply existing baseline rules that apply to most other FCA authorised firms to rating providers, where appropriate (see chapter 2 of the CP). • Introduce tailored rules in the ESG sourcebook where existing requirements are either not appropriate or not proportionate to address the risks of harm. 58. Our tailored rules are structured to incorporate 4 core areas, drawing from IOSCO’s recommendations, to address key risks of harm in the market (see Chapters 3 to 6 of the CP for further details). Our causal chain and mechanisms for benefits 59. Our causal chain (Figure 3) sets out how we expect our regime to improve the ESG rating market’s efficiency, effectiveness and reliability.

64 Figure 3: Causal chain 8 Interventions Provider changes Outcomes Drivers of SICGO Eff ect on SICGO Transparency requirements Requirements to identify, prevent, manage and disclose confl icts of interest Stakeholder engagement, complaints, and dispute resolution requirements Systems and controls and governance requirements Appropriate and transparent policies to identify, eliminate, manage, mitigate and disclose existing or potential confl icts of interest ESG ratings are more transparent, reliable and understandable Users and rated entities can engage meaningfully with providers and access fair and transparent complaints procedures, to correct factual errors and resolve issues Suffi cient and clear information about ESG ratings products (methodology, processes, objective, and data points) Improved or maintained international competitiveness HARM REDUCED Enhancing market integrity Protect consumers Reduction in purchases of unsuitable ESG rating products Enhancing market integrity Protect consumers Better informed fi nancial decisions and improved price effi ciency Enhancing market integrity Increase in trust, confi dence and participation in the ESG ratings market Promote productivity and innovation of fi nancial services Decrease in due diligence costs Effi ciency gains for users Trust in the market and reputation improve Compliance with the rest of the FCA requirements to achieve intended outcomes Sustainable and long-term growth Proportionate regulation & Internationally aligned regulation Robust governance, processes and eff ective systems across the ESG ratings process

65 60. Our transparency requirements will ensure users are provided with sufficient and clear information about ESG rating products. This will reduce information asymmetries and enable users to better understand the methodologies, data and limitations of the ratings. This will help achieve more informed decision-making. 61. Our requirements on stakeholder engagement and complaints handling aim to ensure that stakeholders, including users and rated entities, can engage meaningfully with providers and access fair and transparent complaints procedures. We expect this to allow for more timely resolution of issues with the ratings, such as factual inaccuracies. 62. Our systems and controls requirements will ensure rating providers have appropriate and transparent systems and controls throughout the development and production of ESG ratings. This will help ensure methodologies are applied correctly and consistently with the disclosed methodology, setting a standard for ratings’ quality and reliability. Our governance requirements will ensure there is appropriate oversight to ensure the rest of our requirements are appropriately implemented and overseen. 63. We also expect rating providers to have appropriate and transparent policies to identify, prevent, manage and disclose actual or potential conflicts of interest. This will reduce bias and enhance the reliability of ESG ratings in the market. 64. Once authorised, we will supervise rating providers to ensure they continue to meet our standards. Alternative policy options ‘Do nothing’ 65. The option of not intervening (‘do nothing’) in this market was not available. If Treasury’s SI is approved by Parliament, we will be required to regulate the provision of ESG ratings from 29 June 2028. Further, the Treasury’s November 2024 Consultation Response on the future regulatory regime for ESG rating providers sets out government’s expectation that, in forming the new regulatory regime, we should ‘have regard to the IOSCO recommendations’ and the Code. 66. We consider that the market cannot address harm independently and without regulation to ensure users can get high quality and understandable ESG ratings. 67. Industry-led solutions to which FCA has also contributed have improved market practices, but we consider they do not go far enough to address the prevailing drivers of harm. Based on our survey, users still face several challenges, despite many providers having signed up to the ICMA voluntary code of conduct (the Code), based on the IOSCO recommendations. The Code only provides high-level principles and is voluntary, so adoption rates vary and it can be interpreted in different ways, limiting its effectiveness. 68. The limited effectiveness of industry-led solutions can be partly explained by the lack of incentives for rating providers to materially improve their practices. First, rating providers have incentives to limit their disclosures to protect their proprietary

66 methodologies from competitors, which can perpetuate information asymmetries. Second, processes that aim to identify, prevent, manage and disclose conflicts of interests, as well as additional disclosures, can be particularly costly. Our general approach to alternative policy options 69. In developing our proposals, we considered a range of alternative policy options. We assessed policy options against a consistent set of criteria, including their effectiveness in addressing the identified harms, proportionality, alignment with international standards (including IOSCO recommendations), and their impact on the competitiveness and growth of UK financial markets. 70. In designing our preferred option, we considered the trade-off between more and less prescriptive rules and principles-based approaches which offer flexibility. On the one hand, more prescriptive rules can give firms clarity and could reduce the costs of interpreting them. On the other, highly prescriptive rules can be over-burdensome for rating providers and may not be appropriate for the variety of products and business models in the market. They could also stifle innovation. Highly prescriptive rules could also limit our ability to meet our secondary growth and competitiveness objective. 71. We have drawn on existing regulation in similar markets, such as those for credit rating agencies and benchmark administrators. While similarities in the markets, such as business models, have been useful to consider in structuring our proposals, we have also ensured the strength of regulation is proportionate to the potential harm in the ESG ratings sector. Where ESG rating providers are less systemically interlinked with the wider financial services ecosystem, we have tailored our proposals proportionately. 72. We also considered our approach from the perspective of ‘rebalancing risk’ (Our Strategy 2025-2030). This approach recognises the important role of risk-taking in driving innovation and delivering benefits for financial services markets, while also reducing harm where needed. In ‘rebalancing risk’ we look to assess the relationship between the benefits and the potential harm in pursuing these benefits. This approach is not about accepting harm. Rather, it is about ensuring we make balanced, risk￾informed decisions that reflect the real-world complexity of dynamic markets, and allow us to be a smarter, more adaptive regulator. 73. We have sought to strike a balance. We want to introduce a robust and enforceable regime that sets clear expectations while ensuring that requirements are proportionate to the provider’s size, complexity and business model. This includes recognising the diversity of firms in the market and the fact that many operate as part of international group structures. In striking this balance, we expect it is likely some of the inefficiencies (see ‘Benefits’ section) will remain in the market, while we limit the regulatory burden on firms and pursue our objectives of market integrity and economic growth. 74. We have also considered the evolving international landscape. Several jurisdictions, including the European Union (EU), have introduced or are developing regulatory frameworks for ESG ratings. Our proposals are designed to be consistent with international standards, particularly the IOSCO recommendations, to support cross￾border coherence and reduce the risk of regulatory fragmentation.

67 The counterfactual and key assumptions The counterfactual 75. The impacts of our proposals depend on several factors that, without our proposed intervention, will shape the market’s future development (the counterfactual). For the purpose of this CBA, we assume: • The current practices of the rating providers will not change (eg by increasing the adoption of the IOSCO’s recommendations or the Code). • We do not account for the impact on costs and benefits from future regulatory interventions in other jurisdictions. So, these will not reduce the costs and benefits of our proposals for the ESG ratings market. • The ESG ratings market will continue to grow, likely at a slower pace as demand for ESG data and ratings stabilises. • The number of rating providers operating in the market will remain unchanged. 76. These assumptions are consistent with the current state of the market established using data from our provider and user surveys, which we used for our cost and benefits estimates. 77. However, in the CBA section ‘Sensitivity Analysis’ we demonstrate how changing these assumptions affects the estimated costs and benefits, as well as our overall conclusions. 78. We make these assumptions as we cannot reliably assess how these factors will evolve and how they will affect the ESG ratings market. For example, it is likely that several rating providers will improve their current practices by increasingly aligning with IOSCO’s recommendations and the Code. However, we cannot estimate how many of them will do so and to what extent. Summary of key assumptions 79. This section describes the key assumptions underpinning the CBA. We make further assumptions informed by evidence to quantify impacts, which we discuss in detail in the ‘Costs’ and ‘Benefits’ sections of our assessment. 80. A key driver of estimated benefits is the implicit willingness of users to pay for due diligence. That is, (i) to resolve issues about ESG ratings, and (ii) to be able to readily access the information they need to assess the ratings’ suitability and reliability. We estimate this benefit using data from our user survey. To estimate the benefits, we make an informed judgement about the % reduction in the costs users incur for due diligence. 81. The costs of our proposals will vary based on the specific characteristics of each rating provider. For instance, how far they have adopted the Code or are affected by the EU’s incoming regulation. For our analysis, we estimate the average (mean) costs to rating providers to comply with our proposals and apply these to the population of in-scope rating providers to estimate total costs. Based on data from our provider survey, we

68 account for their current practices, how costly it was for the providers to achieve this and how similar our proposals are to the processes we covered in the survey. This provides a reasonable approximation of the scale of costs to the rating providers. 82. We use standard assumptions from our Statement of Policy on CBAs: • We use the standard appraisal period of 10 years. • We assume 100% compliance. However, relaxing this assumption would still result in estimated impacts falling within the ranges we provide (see ‘Sensitivity analysis’). • We apply a discount rate of 3.5% to determine the present value of the stream of costs and benefits we expect to occur in future years. • All values are in 2025 prices. Summary of impacts 83. Our proposals are expected to generate the following benefits by addressing the risks of harm we identified from the survey and our engagement • Better informed financial decisions and efficient prices of financial products. • Reduction in purchases of unsuitable ESG ratings. • Increase in trust, confidence and participation in the ESG ratings market. 84. We have quantified a benefit to ESG ratings users amounting to £669.62m over the 10-year appraisal period in present value (PV) terms. This is due to efficiencies in getting relevant information from, and resolving issues with, rating providers accruing to an estimated 3,400 regulated firms who use ESG ratings and incur costs to assess their suitability and reliability. We estimate that each of these users will save £23,000 on average in efficiency gains per year. 85. We estimate the present value cost of our proposals over a 10-year appraisal period is approximately £91.85m. The largest share of costs the rating providers will incur is to comply with: • Our core ESG sourcebook proposals covering transparency, conflicts of interest, systems and controls, stakeholder engagement and governance, which we estimate to be £44.83m over the 10-year period. • Our other baseline rules, which we estimate at £19.38m over the 10-year period. 86. Table 1 presents a summary of these benefits and costs and the total one-off and ongoing costs to all affected groups.

69 Table 1: Summary of total benefits and costs, by cost type Cost type Benefits Costs One-off Ongoing, annual One-off Ongoing, annual ESG rating providers FCA’s baseline rules (direct) £6.00m £1.55m Familiarisation and gap analysis with new ESG sourcebook rules (direct) £0.30m - Training for staff involved in the production of and/or distribution of ESG ratings (direct) £0.93m - Total new ESG sourcebook rules (direct) £19.36 £2.96m • Systems and controls and stakeholder engagement £7.70m £0.90m • Conflicts of interests £1.24m £0.55m • Transparency £10.42m £1.51m • Governance Included as part of the compliance costs to the ESG sourcebook rules Form of UK presence Potential search costs (unable to quantify) £1.14m Increased trust, confidence and participation in the ESG ratings market (indirect)

• Increase revenue from increased volume of business for rating providers (unable to quantify) ESG ratings users (financial services firms) Primary benefits • Better informed financial decisions and efficient prices of financial products • Reduction in purchases of unsuitable ESG ratings (indirect) Not quantified

70 Cost type Benefits Costs One-off Ongoing, annual One-off Ongoing, annual Efficiency gains from reduced due diligence costs (indirect)

• £77.79m - Potential pass-through of compliance costs to users (transfer) Improvements in productivity and innovation (indirect) Not quantified Consumers Better informed financial decisions (to the extent they incorporate ESG ratings or use them directly) (indirect) Not quantified Reduction in purchases of unsuitable ESG ratings products (to the extent they use ESG ratings directly) (indirect) Not quantified FCA Proposal development and set-up of the proposed regime (direct) £9.40m (recovered through fees)

Maintenance and oversight of the regime (direct)

• £0.84m (recovered through fees)

87. Table 2 gives a summary of the present value costs and benefits over our 10-year appraisal period. Overall, we expect the proposals to deliver a net benefit, with the PV of benefits exceeding the PV of costs by approximately £577.78m over our 10-year period in our central scenario (NPV). As we present in Table 3, the equivalised annual net direct cost to business (EANDCB) is approximately £10.67m.
88. The greatest uncertainty on the scale of benefits is improvements made by the largest global providers in response to similar regulatory regimes in other overseas jurisdictions. However, as we discuss in the ‘Sensitivity analysis’ section, we do not expect this to affect the CBA’s overall conclusion.
89. Another sizeable uncertainty in the PV of the estimated benefits is the variation in resources users spend on due diligence, as well as the sample size and limitations of the survey data. In the ‘Benefits’ section we explain this in more detail.

71 Table 2: Summary of quantified impacts across 10-year appraisal period PV Benefits PV Costs NPV Equivalised annual net direct cost to business (EANDCB) Total impact £669.62m (£108.00 to £4,320.15m) £91.85m (£69.51m to £169.25m) £577.78m (-£61.25m to £4,250.65m) £10.67m (£8.07m to £19.66m) of which direct - £91.85m - £10.67m of which indirect £669.62m - - - Key unquantified items to consider • Primary benefits for users (regulated firms) and consumers (indirect) • Increase in volume of business (revenue) of rating providers (indirect) • Improvements in productivity and innovation (indirect) Table 3: Net direct costs to firms Total Net Direct Cost to Business (10-year PV) Equivalent annual net direct cost (EANDCB) Total net direct cost to business (costs to businesses – benefits to businesses) £91.85m (£69.51m to £169.25m) £10.67m (£8.07m to £19.66m) Benefits 90. In short, we expect the following benefits from our proposals: • Better informed financial decisions and more efficient prices of financial products. • Reduction in purchases of unsuitable ESG ratings products. • Increased in confidence and participation in the ESG ratings market. 91. We also expect our proposals to deliver resource efficiencies for ESG ratings users by reducing the resources they spend on due diligence. Smaller firms and start-ups who use ESG ratings, and for whom due diligence costs are a proportionally greater burden, are likely to benefit more than larger firms. This could improve their productivity and promote innovation, such as through creating and providing products that integrate ESG ratings. 92. The increase in confidence will likely attract new users in the market who will require some resources to conduct due diligence and to integrate ESG ratings. We expect this will help offset any potential negative impact on employment from the efficiency gains among current users.

72 Benefits to users of ESG ratings Better informed financial decisions and more efficient prices of financial products 93. Addressing limitations in rating providers’ internal processes across various dimensions will improve users’ access to suitable, reliable and high-quality ESG ratings. 94. ESG ratings play a role in investment analysis and the development of financial products, such as benchmarks that embed ratings. See Figure 1 for more details. 95. By improving access to suitable, reliable, and high-quality ESG ratings, users will be better equipped to select appropriate products aligned with their goals and preferences, and to make better informed financial decisions. 96. Better informed financial decisions could also reduce instances of price inefficiencies and capital misallocation (see ‘Description of harm’). So the prices of financial instruments, such as stocks and corporate bonds, will more accurately reflect the ESG characteristics of their issuers, in line with market preferences. 97. We also expect that by enabling users of ESG ratings to make better informed capital allocation decisions, our proposals will also support the transition to net zero. This is discussed in more detail in ‘Wider economic impacts, including on secondary objective’. 98. We cannot quantify these benefits because it is not reasonably practicable to estimate the difference in GBP value of better-informed financial decisions due to data limitations. Data limitations also restrict our ability to quantify the efficient price of market assets. Reduction in purchases of unsuitable ESG rating products 99. We expect our proposals to improve transparency will ensure ESG rating providers disclose sufficient and clear information about their ESG rating products. This includes their methodology, objective, and data inputs, and the rating provider’s internal processes. This will reduce information asymmetries between rating providers and users. Users will be better able to interpret the quality and reliability of ESG ratings, and to compare products across providers. This, in turn, will enable users to choose ESG rating products that best meet their needs and to make more informed investment decisions, in line with standard economic theory. 100. However, we know it will still be impossible for some existing or potential users to access some relevant information, for instance, due to intellectual property issues. We have tried to strike an appropriate balance between addressing the harms in the market and respecting the intellectual property of the rating providers. 101. Fewer purchases of unsuitable ESG ratings will also increase better informed decision￾making. By getting suitable ratings, users will be better equipped to make informed decisions and to align their capital allocations accordingly. 102. We cannot quantify this benefit as it is not reasonably practicable to estimate the GBP value of a reduction in purchases of unsuitable products due to data limitations.

73 Increased trust, confidence and participation in the ESG ratings market 103. We expect that improvements in quality and reliability of ESG ratings will improve trust and participation in the ESG ratings market (see ‘Problem and rationale for intervention’). 104. If increased trust encourages greater participation, this would lead to higher aggregate revenues for rating providers due to an increased volume of business. Broader integration of ESG into more financial products is also likely to create more revenue opportunities and volume of business for product providers like fund managers. This will also likely increase innovation in the financial services market by rewarding the development of new products that can better match investors’ ESG needs and preferences. 105. In particular, smaller rating providers and new market entrants will benefit from greater trust in their ratings due to being regulated and complying with our rules. Consistent standards for systems, controls, conflict management and transparency will help them compete with larger firms. As evidenced from our user survey, users often favour providers with strong reputations, so increasing trust in smaller providers’ ratings may encourage users to consider a wider range of providers. 106. By increasing trust in the ratings of smaller providers, lenders might consider their ratings as part of their assessment for providing funding to small rated entities. This may support small rated entities to access lower-cost funding when they are being rated only by small rating providers (see ‘Description of harm’). 107. We cannot quantify this benefit as it is not reasonably practicable to estimate the increase in expenditure on ESG ratings from improving the trust in the market due to data limitations. Efficiency gains Overview 108. Improved systems and controls, stakeholder engagement, governance, management of conflicts of interests and transparency from ESG rating providers can reduce users’ due diligence costs. Users incur costs to assess the suitability and reliability of ESG ratings products, to resolve any issues they find, or to request the information they need from rating providers to conduct their assessment. By undertaking this work, users can mitigate or avoid the harm we described in ‘Problem and rationale for intervention’. Due diligence costs are thus an indirect way to quantify the harm in the market. 109. Our proposals reduce due diligence costs in two main ways. First, improved transparency will reduce the time and resources users spend on requesting additional information for their assessments. Second, improvements in the quality and reliability of the ratings will reduce the incidence of issues that users need to resolve. 110. Users would continue to do some level of due diligence and incur some assessment costs even if ESG ratings in the market were of high quality, reliable and had improved transparency. We refer to the portion of assessment costs that can be reduced through our proposals as potential ‘efficiency gains’ (or efficiency losses avoided).

74 111. The efficiency gains in the market arise because the aggregate cost to rating providers to improve the quality, reliability and transparency of their ratings is lower than the aggregate costs users incur to resolve issues and request information that is not readily available. There are only an estimated maximum of 150 providers and approximately 5,400 users of the ESG ratings within our regulated firm population. Within this user population, approximately 3,400 assess the suitability and reliability of the ratings (estimates based on our user survey). 112. We expect these efficiency gains will generate broader economic benefits, as users will be able to redirect the resources saved towards more productive activities. We discuss these wider economic impacts in detail in the section ‘Wider economic impacts, including on secondary objective’. Methodology to estimate efficiency gains 113. To estimate the efficiency gains we used data from our user survey, which we describe in detail in our Research Note. 114. The efficiency gains we measured relate to approximately 3,400 firms within our regulatory perimeter. This means our quantified indirect benefit does not capture the benefits to the following types of users: • Users who do not use internal resources for due diligence. • Users outside of our regulatory perimeter. • Consumers (except through any pass-through mechanism). 115. Based on the user survey, we estimate users spend on average 3 full-time equivalent (FTE) per annum on due diligence (see question 21b in our Research Note). We have also estimated that on average 21% of these costs are efficiency losses that our proposals can potentially eliminate. This is based on the proportion of users’ due diligence costs that were attributed to (question 24): • Identifying and resolving issues that users may find with the ESG rating providers. • Requesting relevant information when that is not easily available. 116. We then make two additional key assumptions: • Our proposals will reduce efficiency losses by 75%. Specifically, this is 75% of the average 21% of due diligence costs currently attributed to identifying and resolving issues and requesting information. This assumption is based on our judgement there will still be some problems with ratings. However, we expect these to occur only sporadically or in a non-systematic way, along with some more bespoke information requests and clarifications. In the ‘Sensitivity analysis’ section, we show that the conclusion of our CBA does not materially change if we instead use 40% or 90%. • Analysts conducting assessments have, on average, an annual salary of £49,000, including 21% for overhead costs. This is based on the 4th decile of the full-time annual gross pay in sector ‘Activities of head offices; management consultancy activities’ (SICO7 code 70), from the Office of National Statistics. We use the 4th

75 decile as we expect analysts involved in due diligence are likely to be at an earlier stage of their career than those at the higher percentiles. 117. In the Annex 2.2 of the ‘Annex to the CBA’ we explain the details of our calculations as well as our detailed assumptions. Estimated efficiency gains 118. Based on this, we estimate that each firm which currently incurs due diligence costs (approximately 3,400) will benefit from an efficiency gain of £23,000 per year, on average. This means the aggregate efficiency gains to the financial sector will be £77.79m per year, with a 95% confidence interval of £12.55m – £501.89m per year. 119. We estimate that the 10-year PV aggregate efficiency gain for the financial sector will be £669.62m, with a 95% confidence interval of £108.00m – 4,320.15m. 120. The confidence interval for our central estimate is relatively wide, reflecting the uncertainty of the estimates, and the skewness and variance in the underlying data (ie, a few very large or large users will spend many more resources than the smaller ones). Additionally, by multiplying the 2 variables described in paragraph 115 to compute the efficiency gains, we combine their uncertainty. 121. Table 4 below summarises the estimated efficiency gains to users in the financial sector and the key inputs to our analysis. Table 4. Summary of quantified efficiency gains and key inputs Description of estimate Estimates Aggregate due diligence costs per year £495.20m 95% confidence interval £33.46m – £1,166.07m Average efficiency losses, % of assessment costs 21% 95% confidence interval 11% – 34% Aggregate benefit from reducing 75% of efficiency losses £77.79m per year 95% confidence interval £12.55m – £501.89m per year Total number of users who incur due diligence costs ca. 3,400 regulated firms Average benefit per user who incurs due diligence costs £23,000 per year 10-year PV of aggregate benefit from reducing 75% of efficiency losses £669.62m 95% confidence interval £108.00m – 4,320.15m Table notes: 1. FCA estimates based on ESG ratings user survey of Q4 2024. All estimates are weighted (total and average) using sampling weights. Numbers are rounded. 2. Assessment costs estimates are based on a sample of 39 observations. 3. Estimates of efficiency losses as a proportion (%) of the assessment costs are based on a sample of 45 users. 4. Details on calculations are in Annex 2.2 of the ‘Annex to the CBA’.

76 Costs 122. We summarise the key costs of our proposals in Table 5 below. Table 5: Summary of costs Cost type Total 10-year PV (central) Familiarisation and gap analysis with ESG sourcebook rules £0.30m Training for staff producing and/or distributing of ESG ratings £0.93m New ESG sourcebook rules £44.83m Form of UK presence £9.82m FCA’s baseline rules for authorised firms £19.38m Costs to ESG ratings users and consumers Unquantified Costs to FCA £16.59m Grand total £91.85m Costs to ESG rating providers 123. The main costs of our proposals will be incurred by 80 rating providers we assume to be in scope of our regime in our central scenario. We estimate that 12 of these providers are large – reflecting those that together hold 88% of the global ESG data vendor market share (Opimas, 2025 (paywalled)) – while the remaining 20 are classified as medium-sized and 48 as small. Familiarisation and gap analysis for new ESG sourcebook rules 124. Rating providers will incur costs to familiarise themselves with our proposed requirements in the ESG sourcebook rules and complete gap analysis to understand the changes they need to make to comply with it. 125. Table 6 summarises the estimated costs to providers, using assumptions from our Standard Cost Model (SCM). These are based on rating providers reviewing 80 pages of policy documentation (the CP) and 50 pages of the new legal text in the ESG sourcebook, reflecting the complexity of the regime. 126. After initial familiarisation and gap analysis on our proposals, firms will incur additional costs that we estimate in the following subsections. These costs include: • Establishing and maintaining processes to ensure compliance with our new ESG sourcebook rules. • Familiarising themselves and complying with our other baseline rules for authorised firms.

77 Table 6: Familiarisation and gap analysis costs, central estimates Firm size  Assumptions1 Average cost per firm (£) Total costs to firms (£) Large  Familiarisation: 20 compliance staff, with an hourly salary of £68. Gap analysis: 4 legal staff, with an hourly salary of £79. 14,000 172,000 Medium Familiarisation: 5 compliance staff, with an hourly salary of £63. Gap analysis: 2 legal staff, with an hourly salary of £74.  4,000 87,000 Small Familiarisation: 2 compliance staff, with an hourly salary of £52. Gap analysis: 1 legal staff, with an hourly salary of £70.  1,000 44,000 Total 10-year PV cost 0.3m Table notes: 1. All salaries include an additional 21% for overheads. 2. Figures might not add up because of rounding. Training costs for new ESG sourcebook rules 127. Rating providers will incur costs to train staff involved in producing and/or distributing ESG ratings. Training will involve executive directors, board members, managers and other staff (eg analysts) familiarising themselves with our requirements. 128. To estimate the number of staff that need training we use information from our provider survey. We asked firms how many of each of the following functions involved in producing and/or distributing the ratings were located in the UK: • Executive directors and/or board members (Senior Leadership Team (SLT)). • Managers. • Other full-time staff (eg analysts). 129. For medium and large firms, we assume the number of staff that will need training in each function is the same as the average number of these staff reported in the survey. Due to our sample size, we group our survey respondents into large and non-large firms. We map medium and small rating providers to medium and small respondents and large rating providers to large respondents. For small firms, we further assume approximately half the average number of employees that we saw for non-large firms will need training. 130. The cost of training reflects both the time lost by trainees and the time required to develop and deliver the training, in line with our SCM. 131. Table 7 below outlines the key assumptions underlying our calculations and the estimated costs of training.

78 Table 7: Training costs, central estimates Firm size  Assumptions1 Average cost per firm (£) Total costs to firms (£) Large 2 SLT with an hourly salary of £325, 5 managers with an hourly salary of £80, 12 analysts with an hourly salary of £48. 6 hours of training, 48 hours to prepare training. 23,000 274,000 Medium 2 SLT with an hourly salary of £241, 3 managers with an hourly salary of £81, 6 analysts with an hourly salary of £48. In house training (40% of medium firms): 6 hours of training, 48 hours to prepare training. External training (60% of firms): £700 per person per day of training 17,000 346,000 Small 1 SLT with an hourly salary of £90, 1 manager with an hourly salary of £53, 3 analysts with an hourly salary of £43. External training (100% of small firms): £700 per person per day of training 6,000 307,000 Total 10-year PV cost 0.93m Table notes: 1. All salaries include an additional 21% for overhead. Figures might not add up because of rounding. New ESG sourcebook rules 132. Our proposed ESG sourcebook rules are structured around the following core areas: transparency, governance, systems and controls, conflicts of interest, complaints handling and stakeholder engagement. To inform the assumptions underpinning our estimates of these costs, we draw on insights from our provider survey to calibrate our SCM. 133. We took stock of providers’ current practices, drawing in part on IOSCO’s recommendations and the Code (see questions 33, 36 and 39 of the provider survey in our Research Note). The survey asked providers which key processes they had in place in four areas: transparency, systems and controls (including stakeholder engagement), conflicts of interest, and governance. We also asked them to estimate the one-off FTE hours used to set their processes up. As our proposals are broadly aligned with those covered in the survey, we consider that these survey responses can inform our assumptions about rating providers’ FTE costs to comply with our core proposals. In Annex 2.1 of the ‘Annex to the CBA’, we map our core proposals against the processes covered by the survey, as well as those not included. We also explain our approach to estimating the costs for each.

79 134. For each core area (and thus for our core proposals), except governance, we asked respondents to assess the resources required to set up the associated processes. These resources would cover activities such as “developing any documentation, initial staff training, technology acquisition, setting up any IT systems, setting up any governance and/or oversight frameworks”. Because we consider governance costs to be embedded within the setup of processes for the other three core areas, we did not ask respondents to provide a separate estimate. 135. Our proposals are structured slightly differently from the survey. The provider survey addressed proposals on complaints handling and engagement with rated entities within the broader systems and controls processes. So, we treat the costs for complaints handling as included within the systems and controls costs derived from the user survey. 136. Rating providers will initially incur one-off costs to set up the necessary processes to comply with our core proposals. To calibrate the FTE resources inputted in our SCM, we start with the average FTE hours reported from the provider survey for setting up any remaining processes that we covered in the provider survey and providers had not at the time implemented. We calculate this by multiplying the average FTE hours per process by the average number of processes still to be implemented. We do this separately for large and non-large rating providers, as larger organisations typically have more complex and costly operations. Due to the survey sample size, we group small and medium providers together and apply the non-large provider estimates for both. We assume one FTE person-day equals 7 hours. 137. Rating providers will also face ongoing costs to maintain the processes needed to comply with our core proposals. To estimate these costs, we assume the FTE effort will be a proportion of the one-off costs, based on the nature of the processes. We could not derive insights from the user survey on such costs due to the large number of non￾responses to the relevant questions. 138. We also propose some additional requirements that were not explicitly covered by the provider survey. 139. The provider survey did not cover our proposals on individual product-level disclosures, as part of our transparency proposals (see Table 3, in Chapter 3 of the CP). As a result, we estimate their costs separately. We assume that setting up or amending individual product-level disclosures will be technically demanding, requiring extensive IT development and system integration (eg updating user platforms). Therefore, to comply with this proposal, rating providers will likely require more resources for IT configuration and support, than for governance-related changes. 140. For the remaining areas of divergence, we inflate the average FTE estimated to account for: • Instances where rating providers might need to make further improvements to their already-implemented processes to meet the expectations of our proposals. • Instances where our proposals go beyond the processes we covered in the survey.

80 141. We use the inflated FTE estimates to calibrate our SCM – instead of selecting predefined ‘complexity levels’ – to estimate costs in 2 main categories: IT development and governance changes. IT development captures changes that require modifications to IT systems, additional work by IT staff or buying in outside IT help. Governance changes cover policy interventions that require firms to change their internal processes or governance arrangements in some way. The rest of the assumptions underpinning our SCM are as described in our Statement of Policy on CBAs. 142. Table 8 below shows our estimates of the costs of our core proposals. We provide both the assumed FTE effort in days to underpin the estimates used in our SCM and the estimated averages from the survey that inform them. In section ‘Sensitivity Analysis’ we present estimates for alternative lower and higher cost scenarios. Table 8: Costs of new ESG sourcebook rules for ESG rating providers, central estimates Firm size  Assumed FTE resources, person days Average FTE resources from provider survey, person days1 Average cost per firm (£)2 Total costs to firms (£) Panel A: One-off costs Systems and controls, stakeholder engagement and complaints handling Large 200 for IT; 400 for Governance 393 272,000 3.27m Medium 100 for IT; 200 for Governance 19 127,000 2.55m Small 50 for IT; 70 for Governance 39,000 1.88m Conflicts of interest Large 20 for IT; 30 for Governance 5 27,000 0.33m Medium 15 for IT; 20 for Governance 13 17,000 0.35m Small 15 for IT; 20 for Governance 12,000 0.56m Transparency (excluding individual product-level disclosures) Large 100 for IT; 200 for Governance 220 139,000 1.67m Medium 40 for IT; 60 for Governance 61 45,000 0.89m Small 40 for IT; 60 for Governance 33,000 1.57m Individual product-level disclosures Large 546 for IT; 45 for Governance N/A 268,000 3.22m Medium 156 for IT; 14 for Governance 74,000 1.48m Small 100 for IT; 3 for Governance 33,000 1.60m Total one-off costs 19.36m

81 Firm size  Assumed FTE resources, person days Average FTE resources from provider survey, person days1 Average cost per firm (£)2 Total costs to firms (£) Panel B: Ongoing costs, per annum Systems and Controls, stakeholder engagement and complaints handling Large 46 for IT; 45 for Governance N/A 43,000 0.51m Medium 8 for IT; 14 for Governance 11,000 0.21m Small 4 for IT; 7 for Governance 4,000 0.18m Conflicts of interest Large 12 for IT; 12 for Governance N/A 16,000 0.19m Medium 4 for IT; 8 for Governance 8,000 0.16m Small 4 for IT; 8 for Governance 4,000 0.20m Transparency (excluding individual product-level disclosures) Large 10 for IT; 20 for Governance N/A 18,000 0.22m Medium 4 for IT; 10 for Governance 9,000 0.17m Small 4 for IT; 10 for Governance 5,000 0.23m Individual product-level disclosures Large 46 for IT; 45 for Governance N/A 42,000 0.50m Medium 8 for IT; 14 for Governance 10,000 0.20m Small 8 for IT; 3 for Governance 4,000 0.18m Total ongoing costs, per annum 2.96m Panel C: Total costs across the 10-year period Total 10-year PV cost 44.83m Table notes: 1. The average FTE resources from the provider survey is our estimated average FTE person-days rating providers would spend to set up the remaining processes we covered in the survey. 2. All salaries include an additional 21% for overheads. 3. Figures might not add up because of rounding. Form of UK presence 143. In line with our Approach to International Firms, international firms should assess whether they establish a third-country branch or a UK incorporated subsidiary (see Chapter 8 of the CP). The ESG rating providers’ UK presence should be proportionate to their size, complexity and risk profile. 144. From our provider survey, we estimate that 3 large rating providers, 5 medium and 12 small have no UK presence but provide ESG ratings to the UK market. Some of these providers might make the commercial decision not to establish a presence in the UK and stop accessing the UK market if, for example, the costs of doing so are much higher than their UK revenues. We are unable to estimate how many of the international providers might choose not to establish presence in the UK.

82 145. For the international providers without UK presence, we estimate the cost to rent office space. We assume large providers would require on average 2,450 sq. ft of office space, medium providers would require on average 1,000 sq. ft, and small providers would require on average 750 sq. ft. For the rental cost we assume the large providers will set up their office space in London with £60 per sq. ft. of office space, and the medium and small with £50 per sq. ft. (see The Cost of London Office Space in 2025). We implicitly assume that smaller providers will choose a lower cost rental either because they are more likely to choose a lower cost location or because they might opt for lower quality space. 146. To inform our assumption about how much offices space these providers may need, we account for the number of people that would be employed in the UK office of an overseas rating provider after setting up a UK presence. We draw insights from the provider survey. We account for how many executive directors, board members, managers, other full-time staff working in the production of ESG ratings (eg analysts), and compliance staff these providers could potentially have in the UK. 147. There are likely other one-off costs involved in searching and finding an office space (eg estate agents fees), but we are unable to quantify them. These are considered to be reflected in the ranges set out in section ‘Sensitivity analysis’. 148. In Table 9 we present our estimates of rental cost for office space in London for the overseas rating providers who will incur additional costs to establish UK presence. We provide the key assumptions underpinning our estimates. These data-informed assumptions are made to estimate the cost of establishing a UK presence and do not reflect any prescriptive requirements in our proposals. Table 9: Form of UK presence costs, central estimates Firm size  Assumptions Average annual rental cost per firm (£) Total annual rent cost to firms (£) Large 3 providers would each require on average 2,450 sq. ft. office space with £60 per sq. ft 147,000 0.44m Medium 5 providers would each require on average 1,000 sq. ft. office space with £50 per sq. ft. 50,000 0.25m Small 12 providers would each require on average 750 sq. ft. office space with £50 per sq. ft. 38,000 0.45m Total rent costs, per annum 1.14m Total 10-year PV cost 9.82m Table notes: Figures might not add up because of rounding.

83 Our baseline rules for authorised firms 149. As set out in Chapter 2 of the CP, we propose to apply other rules that are standard for authorised firms to rating providers: • Threshold Conditions (COND): The minimum conditions, set out in FSMA, that a firm must satisfy, and continue to satisfy, to obtain and keep its permissions. We provide guidance on these conditions in COND. • General Provisions (GEN): General rules that apply to all firms, including statutory disclosure statements and use of the FCA name or logo. • Principles for Businesses (PRIN): General statements of the fundamental obligations that firms must comply with at all times. We do not propose applying the Consumer Duty to ESG ratings activity. • Systems and Controls (SYSC): How firms must organise their businesses, manage risk and maintain effective internal systems and controls. • Senior Manager & Certification regime (SM&CR): How firms must allocate responsibilities, certify key staff and apply conduct rules to promote accountability and good governance. 150. Rating providers will also need to familiarise themselves with the following regulatory processes and guides in our Handbook: • Supervision Guide (SUP). • Decision Procedure and Penalties Manual (DEPP). • The Enforcement Guide (ENFG). • The Financial Crime Guide (FCG). • The Perimeter Guidance Manual (PERG). • The Wind-down Planning Guide (WDPG). 151. Finally, the anti-greenwashing rule (ESG 4.3.1R and FG24/3) would also apply to rating providers. 152. As described in Chapter 2 of our CP, we do not propose to introduce additional guidance within our MAR Sourcebook on how firms should interpret UK Market Abuse Regulation (UK MAR) in the context of ESG ratings. These requirements – including the prohibitions on insider dealing, unlawful disclosure of inside information, and market manipulation – apply to unauthorised firms. So they would already apply to rating providers and should not generate additional costs. 153. We estimate the costs based on whether providers are already authorised for other activities or not, and on their size. As Table 10 shows, there are 7 firms that are already authorised for other regulated activities or within a group with other authorised entities. In these cases, the incremental cost of complying with these baseline rules for their ESG ratings activities will be lower than in newly authorised firms. This is because the former can apply their experience with implementing these rules in their wider business. We assume the costs for these firms are 30% of firms that will need to be authorised and are of equivalent size.

84 154. Tables 10 and 11 present our estimates of the average costs for each provider and the total costs to the entire provider population, respectively. Table 10: Average costs per provider for baseline rules, central estimates Provider size (no. of firms) Cost One-off (£) Ongoing (annual) (£) Large (5) COND 10,000 - GEN 15,000 - PRIN 10,000 - SYSC (excluding SM&CR) 6,000 12,000 SM&CR 28,000 2,000 Anti-greenwashing 4,000 - Regulatory guides and processes 170,000 - Large authorised (7) COND 3,000 - GEN 5,000 - PRIN 3,000 - SYSC (excluding SM&CR) 2,000 4,000 SM&CR 8,000 1,000 Anti-greenwashing 1,000 - Regulatory guides and processes 51,000 - Medium (20) COND 3,000 - GEN 5,000 - PRIN 3,000 - SYSC (excluding SM&CR) 17,000 29,000 SM&CR 28,000 2,000 Anti-greenwashing 1,000 - Regulatory guides and processes 45,000 - Small (48) COND 1,000 - GEN 1,000 - PRIN 1,000 - SYSC (excluding SM&CR) 4,000 15,000 SM&CR 28,000 2,000 Anti-greenwashing 1,000 - Regulatory guides and processes 12,000 -

85 Table 11: Total costs to provider population for baseline rules, central estimates Costs One-off (£m) Ongoing (annual) (£m) COND 0.16 0.00 GEN 0.25 0.00 PRIN 0.16 0.00 SYSC (excluding SM&CR) 0.57 1.40 SM&CR 2.07 0.16 Anti-greenwashing 0.45 0.00 Regulatory guides and processes 2.42 0.00 Total 6.10 1.55 Total 10-year PV 19.38 155. Table 12 summaries our methodology to estimate the costs for each set of existing Handbook rules and regulatory processes and guides. Table 12: Approach to estimation Cost type Approach to estimation1 GEN We estimate the one-off familiarisation and gap analysis costs using the length of the legal instrument (85 pages) and our SCM. PRIN We estimated the costs for familiarisation with, and conducting gap analysis on, the remainder of PRIN based on the length (41 pages) of the remaining chapters in the PRIN sourcebook and our SCM. SYSC (excluding SM&CR) We estimated the costs for familiarisation with, and conducting gap analysis on, SYSC using the length (177 pages) of the chapters of the SYSC sourcebook that will apply to rating providers (excluding SM&CR) and our SCM. The costs to set-up and maintain the relevant processes, and train staff were sourced from the CBA in CP21/4 and uprated to account for inflation. These costs were based on approximately 69 responses to our survey of funeral plan providers in Q3 2019. The estimates include some additional costs to comply with SYSC chapters 10, 18, 19 and 28A, that would not apply to rating providers. As there are no specific training requirements for ESG rating providers we do not include these costs from CP21/4 in our estimates. SM&CR The costs to comply with SM&CR are sourced from the CBA relating to PS18/14 and PS18/15 and uprated to account for inflation. These costs are based on approximately 227 responses to a FCA survey of firms undertaken in Q4 2016. All providers are classified as core SM&CR regime firms.

86 Cost type Approach to estimation1 Regulatory processes: • SUP • DEPP Regulatory guides: • FCG • PERG • ENFG • WDPG We estimate the costs for familiarisation with these documents using the length of the rules and/or guidance and our SCM. We also include costs for rating providers to conduct legal gap analysis. This involves comparing their current financial crime processes against FCG and Financial Crime Thematic Reviews (FCTR). We do not expect there to be any material ongoing costs to firms for the other regulatory processes and guides that are not captured elsewhere. The total number of pages of documentation on regulatory processes and guides is 1,854, comprised of: • SUP (388 pages) • DEPP (178 pages) • FCG (134 pages) and FCTR (154 pages) • PERG (848) • ENFG (92 pages) • WDPG (60 pages) Anti￾greenwashing The costs to comply with the anti-greenwashing rule are estimated based on the length of the guidance (23 pages) and our SCM. Table note: 1. We estimate costs for providers that are either already authorised or within a group with at least one other entity to be 30% of full costs of compliance. Costs to ESG ratings users and consumers 156. ESG ratings users and consumers will face indirect costs from the introduction of our regulatory regime. These costs arise through 2 channels: rating providers passing on costs to users (who may then pass these to end-consumers) and market consolidation due to higher regulatory costs. 157. We expect that at least part of the providers’ costs under the proposed regulatory regime will be passed on to ESG ratings users through higher prices of ESG rating products. We consider that consumers rarely access or buy ESG ratings directly. However, they might be indirectly affected through increased costs of financial products that integrate ESG ratings. We expect these impacts should be offset by improved reliability of the ESG ratings. 158. We also expect that imposing compliance costs on providers may lead some to seek mergers or acquisitions. This is particularly the case for some smaller providers who may decide these costs are unaffordable. Under this scenario, we expect them to either seek out a merger with or to be acquired by a larger provider. Fewer providers would increase market concentration, potentially leading to reduced competition and less choice – an indirect cost to users. However, we expect a sufficient number of ESG rating providers will remain in the market to maintain competitive pressure on both price and quality, and improved confidence in the market may encourage new entrants. Overall, the impact on market competition is thus likely to be limited.

87 Costs to the FCA 159. We will incur costs to set up our proposed regulatory regime, including resources to set up and implement new processes and build new systems. We estimate these to be £9.40m. In line with our statutory funding arrangements under FSMA, we will recover most of this cost through setting fees paid by the firms we regulate. A part of this cost also includes the authorisation application process, which will be recovered through the authorisation application fees from the rating providers (see Chapter 8 of the CP). 160. There are also ongoing costs to maintain these systems and supervise the regime. We estimate these costs to be approximately £0.8m annually. They will be recovered through periodic fees paid by rating providers that will be consulted on in late 2026. Sensitivity analysis 161. We conduct scenario analyses to highlight the sensitivity of our cost and benefit estimates to key assumptions and parameters. We begin by modifying certain assumptions underpinning our quantitative estimates. For example, we reduce (and increase) the average compliance cost per firm for our regime by 30% compared to the central estimate. Then we discuss the sensitivity of our estimates to the key assumptions of our counterfactual and compliance with our proposals. 162. First, in Table 13 below we annotate how we modify specific assumptions underpinning our cost estimates. We report the impact of this modification on the estimated values of the different types of costs. We estimate the range of the total cost of our proposed regime, in PV terms for the 10-year horizon, to be £69.51m – £169.25m (central estimate is £91.85m). 163. Second, in Table 14 we provide a range for the quantifiable benefits – the efficiency gains. The range of the quantifiable benefits, in PV terms for the 10-year horizon, is £108.00m – £4,320.15m (central estimate is £669.62m). The range is largely driven by the uncertainty in the estimates from the user survey captured in the 95% confidence interval we provided in ‘Benefits’. 164. Third, we do a sensitivity analysis for our key assumption that our proposals will reduce 75% of the efficiency losses (paragraph 116 in ‘Benefits’). We test a reduction of 40% and 90% of the efficiency losses, and we find that it does not materially change the outcome of our CBA. In particular, assuming a 40% reduction would decrease the quantified benefits to £357.13m in PV terms for the 10-year horizon, which remains higher than the upper estimate of our costs in paragraph 162 above. Assuming 90% would increase quantified benefits to £803.55m in PV terms for the 10-year horizon. These values lie well within the confidence interval of our quantified benefits (paragraph 163). 165. Finally, in Table 15 we discuss how altering the assumptions underpinning the central estimates, including sensitivity to reduced compliance to our proposals, can affect the estimated costs and benefits.

88 166. Overall, we qualitatively show that if we alter the assumptions underpinning the central estimates, the outcome of our CBA will not materially change. We conclude that if we changed these assumptions, the estimated costs and benefits would likely fall within the ranges we provide in Tables 13 and 14. 167. Given the ranges we have estimated, the NPV of our proposals would be within the range of -£61.25m and £4,250.65m. However, we obtain this range by subtracting the low cost from high benefit scenarios for the upper bound, and the high cost from the low benefit scenarios for the lower bound. That is, the point where our proposals are no longer net beneficial is extreme and unlikely. Therefore, we expect our proposals to be net beneficial. Table 13: Sensitivity analysis for cost estimates Cost type  Assumptions Total costs to firms (£), 10-year PV Low cost FCA costs As central estimates 16.59m FCA’s baseline requirements for authorised firms Same number of firms as central estimates; 30% lower average per firm cost 13.63m Familiarisation and gap analysis for new ESG sourcebook rules As central estimates 0.3m Training for staff involved in the production and/or distribution of ESG ratings As central estimates 0.93m New ESG sourcebook rules Same number of firms as central estimates; 30% lower average per firm cost 31.38m Form of UK presence Same number of firms as central estimates; 25% less office space per firm; £5 per sq. ft. less rent than central estimates for all sizes of firms 6.68m Total costs 69.51m High Cost FCA costs As central estimates 16.59m FCA’s baseline requirements for authorised firms Higher number of providers in scope (12 large, 40 medium, 98 small); 30% higher per firm cost 42.66m Familiarisation and gap analysis for new ESG sourcebook rules Higher number of providers in scope 0.43m

89 Cost type  Assumptions Total costs to firms (£), 10-year PV Training for staff involved in the production and/or distribution of ESG ratings Higher number of providers in scope 1.59m New ESG sourcebook rules Higher number of providers in scope; 30% higher per firm cost 90.26m Form of UK presence Higher number of providers in scope; £5 per sq. ft. higher rent than central estimates for large firms only 17.72m Total 10-year PV 169.25m Table notes: Figures might not add up because of rounding. Table 14: Sensitivity analysis for benefits estimates Cost type  Assumptions1 Total benefits to users (£), 10-year PV Lower bound Efficiency gains Lower bound of 95% confidence interval, discounted by 25% 108.00m Upper bound Efficiency gains Upper bound of 95% confidence interval, discounted by 25% 4,320.15m Table notes: Figures might not add up because of rounding. Table 15: Sensitivity analysis for central estimates and compliance Alternative assumptions  Likely impact on costs Likely impact on benefits Likely impact on CBA outcome Adoption of the Code will increase in the future absent FCA intervention Fall within lower range. Per firm average cost lower than central. Fall within lower range. Lower percentage of due diligence costs attributed to limitations in rating providers’ processes. Unchanged. We expect costs and benefits would decrease proportionately by a small amount. Our provider survey indicates the providers have adopted a number of current practices drawing from the Code, but the user survey suggests there are still challenges in the market. So, the Code on its own would likely not be enough to reduce the harm in the market.

90 Alternative assumptions  Likely impact on costs Likely impact on benefits Likely impact on CBA outcome Future regulatory interventions in other jurisdictions will reduce costs and benefits of the UK ESG ratings market Fall within lower range. Per firm average cost lower than central. Fall within lower range. Lower proportion of due diligence costs attributed to limitations in rating providers’ processes. Unchanged. We expect costs and benefits would decrease disproportionately. Overseas regulation for rating providers will affect larger global providers and smaller local overseas providers. Limitations in the larger rating providers’ processes likely account for the majority part of the harm in the market, due to their size and market shares. They also account for a significant part of the total costs. Because the estimated benefit is much higher than the costs in the central estimates, we expect overall benefits will remain higher than costs, but the net benefit will be lower. ESG ratings market in the UK will contract Fall within lower range Per firm average cost lower than central. Fall within lower range. Lower number of users incurring due diligence costs attributed to limitations in rating providers’ processes. Unchanged. We expect costs and benefits would decrease disproportionately. Lower volume of business for the rating providers could slightly decrease their compliance costs. As either fewer users will enter the market or existing users use ESG ratings less extensively, the harm will decrease more than the costs. We expect that overall benefits will remain higher than costs, but the net benefit will be lower. ESG ratings market in the UK will continue to grow As above but in opposite direction. The number of rating providers will increase Fall within higher range Higher number of rating providers in scope. Fall within higher range. Higher due diligence costs. Unchanged. We expect costs and benefits would increase disproportionately. A higher number of rating providers would increase the aggregate compliance costs. As the new providers will be smaller and with low market share, the harm in the market will increase marginally. We expect overall benefits will remain higher than costs, but the net benefit will be lower. The number of rating providers will decrease As above but in opposite direction.

91 Alternative assumptions  Likely impact on costs Likely impact on benefits Likely impact on CBA outcome Compliance lower than 100% Fall within lower range Per firm average cost lower than central. Fall within lower range. Lower % of due diligence costs would be economised. Unchanged. We expect costs and benefits would decrease. We expect overall benefits will remain higher than costs. But, depending on whether larger or smaller rating providers show lower compliance, the net benefit could be lower. This is because larger providers are responsible for a larger portion of the harm in the market than the smaller ones as their actions affect a greater share of the market. Wider economic impacts, including on our secondary objective 168. Overall, we expect the wider economic impacts of our proposals to be small and it is not reasonably practicable to quantify them. The main channels for impacts on the wider economy and international competitiveness are through increased market confidence, higher regulatory burden and enabling the transition to net-zero. Increased market confidence 169. Increased market confidence may increase the number of users who enter the market, increasing rating providers’ revenue. This contributes to the growth of the wider UK economy. 170. Increased confidence in smaller providers can improve their reputation and trust internationally, enhancing the UK’s international competitiveness. Larger rating providers often use their established reputation in other product markets or use their ability to integrate with complementary data products and systems. Both of these factors ranked among the top 5 reasons users gave for choosing a rating provider in our survey. By contrast, smaller rating providers are likely to gain more competitive advantage from strengthening trust from users both inside and outside the UK. This would make rating providers based in the UK more attractive, promoting growth and international competitiveness. We discuss international competitiveness more generally in our Research Note on regulation and growth. Higher regulatory burden 171. The regulatory burden is a key consideration in determining whether a market can continue to sustain opportunities for growth. By introducing formal regulation, we inherently introduce costs to rating providers. This could affect the number of rating providers entering and exiting the market. We have sought to make these costs

92 proportionate to the size of rating providers. However, smaller rating providers will face some fixed costs that are large relative to their size, such as the ongoing cost of complying with SYSC. This is an unavoidable part of creating our regulatory regime and could result in an increase in mergers and acquisitions, leading to further market consolidation, or a small number of firms leaving the market. 172. Another large part of compliance costs is the requirement for providers to have a UK presence. Most providers (16 of 26 in our survey) already have UK presence, but for this is expected to be one of the most substantial compliance costs for those who do not. 173. Overall, we expect the net impact on UK financial sector productivity will be positive. This is because compliance costs are offset by the indirect benefit of efficiency gains for users (£77.79m per year). This will likely reduce unnecessary costs for the financial services firms that use ESG ratings, promoting their international competitiveness (see The growth gap: a literature review of regulation and growth). Additionally, fund managers who are the most frequent users of ESG ratings and will benefit most from our proposals, contribute to approximately 7% of the UK’s net services exports (see Investment management in the UK 2023-2024). Enabling the transition to net-zero 174. We expect our rules to help the UK economy to transition to net-zero greenhouse gas (GHG) emissions, by improving the quality, reliability and trust and confidence in ESG ratings. This aligns with our duty to have regard to contributing towards the Secretary of State achieving compliance with the net-zero emissions target. 175. More reliable ESG ratings mean investors can more easily identify corporates that are, for example, managing the risks or opportunities of transitioning to net zero (see Kräussl et al. (2025) and references therein). This, in turn, could improve their ability to attract the necessary capital to fund their transition, or it may reduce the cost of the funding through a lower cost of capital. 176. There is also some evidence that the transition to a net-zero economy can yield wider societal benefits like innovation, productivity and higher living standards (see for example Stern and Valero (2021) and the references therein, and Confederation of British Industries (2025)). Monitoring and evaluation 177. Our proposed regime would be successful if it leads to: • Fewer issues reported by users on transparency, systems and controls, governance and conflicts of interest. • Improved trust and confidence in the market.

93 178. Building on our approach when developing our proposals, we will monitor how firms are complying with our rules, and the quality and reliability of the ESG ratings. This could include: • Undertaking thematic reviews, or post-impact evaluations. For example, this may include reviewing disclosures to assess improvements in transparency. • Continued industry engagement with a range of market participants, to gather views on the effectiveness of any final rules we decide to make. • Survey users and/or providers of ESG ratings, carry out other market analysis or research. 179. However, we know it may be difficult to isolate the impact of our proposals from regulatory developments in overseas jurisdictions that will affect the largest rating providers with global presence. As a result, it may be difficult to measure success in a systematic way. 180. We will also monitor market participation from smaller providers, to measure the proportionality of our approach. Consultation with our Cost Benefit Analysis Panel 181. We have consulted the CBA Panel in preparing this CBA in line with the requirements of s138IA(2)(a) FSMA. In the Table 16 below, we summarise the Panel’s main recommendations and the measures we took in response. We have also made further changes based on wider feedback from Panel on specific points of the CBA. The CBA Panel publishes a summary of their feedback on their website. Table 16: Summary of our response to the CBA Panel’s main recommendations Main recommendations Our responses Improve assessment of costs and benefits. The Panel recommends that the CBA be improved in two ways; firstly, by properly scrutinising the mathematical mechanics of the CBA – in some cases, the review found purported error in calculation. Secondly, by considering further some individual costs and benefits; much of the CBA conducts in-depth assessment of relatively minor costs when compared with benefits, whilst other benefits are not included e.g. potentially qualitative second-order effects of ESG ratings on market stability and capital allocation. We have completed our usual quality assurance process ahead of publication to ensure the validity of the estimates presented in the CBA. In the ‘Benefits’ section, we discuss the second-order effects on capital allocation from improvements in the quality and transparency of ESG ratings. We have also considered the implications to market stability, but we consider that ESG ratings are unlikely to be sufficiently systemic to affect this. This informed our overall approach to regulation (see ‘Alternative policy options’ section).

94 Main recommendations Our responses Strengthen the evidence around assumptions. The Panel recognises that it is difficult to be certain around the scale of the benefits derived from assumptions. There are likely to be many small suppliers, against which the costs and benefits may align differently. At present the CBA uses assumptions around efficiency gains which lead to a large NPV, with benefits dwarfing costs.  We have provided some further discussion about the limitations of our methodology. We made considerable efforts to improve our evidence base through 2 surveys of the market and desk-based research. Naturally, some data limitations remain, creating uncertainty in some of our estimates. In particular, we recognise uncertainty in the estimated efficiency gains, as shown by the wide 95% confidence interval stemming from differences in users’ due diligence efforts and data limitations. We also now conduct sensitivity analysis around our assumption that 75% of the efficiency losses, concluding the benefits estimates will be within the confidence interval. Our sensitivity analysis, using the lower bound of this interval, confirms the proposals still deliver net benefits. The estimated benefits are driven by an average efficiency gain of £23,000 per ESG rating user, with 3,400 users expected to benefit. This far exceeds the maximum of 150 rating providers who will bear the associated costs. In addition to efficiency gains, we also expect unquantified benefits to the market. Recognise more clearly the uncertainty. The Panel commends the team for undertaking thorough sensitivity analysis, however, in applying the upper bounds to all scenarios this leads to a suspected statistical anomaly whereby the ranges of costs and benefits are extremely large. It is recommended that the team consider whether these ranges are truly applicable in this case. Furthermore, the causality of cost factors like job losses may be less certain with references to developments in AI etc. We have refined our approach to estimating confidence intervals for indirect benefits. As above, the wide ranges indicate considerable uncertainty around the estimated efficiency gains, which we acknowledge throughout the CBA. We do not anticipate that efficiency gains will lead to overall job losses; instead, increased trust in ESG ratings should create more roles, offsetting any reductions. Any resources freed up are also likely to be redeployed in other areas. Finally, while AI may help reduce data validation costs and thus both proposal costs and efficiency gains, these effects are expected to remain within our estimated ranges.

95 Annex to the CBA Annex 2.1: Mapping the core proposals to the processes included in the provider survey questions 182. In Table 17 below, we show how our new ESG sourcebook proposals are mapped to the processes described in our provider survey. We also highlight proposals that were not covered by the survey. For each process listed in Table 17, we asked providers if they had the process in place at the time of completing the survey. Where applicable, we also requested details of the one-off and ongoing resource costs (in FTE hours) required to set up and maintain these processes. Table 17: Core proposals and processes covered in the survey Core policy proposals Processes Overview of minimum public disclosures (Table 2 of CP) • Objectives, characteristics & coverage universe. • Approach to engagement. • Methodology. • Risks. • Conflicts of interest (component of transparency proposals). From Question 39 of the provider survey: • The measurement objective and output (e.g., scale) of the ESG ratings. • High-level methodology document(s). • Detailed methodology document(s). • Regular evaluation of your methodologies against the outputs which they have been used to produce. • Terms of engagement describing engagement with rated entities, including when information is likely to be requested and the opportunities available (if any) to the rated entity review. • Disclosures of potential and actual conflicts of interest that may compromise the independence and integrity of the ESG ratings. Risks are not covered in the survey. We account for this cost by inflating the reported resources that providers spent to implement the processes (see paragraph 140 of the CBA). Overview of additional minimum disclosures to direct users and rated entities (Table 3 of the CP) • Product level disclosures. • Individual rating-level disclosures. From Question 39 of the provider survey: • Detailed methodology document(s). • Regular evaluation of your methodologies against the outputs which they have been used to produce. • Information on data confidentiality management and on the protection of non-public information, to the extent terms of engagement are published. Individual rating-level disclosures are not covered in the survey. We estimate this cost separately (see paragraph 139 of the CBA).

96 Core policy proposals Processes Governance and Systems & Controls (Chapter 4 of the CP) • Governance. • Quality control and methodology. • Data quality and accuracy. • Record keeping. • Personal transactions. • Form of UK presence (Chapter 8 of the CP). For Question 33 of the provider survey: • Ongoing monitoring and updating of ESG ratings – where applicable and in accordance with methodology. • Regular review of methodology, with recording and communication of methodology changes and impacts of those changes. • Ensuring sufficient technological capability to deliver high￾quality ESG ratings. • Quality controls including both (i) procedural checks to ensure that the methodology and internal processes are followed correctly, and (ii) holistic checks to ensure that the process considering the plausibility, coherence and logic of the product is sound. • Maintenance of internal records and management, protection and limitations around use of non-public information. From Question 36 of the provider survey: • Measures to help ensure staff refrain from any securities and derivatives trading presenting inherent conflicts of interest. Governance is considered (for the CBA purposes) as part of all the core proposals in line with Questions 34, 37 and 40. Form of UK presence is not covered in the survey. We estimate its cost separately (see section ‘Form of UK presence’). Conflicts of interest (Chapter 5 of the CP) • Take appropriate steps to identify conflicts of interest. • Maintain effective systems and controls to prevent or manage conflicts of interest. • Keep record of conflicts of interest. • Publish certain information related to a conflict of interest. • Have an effective and transparent conflicts of interest policy. From Question 36 of the provider survey: • Written internal policies and procedures and mechanisms designed to (1) identify and (2) eliminate, or manage, mitigate and disclose any actual or potential conflicts of interest. • Regular review of such policies and procedures, and their application. • Appropriate records of actual and potential conflicts of interest. • Disclosure of your conflict avoidance and management measures to (potential) users/rated entities. • Reporting lines for appropriate staff and their compensation arrangement structured to eliminate or appropriately manage actual and potential conflicts of interest.

97 Core policy proposals Processes Stakeholder Engagement (Table 4 for the CP) • Notification. • Data. • Factual Errors. • Procedures. From Question 33 of the provider survey: • Communication with rated entities when they are in the process of being assessed and of the principal categories of data on which the relevant ESG rating is based ahead of its publication – to the extent it is feasible and appropriate. • Quality control framework allowing for the appropriate and timely consideration of information brought to your attention by rated entities or users. • Clear and consistent contact point for rated entities to interact with. Engagement requirements on data are not covered in the survey. We account for this cost by inflating the reported resources that providers spent to implement the processes (see paragraph 140 of the CBA). Complaints (Table 5 of the CP) • Policy and procedures. • Public information. • Complaint handling. • Systemic issues. • Time period. From Question 33 of the provider survey: • Quality control framework allowing for the appropriate and timely consideration of information brought to your attention by rated entities or users. • Clear and consistent contact point for rated entities to interact with. We account for additional costs by inflating the reported resources that providers spent to implement the processes (see paragraph 140 of the CBA). Annex 2.2: Further details on quantified efficiency benefits 183. In this Annex, we describe the calculations underlying the quantified efficiency benefits. We begin by outlining the approach to estimating total assessment costs, followed by the approach to estimating the proportion of assessment costs that will contribute to efficiency gains. Finally, we outline the key overarching assumptions. Total assessment costs 184. We first need to estimate the total assessments costs and then estimate the proportion of these costs that could be efficiency gains. 185. We estimate the annual assessment cost per firm based on the full-time equivalent (FTE) hours that firms reported spending, as indicated in the user survey, on ongoing activities to assess the ‘overall suitability, quality and/or reliability of the ESG ratings that they receive externally’. 186. We assumed an FTE value of zero for firms that either do not use externally produced ESG ratings or do not conduct their own internal assessments of these ratings. Of the 73 firms eligible to answer the question on FTE spent on assessments, 39 responded and 34 did not. We treat the 34 that did not respond and were eligible to respond as missing.

98 187. To remove possible outliers, we winsorized (a technique to reduce the impact of outliers) the two largest reported FTE values (technically, at the upper 5th percentile, based on the 39 responses to that question). That is, we replaced the values reported by 2 respondents of 23 and 35 FTE per year, with 14 FTE. The users with the 2 highest FTE values were considerably large firms. Despite this, because of the small sample and the risk of outliers inflating our estimates, we chose to winsorize them to avoid over￾estimating the assessment costs that feed into our benefit estimates. 188. Next, we assume an annual salary of £49,000 including a 21% uplift for overhead costs. This is the 4th decile of the full-time annual gross pay in sector ‘Activities of head offices; management consultancy activities’ (SICO7 code 70) from ONS data. We selected a bespoke salary from ONS data as it is more closely aligned to this type of work, assessing the suitability and reliability of the ESG ratings, than the existing salary assumptions used in our SCM. 189. We use the following formula to estimate the annual assessment cost per firm in GBP: 190. Second, we aggregate the annual assessment cost per firm to estimate the total annual assessment costs by multiplying the firm-level assessment cost with the sampling weight of that firm and then we sum these up for all the observations. That is: where are the final sampling weight. The final sample weight is adjusted to account for the non-response rate in the relevant question as we describe in the ‘User survey weighting’ annex of our Research Note. 191. We estimate that the total annual assessment cost that users incur to assess the suitability and reliability of the ESG ratings they buy is £495.20m, with a 95% (bootstrap) confidence interval of £33.46m – £1,166.10m. The wide range of the confidence interval is driven by the dispersion of the responses in the user survey as well as the small sample size. In the ‘Details of bootstrapping steps’ Annex of our Research Note, we describe in detail how we get the confidence interval using bootstrapping. Assessment costs associated with the efficiency gains 192. The ‘efficiency gains’ represent the part of the assessment costs we expect our proposals will address. Users are likely to be doing some minimum level of due diligence, even if there were no underlying issues in the ESG ratings in the market. 193. In our user survey, we asked firms to report the percentage of total assessment costs (in FTE) that were due to: • Identifying and resolving issues they find with the ESG rating providers, and/or • Requesting relevant information when that is not easily available.

99 194. Based on these responses, we have a sample size of 45 users to inform our estimate. Users were given 11 options to choose from (0%; 1%-10%; 11%-20%; …; 91%-100%). So we used the mid-point of each interval in the answers of the firms to get our estimates. That is, 0%, 5.5%, 15.5%, …, 95.5%. We estimate the weighted average efficiency across the respondents. As we compute the weighted mean, we do not need to adjust the weights for non-response. 195. We estimate the weighted average of the efficiency losses due to identifying and resolving issues and requesting relevant information that is not easily available to be 21% of the assessments costs that firms incur per year. The 95% (bootstrap) confidence interval is 11% – 34%. 196. Based on the estimated averages from paragraphs 193 and 197 of the CBA, we compute the total (aggregated) efficiency losses per year by multiplying the weighted sum of the annual assessment cost per firm with the weighted average of the % efficiency losses. That is: 197. We estimate that the total (aggregate) efficiency losses due to identifying and resolving issues and requesting relevant information that is not readily available is £103.72m per year. The 95% confidence interval is £16.73m – £669.19m. 198. Based on the estimates above, on average, the 3,400 regulated firms who use externally produced ESG ratings and assess the ratings using internal resource: • Spend £145,000/year to assess the suitability and reliability of the ratings, • of which, £30,000 is efficiency losses, for identifying and resolving issues and requesting relevant information. 199. To compute the confidence interval in paragraph 197 above, we use analytical methods. We are unable to use bootstrapping methods, because of sample limitations when combining the 2 relevant variables, 96 FCA Sensitive of our Research Note [LINK], we describe in detail how we get the confidence interval using bootstrapping. Assessment costs associated with the efficiency gains 194. The ‘efficiency gains’ represent the part of the assessment costs we expect our proposals will address. Users are likely to be doing some minimum level of due diligence, even if there were no underlying issues in the ESG ratings in the market. 195. In our user survey, we asked firms to report the percentage of total assessment costs (in FTE) that were due to: • Identifying and resolving issues they find with the ESG rating providers, and/or • Requesting relevant information when that is not easily available. 196. Based on these responses, we have a sample size of 45 users to inform our estimate. Users were given 11 options to choose from (0%; 1%-10%; 11%-20%; …; 91%- 100%). So we used the mid-point of each interval in the answers of the firms to get our estimates. That is, 0%, 5.5%, 15.5%, …, 95.5%. We estimate the weighted average efficiency across the respondents. As we compute the weighted mean, we do not need to adjust the weights for non-response. 197. We estimate the weighted average of the efficiency losses due to identifying and resolving issues and requesting relevant information that is not easily available to be 21% of the assessments costs that firms incur per year. The 95% (bootstrap) confidence interval is 11% - 34%. 198. Based on the estimated averages from paragraphs 193 and 197 of the CBA, we compute the total (aggregated) efficiency losses per year by multiplying the weighted sum of the annual assessment cost per firm with the weighted average of the % efficiency losses. That is: 𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎 𝑎𝑎𝑎𝑎𝑒𝑒𝑒𝑒 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝐴𝐴𝐴𝐴 = (𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝑎𝑎𝑎𝑎 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝐴𝐴𝐴𝐴 ) × (𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎 𝐴𝐴𝐴𝐴𝑎𝑎𝑎𝑎 % 𝑎𝑎𝑎𝑎𝑒𝑒𝑒𝑒𝑝𝑝𝑝𝑝 𝑒𝑒𝑒𝑒 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎 𝑎𝑎𝑎𝑎𝑒𝑒𝑒𝑒 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝐴𝐴𝐴𝐴) 199. We estimate that the total (aggregate) efficiency losses due to identifying and resolving issues and requesting relevant information that is not readily available is £103.72m per year. The 95% confidence interval is £16.73m – £669.19m. 200. Based on the estimates above, on average, the 3,400 regulated firms who use externally produced ESG ratings and assess the ratings using internal resource: • Spend £145,000/year to assess the suitability and reliability of the ratings, • of which, £30,000 is efficiency losses, for identifying and resolving issues and requesting relevant information. 201. To compute the confidence interval in paragraph 199 above, we use analytical methods. We are unable to use bootstrapping methods, because of sample limitations when combining the 2 relevant variables, 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝐴𝐴𝐴𝐴 𝑝𝑝𝑝𝑝𝑎𝑎𝑎𝑎 and % 𝑎𝑎𝑎𝑎𝑒𝑒𝑒𝑒𝑝𝑝𝑝𝑝 𝑒𝑒𝑒𝑒 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎 𝑎𝑎𝑎𝑎𝑒𝑒𝑒𝑒 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝐴𝐴𝐴𝐴. We assume that both variables are log-normally and independently distributed, and we use their 95% bootstrap confidence intervals. In our Research note [LINK] we describe in detail how we achieve the confidence interval. and 96 FCA Sensitive of our Research Note [LINK], we describe in detail how we get the confidence interval using bootstrapping. Assessment costs associated with the efficiency gains 194. The ‘efficiency gains’ represent the part of the assessment costs we expect our proposals will address. Users are likely to be doing some minimum level of due diligence, even if there were no underlying issues in the ESG ratings in the market. 195. In our user survey, we asked firms to report the percentage of total assessment costs (in FTE) that were due to: • Identifying and resolving issues they find with the ESG rating providers, and/or • Requesting relevant information when that is not easily available. 196. Based on these responses, we have a sample size of 45 users to inform our estimate. Users were given 11 options to choose from (0%; 1%-10%; 11%-20%; …; 91%- 100%). So we used the mid-point of each interval in the answers of the firms to get our estimates. That is, 0%, 5.5%, 15.5%, …, 95.5%. We estimate the weighted average efficiency across the respondents. As we compute the weighted mean, we do not need to adjust the weights for non-response. 197. We estimate the weighted average of the efficiency losses due to identifying and resolving issues and requesting relevant information that is not easily available to be 21% of the assessments costs that firms incur per year. The 95% (bootstrap) confidence interval is 11% - 34%. 198. Based on the estimated averages from paragraphs 193 and 197 of the CBA, we compute the total (aggregated) efficiency losses per year by multiplying the weighted sum of the annual assessment cost per firm with the weighted average of the % efficiency losses. That is: 𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎 𝑎𝑎𝑎𝑎𝑒𝑒𝑒𝑒 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝐴𝐴𝐴𝐴 = (𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝑎𝑎𝑎𝑎 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝐴𝐴𝐴𝐴 ) × (𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎 𝐴𝐴𝐴𝐴𝑎𝑎𝑎𝑎 % 𝑎𝑎𝑎𝑎𝑒𝑒𝑒𝑒𝑝𝑝𝑝𝑝 𝑒𝑒𝑒𝑒 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎 𝑎𝑎𝑎𝑎𝑒𝑒𝑒𝑒 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝐴𝐴𝐴𝐴) 199. We estimate that the total (aggregate) efficiency losses due to identifying and resolving issues and requesting relevant information that is not readily available is £103.72m per year. The 95% confidence interval is £16.73m – £669.19m. 200. Based on the estimates above, on average, the 3,400 regulated firms who use externally produced ESG ratings and assess the ratings using internal resource: • Spend £145,000/year to assess the suitability and reliability of the ratings, • of which, £30,000 is efficiency losses, for identifying and resolving issues and requesting relevant information. 201. To compute the confidence interval in paragraph 199 above, we use analytical methods. We are unable to use bootstrapping methods, because of sample limitations when combining the 2 relevant variables, 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹𝐹 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝐴𝐴𝐴𝐴 𝑝𝑝𝑝𝑝𝑎𝑎𝑎𝑎 and % 𝑎𝑎𝑎𝑎𝑒𝑒𝑒𝑒𝑝𝑝𝑝𝑝 𝑒𝑒𝑒𝑒 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎 𝑎𝑎𝑎𝑎𝑒𝑒𝑒𝑒 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝐴𝐴𝐴𝐴. We assume that both variables are log-normally and independently distributed, and we use their 95% bootstrap confidence intervals. In our Research note [LINK] we describe in detail how we achieve the confidence interval. . We assume that both variables are log-normally and independently distributed, and we use their 95% bootstrap confidence intervals. In our Research note we describe in detail how we achieve the confidence interval. Assumptions 200. First, we assume our proposals will eliminate 75% of the efficiency losses. We make this assumption because we expect some issues with the ratings will likely continue to emerge but in a non-systematic or re-occurring manner. We also expect some more bespoke information requests and clarifications. 201. Second, we assume our proposals will not alter the amount of due diligence users undertake. If our proposals, in particular those designed to improve transparency and disclosures, enable firms to carry out more extensive due diligence, then some users might incur higher costs. However, we expect the overall costs of due diligence should be lower than without our intervention due to efficiencies.

100 202. Third, we do not consider the impact of increased trust and participation in the ESG ratings market, which could lead to more users conducting due diligence and incurring assessment costs. While this may raise the aggregate assessment costs due to additional users, we expect these costs to be lower per user as our proposals would make due diligence more efficient. 203. Fourth, we do not account for any potential increase in the price of the ESG ratings from rating providers passing on a part of the costs of our proposals. This is because we want to avoid double-counting as we already account for these costs. Question 30: Do you have any comments on our cost benefit analysis?

101 Annex 3 Compatibility statement Compliance with legal requirements

1. This Annex records the FCA’s compliance with a number of legal requirements applicable to the proposals in this consultation, including an explanation of the FCA’s reasons for concluding that our proposals in this consultation are compatible with certain requirements under the Financial Services and Markets Act 2000 (FSMA).
2. When consulting on new rules, the FCA is required by section 138I(2)(d) FSMA to include an explanation of why it believes making the proposed rules (a) is compatible with its general duty, under section 1B(1) FSMA, so far as reasonably possible, to act in a way which is compatible with its strategic objective and advances one or more of its operational objectives, (b) so far as reasonably possible, advances the secondary international competitiveness and growth objective, under section 1B(4A) FSMA, and (c) complies with its general duty under section 1B(5)(a) FSMA to have regard to the regulatory principles in section 3B FSMA. The FCA is also required by s 138K(2) FSMA to state its opinion on whether the proposed rules will have a significantly different impact on mutual societies as opposed to other authorised persons.
3. This Annex also sets out the FCA’s view of how the proposed rules are compatible with the FCA’s competition duty. The competition duty requires the FCA, so far as is compatible with acting in a way which advances the consumer protection objective and the integrity objective, to discharge its general functions (which include rulemaking) in a way which promotes effective competition in the interests of consumers (section 1B(4)).
4. In addition, this Annex explains how we have considered the recommendations made by the Treasury under s 1JA FSMA about aspects of the economic policy of His Majesty’s Government to which we should have regard in connection with our general duties.
5. This letter from the Treasury is known as the ‘remit letter’. The FCA must have regard to the recommendations in it when the FCA discharges general functions including giving general guidance and making rules.
6. This Annex includes our assessment of the equality and diversity implications of these proposals.
7. Under the Legislative and Regulatory Reform Act 2006 (LRRA) the FCA is subject to requirements to have regard to a number of high-level ‘Principles’ in the exercise of some of our regulatory functions and to have regard to a ‘Regulators’ Code’ when determining general policies and principles and giving general guidance (but not when exercising other legislative functions like making rules). This Annex sets out how we have complied with requirements under the LRRA.

102 The FCA’s objectives and regulatory principles: Compatibility statement Strategic and operational objectives 8. The proposals set out in this consultation are primarily intended to advance the FCA’s strategic objective of ensuring that the relevant markets (defined by section 1F FSMA) function well, and our integrity objective. They are also relevant to the FCA’s competition and consumer protection objectives. 9. Our proposals aim to make ESG ratings more transparent and reliable, which will enhance trust in the UK market. Introducing minimum disclosures will ensure there is sufficient information for users and rated entities to make well-informed investment decisions, improve confidence in the market and support the integrity of the UK financial system. In developing our proposals, we have had regard to s1D(2) in FSMA 2000 as set out below. 10. We consider that our measures will support the soundness, stability and resilience of the UK financial system. The proposed rules on governance, systems and controls will lead to more accurate and reliable ESG ratings, which should enable market participants to make better informed capital allocation decisions and accurately price risk. Accurate risk pricing contributes to transparency of the price formation process and market efficiency. 11. Our proposals also advance our consumer protection objective. While there is limited direct consumer use, consumers can access ESG ratings embedded in financial products. If rating providers provide more transparent and reliable products as a result of the rules we are proposing, this will enable consumers to make better informed decisions. 12. This will also support effective competition between providers, as users will have access to comparable information to make better informed choices. We have also taken a proportionate approach to the regime, to reduce barriers to entry and support innovation and competition. 13. Our proposals to introduce rules prohibiting certain types of personal transactions that are prohibited under MAR, including those that would involve the improper use or disclosure of confidential information, take direct and proactive steps to avoid the UK market being used to contravene Article 14 or Article 15 of UK MAR. Secondary international competitiveness and growth objective 14. We also consider that these proposals are compatible with our secondary international growth and competitiveness objective. We expect a well-regulated ESG ratings market will enhance the UK’s reputation as a global hub for sustainable finance and attract investment in ESG-related services and innovation. This is in line with the Government’s Modern Industrial Strategy to use sustainable finance as a growth-driving sector of the UK economy, as set out in paragraph 174 of our CBA.

103 The FCA’s regulatory principles 15. In preparing the proposals set out in this Consultation Paper, the FCA has had regard to the regulatory principles set out in s 3B FSMA. The need to use our resources in the most efficient and economic way 16. We are taking a proportionate approach to regulating rating providers by introducing rules where we see clear risks of harm. Our rules focus on four core policy areas: governance, transparency, conflicts of interest and systems and controls. These are based on the IOSCO recommendations and are aligned with existing expectations in the Code of Conduct for Rating providers to which a number of rating providers are already signatories. Additionally, we have tailored our proposals to be more proportionate compared to other jurisdictions. 17. As part of our commitment to becoming a smarter regulator, we will test certain information we ask rating providers to submit to support our supervisory work before making these submissions a formal part of our regulatory reporting requirements. This approach helps ensure we collect information that supports effective decision-making while reducing cost and regulatory burden on firms. The principle that a burden or restriction should be proportionate to the benefits 18. We have considered the impact of our proposals on rating providers, rated entities and users of ESG ratings and undertaken a cost benefit analysis which is included in Annex 2 of this CP. We consider the overall benefits of our proposals outweigh the costs as set out in our CBA. The need to contribute towards achieving compliance by the Secretary of State with section 1 of the Climate Change Act 2008 (UK net zero emissions target) and section 5 of the Environment Act 2021 (environmental targets) 19. Bringing ESG rating providers within the FCA’s perimeter will enhance transparency, improve quality and strengthen trust in ESG ratings. This should increase their potential to drive positive change, for example, to help investors allocate capital towards businesses and activities that provide environmental benefits aligned with the Government targets and support the transition to a more sustainable future. However, we recognise the impact of regulating ESG ratings may be limited by factors outside of our perimeter, such as the quality and provision of ESG data, or beyond our influence, including providers’ proprietary methodologies.

104 The general principle that consumers should take responsibility for their decisions 20. While there is limited direct consumer use of ESG ratings products, our proposals should provide consumers with more transparent information on how ESG ratings work, enabling them to decide which ratings product is right for them. Some ESG ratings are embedded in financial products sold to retail customers (eg funds on investment platforms). Our proposals support rating providers in providing more transparent and reliable products, enabling consumers to make better informed decisions, while also supporting our primary objectives by promoting market integrity and fostering effective competition between providers. The responsibilities of senior management 21. Our proposals to apply the Senior Managers & Certification Regime to rating providers will ensure that firms and the FCA are able to hold individuals accountable. This will encourage staff to take personal responsibility for their actions, improve conduct at all levels, as well as make sure firms and staff clearly understand and are able to demonstrate how they carry out their functions. The desirability of recognising differences in the nature of, and objectives of, businesses carried on by different persons including mutual societies and other kinds of business organisation 22. We recognise that the market for ESG ratings is diverse, with providers having a range of business models, product offerings, and differing in size and resources. 23. Our principles-based approach is designed to be proportionate to the risk of harm in the market. The flexibility in our approach recognises different businesses may have different operating models. 24. Some rating providers already carry out other regulated activities and are authorised by us, whereas other firms will come into our perimeter for the first time. Our CBA in Annex 2 sets out the impact of rules on rating providers, including smaller firms. The desirability of publishing information relating to persons subject to requirements imposed under FSMA, or requiring them to publish information 25. Our proposals require rating providers to make a range of disclosures. Some of these need to be made public, and others are for users and rated entities. These have been developed to address the risks of harm where there is insufficient information to understand the ESG ratings and make informed investment decisions.

105 The principle that we should exercise our functions as transparently as possible 26. In developing the proposals set out in this CP, we have engaged with a wide range of market participants including ESG rating providers, users, rated entities and other stakeholders. This CP makes clear how we plan to regulate ESG rating providers and invites feedback from industry to inform our final rules and guidance. We also gave industry sufficient notice of our intention and timeline to publish our proposals using the regulatory initiatives grid. 27. We have also shared our approach with our statutory panels, including the Markets Practitioner Panel, the Listing Authority Advisory Panel, the Practitioner Panel, the Smaller Business Practitioner Panel, and the Financial Services Consumer Panel. Financial crime 28. In formulating these proposals, the FCA has had regard to the importance of taking action intended to minimise the extent to which it is possible for a business carried on (i) by an authorised person or a recognised investment exchange; or (ii) in contravention of the general prohibition, to be used for a purpose connected with financial crime (as required by s 1B(5)(b) FSMA). 29. Rating providers authorised by us will be required to actively implement and maintain measures to counter the risk that the provider might be used to further financial crime (SYSC 6.1.1R). Our proposed rules on personal transactions should limit the likelihood of employees of rating providers engaging in insider trading and other activities that would constitute market abuse as defined in UK MAR. Expected effect on mutual societies 30. The FCA does not expect the proposals in this paper to have a significantly different impact on mutual societies. Mutual societies are not within scope of our proposed rules. Compatibility with the duty to promote effective competition in the interests of consumers 31. In developing our proposals in this CP, we have had regard to the FCA’s duty to promote effective competition in the interests oof consumers. 32. We consider that our regulation will improve the quality and reliability of available ESG rating products in the market. By applying the same rules to ESG rating providers operating in UK markets, our proposals level the playing field and provide consumers with access to high quality ratings.

106 33. We have also considered the competition objective when framing how these proposals should be implemented, with a particular focus on whether there is a risk of market concentration and disadvantaging smaller firms and new market entrants. Equality and diversity 34. We are required under the Equality Act 2010 in exercising our functions to ‘have due regard’ to the need to eliminate discrimination, harassment, victimisation and any other conduct prohibited by or under the Act, advance equality of opportunity between persons who share a relevant protected characteristic and those who do not, to and foster good relations between people who share a protected characteristic and those who do not. 35. As part of this, we ensure the equality and diversity implications of any new policy proposals are considered. 36. Overall, we do not consider that our proposals adversely impact any of the groups with protected characteristics ie, age, disability, sex, marriage or civil partnership, pregnancy and maternity, race, religion and belief, sexual orientation and gender reassignment. 37. Some ESG rating providers assess companies on social factors that may involve protected characteristics, such as gender diversity at board level. Strengthening governance and systems and controls may indirectly improve how this data is handled and help prevent misuse. Greater transparency in the ratings process may also improve the credibility of these ratings and support broader equality and diversity outcomes. 38. We welcome your comments if you have any concerns. We will keep these considerations under review throughout the consultation period and in developing our final rules. Remit letter 39. We have had regard to the content of the Treasury’s November 2024 remit letter. Our view is that our consultation proposals support the matters in the remit letter by implementing a proportionate and effective regulatory regime for ESG rating providers that supports growth of the UK economy. 40. By regulating ESG rating providers, we demonstrate our commitment to leading the world in sustainable finance. We have had regard to ensuring the UK’s capital markets are competitive and facilitate growth by aligning our proposals with IOSCO’s recommendations.

107 Legislative and Regulatory Reform Act 2006 (LRRA) 41. We have had regard to the principles in the LRRA for the parts of the proposals that consist of general policies, principles or guidance and consider that our proposals are compliant with the five LRRA principles – that regulatory activities should be carried out in a way which is transparent, accountable, proportionate, consistent and targeted only at cases in which action is needed. • Transparent – We are using this CP to consult with industry and will consider all feedback received before making final rules. We have engaged with industry ahead of this consultation and will continue to engage throughout the consultation period and before introducing our final rules. • Accountable – We are acting within our statutory powers and will publish final rules after we have considered feedback on the proposals outlined in this CP. • Proportionate – Our proposals aim to implement a proportionate regime for rating providers, focusing on areas where we see harm. We recognise that smaller providers may face increased compliance costs as they seek to implement our rules. We will monitor market participation from smaller providers, to measure the proportionality of our approach. • Consistent – We would apply the same expectations across all firms carrying out ESG rating activities. • Targeted – Our proposals are targeted towards areas where we have identified the greatest risk of harm to markets. • Regulators’ Code – We have had regard to the Regulators’ Code for the parts of the proposals that consist of general policies, principles or guidance. In designing our policy proposals, we have considered how to support firms to comply and grow and will continue to do so by considering their feedback to this CP and refining our proposals where necessary. Our CP, CBA, draft instrument, accompanying annexes, public communications with firms are provided in a simple, straightforward, transparent and clear way to help firms meet their responsibilities.

108 Annex 4 Abbreviations used in this paper Abbreviation Description CBA Cost Benefit Analysis COBS Conduct of Business Sourcebook COCON Code of Conduct Sourcebook COND Threshold Conditions sourcebook CP Consultation Paper DEPP Decision Procedure and Penalties Manual DISP Dispute Resolution: Complaints Sourcebook ENFG Enforcement Guidance ESG Environmental Social Governance EU European Union FCA Financial Conduct Authority FG Finalised Guidance FIT Fit and Proper Test for Employees and Senior Personnel FOS Financial Ombudsman Service FSCS Financial Services Compensation Scheme FSMA Financial Services and Markets Act 2000 GEN General Provisions Sourcebook ICMA International Capital Market Association IOSCO International Organisation of Securities Commissions LRRA Legislative and Regulatory Reform Act 2006

109 Abbreviation Description MAR Market Abuse Regulation (UK) MAR 1 Market Conduct Sourcebook PERG Perimeter Guidance Manual PRIN Principles for Business Sourcebook PS Policy Statement RDC Regulatory Decisions Committee SMF Senior Managers Functions SM&CR Senior Managers & Certification Regime SUP Supervision Manual SYSC Senior Management Arrangements, Systems and Controls Sourcebook TC Threshold Conditions UK United Kingdom WDPG Wind-down Planning Guidance

Appendix 1 Draft Handbook text

FCA 2025/XX FOS 2025/XX ENVIRONMENTAL, SOCIAL AND GOVERNANCE RATINGS INSTRUMENT 2025 Powers exercised by the Financial Conduct Authority A. The Financial Conduct Authority (the “FCA”) makes this instrument in the exercise of: (1) the following powers and related provisions in the Financial Services and Markets Act 2000 (the “Act”): (a) section 137A (The FCA’s general rules); (b) section 137P (Control of information rules); (c) section 137T (General supplementary powers); (d) section 138D (Actions for damages); (e) section 139A (Power of the FCA to give guidance); (f) section 226 (Compulsory jurisdiction); and (g) paragraph 23 (Fees) of Part 3 (Penalties and fees) of Schedule 1ZA (The Financial Conduct Authority); (2) the other powers and related provisions listed in Schedule 4 (Powers exercised) to the General Provisions of the FCA’s Handbook; and (3) article 2(2) of the Financial Services and Markets Act 2000 (Regulated Activities) (ESG Ratings) Order 2025. B. The rule-making powers listed above are specified for the purpose of section 138G(2) (Rule-making instruments) of the Act. C. The FCA approves the making of the Voluntary Jurisdiction rules and guidance and the fixing and varying of the standard terms for Voluntary Jurisdiction participants by the Financial Ombudsman Service Limited, as set out at paragraph D below. Powers exercised by the Financial Ombudsman Service Limited D. The Financial Ombudsman Service Limited makes and amends the rules and guidance for the Voluntary Jurisdiction, and fixes and varies the standard terms for Voluntary Jurisdiction participants, as set out in Annex G to this instrument, and to incorporate the changes to the Glossary of definitions as set out in Annex A to this instrument, in the exercise of the following powers and related provisions in the Act: (1) section 227 (Voluntary jurisdiction); (2) paragraph 8 (Information, advice and guidance) of Schedule 17; (3) paragraph 18 (Terms of reference to the scheme) of Schedule 17; and (4) paragraph 20 (Voluntary jurisdiction rules: procedure) of Schedule 17. E. The making and amendment of the Voluntary Jurisdiction rules and guidance and the fixing and varying of the standard terms for Voluntary Jurisdiction participants by the Financial Ombudsman Service Limited, as set out at paragraph D above, is subject to the approval of the FCA.

FCA 2025/XX FOS 2025/XX Page 2 of 59

Commencement F. This instrument comes into force on [date].

Amendments to the FCA Handbook G. The modules of the FCA’s Handbook of rules and guidance listed in column (1) below are amended in accordance with the Annexes to this instrument listed in column (2). (1) (2) Glossary of definitions Annex A Principles for Businesses sourcebook (PRIN) Annex B Senior Management Arrangements, Systems and Controls sourcebook (SYSC) Annex C Fees manual (FEES) Annex D Environmental, Social and Governance sourcebook (ESG) Annex E Supervision manual (SUP) Annex F Dispute Resolution: Complaints sourcebook (DISP) Annex G

Amendments to materials outside the Handbook H. The Perimeter Guidance manual (PERG) is amended in accordance with Annex H to this instrument.

Notes I. In the Annexes to this instrument, the notes (indicated by “Editor’s note:”) are included for the convenience of the reader but do not form part of the legislative text. Citation J. This instrument may be cited as the Environmental, Social and Governance Ratings Instrument 2025. By order of the Board of the Financial Ombudsman Service Limited [date] By order of the Board of the FCA [date]

FCA 2025/XX FOS 2025/XX Page 3 of 59 Annex A Amendments to the Glossary of definitions In this Annex, underlining indicates new text and striking through indicates deleted text, unless otherwise stated. Insert the following new definitions in the appropriate alphabetical position. The text is not underlined. ESG rating (a) an assessment that: (i) fulfils the definition of an ‘ESG rating’ in article 63Z7 of the Regulated Activities Order; and (ii) is within scope of the regulated activity specified in article 63U of the Regulated Activities Order (ESG ratings). (b) For ease of reference, an ‘ESG rating’ according to article 63Z7 of the Regulated Activities Order is an assessment regarding 1 or more environmental, social or governance factors, which: (i) is produced in the form of an opinion, a score or a combination of both, where: (A) ‘score’ means a measure derived from data and a pre-established statistical or algorithmic system or model, without additional substantial analytical input from an analyst; and (B) ‘opinion’ means an assessment involving substantial analytical input from an analyst; and (ii) is prepared using an established methodology and a defined ranking system of ratings categories, whether or not it is characterised as an ESG rating. ESG rating process the complete process of producing and directly distributing an ESG rating, including, but not limited to: (a) the design of the ESG rating product-line; (b) the development, monitoring and review of the relevant methodology; (c) the sourcing, validation and quality control of the data used to produce an ESG rating; (d) the synthesis and analysis of the data to produce the ESG rating;

FCA 2025/XX FOS 2025/XX Page 4 of 59 (e) the quality control of the ESG rating; (f) the direct distribution of the ESG rating; (g) monitoring the ESG rating; and (h) communicating with ESG rating users and other notifiable persons including administering contracts and dealing with complaints. ESG rating product-line the type of ESG ratings produced according to a single methodology. ESG rating provider a firm with permission to carry on the regulated activity of providing an ESG rating. ESG rating user a person who has: (a) paid an ESG rating provider for the use of an ESG rating; or (b) accessed an ESG rating directly from an ESG rating provider for free. methodology a system of models, techniques and procedures for producing an ESG rating product-line. notifiable person a person reasonably identifiable by an ESG rating provider, who is: (a) the issuer of a rated item; (b) the person who commissioned the ESG rating; (c) a body corporate or other legal person, which is a rated item; (d) a UK AIFM, where the AIF is a rated item; (e) a SEF manager in relation to any SEF that it manages, which is a rated item; or (f) a RVECA manager in relation to any RVECA that it manages, which is a rated item. providing an ESG rating the regulated activity specified in article 63U of the Regulated Activities Order, which, in summary, means producing and making available an ESG rating, where that rating is likely to influence a decision to make a specified investment, unless the provider could not reasonably have expected it to do so, whether the ESG rating is solicited or unsolicited. rated item the subject of an ESG rating. rating category has the meaning in article 63Z7 of the Regulated Activities Order, which (for ease of reference) is ‘includes, but is not limited to, a variable or division within a system, such as a letter, number, symbol, colour or

FCA 2025/XX FOS 2025/XX Page 5 of 59 temperature, that provides a relative measure to distinguish one or more characteristics of various rated items’. Amend the following definitions as shown. branch … (i) … [Note: article 4(1)(c) of AIFMD] (j) (in relation to an ESG rating provider) a place of business which is part of an ESG rating provider that has no legal personality and provides the services for which the ESG rating provider has been authorised. conflicts of interest policy (1) (except in MAR 8 and ESG 6) the policy established and maintained in accordance with SYSC 10.1.10R; and. (2) (in MAR 8) the policy established and maintained in accordance with MAR 8.2.8 G which: (a) identifies circumstances that constitute, or may give rise to, a conflict of interest arising from benchmark submissions and the process of gathering information in order to make benchmark submissions; and (b) sets out the process to manage such conflicts. (3) (in ESG 6) the policy established and maintained in accordance with ESG 6.5.12R. control … (2) (in SYSC 3, SYSC 8 and, SYSC 10 and ESG 6): … client … (B) In the FCA Handbook: … (12) (a) (in ESG, except ESG 6) in addition to (1), includes: (i) a unitholder or potential unitholder in a scheme; and

FCA 2025/XX FOS 2025/XX Page 6 of 59 (ii) to the extent not within (i), an investor or potential investor in an AIF. (b) (in ESG 6) the same as in (1) above but does not include a potential client. regulated activity … (B) in the FCA Handbook: (in accordance with section 22 of the Act (Regulated activities)) the activities specified in Part II (Specified activities), Part 3A (Specified activities in relation to information) and Part 3B (Claims management activities in Great Britain) of the Regulated Activities Order, which are, in summary: … (tv) advice, investigation or representation in relation to an employment-related claim (article 89M); and (tw) Regulated pension dashboard activity (article 89BA); and (tx) providing an ESG Rating (article 63U); … retail market business the regulated activities and ancillary activities to those activities, payment services, issuing electronic money, and activities connected to the provision of payment services or issuing of electronic money, of a firm in a distribution chain (including a manufacturer and a distributor) which involves a retail customer, but not including the following activities: … (6) insurance distribution activities carried on by a firm in respect of a group policy that: … (c) do not involve any direct contact between the firm and that person.; and (7) providing an ESG rating and any ancillary activity to that activity. senior management … (2) (in SYSC (except SYSC 4.3.2-AR, SYSC 4.3A, SYSC 7.1.6R, SYSC 8.1.6-AR, SYSC 9.1.1BR, SYSC 10.1.6AAR, SYSC 19F and paragraph (1) of the definition of supervisory function) and ESG 6 and in accordance with article 4(1)(10) of the UK CRR) those persons who are a natural person and who exercise executive functions in an institution and who are responsible and

FCA 2025/XX FOS 2025/XX Page 7 of 59 accountable to the management body for the day-to-day management of the institution. …

FCA 2025/XX FOS 2025/XX Page 8 of 59 Annex B Amendments to the Principles for Businesses sourcebook (PRIN) In this Annex, underlining indicates new text and striking through indicates deleted text. 3 Rules about application … 3.4 General Clients and the Principles 3.4.-1 R PRIN 3.4.1R, PRIN 3.4.2R and PRIN 1 Annex 1 do not apply with respect to: … (4A) regulated pensions dashboard activity; or (5) the issuing of electronic money (where not a regulated activity).; or (6) providing an ESG rating. …

FCA 2025/XX FOS 2025/XX Page 9 of 59 Annex C Amendments to the Senior Management Arrangements, Systems and Controls sourcebook (SYSC) In this Annex, underlining indicates new text and striking through indicates deleted text. 1 Application and purpose … 1 Annex 1 Detailed application of SYSC … 1 Annex 1 Part 2 Part 2 Application of the common platform requirements (SYSC 4 to 10) … What? … 2.9 G The application of the provisions on the conflicts of interest in SYSC 10 is set out in SYSC 10.1.-4G to SYSC 10.1.1AR, SYSC 10.1.1BR and SYSC 10.2.1R. … 1 Annex 1 Part 3 Part 3 Tables summarising the application of the common platform requirements to different types of firm … Other firms … 3.3 R For all other firms:

FCA 2025/XX FOS 2025/XX Page 10 of 59 (1) (Subject to (3)) SYSC 4 to SYSC 10 apply as rules or as guidance in accordance with Column B in Table A below in the following way: (a) where a rule is shown modified in Column B as ‘Guidance’, it should be read as guidance (as if “should” appeared in that rule instead of “must”); and (b) the provision should be applied in a proportionate manner, taking into account the nature, scale and complexity of the firm’s business.; and (2) … (3) SYSC 10 does not apply to ESG rating providers. … 1 Annex 1 Table A Table A: Application of the common platform requirements in SYSC 4 to 10 … Provision SYSC 6 Column A Application to a common platform firm other than to a UCITS investment firm COLUMN A+ Application to a UCITS management company COLUMN A++ Application to a full￾scope UK AIFM of an authorised AIF Column B Application to all other firms apart from insurers, UK ISPVs, managing agents, the Society, full￾scope UK AIFMs of unauthorised AIFs, MiFID optional exemption firms and third country firms … SYSC 6.3.9R Rule For firms carrying on a credit-related regulated activity or regulated claims management activity, or operating an electronic system in relation to lending,

FCA 2025/XX FOS 2025/XX Page 11 of 59 applies only where the Money Laundering Regulations apply to the firm. Rule does not apply to a firm with a limited permission for entering into a regulated credit agreement as lender. Rule does not apply to a firm for which a professional body listed in Schedule 1 to the Money Laundering Regulations, and not the FCA, acts as the supervisory authority for the purposes of those regulations (FCA Handbook only). Rule does not apply to a firm carrying on regulated pensions dashboard activity. Rule does not apply to a firm carrying on the regulated activity of providing an ESG rating. … Provision SYSC 8 Column A Application to a common platform firm other than to a UCITS investment firm COLUMN A+ Application to a UCITS management company COLUMN A++ Application to a full￾scope UK AIFM of an authorised AIF Column B Application to all other firms apart from insurers, UK ISPVs, managing agents, the Society, full-scope UK AIFMs of unauthorised AIFs, MiFID optional exemption firms and third country firms …

FCA 2025/XX FOS 2025/XX Page 12 of 59 SYSC 8.1.1R Rule Rule for a UCITS investment firm; otherwise guidance Not applicable Guidance - but applies as a rule to an ESG rating provider … 6 Compliance, internal audit and financial crime 6.1 Compliance … Compliance function … 6.1.4C R … (2) This rule applies to: (a) a debt management firm; and (b) a credit repair firm.; and (c) an ESG rating provider. … … 6.3 Financial crime … The money laundering reporting officer 6.3.9 R A firm (with the exception of a sole trader who has no employees and an ESG rating provider) must: (1) appoint an individual as MLRO, with responsibility for oversight of its compliance with the FCA’s rules on systems and controls against money laundering; and (2) ensure that its MLRO has a level of authority and independence within the firm and access to resources and information sufficient to enable him them to carry out that responsibility.

FCA 2025/XX FOS 2025/XX Page 13 of 59 … 8 Outsourcing 8.1 General outsourcing requirements … General requirements 8.1.1 R A common platform firm and an ESG rating provider must: … … 10 Conflicts of interest 10.1 Application … General application … 10.1.1A R This section also applies to: … (c) a non-UK AIF; and. 10.1.1B R This section does not apply to an ESG rating provider. …

FCA 2025/XX FOS 2025/XX Page 14 of 59 Annex D Amendments to the Fees manual (FEES) In this Annex, underlining indicates new text and striking through indicates deleted text. [Editor’s note: The proposed changes in this Annex take into account the changes proposed by the consultation paper ‘Regulatory fees and levies: policy proposals for 2026/27’ (CP25/33) as if they were made.] 3 Application, Notification and Vetting Fees … 3 Annex 1R Authorisation fees payable … Part 2 – Pricing categories applicable to applications made in the following activity groupings in the A, B, C, CC and CMC fee blocks Activity grouping Description Applicable pricing category in FEES 3 Annex 1AR … A.26 … … A.27 ESG rating providers with relevant annual revenue from providing ESG ratings forecast to be under £250,000 as at [Editor’s note: insert the day before the application gateway for ESG rating providers opens, which is likely to be in June 2027.] 4 ESG rating providers with relevant revenue from providing ESG ratings forecast to be of £250,000 or over as at [Editor’s note: insert the day before the application gateway for ESG rating providers opens, which is likely to be in June 2027.] 6 …

FCA 2025/XX FOS 2025/XX Page 15 of 59 … 4 Periodic fees … 4 Annex 1AR FCA activity groups, tariff bases and valuation dates Part 1 This table shows how the FCA links the activities (for which a firm has permission or designation) to activity groups (fee-blocks). A firm can use the table to identify which fee-blocks it falls into based on its permission or its other activities. Activity group Fee payer falls in the activity group if: … A.26 Cryptoasset activities … A.27 ESG rating providers its permission includes providing an ESG rating. … …

FCA 2025/XX FOS 2025/XX Page 16 of 59 Annex E Amendments to the Environmental, Social and Governance sourcebook (ESG) In this Annex underlining indicates new text and striking through indicates deleted text, unless stated otherwise 1 Purpose and application 1.1 Purpose and application Purpose 1.1.1 G The ESG sourcebook sets out: (1) the rules and guidance concerning a firm’s approach to environmental, social and governance matters.; and (2) the conduct rules and guidance for ESG rating providers. … 1.1.5 G … 1.1.6 G ESG 6 contains the conduct rules and guidance for ESG rating providers. These include rules and guidance about transparency, governance, systems and controls, and conflicts of interest. 1.2 General application … 1.2.4 G (1) The table at ESG 1.2.4G(2) provides a general overview as to how the rules in ESG 2, ESG 4, and ESG 5 and ESG 6 apply to firms. (2) This table belongs to ESG 1.2.4G(1). Type of firm Applicable provisions … Distributors ESG 4.1.1R(1); ESG 4.1.16R to ESG 4.1.19R; ESG 4.3.1R. An ESG rating provider ESG 6. …

FCA 2025/XX FOS 2025/XX Page 17 of 59 Insert the following new chapter, ESG 6, after ESG 5 (Disclosure of sustainability-related information). All the text is new and is not underlined. 6 Conduct rules for ESG rating providers 6.1 Application 6.1.1 R This chapter applies to an ESG rating provider. 6.1.2 G (1) ESG 6 (Conduct rules for ESG rating providers) is the specialist chapter for firms carrying on the regulated activity of providing an ESG rating. (2) PERG 18 provides guidance on when activities are likely to amount to the regulated activity of providing an ESG rating. (3) The detailed obligations in this chapter build on the high-level obligations elsewhere in the FCA Handbook – for example, in PRIN, GEN, SUP and SYSC. 6.2 Governance, systems and controls Purpose 6.2.1 G The rules in this section supplement the rules and guidance in SYSC 4 to SYSC 9. They seek to ensure (among other things) that firms implement and maintain appropriate systems, controls, governance and oversight arrangements to enable them to provide ESG ratings that comply with the requirements of the regulatory system. Systems and controls in relation to the ESG rating process 6.2.2 G Firms are reminded that the rules and guidance in SYSC 4 to SYSC 9 apply, as set out in the table in SYSC 1 Annex 1 3.3R. 6.2.3 R A firm must have robust governance arrangements, and systems and controls to ensure the integrity, independence and reliability of: (1) the ESG ratings it provides; and (2) the data it uses in the ESG ratings process. 6.2.4 R A firm must implement and maintain clear and effective policies, procedures and systems to ensure it relies on accurate and up-to-date information when producing an ESG rating. Methodology 6.2.5 R A firm must implement and maintain clear and effective policies, procedures and systems to:

FCA 2025/XX FOS 2025/XX Page 18 of 59 (1) ensure each ESG rating is consistent with its methodology; and (2) review the methodology periodically to confirm whether it continues to meet its intended purpose. 6.2.6 R A firm must implement and maintain a process for ensuring that each methodology is defined, thorough, and applied systematically and consistently. 6.2.7 G Firms are reminded that they are required to make certain notifications in relation to material changes to a methodology under ESG 6.4.14R. Quality control 6.2.8 R (1) A firm must have adequate human and technical resources to quality-control its ESG rating process periodically. (2) The quality control referred to in (1) must, at a minimum: (a) ensure that each ESG rating is produced in line with its methodology and the firm’s processes; (b) where relevant, verify that the data used in the ESG rating process is timely and accurate; (c) check whether feedback received from notifiable persons has been considered; and (d) include a periodic review of its ESG ratings, except where the ESG rating is a point-in-time rating. Outsourcing 6.2.9 G SYSC 8 sets out the rules and guidance that apply to a firm in relation to outsourcing, in particular: (1) SYSC 8.1.1R requires an ESG rating provider, among other things, not to undertake the outsourcing of important operational functions in such a way as to impair materially the quality of its internal control. (2) SYSC 8.1.6R makes clear that even if an ESG rating provider outsources critical or important operational functions, or any relevant services and activities, it remains fully responsible for discharging all of its obligations under the regulatory system. 6.2.10 R In addition to its obligations under SYSC 8, a firm must not outsource: (1) operational responsibility for the ESG rating process; or

FCA 2025/XX FOS 2025/XX Page 19 of 59 (2) the performance of its obligations in ESG 6.2.3R and ESG 6.2.6R, except to a member of its group. 6.2.11 G The requirement in ESG 6.2.10R(1) to retain operational responsibility for the ESG rating process means a firm must be able to take decisions to review any part of the ESG rating process and ensure any necessary change is made to it, particularly where such changes are needed for compliance with the regulatory system. 6.2.12 R Where a firm outsources any part of the ESG rating process to any person, there must be an agreement in writing clearly setting out the responsibilities of each party. 6.2.13 G Firms are reminded that a reference to any person includes entities within the firm’s group. Record-keeping 6.2.14 G Firms are reminded of their obligations under SYSC 9 in relation to record-keeping. 6.2.15 R For the purposes of SYSC 9.1.1R, the requirement to keep orderly records includes, but is not limited to: (1) keeping the data used to produce an ESG rating, such that the ESG rating could be reproduced; (2) keeping records of the governance process and decision-making involved in the ESG ratings process and ESG rating product-lines; (3) keeping details of any changes made to methodologies and the reasons for such changes; (4) keeping and regularly updating a record of the kinds of service or activity carried out by, or on behalf of, that firm in which a conflict of interest of the type described in ESG 6.5.1R may arise, or has arisen; and (5) keeping a record of each complaint received and the measures taken for its resolution. 6.2.16 R If steps taken by a firm under ESG 6.5.7R are not sufficient to ensure, with reasonable confidence, that risks of damage to the integrity or independence of an ESG rating will be prevented, the firm must keep a record of the steps taken to manage the conflict. 6.3 Engagement and complaints handling Notifications

FCA 2025/XX FOS 2025/XX Page 20 of 59 6.3.1 R (1) When a firm first decides to produce an ESG rating, it must inform any notifiable persons of this decision. (2) The notification in (1) must contain: (a) the nature of the rating; (b) the methodology that will be used; (c) a summary of the main types of data that will be used to produce the ESG rating, including whether that data will be forward-looking or backward-looking; (d) the appropriate contact details for the ESG rating provider; (e) an explanation of the notifiable person’s right to request data under ESG 6.3.4R, and how that request can be made; and (f) an explanation of how the ESG rating provider can be notified of any factual errors regarding the ESG rating. 6.3.2 G The notification obligation in ESG 6.3.1R(1) only applies at the point the ESG rating provider first decides to produce an ESG rating. It does not therefore apply to subsequent updates of that ESG rating. 6.3.3 G For the purposes of ESG 6.3.1R(2)(d), ‘appropriate contact details’ means providing the contact information for the person or team who is able to deal with queries from a notifiable person, or direct them to someone who can. Obligations where a notifiable person requests data 6.3.4 R (1) Upon request, a firm must provide a notifiable person with the data used to assess the characteristics of the rated item. (2) Where a notifiable person has requested data in accordance with (1), the firm must not issue the ESG rating before it has given the notifiable person sufficient time to correct any factual errors. (3) The obligation in (2) only applies where the notifiable person has requested the data within a reasonable period. Procedure for receiving feedback 6.3.5 R A firm must establish and maintain a procedure for receiving and processing feedback from stakeholders about the accuracy of the ESG rating or elements of the production of an ESG rating. Obligations when requesting data from notifiable persons 6.3.6 R When requesting data from a notifiable person, a firm must:

FCA 2025/XX FOS 2025/XX Page 21 of 59 (1) make clear what data is requested; (2) make the data request as easy as possible for notifiable persons to comply with; and (3) provide notifiable persons with sufficient time to complete the information request. 6.3.7 G A firm could, for example, make a data request as easy as possible for the notifiable person to comply with by pre-populating it with information already available from public sources or previous data requests. Complaints handling 6.3.8 R For the purpose of this section, a ‘complaint’ means any written expression of dissatisfaction made by or on behalf of a complainant, concerning any aspect of the ESG rating process and which alleges that the complainant has suffered (or may suffer) financial loss, material distress or material inconvenience. 6.3.9 G For purposes of ESG 6.3.8R a complainant may be an ESG rating user, notifiable person, or any other person with an interest in the ESG rating. 6.3.10 G The term ‘complaint’ used in this section has the meaning given in ESG 6.3.8R and does not have the same Glossary meaning as complaint. 6.3.11 G Firms are reminded of their obligations under SYSC 6.1.1R to establish, implement and maintain adequate policies and procedures, which includes effective and transparent complaints handling policies and procedures. 6.3.12 R The complaints handling policies and procedures must be: (1) set out in writing; (2) clear, accurate and up to date; and (3) made available to all relevant staff of the firm through appropriate internal channels. 6.3.13 R A firm must publish information on its website about its complaints handling policy including information about: (1) the procedure for a complainant to make a complaint; (2) how complaints are handled by the firm; (3) the contact details of the person or team within the firm responsible for handling complaints; and (4) the expected timeline for handling the complaint. 6.3.14 R It must be free of charge for a complainant to submit a complaint to a firm.

FCA 2025/XX FOS 2025/XX Page 22 of 59 6.3.15 R A firm is only required to deal with a complaint that has been raised within 3 years of the date on which the matter giving rise to the complaint occurred. 6.3.16 G A complaint submitted to the firm after the period described in ESG 6.3.15R does not have to be investigated by the firm. 6.3.17 R A firm must: (1) investigate a complaint in a fair and timely manner; and (2) communicate the outcome of its investigation to the complainant within a reasonable period. 6.3.18 R A firm must ensure that conflicts of interest arising in the complaints handling process are managed in accordance with ESG 6.5. 6.3.19 R A firm must put in place appropriate management controls and take reasonable steps to ensure that it identifies and remedies any recurring or systemic problems raised by the complaints it receives. 6.3.20 G For the purpose of ESG 6.3.19R, appropriate management controls and reasonable steps could include: (1) analysing the causes of individual complaints so as to identify root causes common to types of complaint; and (2) correcting, where reasonable to do so, such root causes. 6.3.21 G Firms are reminded of their record-keeping obligations under SYSC 9 and, in particular, ESG 6.2.15R(5). 6.4 Transparency 6.4.1 G (1) This section contains rules and guidance on disclosures, designed to enhance the transparency and comparability of ESG ratings and ESG rating product-lines, and the information relating to them. (2) Some of the disclosures relate to ESG rating product-lines, which are types of ESG ratings produced according to the same methodology – for example, a firm’s standard ESG risk rating product. (3) Some of the disclosures relate to individual ESG ratings – for example, for the methodology in (2), an ESG risk rating of a particular company. (4) Firms are required to publicly disclose certain minimum information about their ESG rating product-lines (ESG 6.4.2R).

FCA 2025/XX FOS 2025/XX Page 23 of 59 (5) Firms are then required to disclose to ESG rating users, and other notifiable persons: (a) more detailed information about their ESG rating product￾lines (ESG 6.4.10R); and (b) certain minimum information about individual ESG ratings (ESG 6.4.12R). (6) For example, for the methodology in (2), an ESG rating provider would have to give a notifiable person that had commissioned an ESG risk rating on its company: (a) the more detailed information about that product-line in ESG 6.4.10R; and (b) the minimum information about the individual ESG risk rating in ESG 6.4.12R. (7) This section also contains rules relating to a notification requirement concerning material changes to methodologies. Minimum public disclosures 6.4.2 R A firm must, at a minimum, publish the following information about each of its ESG rating product-lines: (1) the objective(s), including whether the assessment covers ESG risks, ESG impacts, or any other dimensions; (2) which environmental, social or governance factors are assessed by the methodology; (3) the meaning of its rating scale and rating categories, including what a higher or lower ranking means; (4) whether ESG ratings produced as part of that ESG rating product￾line are expressed as absolute values or as a value relative to a peer group; (5) where applicable, how the peer group against which rated items are compared was chosen; (6) how the firm determines which rated items it rates within the ESG rating product-line; (7) where applicable, a summary of the approach to engagement with notifiable persons as required by ESG 6.3, such as the means and process for such engagement; (8) a summary of the methodology, including:

FCA 2025/XX FOS 2025/XX Page 24 of 59 (a) a summary of the model and how the ratings are determined, including, but not limited to, a description of how the factors, inputs, or data are weighted or aggregated; (b) a breakdown of the factors described in (2); (c) a summary of the main types of data used, including whether that data is forward-looking or backward-looking; (d) a summary of the sources of data used and whether they are public or non-public; (e) whether the assessment is intended to be forward-looking or backward-looking and the timeframe considered; (f) the main assumptions on which the assessment is based; (g) a summary of the main data policies and processes, including those for addressing the: (i) unavailability of data; (ii) data updates and corrections; and (iii) frequency of data updates; (h) where applicable, an explanation of how artificial intelligence is used in the data-collection or ESG rating process; (i) how frequently the methodology is reviewed under ESG 6.2.5R and the process for making any material changes as set out in ESG 6.4.14R; and (j) the date and nature of the last material methodology change; and (9) how and why any aspect of the methodology described in (8), or the ESG rating process, has the potential to significantly affect the accuracy of ESG ratings produced within the ESG rating product￾line. 6.4.3 G In complying with ESG 6.4.2R(2), a firm should explain whether an ESG rating product-line covers a particular type of environmental, social or governance factor, such as biodiversity or transition risk. 6.4.4 R The disclosures in ESG 6.4.2R must: (1) be made when an ESG rating product-line is launched;

FCA 2025/XX FOS 2025/XX Page 25 of 59 (2) remain available for as long as the ESG rating product-line is available; and (3) be updated as soon as reasonably practicable after any material change to the ESG rating product-line. 6.4.5 G Firms are reminded that they are also required to make certain public disclosures in relation to: (1) conflicts of interest under ESG 6.5.9R and 6.5.13R; and (2) their complaints management policy under ESG 6.3.13R. Disclosures and notification to ESG rating users and other notifiable persons 6.4.6 G The disclosures required by ESG 6.4.10R and ESG 6.4.12R are in addition to the minimum public disclosures required by ESG 6.4.2R. 6.4.7 R In addition to the disclosures required under ESG 6.4.10R and ESG 6.4.12R, a firm must disclose any further information that could be reasonably expected to assist notifiable persons or ESG rating users in understanding the firm’s ESG rating or ESG rating product-line. 6.4.8 R (1) The disclosures required by ESG 6.4.10R and ESG 6.4.12R, and the notification required by ESG 6.4.14, must be made: (a) to all notifiable persons for the relevant ESG rating; and (b) to any ESG rating user who is entitled to receive or access the relevant ESG ratings (whether on a free or paid-for basis). (2) A firm may provide the disclosures required in (1) by making the relevant information publicly available. 6.4.9 R (1) When a firm permits an ESG rating user to disclose an ESG rating to a third party, the firm must ensure the ESG rating user is able to share with that third party any information that has been disclosed under ESG 6.4.10R and ESG 6.4.12R. (2) The rule in (1) only applies where such information can reasonably be expected to assist the third party in understanding the disclosed ESG rating. Product-line disclosures to ESG rating users and other notifiable persons 6.4.10 R A firm must disclose the following information in relation to an ESG rating product-line: (1) a full explanation of the methodology and information about review of the methodology, including:

FCA 2025/XX FOS 2025/XX Page 26 of 59 (a) the policy on methodology review, including the criteria that would trigger a revision, and, where applicable, the process for engagement with relevant stakeholders during revision; and (b) the outcome of the most recent methodology review (required by ESG 6.2.5R(2)); (2) steps taken to mitigate any risks arising from material limitations of the ESG rating process; and (3) an overview of the steps taken to meet the quality control requirements in ESG 6.2.8R, including the remediation process if quality issues arise. 6.4.11 R The disclosures in ESG 6.4.10R: (1) must be made: (a) to the notifiable person who commissioned the rating, at the time of contracting with them; (b) to any other notifiable persons, as soon as reasonably practicable after (a); (c) to an ESG rating user mentioned in ESG 6.4.8(1)(b), at the point they access the ESG rating; (2) must remain accessible for as long as the ESG rating product-line is available; and (3) must be updated as soon as reasonably practicable after a firm makes a material change to the information required under ESG 6.4.10R. Individual ESG rating disclosures to ESG rating users and other notifiable persons 6.4.12 R A firm must disclose the following information regarding an individual ESG rating: (1) where relevant: (a) which business activities have been considered; (b) whether and how group entities are taken into account in the determination of the ESG rating; and (c) where the ESG rating has been inherited from another entity within the same group, the rules and conditions that governed that process;

FCA 2025/XX FOS 2025/XX Page 27 of 59 (2) the factors, criteria and data used to assess the relevant characteristics of the rated item; (3) where applicable, the weights given to each factor considered under the rating methodology; (4) a detailed explanation of the source(s) of specific data points that inform the ESG rating; (5) where the firm estimates data, the approach used; (6) where data underlying an ESG rating is absent or unavailable, and the ESG rating provider has not made estimations, how this is handled; (7) where applicable, details of any material challenge by a notifiable person to the factual accuracy of any data informing an ESG rating, in cases which are not yet resolved by the ESG rating provider; (8) when the ESG rating was last updated and the expected timeframe for the next review; and (9) where there has been a material change in either the ESG rating or its data, the reason for the change. 6.4.13 R The disclosures in ESG 6.4.12R must be: (1) made when an ESG rating is made available; and (2) updated as soon as reasonably practicable after a material change to the ESG rating. Notification 6.4.14 R (1) Where a firm wishes to make a material change to a methodology, it must first consider the likely impact on the ESG ratings it has provided in that product-line. (2) The firm must then notify in writing notifiable persons and ESG rating users for all ESG ratings provided in the product-line, clearly explaining: (a) the nature of the change to the methodology; (b) the reasons for it; and (c) a summary of its impact on the ESG ratings provided in the product-line; and

FCA 2025/XX FOS 2025/XX Page 28 of 59 (3) In providing the notification in (2), the firm must give ESG rating users and notifiable persons sufficient time to consider the information provided before the change takes effect. Manner of disclosure and notification 6.4.15 R A firm must provide the information required in this section in a manner that is: (1) easily accessible, prominent and free to obtain; (2) in a written format that is clearly presented and easy to understand; and (3) accurate, fair and not misleading. 6.4.16 G When making disclosures under this section, a firm should consider what information could be reasonably expected to assist recipients to understand the firm’s ESG rating or ESG rating product-line. Intellectual property rights and proprietary information 6.4.17 R (1) The provisions of this section do not require a firm to disclose information that would qualify as trade secrets as defined in regulation 2 of the Trade Secrets (Enforcement, etc.) Regulations 2018 (SI 2018/597). (2) Where a firm relies on the exemption in (1), it must instead disclose the extent to which it is unable to make the relevant disclosures and the reason for that. 6.5 Conflicts of interest Types of conflicts 6.5.1 R The rules and guidance in this section relate to conflicts of interest that entail a material risk of damage to the integrity or independence of an ESG rating or a firm’s operations – for example, by influencing the opinions, analysis or judgement of the firm or its officers or employees involved in the ESG rating process. 6.5.2 G To ensure ESG ratings are independent within the meaning of ESG 6.5.1R, they should be free from political or economic interference. 6.5.3 R For the purposes of identifying the types of conflict of interest that arise, or may arise, at any point in the ESG rating process, the firm must take into account, as a minimum: (1) the firm’s organisational structure and business or financial activities, including different business lines;

FCA 2025/XX FOS 2025/XX Page 29 of 59 (2) where the firm is a member of a group, any circumstances that may give rise to a conflict of interest arising as a result of the structure and business or financial activities (including different business lines) of other members of the group; (3) whether the firm’s ESG rating charging model may create conflicts of interest; (4) whether the firm provides other services to a notifiable person; (5) the ESG rating process and the methodology used to produce an ESG rating; (6) whether an employee or officer of the firm, has a financial or other incentive connected to any aspect of the ESG rating process; and (7) the extent to which performance and evaluation of employees or officers could create conflicts of interest or otherwise affect the independence or integrity of its ESG rating. 6.5.4 G For the purposes of ESG 6.5.3R(1) and (2), a firm should consider all relevant business lines within its group for any conflicts that arise, or may arise, including where the firm provides: (1) consulting services that could reasonably give rise to a conflict with a firm’s provision of ESG ratings; (2) accountancy or audit services; or (3) other regulated activities. 6.5.5 G (1) Examples of ESG rating charging models referred to in ESG 6.5.3R(3) are: (a) the user-pays model; and (b) the issuer-pays model. (2) An example of the kind of conflict that could arise in relation to a firm’s ESG rating charging model is where the firm uses an issuer￾pays model for ESG rating product-lines, leading to pressure from the client or relationship with the client to give favourable ratings. Identifying conflicts of interest 6.5.6 R A firm must take all appropriate steps to identify conflicts of interest that arise or may arise at any point in the ESG rating process. Managing conflicts of interest

FCA 2025/XX FOS 2025/XX Page 30 of 59 6.5.7 R A firm must establish and maintain effective systems and controls that enable it to take all reasonable steps to prevent or manage conflicts of interest. Record of conflicts 6.5.8 G Firms are reminded that there are requirements in relation to record￾keeping for conflicts of interest in ESG 6.2.15R(4) and ESG 6.2.16R. Disclosure of conflicts 6.5.9 R (1) If steps taken by a firm under ESG 6.5.7R are not sufficient to ensure, with reasonable confidence, that risks of damage to the integrity or independence of an ESG rating will be prevented, the firm must publish the following: (a) a description of the conflict of interest; (b) the sources of that conflict of interest; (c) an explanation of the risks that arise as a result of the conflict of interest; and (d) the steps taken to mitigate those risks. (2) The disclosure must: (a) comply with the requirements of ESG 6.4.15R; and (b) clearly state that the systems and controls established by the firm to prevent such conflicts are not sufficient to ensure, with reasonable confidence, that the risks of damage to the integrity or independence of the ESG rating will be prevented. (3) Disclosures made under (1) which are based on confidential information may, for the purposes of (1)(a), be described in summary form, but should include sufficient detail to enable the recipient to understand the nature of the conflict and its potential impact. 6.5.10 G Where a requirement to make a disclosure under ESG 6.5.9R arises, such disclosure should be made as soon as reasonably practicable. 6.5.11 G Disclosing conflicts of interest in accordance with ESG 6.5.9R does not: (1) exempt a firm from the obligation to establish and maintain the effective systems and controls to prevent or manage conflicts of interest under ESG 6.5.7R; or

FCA 2025/XX FOS 2025/XX Page 31 of 59 (2) enable a firm to over-rely on such disclosure without adequate consideration as to how conflicts may appropriately be managed. Conflicts of interest policy 6.5.12 R (1) A firm must implement and maintain in writing an effective conflicts of interest policy that is appropriate to the size and organisation of the firm and the nature, scale and complexity of its business. (2) The conflicts of interest policy must include the following: (a) it must identify, in accordance with ESG 6.5.1R, the circumstances which constitute or may give rise to a conflict of interest entailing a material risk of damage to the integrity or independence of ESG rating; and (b) it must specify policies and procedures to be followed, and measures to be adopted in order to: (i) prevent those conflicts in accordance with ESG 6.5.7R; (ii) record and disclose conflicts in accordance with ESG 6.2.15R(4), ESG 6.2.16R (where relevant) and ESG 6.5.9R; and (iii) prevent certain types of transaction in accordance with ESG 6.5.17R. (3) A firm must assess and periodically review, on at least an annual basis, its conflicts of interest policy and should take all appropriate measures to address any deficiencies (such as over-reliance on disclosure of conflicts of interest). 6.5.13 R A firm must publish its conflicts of interest policy, or a summary of its conflicts of interest policy. Conflicts of interest report 6.5.14 R A firm must ensure that its senior management receives written reports on a regular basis, and at least annually, on all situations referred to in ESG 6.2.15R(4) and, where relevant, ESG 6.2.16R. Information barriers 6.5.15 R (1) When a firm establishes and maintains an information barrier between different parts of its business, to the extent that the business of one of those parts involves the carrying on any part of the ESG rating process, it may:

FCA 2025/XX FOS 2025/XX Page 32 of 59 (a) withhold or not use the information held; and (b) for that purpose, permit persons employed in the first part of its business to withhold the information held from those employed in the other part of the business. (2) Information may also be withheld or not used by a firm when this is required by an established arrangement maintained between different parts of the business (of any kind) in the same group. (3) For the purpose of this rule, ‘maintains’ includes taking reasonable steps to ensure that the arrangements remain effective and are adequately monitored, and must be interpreted accordingly. 6.5.16 R When a firm manages a conflict of interest using the arrangements in ESG 6.5.15R which take the form of an information barrier, individuals on the other side of the barrier will not be regarded as being in possession of knowledge denied to them as a result of the information barrier. Personal transactions 6.5.17 R COBS 11.7 (Personal account dealing) applies to an ESG rating provider with the following modifications: (1) in COBS 11.7.1R (Rule on personal account dealing): (a) for ‘conducts designated investment business’, substitute ‘carries on the regulated activity of providing an ESG rating’; (b) for ‘clients or transactions with or for clients’ substitute ‘ESG ratings or the ESG ratings process’; (c) for sub-paragraph (1)(c), substitute: ‘it creates or it is likely to create a conflict of interest that damages or that may damage the integrity and independence of an ESG rating or a firm’s operations’; (2) for the purposes of COBS 11.7.2R, the references in COBS 12.2.21R(1)(a) and (b) to ‘investment research’ are to be read as if they referred instead to ‘an ESG rating’; (3) for COBS 11.7.5R(2), substitute: ‘personal transactions in units or shares in a UCITS scheme, a non￾UCITS retail scheme or a recognised scheme, where the relevant person and any other person for whose account the transactions are effected are not involved in the management of that scheme;’ and

FCA 2025/XX FOS 2025/XX Page 33 of 59 (4) in COBS 11.7.6R, for ‘provision of designated investment business or collective portfolio management services’ substitute ‘provision of an ESG rating’. Insert the following new schedules, ESG Sch 1 to ESG Sch 4, after ESG TP 1 (Transitional provisions). All the text is new and is not underlined. Sch 1 Record keeping requirements Sch 1.1 G (1) The aim of the guidance in the following table is to give the reader a quick overall view of the relevant record keeping requirements. (2) It is not a complete statement of those requirements and should not be relied on as if it were. Handbook reference Subject of record Contents of record When record must be made Retention period ESG 4.1.6R Record keeping for sustainability labels A manager that uses a sustainability label must prepare a record as to the basis on which the label has been used When using a sustainability label Record must be kept for the duration of the label’s use, including where the use of the label changes ESG 4.1.12R Reviews of sustainability label use Requirement for a manager to keep a record of the fact that it has undertaken a review under ESG 4.1.11R and the decision it has reached as a result of the review At the time of review under ESG 4.1.11R None specified ESG 5.2.8R Consumer￾facing disclosure Requirement for a manager to keep a copy of each version of its published consumer-facing disclosure When a new version published 5 years

FCA 2025/XX FOS 2025/XX Page 34 of 59 ESG 6.2.15R Requirement to keep orderly records for ESG rating providers Includes but is not limited to keeping records of: (a) Data used to produce and ESG rating When rating produced None specified (b) Records of governance process and decision￾making Ongoing None specified (c) Details of change to methodologies When methodology changed None specified (d) Kinds of service or activity that could give rise or has given rise to a conflict of interest Ongoing Not specified (e) Each complaint received and the measures taken for its resolution When complaint received or measures taken Not specified ESG 6.2.16R Conflicts of interest – management Firm must retain a record of the steps taken to manage a conflict where damage to integrity or independence of the ESG rating cannot be prevented When steps taken to manage a conflict None specified ESG 6.5.17R (applying COBS 11.7.4R) Personal transactions ESG rating provider must keep record of personal transactions notified to, or identified by, it, including any authorisation or prohibition Date of notification 5 years

FCA 2025/XX FOS 2025/XX Page 35 of 59 Sch 2 Notification requirements Sch 2.1 G (1) The aim of the guidance in the following table is to give the reader a quick overall view of the relevant notification requirements. (2) It is not a complete statement of those requirements and should not be relied on as if it were. Handbook reference Matter to be notified Contents of the notification Trigger event ESG 4.1.7R Use or revision of, or ceasing to use a sustainability label Notify the FCA of intention to use a sustainability label in relation to a particular sustainability product, or to revise or cease the use of that label using the FCA’s online notification and application system Intention to use a sustainability label in relation to a particular sustainability product, or to revise or cease the use of that label. Sch 3 Fees and other required payments Not used Sch 4 Right of action for damages Sch 4.1 G The table below sets out the rules in ESG 6 the contravention of which by an authorised person may be actionable under section 138D of the Act (Actions for damages) by a person who suffers loss as a result of the contravention. Sch 4.2 G If a ‘Yes’ appears in the column headed ‘For private person?’ the rule may be actionable by a private person under section 138D of the Act (or, in certain circumstances, that person’s fiduciary or representative; see article 6(2) and (3)(c) of the Financial Services and Markets Act 2000 (Rights of Action) Regulations 2001 (SI 2001/2256)). A ‘Yes’ in the column headed ‘Removed’ indicates that the FCA has removed the right of action under section 138D(3) of the Act. Where this is the case, a reference to the rule in which it is removed is also given. Sch 4.3 G The column headed ‘For other person?’ indicates whether the rule may be actionable by a person other than a private person (or their fiduciary or representative) under article 6(2) and (3) of the Financial Services and Markets Act 2000 (Rights of Action) Regulations 2001 (SI 2001/2256). Where this is the case, an indication of the type of person by whom the rule may be actionable is given.

FCA 2025/XX FOS 2025/XX Page 36 of 59 Chapter Section/Annex Paragraph Right of action under section 138D For private person? Removed? For other person? All of the rules in ESG Yes No No

FCA 2025/XX FOS 2025/XX Page 37 of 59 Annex F Amendments to the Supervision sourcebook (SUP) In this Annex, underlining indicates new text and striking through indicates deleted text. 16 Reporting requirements 16.1 Application … Application of different sections of SUP 16 (excluding SUP 16.13, SUP 16.14A, SUP 16.15, SUP 16.22 and SUP 16.26) 16.1.3 R (1) Section(s) (2) Categories of firm to which section applies (3) Applicable rules and guidance … SUP 16.4 and SUP 16.5 All categories of firm except: Entire sections … … (k) a firm falling within a combination of (i), (ia), (j), (ja), (jb) and (jc).; (l) a firm with permission to carry on only the regulated activity of administering a benchmark; and (m) an ESG rating provider. … … 16.26 Reporting of information about Directory persons Application

FCA 2025/XX FOS 2025/XX Page 38 of 59 16.26.1 R This section of the FCA Handbook applies to an SMCR firm but it does not apply to a pure benchmark SMCR firm or to an ESG rating provider. … 16.30 Baseline Financial Resilience Report Application 16.30.1 R This section applies to any firm except: … (4) a PRA-authorised person; and (5) a supervised run-off firm.; and (6) … (7) an ESG rating provider.

FCA 2025/XX FOS 2025/XX Page 39 of 59 Annex G Amendments to the Dispute Resolution: Complaints sourcebook (DISP) In this Annex, underlining indicates new text and striking through indicates deleted text. [Editor’s note: this Annex takes into account the changes made by the Public Offers of Relevant Securities (Operating an Electronic System) Instrument 2025 (FCA 2025/32), which comes into force on 19 January 2026.] 1 Treating complainants fairly 1.1 Purpose and application … Application to firms … 1.1.5 R This chapter does not apply to: … (6) a depositary, for complaints concerning activities carried on for an AIF that is: … (b) another type of AIF unless it is: … (iii) a charity AIF; and (7) complaints in respect of administering a benchmark.; and (8) complaints in respect of providing an ESG rating. … 1 Annex 2 Application of DISP 1 to type of respondent/complaint 1 Annex 2 G …

FCA 2025/XX FOS 2025/XX Page 40 of 59 Type of respondent / complaint DISP 1.1A Requirements for MiFID investment firms DISP 1.2 Consumer awareness rules DISP 1.3 Complaints handling rules DISP 1.4 - 1.8 Complaints resolution rules etc. DISP 1.9 Complaints record rule DISP 1.10 Complaints reporting rules DISP 1.10A Complaints data publication rules DISP 1.10B Complaints reporting directions … Complaints relating to administering a benchmark … … … … … … … … Complaints relating to providing an ESG rating Does not apply Does not apply Does not apply Does not apply Does not apply Does not apply Does not apply Does not apply

FCA 2025/XX FOS 2025/XX Page 41 of 59 2 Jurisdiction of the Financial Ombudsman Service … 2.3 To which activities does the Compulsory Jurisdiction apply? Activities by firms 2.3.1 R The Ombudsman can consider a complaint under the Compulsory Jurisdiction if it relates to an act or omission by a firm in carrying on one or more of the following activities: (1) regulated activities (other than auction regulation bidding, administering a benchmark and, dealing with unwanted asset money and providing an ESG rating); … … 2.5 To which activities does the Voluntary Jurisdiction apply? 2.5.1 R The Ombudsman can consider a complaint under the Voluntary Jurisdiction if: … (2) it relates to an act or omission by a VJ participant in carrying on one or more of the following activities: (a) an activity (other than auction regulation bidding, administering a benchmark, meeting of repayment claims, managing dormant asset funds (including the investment of such funds), regulated pensions dashboard activity and, operating an electronic system for public offers of relevant securities and providing an ESG rating) carried on after 28 April 1998 which: … (c) activities, other than regulated claims management activities, activities ancillary to regulated claims management activities, meeting of repayment claims, managing dormant asset funds (including the investment of such funds), regulated pensions dashboard activity and, operating an electronic system for public offers of relevant securities and providing an ESG rating, which (at 19 January 2026 [Editor’s note: insert the date on which this instrument comes into force]) would be covered by the Compulsory Jurisdiction, if they were carried on from an establishment in the United Kingdom (these activities are listed in DISP 2 Annex 1G);

FCA 2025/XX FOS 2025/XX Page 42 of 59 … … … 2 Annex 1 Regulated Activities for the Voluntary Jurisdiction at 19 January 2026 [Editor’s note: insert the date on which this instrument comes into force] … G The activities which were covered by the Compulsory Jurisdiction (at 19 January 2026 [Editor’s note: insert the date on which this instrument comes into force]) were: … The activities which (at 19 January 2026 [Editor’s note: insert the date on which this instrument comes into force]) were regulated activities were, in accordance with section 22 of the Act (Regulated Activities), any of the following activities specified in Part II and Parts 3A and 3B of the Regulated Activities Order (with the addition of auction regulation bidding, administering a benchmark and dealing with unwanted asset money): … (38F) administering a specified benchmark (article 63O(1)(b)); (38G) providing an ESG rating (article 63U); …

FCA 2025/XX FOS 2025/XX Page 43 of 59 Annex H Amendments to the Perimeter Guidance manual (PERG) In this Annex, underlining indicates new text and striking through indicates deleted text, unless stated otherwise. [Editor’s note: the amendments to this guidance are drafted on the basis of the draft Financial Services and Markets Act 2000 (Regulated Activities) (ESG Ratings) Order 2025, which is currently before Parliament.] 1 Introduction to the Perimeter Guidance manual … 1.4 General guidance to be found in PERG 1.4.1 G PERG 1.4.2G has a table setting out the general guidance to be found in PERG. 1.4.2 G Table: list of general guidance to be found in PERG. Chapter Applicable to: About: … PERG 17: Consumer credit debt counselling … … PERG 18: Guidance on the scope of the environmental, social and governance ratings regime Any person who needs to know whether their activities in relation to providing ESG ratings will amount to regulated activities. The scope of the regulated activities relating to providing ESG ratings. 2 Authorisation and regulated activities … 2.4 Link between activities and the United Kingdom … 2.4.10 G … 2.4.11 G (1) A person will need a permission for providing an ESG rating where the person is:

FCA 2025/XX FOS 2025/XX Page 44 of 59 (a) located in the United Kingdom and providing an ESG rating to a person, irrespective of whether that person is located in the UK, or overseas (see also PERG 18.5); or (b) not located in the United Kingdom but providing an ESG rating to a person in the UK for remuneration (see also PERG 2.8.14FG(11) and PERG 18.5). (2) ‘located in the United Kingdom’ is defined in article 63Z7 of the Regulated Activities Order as: ‘(a) in relation to a legal person— (i) the person’s registered office is in the United Kingdom, or, if the person does not have a registered office, the person’s head office is in the United Kingdom, or (ii) the person's registered office is outside of the United Kingdom (or, if the person does not have a registered office, the person's head office is outside of the United Kingdom) but it is providing or receiving the ESG rating (as the case may be) through an establishment maintained by it in the United Kingdom, and (b) in relation to a natural person, means a person who is able to satisfy the requirements of the statutory residence test as set out in Schedule 45 to the Finance Act 2013 at the time that the ESG rating is made available to them’. 2.7 Activities: a broad outline … Regulated claims management activity … 2.7.20N G … Providing ESG ratings 2.7.20O G Providing an ESG rating is a regulated activity under article 63U of the Regulated Activities Order (ESG ratings). Guidance on this regulated activity is in PERG 2.8.14FG and PERG 18 (Guidance on the scope of the environmental, social and governance ratings regime). …

FCA 2025/XX FOS 2025/XX Page 45 of 59 2.8 Exclusions applicable to particular regulated activities … Regulated claims management activity 2.8.14D G … Providing ESG ratings 2.8.14E G For further guidance on the activity of providing an ESG rating and its exclusions set out in PERG 2.8.14F below, see PERG 18. 2.8.14F G The regulated activity of providing an ESG rating is cut back by various exclusions as follows: (1) Regulated products and services (article 63V) Regulated Activities Order). Where a person provides an ESG rating in the course of carrying on another regulated product or service, this activity does not constitute the regulated activity of providing an ESG rating. However, the exclusion does not apply where the ESG rating is provided as a standalone product or service – see PERG 18.6 Q23. For the purpose of this exclusion, regulated products and services means: (a) another activity which is carried on in accordance with a Part 4A permission and is: (i) a regulated activity; or (ii) an ancillary service; (b) an activity for which a person is subject to approval by the FCA under a provision of assimilated law or legislation restated by virtue of section 4 (Power to restate and modify saved legislation) of the Financial Services and Markets Act 2023; (c) an activity that is within scope of a market access arrangement; and (d) an activity in relation to: (i) a scheme recognised for the purpose of Part 17 of the Act; or (ii) an AIF which is marketed under regulation 58 (Marketing of AIFs managed by small third country AIFMs) or 59 (Marketing of AIFS managed by other third country AIFMs) of the Alternative Investment Fund Managers Regulations 2013.

FCA 2025/XX FOS 2025/XX Page 46 of 59 (2) Unregulated benchmarks (article 63W of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where it provides that ESG rating in the course of providing a benchmark that is unregulated as a result of Article 2(2)(a) to (g) of the benchmarks regulation. However, this exclusion does not apply where the ESG rating is provided as a standalone product or service – see PERG 18.6 Q23. (3) Unregulated credit ratings (article 63X of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where the ESG rating is used to produce, or is incorporated in, any of the following, which are unregulated as a result of Article 2(2) of the CRA Regulation: (a) an unregulated credit rating; (b) an unregulated credit score; or (c) an unregulated credit scoring system or similar assessment related to obligations arising from a consumer, commercial or industrial relationship, however, this exclusion does not apply where the ESG rating is provided as a standalone product or service – see PERG 18.6 Q23. (4) Intra-group ratings (article 63Y of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where it provides the ESG rating to another member of its group and where it does not reasonably expect the ESG rating to be made available outside its group, except in the course of carrying on an activity mentioned in PERG 2.8.14FG(1)(a) to (d). (5) Private use (article 63Z of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where it provides an ESG rating to a third party pursuant to a contract with that third party and: (a) where the ESG rating relates solely to the third party; and (b) the person does not reasonably expect the ESG rating to be made available outside the third party’s group. (6) Ancillary non-commercial provision (article 63Z1 of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where it provides an ESG rating in the course of journalistic, academic or charitable activities and where either: (a) there is no relevant remuneration (see PERG 18.6 Q24); or

FCA 2025/XX FOS 2025/XX Page 47 of 59 (b) the ESG rating is provided on an occasional or one-off basis and not regularly updated or maintained in a way that would enable it to be relied upon on an ongoing basis. (7) Public authorities, central banks and international organisations (article 63Z2 of the Regulated Activities Order). Public authorities, central banks and international organisations that provide ESG ratings are not considered to be carrying on the regulated activity of providing an ESG rating. In this context, ‘international organisation’ means any body or bodies the members of which comprise states including the UK. ‘State’ includes a public authority of a state. (8) Accreditation or certification (article 63Z3 of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where the ESG rating is developed exclusively for accreditation or certification processes and the purpose of that accreditation or certification is not to influence a decision to make a specified investment. (9) Regulatory or legal requirement (article 63Z4 of the Regulated Activities Order). A firm will not be carrying on the regulated activity of providing an ESG rating where the ESG rating is provided solely for the purpose of complying with its own regulatory or legal requirements. (10) Proxy advice (article 63Z5 of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where the ESG rating is provided as part of the provision of proxy advisor services within the meaning given in regulation 2 of the Proxy Advisors (Shareholders’ Rights) Regulations 2019 (SI 2019/926). (11) Overseas person (article 63Z6 and 72 of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where the ESG rating is provided by a person located overseas to a person ‘located in the United Kingdom’ (see PERG 2.4.11G) where the overseas person receives no remuneration for the ESG rating from any person (see also PERG 18.5 Q14). 2 Annex 2 Regulated activities and permission regime … 2 Table Table 1: Regulated Activities (excluding PRA-only activities) [See note 1 to Table 1]

FCA 2025/XX FOS 2025/XX Page 48 of 59 Regulated activity Specified investment in relation to which the regulated activity (in the corresponding section of column one) may be carried on … Activities relating to structured deposits (zag) dealing in investments as agent (article 21) (zah) arranging (bringing about) deals in investments (article 25(1)) (zai) making arrangements with a view to transactions in investments (article 25(2)) (zaj) managing investments (article 37) [see note 3 to Table 1] (zak) advising on investments (except P2P agreements) (article 53(1)) structured deposits Activities relating to ESG ratings (zal) providing an ESG rating (article 63U) Any specified investment Insert the following new chapter, PERG 18, after PERG 17 (Consumer credit debt counselling). All the text is new and is not underlined. [Editor’s note: the following text takes into account amendments to the Glossary made by the Berne Financial Services Agreement Instrument 2025 (FCA 2025/57), which comes into force on 1 January 2026.] 18 Guidance on the scope of the environmental, social and governance ratings regime 18.1 Application This guidance applies to any person who needs to know whether their activities in relation to providing environmental, social and governance (ESG) ratings amount to the regulated activity of providing an ESG rating. 18.2 Purpose

FCA 2025/XX FOS 2025/XX Page 49 of 59 Q1. What is the purpose of these questions and answers (‘Q&As’) and who should be reading them? This guidance is issued under section 139A of the Act (Guidance). These Q&As supplement the guidance in PERG 2.4.11G, PERG 2.7.20OG and PERG 2.8.14FG. The purpose of these Q&As is to help persons to consider whether they are carrying on the regulated activity of providing an ESG rating and therefore whether they need authorisation or, for persons that are already FCA-authorised, a variation of their Part 4A permission. The Q&As below cover: (1) an overview of the questions a person should consider when deciding whether authorisation is required (see PERG 18.3 below); (2) the regulated activity of providing ESG ratings and how to apply it (see PERG 18.4 below); (3) the territorial scope of the regime (see PERG 18.5 below); (4) the exclusions in articles 63V to 63Z6 of the Regulated Activities Order (see PERG 18.6 below); and (5) the exemption for designated professional bodies (see PERG 18.7 Q27 below). Q2. To what extent can we rely on these Q&As? The answers given in these Q&As represent the FCA’s views but the interpretation of financial services legislation is ultimately a matter for the courts. The Q&As explain particular aspects of regulatory requirements. They are not a complete statement of a firm’s obligations and are not a substitute for reading the relevant legislation. If you have doubts about your position after reading the legislation and these Q&As, you may wish to seek legal advice. 18.3 Authorisation for providing an ESG rating Q3. Questions to be considered to decide if authorisation is required A person who wants to know whether their proposed activities require authorisation will need to consider the following questions (these questions are a summary of the issues to be considered): (1) Will I be carrying on my activities by way of business (see PERG 2.3 (the business element))?

FCA 2025/XX FOS 2025/XX Page 50 of 59 (2) If so, will I be producing an ‘ESG rating’ (see Q4 and Q9 below)? (3) If so, will the ESG rating be likely to influence a decision to make a specified investment and do I reasonably expect this to be the case (see PERG 18.4 Q13 below)? (4) If so, am I either: (a) providing those services from the UK to persons anywhere; or (b) providing those services from abroad to persons in the UK? (See PERG 18.5 (Territorial scope)). (5) If so, do any exclusions apply to me (see PERG 2.9, PERG 2.8.14FG for a full list of all the exclusions for the activity of providing an ESG rating, and PERG 18.6 for further guidance in relation to some of them)? (6) If not, do any exemptions (see PERG 2.10) apply – for example, the exemption for designated professional bodies (see PERG 2.10.12G to PERG 2.10.16G and Q27 below)? If a person’s answers to (1) to (4) are all ‘yes’ and the answers to questions (5) and (6) are ‘no’, that person requires authorisation and should refer to the FCA webpage How to apply for authorisation or registration for details of the application process. 18.4 Providing ESG ratings Q4. What is an ESG rating? According to article 63Z7 of the Regulated Activities Order, an ESG rating is ‘an assessment regarding one or more ESG factors, which– (a) is produced in the form of an opinion, a score or a combination of both, where– (i) ‘score’ means a measure derived from data and a pre￾established statistical or algorithmic system or model, without additional substantial analytical input from an analyst, and (ii) ‘opinion’ means an assessment involving substantial analytical input from an analyst, and (b) is prepared using an established methodology and a defined ranking system of rating categories’.

FCA 2025/XX FOS 2025/XX Page 51 of 59 It makes no difference for these purposes whether the assessment is characterised as an ESG rating (see Q5 below). An ESG factor is defined in the legislation as ‘an environmental, social or governance factor’. This, along with the definition of an ‘ESG rating’, makes clear that an assessment regarding one or more environmental, social or governance factors is potentially within scope of the regulated activity. For example, an assessment of the governance of a company could be within scope. But so could an assessment of the environmental, social and governance performance of that company (or any combination of those factors). Q5. What does ‘whether or not it is characterised as an ESG rating’ mean in this context? A product can be in scope even if it is not described or marketed as an ‘ESG rating’. For example, a product marketed as an ‘ESG data product’ or an ‘ESG solution’ could meet the statutory definition. As could a ‘resilience assessment’ or a ‘transition score’. Q6. Where is the line between an ESG data product (out of scope) and an ESG rating (in scope)? The key distinction between an ESG rating and an ESG data product is that data products do not have a defined ranking system. Examples of ESG data products include ESG news feeds and datasets of corporate CO₂ emissions that are not linked to any ranking system. In contrast, examples of products that are likely to be ESG ratings include ones that assess ESG controversies and assign scores, colour￾coded systems (such as red, amber or green), or other categories that enable ranking. Q7. What is an established methodology? A ‘methodology’ is a system of models, techniques and procedures for producing a type of ESG rating. It must involve a system; it cannot be an unsystematic opinion. A methodology is ‘established’ if it is used to produce an ESG rating product-line. Documented procedures are likely to be indicative of an established methodology. However, a methodology can still be ‘established’ even where the models, techniques or procedures have not been documented. Q8. What are rating categories and what does it mean for there to be a ‘defined ranking system of rating categories’? Under the Regulated Activities Order, ‘rating categories’ include (but are not limited to) variables or divisions within a system. Examples

FCA 2025/XX FOS 2025/XX Page 52 of 59 include colour coding, scores, or other classes expressed using words (for example ‘aligned’, ‘misaligned’ and ‘strongly aligned’), symbols, numbers (including temperatures), grades or letters. To be in scope, ESG ratings must use rating categories within a predefined ranking system. That system needs to provide a relative measure to distinguish one or more characteristics between rated items. Simply having data where some outputs are higher or lower than others would not by itself amount to a defined ranking system, even if data users, for example, interpret a higher number to be better or worse than a lower number. Q9. What does it mean to produce an ESG rating? Producing an ESG rating means making an assessment regarding one or more ESG factors to produce an ESG score, opinion or combination of both. This remains the case even if some steps are outsourced to group companies or third parties. Q10. What is the regulated activity in relation to providing ESG ratings? Providing an ESG rating is a regulated activity (under article 63U of the Regulated Activities Order). As with other regulated activities, authorisation is only required if the activity is carried on ‘by way of business’ (see PERG 2.3). To be within scope of the regulated activity of providing ESG ratings: (1) the provider must both produce the rating and make it available (mere distribution of someone else’s ESG rating is out of scope); and (2) the rating must be likely to influence a decision to make a specified investment. It is immaterial whether someone commissioned the ESG rating (it is solicited) or no-one commissioned the rating (it is unsolicited). Q11. Who needs FCA authorisation to provide ESG ratings? If you provide ESG ratings (see PERG 2.7.20OG and Q10 above) by way of business (see PERG 2.3), you will need FCA authorisation (see PERG 18.3 and PERG 18.4) unless: (1) you could not reasonably have expected the ESG rating to influence a decision to make a specified investment (see Q13 below); (2) you are an exempt person (see PERG 2.10 and Q27 below); or

FCA 2025/XX FOS 2025/XX Page 53 of 59 (3) a Regulated Activities Order exclusion applies (see PERG 2.9, PERG 2.8.14FG and PERG 18.6). Q12.What does making a specified ‘investment’ mean in this context? ‘Make’, in relation to ‘making a specified investment’, has a broad meaning, including (but not limited to): ‘(a) buying, selling, subscribing for, exchanging, redeeming, holding or underwriting the investment, or (b) exercising or not exercising any right conferred by such an investment to buy, sell, subscribe for, exchange or redeem such an investment’. ‘Make’ should therefore be read consistently with the relevant specified investment. For example, using an ESG rating to decide whether to enter into a contract of insurance is a decision to ‘make a specified investment’. Q13. What does ‘likely to influence a decision to make a specified investment’ mean? A person providing an ESG rating will need to consider all relevant facts and think carefully about whether the ESG rating that they have produced is likely to inform a decision to make a specified investment. One key relevant fact would be whether the users use the ratings for financial purposes, as most uses in that context would be informing a decision to make a specified investment. For example, a rating of a publicly traded financial instrument or a fund, for these purposes, is likely to influence a trading decision. A company-commissioned rating included in initial public offering (IPO) documentation or pre-IPO marketing is another likely example. The test is whether the provider of the ESG rating could reasonably have expected the rating to influence a decision to make a specified investment; the provider does not have to know the exact use of every rating. 18.5 Territorial scope Q14. What is the territorial scope of the regime? A provider needs FCA authorisation to provide ESG ratings if: (1) it is a firm ‘located in the United Kingdom’ (whether it provides the ESG rating to a person who is in the UK or overseas); or

FCA 2025/XX FOS 2025/XX Page 54 of 59 (2) it is located overseas but provides an ESG rating to a person ‘located in the United Kingdom’ and is remunerated for it (by any person). See PERG 2.4.11G(2) regarding the meaning of ‘located in the United Kingdom’. A person located overseas is out of scope where it provides a rating into the UK for no remuneration (for example, by publishing on a free to access website). This is excluded by article 72(5G) of the Regulated Activities Order (Overseas persons). Article 72(5H) makes clear that remuneration in this context means: ‘any commission, fee, charge or other payment, including an economic benefit of any kind or any other financial or non-financial advantage or incentive offered or given.’ Q15. I am distributing my ratings to UK users via an overseas intermediary, so I am producing the rating but not making it available myself to anyone in the UK, am I out of scope? No. Where a provider makes a rating available to one or more third parties outside the UK but reasonably expects it to be provided to a person in the UK, the activity is in scope of regulation (see the definition of ‘providing’ in article 63Z7 Regulated Activities Order). 18.6 Exclusions Q16. Which kinds of ESG ratings are excluded from regulation? Exclusions are listed at PERG 2.8.14FG. Further guidance on selected exclusions is below. Q17. What is the purpose of the regulated products and services exclusion? If a firm produces ESG ratings in the course of carrying on another FCA-regulated activity (or ancillary service) that it has permission for, it does not need a separate permission for providing ESG ratings. This exclusion also covers other activities that require a form of FCA￾approval and certain other activities: providers will not need FCA authorisation if they are providing ESG ratings in the course of carrying on those activities (see Q18 below). The regulated products and services exclusion does not apply where you are also providing ESG ratings on a standalone basis (Q23). This exclusion reduces the burden for firms that are already regulated by the FCA.

FCA 2025/XX FOS 2025/XX Page 55 of 59 Q18. Which kinds of activities are covered by the regulated products and services exclusion? This exclusion can apply to: (1) FCA-authorised persons producing ESG ratings in the course of carrying on a regulated activity they already have permission for, or ancillary services set out in Part 3A of Schedule 2 of the Regulated Activities Order; (2) persons that are subject to another form of FCA approval (whether authorisation, registration or equivalent) under: (a) assimilated law; or (b) restated legislation (under section 4 of the Financial Services and Markets Act 2023); (3) persons carrying on activities under special arrangements for overseas providers (‘market access arrangements’ - see Q19 below); and (4) persons carrying on an activity (such as marketing) in relation to: (a) a recognised scheme (ie, a scheme recognised under section 272 of the Act, an OFR recognised scheme, or a scheme or sub-fund which is temporarily recognised under Part 6 of the Collective Investment Schemes (Amendment etc.) (EU Exit) Regulations 2019); or (b) an AIF which has been notified for marketing by a non￾UK AIFM under either regulation 58 or regulation 59 of the AIFMD UK regulation. Q19. What market access arrangements are covered by the regulated products and services exclusion? The regulated products and services exclusion also covers ESG ratings used in the course of providing: (1) credit ratings benefitting from equivalence (known as ‘certification’) under the CRA Regulation; (2) benchmarks benefitting from equivalence, recognition, endorsement or the third country regime transitional provisions under the benchmarks regulation; (3) a regulated activity that is carried on by an overseas person excluded under article 72 (overseas persons) of the Regulated Activities Order; or

FCA 2025/XX FOS 2025/XX Page 56 of 59 (4) services provided by registered BFSA investment firms when exercising market access rights under Annex 5 of the Berne Financial Services Agreement. Q20. Are ESG ratings used in the production of credit ratings within scope? ESG ratings used in the course of carrying on the following activities are likely to be excluded from scope, where they are not provided on a standalone basis (see Q23) and are used to produce, or are incorporated in: (1) credit ratings (including endorsed credit ratings) issued by a credit rating agency registered under the CRA Regulation (article 63V(1)(b) Regulated Activities Order); (2) credit ratings issued by a certified credit rating agency (article 63V(3)(a) Regulated Activities Order); or (3) unregulated credit ratings (article 63X Regulated Activities Order). Q21. Are ESG ratings used in the production of benchmarks within scope? ESG ratings used in the course of carrying on the following activities are likely to be excluded from scope, where they are not provided on a standalone basis (see Q23) and are used to produce, or are incorporated in: (1) benchmarks provided by authorised benchmark administrators under the benchmarks regulation (article 63V(1)(b) Regulated Activities Order); (2) benchmarks provided under equivalence, recognition or endorsement arrangements (article 63V(3)(b)(i)(aa) to (cc) Regulated Activities Order); (3) benchmarks provided under the transitional regime (article 63V(3)(b)(ii) Regulated Activities Order); or (4) benchmarks excluded from the scope of the benchmarks regulation (article 63W Regulated Activities Order). Q22. Are ESG ratings incorporated in investment research covered by the regulated products and services exclusion? Yes, to the extent that investment research is provided by a firm with permission for advising on investments, or as a MiFID ancillary service and the ESG rating is not provided on a standalone basis (see Q23), the exclusion applies (article 63V(1)(i) or (ii) Regulated Activities Order).

FCA 2025/XX FOS 2025/XX Page 57 of 59 If a person providing investment research or financial analysis is unauthorised, it cannot rely on the exclusion in PERG 18.6 Q18(1). It is therefore likely to need permission to provide ESG ratings where its research or analysis includes or amounts to an in-scope ESG rating, if no other exclusion applies to its business. Q23. Some of the exclusions do not apply where an activity is provided as a standalone product or service. What does this mean? The exclusion does not apply if the ESG rating is provided to users as a standalone product or service, separate from its other regulated products and services. For example: (1) An unauthorised person providing an ESG rating for the purpose of marketing a recognised scheme (for example, the operator of an OFR recognised scheme) would benefit from the exclusion. But a person who publishes or supplies an ESG rating completely separately from their investment services would not. (2) A benchmark administrator using ESG ratings to create a benchmark would be able to benefit from the exclusion. However, if an ESG rating is separately commissioned from the benchmark administrator by a rated entity or distributed by subscription, this would amount to ‘standalone’ provision and the exclusion would not apply. (3) An investment firm’s inclusion of an ESG rating within investment research provided as part of its activity advising on investments, or as an ancillary service (see Q22) would benefit from the exclusion. However, where an investment firm publishes or supplies ESG ratings separately to its investment services or ancillary services, it will be providing the ESG rating as a ‘standalone’ product or service, so the exclusion will not apply. Q24. I am a journalist, academic or work in the charities sector and the assessments I produce as part of that work seem to come within scope of the regulated activity of providing ESG ratings. Do I need to seek authorisation? Journalists, academics and charities may rely on the article 63Z1 Regulated Activities Order exclusion (ancillary non-commercial provision) if they meet certain conditions. They must either: (1) receive no relevant remuneration; or (2) provide the rating on an occasional or one-off basis (a condition that will not be met where the ESG rating is regularly updated or undergoes ongoing maintenance).

FCA 2025/XX FOS 2025/XX Page 58 of 59 ‘Relevant remuneration’ means ‘any commission, fee, charge or other payment, including an economic benefit of any kind or any other financial advantage or incentive offered’ (article 63Z1 Regulated Activities Order). [Editor’s note: This differs from the meaning that applies to overseas providers of ESG ratings under article 72 (overseas persons) of the Regulated Activities Order (see PERG 2.8.14FG(11)) and PERG 18.5 Q14).] An example of where the exclusion would not apply would be if a team of academics produced a report ranking company progress on transitioning to net zero, but where the work was funded by subscriptions from financial services firms who then use the ratings. By contrast, a media outlet providing a one-off ranking (for example ‘top 100 companies by workforce satisfaction’) would not be in scope. When assessing remuneration, the FCA will consider all the relevant facts and look at the group structure and organisation holistically. Q25. What does the exclusion for regulatory or legal requirements cover? An ESG rating produced solely to comply with a legal or regulatory requirement may be excluded (under article 63Z4 of the Regulated Activities Order). The exclusion will only apply if: (1) the sole purpose of the rating is to comply with a regulatory or legal requirement; (2) the requirement is imposed by law; and (3) the person producing the rating is the person subject to that requirement. A third-party rating for these purposes is not covered by the exclusion. Q26. Is our advice on ESG to pension schemes in scope? As noted above, specified investment has a broad definition. It also includes rights under a personal pension plan. Providing an ESG rating in relation to any specified investment would likely amount to influencing a decision to make a specified investment. If ESG advice in relation to rights under a personal pension scheme amounts to, or includes, an ESG rating, the persons giving that advice will need permission for providing an ESG rating. Rights under an Occupational Pension Scheme are not generally specified investments (though there are some exceptions). However,

FCA 2025/XX FOS 2025/XX Page 59 of 59 where firms advise on the specified investments that are being proposed or provided to occupational scheme trustees (which are then used to support the benefits being provided under the scheme) and where that advice includes an ESG rating, the firm will need to consider seeking permission to provide ESG ratings. 18.7 Exemption Q27. We offer FCA-regulated services under Part XX of the Act. Do we need FCA-authorisation and permission to offer ESG ratings? Persons that are members of certain Designated Professional Bodies (DPBs) under Part XX of the Act, and that comply with standards set by their DPB, are exempt from the need to become FCA-authorised. The DPB exemption applies only if the relevant DPB has made rules covering the activity and the FCA has approved those rules. For example, if investment consultants are members of a DPB and wish to provide ESG ratings without FCA authorisation, their DPB would need to make FCA-approved rules covering ESG ratings and the firms would need to comply with them.

© Financial Conduct Authority 2025 12 Endeavour Square London E20 1JN Telephone: +44 (0)20 7066 1000 Website: www.fca.org.uk All rights reserved Pub ref: 2-008504 All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 0207 066 1000 Sign up for our news and publications alerts