Guidelines on the Scope of the CRA Regulation

28/10/2022 | ESMA80-196-6345 Guidelines Guidelines on the Scope of the CRA Regulation

SMA • 201-203 rue de Bercy • CS 80910 • 75589 Paris Cedex 12 • France • Tel. +33 (0) 1 58 36 43 21 • www.esma.europa.eu Date: 28 October 2022 ESMA80-196-6345 Table of Contents I. Scope..............................................................................................................................................4 II. Purpose..........................................................................................................................................4 III. Compliance and reporting obligations ........................................................................................4 IV. Obligation to register under Art. 2(1), 3(b), 4, 5, and 14(1) of the CRA Regulation..................5 V. Credit rating activities and exclusions from the scope of the CRA Regulation (Art. 2 and 3 of the CRA Regulation)..................................................................................................................................5 VI. Establishment of branches outside the Union by registered credit rating agencies under art. 14(3) of the CRA Regulation .....................................................................................................................6 VII. Specific disclosure recommendations for best practice relating to Art. 16 (1) of ESMA Regulation..................................................................................................................................................7 VIII. Enforcement of the rules concerning the scope of the CRA Regulation....................................7

3 Acronyms used CRAs Credit Rating Agencies EBA European Banking Authority NCAs National Competent Authorities as defined in the CRA Regulation, Art. 3(1)(p) SCA Sectoral Competent Authorities as defined in the CRA Regulation, Art. 3(1)(r)

4 I. Scope Who?

1. These guidelines are addressed to: a. Credit rating agencies (as defined in the Article 3(1)(a) of the CRA Regulation); b. NCAs and SCAs; and c. Financial market participants providing private credit ratings produced pursuant to an individual order and provided exclusively to the person who placed the order and which are not intended for public disclosure or distribution by subscription. When?
2. These Guidelines will be published in all EU official languages. II. Purpose
3. The purpose of these guidelines is to provide a clarification of the scope of the CRA Regulation, in particular of the provisions thereof concerning the following specific matters: a. obligation to register; b. credit rating activities and exemptions from registration; c. private credit ratings; d. establishment of branches in third countries; e. specific disclosure recommendations for credit scoring firms and CRAs established in third countries; f. enforcement of the scope of the CRA Regulation and Cooperation with National Competent Authorities. III. Compliance and reporting obligations Status of the Guidelines
4. This document contains Guidelines issued under Article 16 of the ESMA Regulation. In accordance with Article 16(3) of the ESMA Regulation competent authorities and financial market participants must make every effort to comply with the Guidelines.
5. Competent authorities to whom the Guidelines are addressed should incorporating them into their supervisory practices, including where particular guidelines within the document are directed primarily at financial market participants.

5 6. As regards all the other chapters of these Guidelines, NCAs and financial market participants are required to comply with the provisions of the CRA Regulation, while ESMA has the duty to ensure the application thereof. 7. The clarifications provided in the present Guidelines are relevant for the application of the provisions of the CRA Regulation. Reporting requirements under art. 16 of ESMA Regulation 8. Competent authorities to which paragraph 24 of these guidelines is addressed must notify ESMA to info@esma.europa.eu whether they comply or intend to comply with the Guidelines, with reasons for non-compliance, within two months of the date of their publication by ESMA in all the EU official languages. In the absence of a response by this deadline, competent authorities will be considered as non-compliant. A template for notifications is available from the ESMA website. IV. Obligation to register under Art. 2(1), 3(b), 4, 5, and 14(1) of the CRA Regulation 9. Credit rating agencies without a physical presence in the EU and fulfilling the prerequisites of Article 5 of the CRA Regulation shall obtain certification from ESMA before distributing credit ratings for regulatory purposes in the EU. 10. Credit rating agencies established in the EU that are carrying out credit rating activities in the EU without prior registration are operating in breach of Article 2(1) and 14(1) of the CRA Regulation. Any credit rating agency that intends to carry out credit rating activities shall immediately apply for registration by ESMA. Entities must not issue credit ratings until they are registered as CRAs. Such obligations also apply to legal entities established in the EU which employ rating analysts providing rating services to a third-country entity. 11. Only a legal person can apply for registration. A natural person cannot apply for registration. 12. ESMA shall take a supervisory measure according to Article 24 of the CRA Regulation against credit rating agencies that operate without registration or, where appropriate, certification in the Union and impose a fine pursuant to Article 36a and Annex III.54 of the CRA Regulation. V. Credit rating activities and exclusions from the scope of the CRA Regulation (Art. 2 and 3 of the CRA Regulation) 13. Credit ratings, as defined in Article 3(1)(a) of the CRA Regulation, include quantitative analysis and sufficient qualitative analysis, according to the rating methodology established by the credit rating agency. A measure of creditworthiness derived from summarising and expressing data based only on a pre-set statistical system or model, without additional substantial qualitative rating￾specific analytical input from a rating analyst should not be considered as a credit rating. 14. A rating which is provided to different persons belonging to a list of subscribers does not fall within the definition of “private credit rating” in Article 2(2)(a) of the CRA Regulation. On the other hand, Article 2(2) of the CRA Regulation does not mean that any transmission of the rating to a third party by the person that ordered it would correspond to public disclosure or distribution by subscription. The recipient of a private credit rating is allowed to share the rating with a limited

6 number of third parties and on a strictly confidential basis – as long as such disclosure does not correspond to public disclosure or distribution by subscription – to ensure that the private credit rating is not disclosed further. For instance, when applying for a loan, the recipient of a private credit rating may share his rating with his bank on a strictly confidential basis, or a bank can circulate a private credit rating to a restricted number of other banks for the purposes of a business transaction. The private credit rating should only be produced following an explicit order, formalised through a written agreement between the person placing the order and the rating provider1. ESMA expects this agreement to contain a specific provision indicating the exclusive issuance of the rating to the person who placed the order, who should sign a non-disclosure undertaking, precluding the dissemination of the rating to more than a limited number of third parties. 15. In accordance with Article 2(2)(a) of the CRA Regulation, rating providers should ensure that the agreements for the issuance of private credit ratings cover the duty of confidentiality and limitations on the distribution of the ratings. When issuing private credit ratings, rating providers should assess whether the person who placed the order, as recipient of the private credit rating, has any intention to use the rating in a way that would bring it into the public domain or to use it for regulatory purposes. Where the rating provider can reasonably conclude that a private credit rating could be disclosed to the public, for instance taking into account that the same client already breached the duty of confidentiality in the past, ESMA recommends as a best practice that rating providers should put in place the necessary measures to avoid such disclosure or refrain from issuing that rating. ESMA also expects that the receiving party only shares the private credit rating on a confidential basis and with a selected and definite number of natural or legal persons. This number should be limited and can never exceed a total of 150 persons. To ensure that this maximum limit is adhered to, appropriate controls should be implemented by the rating provider to allow for the monitoring of the distribution. VI. Establishment of branches outside the Union by registered credit rating agencies under art. 14(3) of the CRA Regulation 16. Since branches do not have a separate legal personality from their parent, credit ratings issued in branches established outside the Union are deemed to be issued by their EU parent. Therefore, infringements by the branches of the CRA Regulation are attributable to the parent CRA which shall be the object of ESMA’s supervisory measures, imposition of fines and/or periodic penalty payments. 17. ESMA might be prevented from performing its supervisory tasks if important operational functions of credit rating agencies were based and primarily operated outside the Union. Moreover, CRAs should demonstrate that there is an objective reason for credit ratings to be issued in branches set up outside the Union. For instance, the need to ensure an adequate presence in the third country in question. ESMA would take action according to Article 24, 36a, 36b in case of infringements by CRAs of Annex III part II points 2, 4, 5, 6, 7 and 8 of the CRA Regulation. 18. Important operational functions, as set out in Art. 9 of the CRA Regulation, should not be based or primarily operated in offices established in third-countries with no (or very limited) involvement of EU-based managers, systems or procedures of the credit rating agency. Important operational 1 Credit rating agencies and financial market participants providing private credit ratings produced pursuant to an individual order and provided exclusively to the person who placed the order and which are not intended for public disclosure or distribution by subscription.

7 functions include units or divisions in charge of elaboration and issuance of credit ratings, credit analysis, rating methodology development and review, compliance, internal quality control, data storage/record keeping and systems maintenance or support. However, the identification of important operational functions may require case-by-case consideration. As regards the compliance function, CRAs should ensure that their internal control system is fully operational also in third-country branches. 19. Credit rating agencies shall not establish branches in third countries to perform activities that are subject to supervision by ESMA if this prevents ESMA from conducting supervisory tasks in relation to such activities of those branches as set out in articles 23b to 23d of the Regulation, including the ability to carry out on-site inspections and investigations. In this respect: a) credit rating agencies should cooperate with ESMA in case of inspections or investigations, including on-site visits, regarding credit ratings or credit rating activities carried out in non-EU branches; b) ESMA will assess the need to enter into cooperation arrangements with the local competent regulators to ensure the adequate supervision of branches located outside the Union; c) prior to establishing branches in third countries, credit rating agencies should ensure that those branches will abide immediately with any request set forth by the officials of ESMA in the exercise of powers pursuant to Articles 23b to 23d of the CRA Regulation, including granting of access to premises, systems and resources in case of on-site inspections and investigations. VII. Specific disclosure recommendations for best practice relating to Art. 16 (1) of ESMA Regulation 20. ESMA recommends as a best practice that credit scoring firms and CRAs that distribute credit scores to the public in the Union should provide clear and prominent disclosure that those scores are not credit ratings issued in accordance with the CRA Regulation. ESMA recommends that this disclosure should be provided also by export credit agencies that act under Article 2(2)(c) of the Regulation. 21. ESMA recommends as a best practice that where credit scoring firms and export credit agencies decide to publish such information, they should retain full responsibility for the disclosure indicated in the previous paragraphs when their credit scores or ratings are distributed to the public in the territory of the Union via agreement with third parties. 22. Credit scores or ratings are distributed to the public in the EU when they are disclosed to an undetermined or undeterminable generality of individuals domiciled in the EU for instance, through a press release. Credit scores or ratings are also distributed to the public when they are issued through a website registered with a domain corresponding to one of the Member States of the EU. VIII. Enforcement of the rules concerning the scope of the CRA Regulation 23. ESMA shall impose periodic penalty payments in order to compel the credit rating agency to put an end to the infringement of issuing credit ratings without being registered by ESMA, and impose

8 fines where appropriate, in accordance respectively with Articles 36(b) and 36(a) of the CRA Regulation. 24. Where a NCA or a SCA receives an application, request for information, or any other form of inquiry concerning the CRA Regulation, including on registration or certification, the Authority should immediately notify ESMA and refer the financial market participant that has submitted the request to ESMA as the sole competent supervisory authority in the Union.