Master Circular for ESG Rating Providers

MASTER CIRCULAR FOR ESG RATING PROVIDERS
SEBI/HO/DDHS/POD2/P/CIR/2023/ 121 July 12, 2023

To,
All Registered ESG Rating Providers,
All Listed Entities,
All Recognized Stock Exchanges,
All Registered Depositories
Madam / Sir,
Subject: Master Circular for ESG Rating Providers (“ERPs”)
I. ESG Rating Providers are regulated under the provisions of Securities and
Exchange Board of India (Credit Rating Agencies) Regulations, 1999 (“CRA Regulations” as amended with effect from July 4, 2023) that inter-alia prescribe guidelines for registration of ERPs, general obligations of ERPs, manner of inspection and code of conduct applicable to ERPs.
II. While the broad framework for ERPs has been laid down in the CRA Regulations,
the procedural / disclosure requirements and obligations are being specified through this master circular, which will enable the industry and other users to have access to all the applicable directions to ERPs at one place.
III. ERPs are directed to comply with the conditions laid down in this master circular.
Also, ERPs shall have necessary systems and infrastructure in place for implementation of this circular. The Board of Directors of the ERP shall be responsible for ensuring compliance with these provisions.
IV. This circular is issued in exercise of the powers conferred by Section 11 (1) of
Securities and Exchange Board of India Act, 1992 read with the provisions of Regulation 28H of CRA Regulations, to protect the interest of investors in

securities, to promote the development of, and to regulate, the securities market.
V. Applicability: The provisions of the Master Circular shall come into force with
immediate effect from the date of notification of this Master Circular. For the purpose of this Circular, “listed entity” shall have the same meaning as provided in Regulation 2(1)(p) of Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) Regulations, 2015.
VI. Monitoring: Monitoring of provisions of this circular shall be done in terms of the
yearly internal audit for ERPs, mandated under Regulation 28S of the CRA Regulations and this master circular issued thereunder.
VII. This Circular is being issued with the approval of Competent Authority.
VIII. This Circular is available on SEBI website at www.sebi.gov.in under “Legal
Framework”.
Yours faithfully,
Ritesh Nandwani
Deputy General Manager
Department of Debt and Hybrid Securities
Tel No. 022-2644-9696
Email ID - riteshn@sebi.gov.in

Table of Contents
Chapter I : Registration, Approval and Surrender Requirements....................................5
Registration Mechanism for ESG Rating Providers .................................................5
Grant of Prior approval for change in control of ERPs.............................................6
Transfer of business by SEBI registered intermediaries to other legal entity...........8
Guidelines on Suspension, Cancellation or Surrender of Certificate of Registration:
....................................................................................................................................9
Chapter II : Rating Operations...........................................................................................13
Type of ESG Ratings / Scores...............................................................................13
Rating Scale ..........................................................................................................16
Other Activities by ESG Rating Providers..............................................................16
Business Model .....................................................................................................17
Rating Process ......................................................................................................17
Monitoring and Review of Ratings .......................................................................19
Rating Rationale ..................................................................................................20
Provisions applicable to ERPs following an issuer-pays business model............21
Withdrawal of ratings ...........................................................................................24
Request by Issuers for review/appeal of ratings provided by ERPs ....................24
Governance Norms of ERPs ...............................................................................25
Accountability of Rating Analysts of ERPs...........................................................25
Dealing with Conflict of interest ...........................................................................25
Guidelines on listed securities/instruments/products falling under the purview of
other financial sector regulator/s or authority/ies’ ......................................................28
Chapter III : Reporting and Disclosures ...........................................................................29
Periodic Disclosures ............................................................................................29
Continuous Disclosures .......................................................................................31
Guidelines on manner of disclosures by ERPs on its website: ............................32
Chapter IV : Internal Audit for ERPs .................................................................................34
Internal Audit for ERPs: .......................................................................................34

Requirements related to Internal Audit of ERPs: .................................................34
Chapter V : Miscellaneous.................................................................................................37
Designated e-mail ID for regulatory communication with SEBI:...........................37
Information regarding Grievance Redressal Mechanism:....................................37
Guidelines on Outsourcing of Activities by ERPs ................................................38
General Guidelines for dealing with Conflicts of Interest of ERPs and their
Associated Persons in Securities Market:..................................................................38
Standardization of Industry classification - Applicability to ERPs.........................40
Firewall between ERPs and their Affiliates: .........................................................41
Annexures...........................................................................................................................42

Chapter I : Registration, Approval and Surrender Requirements
Registration Mechanism for ESG Rating Providers
1.1. SEBI has operationalized SEBI Intermediary Portal (https://siportal.sebi.gov.in) for
the intermediaries to submit all the registration applications online. The SEBI Intermediary Portal shall include online application for registration, processing of application, grant of final registration, application for surrender / cancellation, submission of periodical reports, requests for change of name/ address/ other details, etc., Link for SEBI Intermediary Portal is also available on SEBI website – www.sebi.gov.in.
1.2. All applications for registration/ surrender/other requests will be made through
SEBI Intermediary Portal. The applicants will be separately required to submit relevant documents viz. declarations/ undertakings required as a part of application forms prescribed in relevant regulations, in physical form, for records without impacting the online processing of applications for registration. In case of any queries and clarifications with regard to the SEBI Intermediary Portal, intermediaries may contact on 022-26449364 or may write at portalhelp@sebi.gov.in.
1.3. However, till operationalisation of SEBI Intermediary Portal for ERPs, an entity
desirous of registering with SEBI as an ESG rating provider may file an application with SEBI, as per the format prescribed in CRA Regulations, along with the application fees and relevant documents, in hard copy, addressed to "Chief General Manager, Department of Debt and Hybrid Securities, SEBI", as well as in soft copy, via email to erp@sebi.gov.in. The same process shall also apply for submission of periodical reports, requests for change of name / address / other details, etc.
1.4. Fees and other charges payable to SEBI are subject to Goods and Services Tax
(GST) that is at present 18%.

Grant of Prior approval for change in control of ERPs
2.1. As per Regulation 28H(c) of CRA Regulations, all registered ERPs are required to
obtain prior approval of SEBI in case of change in control.
2.2. To streamline the process of providing approval to the proposed change in control
of an ERP (hereinafter referred to as intermediary or applicant), the following is mandated:
2.2.1. An ERP shall make an application to SEBI for prior approval through the
SEBI Intermediary Portal (https://siportal.sebi.gov.in). However, till operationalisation of SEBI Intermediary Portal for ERPs, an ERP may submit such application, in hard copy, addressed to "Chief General Manager, Department of Debt and Hybrid Securities, SEBI", as well as in soft copy, via email to erp@sebi.gov.in.
2.2.2. The abovementioned application by an ERP shall be accompanied by the
following information/ declaration/ undertaking about itself, the acquirer(s) / the person(s) who shall have the control and the directors/ partners of the acquirer(s) / the person(s) who shall have the control:
2.2.2.1. Current and proposed shareholding pattern of the applicant
2.2.2.2. Whether any application was made in the past to SEBI seeking
registration in any capacity but it was not granted? If yes, details thereof.
2.2.2.3. Whether any action has been initiated / taken under the Securities
Contracts (Regulation) Act, 1956 (SCRA) / Securities and Exchange Board of India Act, 1992 (SEBI Act) or rules and regulations made thereunder? If yes, status thereof along with the corrective action taken to avoid such violations in the future. The acquirer/ the person who shall have the control shall also confirm that it shall honour all past liabilities / obligations of the applicant, if any.
2.2.2.4. Whether any investor complaint is pending? If yes, steps taken and
confirmation that the acquirer/ the person who shall have the control shall resolve the same.

2.2.2.5. Details of litigation, if any.
2.2.2.6. Confirmation that all the fees due to SEBI have been paid.
2.2.2.7. Declaration cum undertaking of the applicant and the acquirer / the
person who shall have the control (in a format enclosed at Annexure 1), duly stamped and signed by their authorized signatories that:
a. That there will not be any change in the Board of Directors of incumbent, till the time prior approval is granted; b. Pursuant to the grant of prior approval by SEBI, the incumbent shall inform all its existing investors / clients about the proposed change prior to effecting the same, in order to enable them to take informed decision regarding their continuance or otherwise with the new management; and
c. The ‘fit and proper person’ criteria as specified in Schedule II of SEBI
(Intermediaries) Regulations, 2008 are complied with.
2.2.3. The prior approval granted by SEBI shall be valid for a period of six months
from the date of such approval within which the applicant shall file application for fresh registration pursuant to change in control.
2.2.4. If the ERP has rated any product or issuer, which falls within the ambit of
another regulator or authority, as specified at Para 5.5, then such ERP shall obtain approval/ NOC from such regulator or authority and submit a selfattested copy of the same to SEBI along with the request for change in control. If the ERP has not handled any such product or issuer, it shall provide a confirmation to that effect.
2.3. To streamline the process of providing approval to the proposed change in control
of an intermediary in matters which involve scheme(s) of arrangement which needs sanction of the National Company Law Tribunal (“NCLT”) in terms of the provisions of the Companies Act, 2013, the following shall be applicable:
2.3.1. The application seeking approval for the proposed change in control of the
intermediary shall be filed with SEBI prior to filing the application with NCLT.

2.3.2. Upon being satisfied with compliance of the applicable regulatory
requirements, an in-principle approval will be granted by SEBI;
2.3.3. The validity of such in-principle approval shall be three months from the date
issuance, within which the relevant application shall be made to NCLT.
2.3.4. Within 15 days from the date of order of NCLT, the intermediary shall submit
an online application in terms of paragraph 2.2 of this circular along with the following documents to SEBI for final approval:
2.3.4.1. Copy of the NCLT Order approving the scheme;
2.3.4.2. Copy of the approved scheme;
2.3.4.3. Statement explaining modifications, if any, in the approved scheme visà-vis the draft scheme and the reasons for the same; and
2.3.4.4. Details of compliance with the conditions/ observations, if any,
mentioned in the in-principle approval provided by SEBI.
Transfer of business by SEBI registered intermediaries to other legal entity
3.1. SEBI has been receiving registration applications pursuant to transfer of business
(SEBI regulated business activity) from one legal entity which is a SEBI registered Intermediary (transferor) to other legal entity (transferee). In this regard, following is clarified:
3.1.1. The transferee shall obtain fresh registration from SEBI in the same capacity
before the transfer of business if it is not registered with SEBI in the same capacity. SEBI shall issue new registration number to transferee different from transferor’s registration number in case business is transferred through regulatory process (pursuant to merger / amalgamation / corporate restructuring by way of order of primary regulator /government / NCLT, etc.) or non-regulatory process (as per private agreement /MOU pursuant to commercial dealing / private arrangement) irrespective of transferor continues to exist or ceases to exist after the said transfer.
3.1.2. In case of change in control pursuant to both regulatory process and nonregulatory process, prior approval and fresh registration shall be obtained.
While granting fresh registration to same legal entity pursuant to change in control, same registration number shall be retained.

3.1.3. If the transferor ceases to exist, its certificate of registration shall be
surrendered.
3.1.4. In case of complete transfer of business by transferor, it shall surrender its
certificate of registration.
3.1.5. In case of partial transfer of business by transferor, it can continue to hold
certificate of registration.
Guidelines on Suspension, Cancellation or Surrender of Certificate of Registration:
4.1. In order to facilitate orderly migration of ESG ratings pursuant to cancellation,
suspension, or surrender of certificate of registration of an ERP to another SEBIregistered ERP, the following are hereby prescribed, subject to the requirements of corresponding cancellation or suspension order(s) passed by SEBI (“the Order”), if any:
4.1.1. On and from the date of the Order, or the date of submission of request for
surrender of certificate of registration (“the Request”) to SEBI, as applicable, the concerned ERP shall –
4.1.1.1. disclose prominently on its website, the Order or the Request, as the
case may be, and communicate the same to its clients within 15 days of the Order or the Request;
4.1.1.2. not take any new clients or fresh mandates;
4.1.1.3. allow its clients to withdraw any assignment given to the ERP, without
any additional cost to such clients;
4.1.1.4. facilitate an orderly migration of assignments as desired by clients to
other ERP(s) holding a certificate of registration under CRA Regulations;
4.1.1.5. continue to comply with the provisions of the CRA Regulations and
circulars issued thereunder, till the time the ERP holds the certificate of registration;
4.1.1.6. continue to co-operate with SEBI with regard to sharing of information
when requested and payment of fees as required under CRA Regulations;
4.1.1.7. take such other action including providing any records or documents

within the time period and in the manner, as may be required under the CRA Regulations or as may be directed by SEBI.
4.1.2. The ERP, on and from the date of acceptance of the Request, or when it is
commencing the winding up process, shall:
4.1.2.1. return the certificate of registration so cancelled to SEBI;
4.1.2.2. not represent itself to be a holder of certificate for carrying out the activity
for which such certificate had been granted;
4.1.2.3. suspend undertaking activity for which such certificate had been
granted;
4.1.2.4. until it is wound up, continue to co-operate with SEBI on matters
pertaining to the activities of the ERP undertaken by it till it held the certificate of registration under CRA Regulations;
4.1.2.5. make provisions as regards liability incurred or assumed by it;
4.1.2.6. until it is wound up, take such other action including providing any
records or documents within the time period and in the manner, as may be required under the CRA Regulations or as may be directed by SEBI
4.1.3. Additionally, in case of suspension of the certificate of registration, the ERP,
during such period of suspension, shall –
4.1.3.1. suspend undertaking activity for which such certificate of registration
had been granted;
4.1.3.2. continue to co-operate with SEBI on matters pertaining to the activities
of the ERP undertaken by it under CRA Regulations;
4.1.3.3. make provisions as regards liability incurred or assumed by it;
4.1.3.4. take such other action including providing any records or documents
within the time period and in the manner, as may be required under the CRA Regulations or as may be directed by SEBI.
4.1.4. In case of cancellation of certificate of registration, the ESG ratings assigned
by the ERP shall be valid till such time the client withdraws the assignment and/or migrates the assignment to another ERP as specified or the ERP is wound-up, whichever is earlier.

4.1.5. Surrender of Certificate of Registration
4.1.5.1. If an ERP wishes to surrender the registration voluntarily, it shall
transfer, wherever relevant, its existing business/ client accounts to another SEBI registered intermediary, before it makes a request to SEBI for accepting the surrender of the certificate of registration.
4.1.5.2. If, at the time of request for surrender of certificate, the ERP has any
outstanding rating of any product or issuer, which falls within the ambit of another regulator or authority, as specified at Para 5.5, then such ERP shall obtain approval/ NOC from such regulator or authority and submit a self-attested copy of the same to SEBI along with the request for surrender of certificate. If the ERP does not have any outstanding rating of any such product or issuer, it shall provide a confirmation to that effect.
4.1.5.3. The ERP may, if it so desires, make a representation for dispensing with
the procedure, along with the application, for surrender in terms of the first proviso to Regulation 33B of Securities and Exchange Board of India (Intermediaries) Regulations, 2008 in the prescribed format placed as Annexure 2.
4.1.5.4. In all cases of transfer of business or client accounts to another
registered intermediary, the clients shall not be subjected to any additional cost.
4.1.5.5. ERP shall maintain its records, documents, information obtained from
its clients during the course of ESG rating from its clients, for at least three years after surrender of registration.
4.1.5.6. In its application to SEBI, the ERP shall also provide an undertaking that
it shall continue to maintain confidentiality of the data obtained by it from its existing clients for the purpose of ESG rating, unless asked to share such information by operation of law.
4.1.6. In case of surrender of certificate of registration, the ESG ratings assigned
by the ERP whose certificate of registration is being surrendered, shall be valid till such time the client withdraws the assignment and/or migrates to

another ERP, or the date of acceptance of surrender by SEBI, whichever is earlier.
4.1.7. In case of suspension of certificate of registration, the ESG ratings assigned
by the ERP, whose certificate of registration is suspended, shall not be valid during the period of suspension.
4.1.8. Upon cancellation or surrender or suspension of certificate of registration of
an ERP, the concerned ERP’s services cannot be used by listed entities or issuers for compliance with requirements of various SEBI regulations which require ESG ratings from an ERP registered with SEBI.
4.1.9. Listed entities or issuers who have obtained ESG rating from an ERP whose
registration is cancelled or suspended or surrendered, desirous of obtaining ESG rating for regulatory purposes, shall obtain ESG rating(s) from other SEBI-registered ERP(s) holding a valid certificate of registration under CRA Regulations.

Chapter II : Rating Operations
Type of ESG Ratings / Scores
5.1. CRA Regulations define “environmental, social, and governance ratings”, or “ESG
ratings” as the rating products that are marketed as opinions about an issuer or a security, regarding its ESG profile or characteristics or exposure to ESG risk, governance risk, social risk, climatic or environmental risks, or impact on society, climate and the environment, that are issued using a defined ranking system of rating categories, whether or not these are explicitly labelled as “ESG ratings”. In this regard, ESG rating or score have been treated interchangeably in this circular. Any reference to ratings in this circular shall refer to ESG ratings, unless stated otherwise.
5.2. An ERP shall offer at least the following ESG rating products:
5.2.1. ESG Rating
5.2.2. Transition or Parivartan Score
5.2.3. Combined Score
5.2.4. Core ESG Rating
5.2.5. Core Transition or Parivartan Score
5.2.6. Core Combined Score
5.3. An ERP may provide additional ESG rating products subject to compliance with
relevant provisions of the CRA regulations and circulars issued thereunder.
5.4. Further, the following is clarified:
5.4.1. If in any of the ESG rating products referred to at Para 5.2.1-5.2.3, the ERP
relies only on third-party assured parameters, then the ERP shall not be required to provide separate ESG rating products referred to at Para 5.2.4- 5.2.6, respectively, or a non-core variant thereof. For instance, if an ERP’s transition scoring is based only on third-party assured data, the ERP shall not be required to provide a separate product

called “Core Transition Score” or another separate product for transition score based on non-assured data.
5.4.2. If an ERP incorporates transition assessment in its ESG ratings or Core ESG
ratings, then the ERP shall not be required to separately offer Combined Score or a Core Combined Score (Para 5.2.3 and Para 5.2.6 above) respectively.
5.4.3. However, in the above cases, such ERP must disclose the said facts in ESG
rating rationales and ESG rating methodologies.
5.5. The above six ESG rating products shall:
5.5.1. suitably incorporate the environmental, social and governance aspects that
are contextual to the Indian market. An indicative list of India-specific ESG parameters is placed at Annexure 3.
5.5.2. be assigned such that they allow comparison with companies in other
sectors, i.e., such rating products must contain sector-agnostic ESG ratings.
5.5.3. adhere to guidelines specific to the rating product as detailed below in this
circular.
5.6. Transition or Parivaratan Score
5.6.1. It is observed that various Indian companies may be rated on their current
emission levels as they begin to align their strategies with India’s commitment of emissions intensity reduction to Net Zero by 2070, despite substantial reduction year on year.
5.6.2. Evaluating Indian corporates on an absolute yardstick without recognizing
the efforts they make, and results they achieve, in transition may not lead to the appropriate incentives for transition finance.
5.6.3. Hence, ESG rating providers shall provide two additional ratings:
5.6.3.1. ESG Transition or Parivartan score: measuring the velocity of and
investments in making the transition to Net Zero Goals/improving ESG risk management. In other terms, the transition or Parivartan score would reflect the incremental changes that the company has made in its

transition story over recent years or concrete plans/targets to address the risk and opportunities involved in transitioning to more sustainable operations, rather than scoring them only on their current profile. This transition score could track changes in quantitative metrics in trend-lines or change in revenues from environmental/social services and products or any quantitative assessments, as per the model of the ERP.
5.6.3.2. Combined Score: incorporating ESG rating and transition rating, i.e.,
measuring both the status and the ability to transition shall also be provided. A combined score shall be determined in the following manner:
ESG Score + Transition or Parivartan Score = Combined Score Note: The “+” symbol does not denote a simple addition of the two scores. An ERP shall be free to combine the two scores in a way that is consistent with its publicly-disclosed rating methodology.
5.7. Core ESG Rating
5.7.1. ERPs shall provide a rating called the “Core ESG Rating” that shall be based
on third-party assured or audited data disclosed by the Company.
5.7.2. Further, core ESG rating rationales may contain an additional commentary /
observations on data that may not be verified/ assured by a third-party. The same ensures that unverified data is not included in core ESG rating, but at the same time, users of core ESG rating are made aware of the unverified information as well, based on which they may take any action as they deem appropriate.
5.7.3. Further, a Core Combined score incorporating Core ESG rating and Core
transition rating, i.e., measuring both the status and the ability to transition shall also be provided. A Core Combined score shall be determined in the following manner:
Core ESG Score + Core Transition or Parivartan Score = Core Combined Score

Note: The “+” symbol does not denote a simple addition of the two scores. An ERP shall be free to combine the two scores in a way that is consistent with its publicly-disclosed rating methodology.
5.7.4. Core ESG rating, Core Transition or Parivartan Score, and Core Combined
Score shall be offered by an ERP pursuant to availability of ‘Business Responsibility and Sustainability Report (BRSR) Core’ for the rated entity. Rating Scale
6.1. In the interest of clarity to market participants, it is mandated that ESG ratings shall
be provided on a scale of 0 – 100, where 100 represents the maximum score.
6.2. For existing outstanding ESG ratings, the ERPs shall disclose new rating symbols
and definitions on their websites and update their rating lists on their websites;
6.3. For various ESG rating products (ESG rating, core ESG rating, transition or
Parivartan score, other ESG rating products), ERPs shall ensure use of suitable nomenclature (use of prefixes or suffixes, etc.) that enables the end user(s) to differentiate ESG rating products from each other. Other Activities by ESG Rating Providers
7.1. CRA Regulations allow ERPs to undertake or offer ESG rating of any product or
issuer, as may be required by another financial sector regulator or authority, as may be specified by SEBI, under the guidelines of such regulator or authority. In this regard, the following is being specified:
7.1.1. A list of financial sector regulators/ authorities has been specified at
Annexure 4.
7.1.2. ERPs may also undertake research activities, incidental to ESG rating, such
as research for economy, environment and ecology, society and social issues, industries and companies.

7.2. Client-group level segregation for ESG ratings and/or green debt certifications –
7.2.1. For the purpose of this provision, client group shall include the client
company of an ERP and all the group companies of such client of the ERP.
7.2.2. For any client group, an ERP shall only offer one of the following two product
categories (i) ESG ratings/ certification of green debt securities or (ii) audit of financial statements / assurance of sustainability disclosures.
7.2.3. In case an ERP wishes to migrate from offering ESG ratings/ green debt
certification to offering audit/assurance to a client-group, or vice versa, a cooling period of one year shall be applicable. Business Model
8.1. ERPs shall follow either of the following two business models:
8.1.1. “Subscriber-pays” business model, where the ERP derives its revenues
from ESG ratings from subscribers that may include banks, insurance companies, pension funds, or the rated entity itself.
8.1.2. “Issuer-pays” business model, where the ERP derives its revenues from
ESG ratings from the rated entity, in terms of a written contractual agreement between such entity and the ERP, which may contain such provisions as may be specified by SEBI.
8.2. In order to mitigate potential conflict of interests, it is mandated that ERPs shall not
follow a hybrid business model, i.e. an ERP shall not assign certain ESG rating based on issuer-pay model, while assigning another ESG rating based on a subscriber-pays business model. Rating Process
9.1. Each ERP shall frame detailed guidelines on the following and disclose the same
on its website:
9.1.1. General nature of compensation arrangements with rated entities
9.1.2. Policy for request for review/appeal by Issuer against the rating being
assigned to its securities

9.1.3. Guidelines on what constitutes non-cooperation, in case of ERPs following
an issuer-pays business model.
9.1.4. Gift policy
9.1.5. Confidentiality policy
9.1.6. Policy on outsourcing of activities
9.1.7. FAQs on ratings
9.1.8. Disclosure on managing conflict of interest
9.2. Any change in the rating process or policies shall be disclosed on the ERP's
website, while also providing a reference/ hyperlink to the original provision/ process/ policy, to enable the investors to discern the changes made to the same.
9.3. An ERP shall keep the records in support of each ESG rating and review/
surveillance thereof, as applicable, including but not limited to the following:
9.3.1. The important factors underlying the ESG rating and sensitivity of such ESG
rating to changes in these factors;
9.3.2. Summary of discussions and copies of correspondences with the issuer, its
management, auditors and bankers which have a bearing on the ESG rating, as applicable;
9.3.3. If a quantitative model is a substantial component of the ESG rating process,
the rationale for any material difference between the ESG rating implied by the model and the ESG rating actually assigned;
9.4. The above records should be maintained as follows and be made available to
auditors and regulatory bodies when sought by them:
9.4.1. ESG rating of listed entities: Records to be maintained at all times. However,
upon withdrawal of ESG rating, records to be maintained till 5 years from the date of withdrawal.
9.4.2. ESG rating of listed securities: Records to be maintained till 5 years from
date of maturity of such securities. However, upon withdrawal of ESG rating, records to be maintained till 5 years from the date of withdrawal.

9.5. During the rating process, ERPs shall record minutes of the meeting with issuer
management, if any.
9.6. The process of discussion of case by circulation must be avoided, unless there is
urgency in taking a rating action.
9.7. The ERP shall, on an annual basis, undertake a review of the decisions taken by
it in that year, which would, inter alia, include:
9.7.1. ESG Ratings assigned by the ERP, including ratings assigned based on best
available information in cases of non- cooperation by the issuer.
9.7.2. Sharp changes in ratings.
9.8. The ERPs shall at all times observe high standards and fairness in conduct of the
business and any act of omission or commission in contravention of the provisions of clauses 12 and/or 23 of Code of Conduct, as specified under Seventh Schedule of the CRA Regulations, in letter and spirit, may result in violation of the provisions of section 12A of the Securities and Exchange Board of India Act,1992 and SEBI (Prohibition of Fraudulent and Unfair Trade Practices relating to Securities Market) Regulations, 2003. Monitoring and Review of Ratings
10.1. Material Events requiring a review
10.1.1. Regulation 28L(g) of CRA Regulations require an ERP to have efficient
systems to track material developments related to environmental, social and governance factors to ensure timely and accurate ESG ratings.
10.1.2. Material developments in this respect shall be any event that results in a
change of the ESG profile of the rated company. Such material developments shall include, but not be restricted to, publication of Business Responsibility and Sustainability Reporting (BRSR) or controversy/ penalty in environmental, social or governance areas.

10.1.3. ERPs shall carry out a review of the ESG ratings upon the occurrence of or
announcement/ news of such material developments, and immediately, but not later than 10 days of occurrence of the said event. Rating Rationale
11.1. ESG rating providers generally follow either a subscription-based business model
or an issuer-pays business model. In either of the case, there is an ESG rating rationale or a report containing ESG rating of an entity, along with a detailed rationale behind the assigned ESG rating.
11.2. It is essential that the ESG rating rationale be articulated in detail to enable a
stakeholder to assess the reasons behind an assigned ESG rating. This is further necessitated by the oft-occurring divergence in ESG ratings across providers.
11.3. Therefore, in order to provide for greater transparency in the ESG rating process,
it is proposed that the ESG rating rationale/ ESG report may contain the following minimum disclosures:
11.3.1. Current ESG rating/score
11.3.2. Change in rating/score from the previous evaluation (direction)
11.3.3. Last review date
11.3.4. Summary of key drivers both qualitative (including controversies and their
impact) and quantitative factors considered for arriving at the overall ESG rating
11.3.5. Pillar wise E, S and G scores – key drivers (including industry comparison of
material parameters) both quantitative and qualitative being considered for carrying out such assessment
11.3.6. Weights of E, S and G scores in the assigned ESG rating
11.3.7. Brief explanation of rating intent to clarify if it represents unmanaged risks/
performance against risks/ impact etc. In case this is available in a methodology document, cross-linking of the relevant document would suffice
11.3.8. Summary of or link to methodology used.
11.4. Disclosure of rating sensitivities in the rating rationale

11.4.1. The disclosure of factors to which the rating is sensitive, is critical for the
end- users to understand the factors that would have the potential to impact the ESG profile of the entity.
11.4.2. Accordingly, in order to improve transparency, the ERP shall have a specific
section on ‘Rating Sensitivities’ in the Rating Rationale which shall explain
the broad level of environmental and/ or social and/or governance performance levels that could trigger a rating change, upward and downward.
11.4.3. Such factors shall be disclosed in quantitative terms to the extent possible,
discernible to the investors, and should not read like a general risk factor. Provisions applicable to ERPs following an issuer-pays business model
12.1. Rating Agreement between issuer and ERP:
12.1.1. The ERP shall enter into a written agreement with each client who (or whose
securities) the ERP proposes to rate, and such agreement shall include the following provisions, namely:
12.1.1.1. the rights and liabilities of each party in respect of the ESG rating shall
be defined;
12.1.1.2. the fee to be charged by the ERP shall be specified;
12.1.1.3. the client shall co-operate with the ERP in order to enable the latter to
carry out periodic review of the ESG rating during the tenure of the rated instrument or validity of ESG rating;
12.1.1.4. the client shall co-operate with the ERP in order to enable the latter to
arrive at, and maintain, a true and accurate ESG rating of the client or clients securities and shall in particular provide to the latter, true, adequate and timely information for the purpose.
12.1.1.5. the ERP shall disclose to the client the ESG rating assigned to the latter
(or its securities) through regular methods of dissemination;
12.1.1.6. The client (issuer) agrees to disclose the history and status (noncooperation, non-payment of fees etc.) of previous rating relation with
the earlier ERP(s) to the new ERP along with reasons for non-

cooperation, etc. if applicable."
12.1.1.7. The client (issuer) agrees to provide the information sought by the ERP
immediately, but not later than 7 days from the date of seeking such information by the ERP.
12.1.2. ERPs following an issuer-pays business model shall refrain from giving
Indicative Ratings without having a written agreement in place. In case such Indicative Ratings are provided by the ERP, it shall be considered as aiding and abetting the Issuer in suppression of material information by the ERP which would be in contravention of Clause 12 of Code of Conduct of ERPs and may result in violation of the provisions of section 12A of the Securities and Exchange Board of India Act, 1992 and SEBI (Prohibition of Fraudulent and Unfair Trade Practices relating to Securities Market) Regulations, 2003 by the ERP.
12.2. Issuer-Not-Cooperating:
12.2.1. Regulation 28M provides that if the rated issuer or the issuer whose
securities are rated by the ERP refuses to co-operate with the ERP regarding review of the ESG rating, despite being under a contractual obligation to do so, the ERP shall review the ESG rating on the basis of the best available information.
12.2.2. In case of non-cooperation by the issuer (such as not providing information
required for rating, non-payment of fees for conducting surveillance), in line with the existing Regulations, the ERP shall continue to review the ESG rating, on an ongoing basis throughout the rating’s lifetime, on the basis of best available information, in accordance with CRA Regulations and circulars issued thereunder as well as the ERP’s ESG rating process and policies.
12.2.3. ERPs shall have a detailed policy in this respect which shall include (but not
be limited to) the following:

12.2.3.1. The criteria/ methodology in respect of assessing the risk of nonavailability of information from the issuers including non-cooperative
issuers.
12.2.3.2. The steps to be taken under various scenarios in order to ascertain the
status of non-cooperation by the issuer company.
12.2.4. ERPs shall also formulate a policy on “Minimum/ Indicative Information
requirement” in terms of various sectors or types of ratings (limited to ESG ratings of securities that are listed, or proposed to be listed, on a recognized stock exchange, and other ESG ratings that are required under various SEBI Regulations or circulars issued thereunder), etc. and disclose it on their website.
12.2.5. In case of non-cooperation by the issuer, the ESG rating symbol shall be
accompanied by the suffix “ISSUER NOT COOPERATING*”in the same font size. The suffix shall be explained below and shall read as ‘Issuer did not cooperate; based on best available information’.
12.2.6. Information to be disclosed through the Rating Rationale: The rating
action(s) in such cases shall be promptly disclosed through rating rationale(s), which shall mention, at least, the following:
12.2.6.1. Date of the Rating Rationale
12.2.6.2. Details of security / entity
12.2.6.3. Rating Action and Indicative/updated rating based on best available
information
12.2.6.4. A brief write-up on the non-co-operation by the Issuer/ Borrower and the
consistent follow-up done by the ERP for getting the information.
12.2.6.5. Hyperlink/ reference to the applicable "Criteria"
12.2.6.6. Limitations regarding information availability (shall have a suitable
caveat cautioning the investors/lenders /public)
12.2.6.7. Rating History for last three years
12.2.6.8. Name and contact details of the Rating Analyst(s)

12.2.7. In case an issuer, having not co-operated with an ERP in the past,
approaches another ERP, following an issuer-pays business model, for ESG rating, the new ERP shall, in its Rating Rationale, disclose the aspect of nonco-operation.
12.2.8. No ERP, following an issuer-pays business model, shall assign any new
ratings to an issuer, if the issuer is categorized as non-cooperative with all the ERPs for a continuous period of preceding 12 months, until the issuer resumes cooperation or the rating is withdrawn. Withdrawal of ratings
13.1. Regulation 28M of CRA regulations prescribe, inter-alia, that an ERP shall not
withdraw an ESG rating except in cases where the rated issuer, or the issuer whose security is rated, is wound up or merged or amalgamated with another company, or except in cases as may be specified by SEBI from time to time. Further, subject to CRA Regulations, ERP shall withdraw an ESG rating as per its documented policies which shall also be disclosed on its website. In this regard, an ERP shall adhere to the provisions of this circular in withdrawal of any ESG rating.
13.2. Rating Rationale for Withdrawal of Rating of a rated entity/ security: At the time of
withdrawal of any ESG rating of entities/securities that are listed, or proposed to be listed, on a recognized stock exchange, and other ESG ratings that are required under various SEBI Regulations or circulars issued thereunder, the ERP shall assign a rating to such entity/security and issue a rating rationale, which shall also mention the reason(s) for withdrawal. Request by Issuers for review/appeal of ratings provided by ERPs Cases of request by an issuer for review/appeal of the ESG rating(s) provided to it or its security/ies shall be reviewed by a team/ panel that shall consist of majority of members that are different from those involved in the assignment of the earlier ESG rating, and at least one-

third of members are independent. ("Independent" would mean people not having any pecuniary relationship with the ERP or any of its employees). Governance Norms of ERPs
15.1. MD/ CEO of an ERP and any person within ERP who has business responsibility
shall not interfere in the determination of ESG rating.
15.2. At least one third of the board of an ERP shall comprise of independent directors,
if the board is chaired by a non-executive director. In case the board of the ERP is chaired by an executive director, at least half of the board shall comprise of independent directors.
15.3. The board of an ERP shall constitute the following committees:
15.3.1. ESG Ratings Sub-Committee
15.3.2. Nomination and Remuneration Committee
15.4. The Rating team of an ERP shall report to a Chief Ratings Officer (CRO).
15.5. The Chief Ratings Officer (CRO) shall directly report to the ESG Ratings SubCommittee of the board of the ERP.
15.6. The Nomination and Remuneration Committee shall be chaired by an independent
director.
Accountability of Rating Analysts of ERPs
16.1. Roles and responsibilities of the ESG rating analysts/team of ERPs shall be clearly
laid out by the ERP.
16.2. Analysts or other members of the ESG rating team shall be responsible for
undertaking the ESG rating process and adhering to the timelines as specified by the ERP. Dealing with Conflict of interest
17.1. An ERP shall formulate the policies and internal codes for dealing with the conflict
of interest.
17.2. An ERP shall ensure:

17.2.1. that its analysts do not participate in any kind of marketing and business
development including negotiations of fees with the issuer who is being rated or whose securities are being rated,
17.2.2. that the employees’ involved in the ESG rating process and their dependents
do not have ownership of the shares of the issuer.
17.2.3. prompt review of the ESG ratings of the entities/securities as and when any
of its employees joins the respective issuer.
17.3. Guidelines for dealing with Conflict of Interest for investment/ trading by ERPs,
Access Persons and other employees
17.3.1. These Guidelines shall be applicable in case of investment / trading by ERPs
and Access Persons connected to ERPs and in case of disclosures to all employees of ERPs.
17.3.2. Explanation: "Access Persons" means officials of ERP appointed as Chief
Executive or by any other designation (such as CEO/MD/President or by whatever name called who are performing functions similar to those of the Chief Executive), the employees of ERP doing the function of analyst, or compliance, or heads of the departments or divisions or any other employee as decided by ERP.
17.3.3. These guidelines shall cover transactions for purchase or sale of securities
either individually or jointly or in the name of their dependents or as a member of HUF.
17.3.4. With a view to adopting best industry practices and systems by ERPs for
managing conflict of interest in case of investment/ trading in securities (except schemes of Mutual Funds) done by ERPs or their Access Persons as defined hereunder, the following guidelines, framed in consultation with ERPs are laid down:
17.3.4.1. ERPs shall adopt adequate systems, procedures and policies to ensure
that they address conflict of interest while making their own investments in securities.
17.3.4.2. The ERPs, their employees and Access Persons shall not take undue
advantage of any price sensitive information that they may have about any company.

17.3.4.3. Access Persons to seek prior approval for transactions
a. An Access Person shall apply to the Compliance Officer for prior approval of transactions for purchase or sale of securities of the companies which have been rated by the ERP or whose securities/instruments/facilities have been rated by the ERP. b. The Compliance Officer of the ERP shall apply to the Chief Executive of the ERP for such prior approval.
c. The CEO/Compliance Officer shall ensure that there is no conflict of
interest while considering the request for prior approval. d. Such approvals, if granted, shall be valid for 7 working days from the date of approval.
17.3.4.4. Disclosures
a. Any person, who becomes an employee of the ERP, shall submit a statement of holding of all securities in respect of persons mentioned at para 17.3.2 above to the Compliance officer or Chief Executive, as the case may be, within 7 working days of joining ERP. b. All employees of ERP including the Access Persons shall submit the following details to the CEO/Compliance Officer, as the case may be:
i. Details of purchase or sale transactions effected within 7 working
days from the date of transaction.
ii. A consolidated statement of holding of all securities within 30
working days from the end of the Financial Year.
c. The members of the Rating Committee shall upfront declare /
disclose their interest, if any, to the Chief Executive Officer or Compliance Officer, as per the policy of the ERP, in the securities/instruments/facilities that are considered for rating by the ERP.
17.3.4.5. Restrictions on employees holding ownership of securities of the
issuer: An ERP shall ensure that employees involved in the rating process shall not have ownership of the securities of the issuer.

Guidelines on listed securities/instruments/products falling under the purview of other financial sector regulator/s or authority/ies’ Certain instruments/products/securities are regulated by other financial sector regulator/s or authority/ies and could be listed or unlisted. The issuers of such instruments/products/securities and any person connected therewith (such as ERPs) shall abide by the rules/regulations/directions/guidelines applicable to or governing such instruments/products/securities as prescribed by such financial sector regulator or authority whether such instruments/products/securities be listed or unlisted. Further, if such instruments/products/securities are listed on a Recognised Stock Exchange or provided to/availed by regulated entities or intermediaries within the Indian Securities Market, the rules/ regulations/ directions/ guidelines specified by SEBI from time to time shall be applicable.

Chapter III : Reporting and Disclosures
Periodic Disclosures
19.1. An ERP shall make all the disclosures stipulated below on their websites. In case
of listed entities/securities, the ERP shall also make disclosures to the stock exchanges as specified in the CRA Regulations. For ratings assigned and their periodic reviews, the ERP shall disclose ESG ratings on their websites. Where a specific format has been prescribed, the disclosures shall be made in that format.
19.2. An ERP can make additional disclosures other than those stipulated in CRA
Regulations or circulars issued thereunder with the prior approval of its board.
19.3. Disclosures by ERPs on annual basis: ERP shall make following disclosures within
30 days from the end of each financial year (March):
19.3.1. Disclosures on ESG rating History and movement:
19.3.1.1. A Rating Summary Sheet presenting a snapshot of the rating actions
carried out during the year shall be uploaded by the ERPs on their websites, in the format specified at Annexure 5. The disclosure in the “Rating Distribution for outstanding ratings as on 31st March” section of Annexure 5 shall also include number of INC ratings outstanding in each category also, if applicable.
19.3.1.2. Details of new ESG ratings assigned during last year (Annexure 6)
19.3.1.3. Movement of ESG rating of all outstanding listed entities/ securities
during the last year (Annexure 7),
19.3.1.4. The history of ESG rating of all outstanding listed entities/ securities
(Annexure 8),
19.3.2. Disclosure of Average Rating Transition Rates
19.3.2.1. Regulation 28K of CRA Regulations requires an ERP to publish its
average one-year ESG rating transition rate on its respective website, in a manner as may be specified by SEBI;

19.3.2.2. Transition studies are central to evaluating the performance of an ERP
and provide an insight on the stability of ratings over a period of time. In order to promote transparency and to enable the market to best judge the performance of the ratings, the ERP should publish information about the historical average rating transition rates across various rating categories, so that investors can understand the historical performance of the ratings assigned by the ERPs.
19.3.2.3. ERPs shall publish their average one-year rating transition rate over a
3-year period, on their respective websites, which shall be calculated as the weighted average of transitions for each rating category, across all static pools in the 3-year period.
19.3.2.4. The format of the disclosure of transition rates is enclosed as Annexure
9. For the said purpose, the following terms shall have the meaning as
under:
a. Static Pool: ESG Ratings outstanding for each category at the beginning of any financial year. However, it shall exclude ratings that have been withdrawn or ratings of non-cooperative issuers, if applicable, during the financial year. b. Transition Rate: The number of movements/ transitions from each rating category to another, as at the end of the financial year, as a percentage of the total number of ratings in the static pool.
c. Averaging: All averaging across static pools for transition rate
computations must be based on the weighted average method where the weights are the number of issuers in each static period.
19.3.2.5. ERPs shall also disclose two additional and separate rating transition
matrices (limited to ESG ratings of entities or securities that are listed, or proposed to be listed, on a recognized stock exchange) using the following definition of static pool:

a. Static Pool: Ratings outstanding for each category at the beginning of any financial year. It shall exclude ratings that have been withdrawn or ratings of non-cooperative issuers, if applicable, during the financial year. b. Static Pool: Ratings outstanding for each category at the beginning of any financial year. It shall include ratings that have been withdrawn or ratings of non-cooperative issuers, if applicable, during the financial year.
19.3.2.6. In the disclosure at para 19.3.2.5 (b) above, an ERP shall include an
additional column to indicate the proportion of ratings that were withdrawn during the financial year.
19.3.3. Income: An ERP shall disclose:
19.3.3.1. An ERP shall disclose the general nature of its compensation
arrangements with the issuers.
19.3.3.2. its total receipt from ESG rating services and non-ESG rating services,
19.3.3.3. issuer wise percentage share of non-ESG rating income of the ERP and
its subsidiary to the total revenue of the ERP and its subsidiary from that issuer, and
19.3.3.4. names of the rated issuers who along with their associates contribute
10% or more of total revenue of the ERP and its subsidiaries.
Continuous Disclosures
20.1. An ERP shall make all the disclosures stipulated below on their websites and
maintain the same at all times.
20.2. The rating history, Rating Rationales and Rating Reports, including those ratings
which have been withdrawn, shall be available on the ERP's website.
20.3. Disclosures in case of delay in periodic review:

20.3.1. Regulation 28M of CRA Regulations prescribe that an ERP shall annually,
or if required, more frequently, review each of the published ESG ratings, unless the ESG rating is withdrawn in accordance with these regulations.
20.3.2. Accordingly, each ERP shall promptly disclose on its website details of all
such ratings where the review became due but was not completed by the due date. Details disclosed shall include the name of the company, security type (if applicable), date of last review, reasons for delay in periodic review, hyperlink to the last Rating Rationale etc.
20.4. Disclosure of guidelines for dealing with Conflict of Interest: The policies adopted
by the ERPs for effective implementation of guidelines for dealing with Conflict of Interest for investment/ trading by ERPs, Access Persons and other employees, shall be disclosed on the ERPs’ website.
20.5. Shareholding: An ERP shall disclose its shareholding pattern as prescribed by
stock exchanges for a listed company under Regulation 31 of Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) Regulations, 2015.
20.6. Compliance with recommendations of the International Organization of Securities
Commissions (IOSCO):
20.6.1. An ERP shall disclose the compliance status of:
20.6.1.1. Recommendations for ESG ratings products providers specified in
IOSCO report FR09/21 dated November 2021.
20.6.1.2. Good practices for ESG rating providers specified in IOSCO call for
action dated November 2022.
20.6.2. In case of any non-compliance with any provision of the above, the ERP shall
disclose rationale for divergence from the IOSCO recommendations and good practices. Guidelines on manner of disclosures by ERPs on its website:

21.1. In order to facilitate enhanced transparency and usability of disclosures made by
ERPs on their websites, the following is directed:
21.1.1. Disclosures required by ERPs on their websites under various SEBI circulars
should be provided in excel / machine readable format.
21.1.2. An archive of all disclosures should be maintained by ERPs on their website,
for at least 10 years. This also includes rating rationales by ERPs.
21.1.3. ERPs may add footnotes in the disclosures mandated by SEBI for purpose
of better understanding of methodology of such disclosure by stakeholder’s subject to methodology explained being in line with the SEBI Regulations and circulars issued thereunder.

Chapter IV : Internal Audit for ERPs
Internal Audit for ERPs:
22.1. The audit envisaged under Regulation 22 of the CRA Regulations shall include an
internal audit to be undertaken in the following manner:
22.1.1. It shall be conducted on a yearly basis.
22.1.2. It shall be conducted by Chartered Accountants, Company Secretaries or
Cost and Management Accountants who are in practice and who do not have any conflict of interest with the ERP.
22.1.3. It shall cover all aspects of ERP operations and procedures, including investor
grievance redressal mechanism, compliance with the requirements stipulated in the SEBI Act, Rules and Regulations made thereunder, and guidelines issued by SEBI from time to time.
22.1.4. The report shall state the methodology adopted, deficiencies observed, and
consideration of response of the management on the deficiencies.
22.1.5. The report shall include a summary of operations and of the audit, covering
the size of operations, number of transactions audited and the number of instances where violations / deviations were observed while making observations on the compliance of any regulatory requirement.
22.1.6. The report shall comment on the adequacy of systems adopted by the ERP
for compliance with the requirements of regulations and guidelines issued by SEBI and investor grievance redressal. Requirements related to Internal Audit of ERPs:
23.1. Eligibility of Auditors for conducting the Internal Audit of the ERP:
23.1.1. The audit firm shall have a minimum experience of three years in the financial
sector.
23.1.2. The internal auditor of an ERP shall declare that:
23.1.2.1. The firm has not been employed by other ERPs for any other services
(such as statutory audit, taxation, consultancy/ retainership etc.) in the

past two years, and
23.1.2.2. The partners/ firm do not have any association with any other ERP.
23.1.3. The audit team must be composed of, at least, a Chartered Accountant (ACA/
FCA) and a Certified Information Systems Auditor/ Diploma in Information Systems Auditor (CISA/ DISA).
23.2. Rotation of Internal Auditors: An auditor shall be appointed for a maximum term of
five years, with a cooling-off period of two years.
23.3. Scope of the Internal Audit: The internal audit shall examine compliance of the ERP
with CRA Regulations and this circular. Such examination shall include but not be limited to following checks:
23.3.1. Whether the ERP maintains the minimum net worth requirement under CRA
Regulations.
23.3.2. Status of targets / projections submitted by the ERP to SEBI during its
application for registration.
23.3.3. ERP and its employees, who are associated directly or indirectly with the
rating business, have complied with the regulations and code of conduct.
23.3.4. ERP has defined processes for operations that have been followed during the
rating exercise.
23.3.5. Policy in respect of non-cooperation by the issuer, if applicable, including
procedures to be followed for the same, have been complied with.
23.3.6. Review of ratings has been carried out as per the review policy of the ERP.
23.3.7. Verify the rating disclosures made by the ERPs on their website.
23.3.8. Comment on the conflict of interest, if any.
23.3.9. The audit shall also cover adherence to the prescribed methodology for
calculation of transition rates.
23.3.10. Compliance by ERP with the provisions of all the Circulars shall be verified
during yearly Internal Audit.
23.4. Action on the Internal Audit Report:
23.4.1. The ERP shall receive the report of the internal audit within two months from
the end of the year.

23.4.2. Upon receipt of the internal audit report, the Compliance Officer of the ERP
shall provide detailed comments on each of the observations therein and place the same before the Board of the ERP.
23.4.3. The final action taken report, including the comments/ recommendations
made by Compliance Officer and the Board of the ERP as well as the corrective steps taken by the ERP, shall be submitted to SEBI within 2 months from the date of receipt of the internal audit report or 1 month from the date of Board Meeting of the ERP, whichever is later, in the following format:
Sr.
No.
Observations of the auditor
Remarks by the
Compliance
Officer
Comments of the Board of the ERP
Corrective actions taken
23.4.4. All ERPs shall report the following change(s) to SEBI while submitting the
Action Taken Report:
23.4.4.1. Amalgamation, demerger, consolidation or any other kind of corporate
restructuring falling within the scope of section 230 of the Companies Act, 2013 or the corresponding provision of any other law for the time being in force;
23.4.4.2. Change in Director, including managing director/ whole-time director;
23.4.4.3. Change in shareholding not resulting in change in control.
23.4.4.4. If there is no change during the relevant year, it shall be indicated in the
report.

Chapter V : Miscellaneous
Designated e-mail ID for regulatory communication with SEBI:
24.1. SEBI has been communicating with the registered market intermediaries inter-alia
ERPs through circulars, letters, directions etc. In order to facilitate the issuance of digitally signed circulars, all registered ERPs are required to create a designated email ID for regulatory communications. This email ID shall be an exclusive email ID only for the above purpose and should not be a person centric email ID.
24.2. The Designated e-mail ID shall be communicated to SEBI by emailing a file in an
excel format to intermediary@sebi.gov.in and erp@sebi.gov.in, as per the format prescribed below.
24.3. The name of the file and the subject of the email shall be in the following format: –
“ESG Rating Provider – <name of the ERP>”
24.4. The file shall contain the following details:
Information regarding Grievance Redressal Mechanism:
25.1. For information of all investors who deal/ invest/ transact in the market, the
information as provided below shall be prominently displayed in the offices of the ERPs:
Name Address Category Registrat ion No.
Designated email ID
Name of compliance officer
Dear Investor,
In case of any grievance / complaint against the ESG rating provider:
Please contact Compliance Officer of the ESG rating provider (Name and Address) / email-id (xxx.@email.com) and Phone No. - 91-XXXXXXXXXX. You may also approach CEO / Partner / Proprietor (Name) / email-id (xxx.@email.com) and Phone No. - 91-XXXXXXXXXX. If not satisfied with the response of the ERP you can lodge your grievances with SEBI at http://scores.gov.in or you may also write to any of the offices of SEBI. For any queries, feedback or assistance, please contact SEBI Office on Toll Free Helpline at 1800 22 7575 / 1800 266 7575.

Guidelines on Outsourcing of Activities by ERPs
26.1. Outsourcing may be defined as the use of one or more than one third party – either
within or outside the group - by a registered ERP to perform the activities associated with services which the ERP offers.
26.2. The principles for outsourcing by ERPs have been framed (Annexure 10). These
principles shall be followed by all ERPs registered with SEBI.
26.3. The SEBI registered ERPs desirous of outsourcing their activities shall not, however,
outsource their core business activities and compliance functions.
26.4. The SEBI registered ERPs shall be responsible for reporting of any suspicious
transactions / reports to FIU or any other competent authority in respect of activities carried out by the third parties. General Guidelines for dealing with Conflicts of Interest of ERPs and their Associated Persons in Securities Market:
27.1. ERPs are presently governed by the provisions for avoidance of conflict of interest
as mandated in the CRA Regulations read with relevant circulars issued from time to time by SEBI.
27.2. On the lines of Principle 8 of the International Organization of Securities
Commissions (IOSCO) Objectives and Principles of Securities Regulations, it has been decided to put in place comprehensive guidelines to collectively cover ERPs and their associated persons, for elimination of their conflict of interest, as detailed hereunder.
27.3. ERPs shall adhere to these guidelines for avoiding or dealing with or managing
conflict of interest. They shall be responsible for educating their associated persons for compliance of these guidelines.

27.4. For the purpose of these guidelines "associated persons" have the same meaning
as defined in Securities and Exchange Board of India Certification of Associated Persons in the Securities Markets) Regulations, 2007.
27.5. ERPs and their associated persons shall:
27.5.1. lay down, with active involvement of senior management, policies and internal
procedures to identify and avoid or to deal or manage actual or potential conflict of interest, develop an internal code of conduct governing operations and formulate standards of appropriate conduct in the performance of their activities, and ensure to communicate such policies, procedures and code to all concerned;
27.5.2. at all times maintain high standards of integrity in the conduct of their
business;
27.5.3. ensure fair treatment of their clients and not discriminate amongst them;
27.5.4. ensure that their personal interest does not, at any time conflict with their duty
to their clients and client’s interest always takes primacy in their advice, investment decisions and transactions;
27.5.5. make appropriate disclosure to the clients of possible source or potential
areas of conflict of interest which would impair their ability to render fair, objective and unbiased services;
27.5.6. endeavor to reduce opportunities for conflict through prescriptive measures
such as through information barriers to block or hinder the flow of information from one department/ unit to another, etc.;
27.5.7. place appropriate restrictions on transactions in securities while handling a
mandate of issuer or client in respect of such issuer/security so as to avoid any conflict;
27.5.8. not deal in securities while in possession of material non - published
information
27.5.9. not to communicate the material non-published information while dealing in
securities on behalf of others
27.5.10. not in any way contribute to manipulate the demand for or supply of
securities in the market or to influence prices of securities;

27.5.11. not have an incentive structure that encourages sale of products not suiting
the risk profile of their clients;
27.5.12. not share information received from clients or pertaining to them, obtained
as a result of their dealings, for their personal interest;
27.6. The Board of ERPs shall put in place systems for implementation of these guidelines
and provide necessary guidance enabling identification, elimination or management of conflict of interest situations. The Board of ERP shall review the compliance of this circular periodically.
27.7. These guidelines shall be in addition to the provisions, if any, contained in respective
regulations/ circulars issued by SEBI from time to time regarding dealing with conflict of interest, in respect of such entities Standardization of Industry classification - Applicability to ERPs
28.1. The Market Data Advisory Committee (MDAC), a standing committee constituted by
SEBI, comprising of representatives from stock exchanges, depositories and other market participants, examined the existing industry classification structures, across sectors, and developed a harmonised four level industry classification framework for adoption by all stakeholders and for all relevant processes/ purposes in Indian securities market.
28.2. As the standardized framework will help bring about uniformity in the classifications
being used across sectors and in securities market, ERPs are advised to use this standardized industry classification published by recognized Stock Exchanges for the purpose of rating exercise, peer benchmarking, research activities including research for Economy, Industries and Companies etc.
28.3. Further, as the standardized industry classification will be reviewed and published
by Stock Exchanges on periodical basis, in view of same, ERPs are directed to follow the standardized industry classification published by Stock Exchanges from time to time.

Firewall between ERPs and their Affiliates:
29.1. The following measures are mandated to strengthen the firewall between SEBIregistered ERPs and their non-ERP entities (i.e. associates or subsidiary or group
entity of the ERP):
29.1.1. ERPs shall formulate a policy on separation or firewall practices with the nonERP entities and document the same. Such policy, and revisions thereto, shall
be ratified by the Board of Directors of the ERPs and the policy may cover inter-alia the following:
29.1.1.1. Nature and extent of sharing of infrastructure, officials/employees or
resources, if any, between the ERP and the non-ERP entity, including specification on whether such arrangement is temporary.
29.1.1.2. Measures taken by ERP to ensure the independence of its ESG rating
process in view of the above arrangement with the non-ERP entity.
29.1.1.3. Guidance to employees on sharing of information or resources, if any,
between the ERP and the non-ERP entity in order to mitigate any potential or actual conflict of interest.
29.1.2. An ERP shall disclose on its website, details of any common director or Chief
Executive Officer or Managing Director between the ERP and the non-ERP entity. Such disclosure shall be updated by the ERP on the first working day of each month. The disclosure should include a reference to the date it was last updated by the ERP, along with a reference or hyperlink to archives of previous such disclosures.
29.1.3. The websites of SEBI-registered ERPs and their non-ERP entities shall be
separate. An ERP’s website may contain hyperlinks to the separate websites of the non-ERP entities.

Annexures
Annexure 1
Declaration-Cum-Undertaking for change in control We M/s. (Name of the ERP/the acquirer/person who shall have thecontrol), hereby declare and undertake the following with respect to the application for prior approval for change in control of (name of the ERP along with the SEBI registration no.):

The applicant/ERP (Name) and its principal officer, the directors or managing
partners, the compliance officer and the key management persons and the promoters or persons holding controlling interest or persons exercising control over the applicant, directly or indirectly (in case of an unlisted applicant or ERP, any person holding twenty percent or morevoting rights, irrespective of whether they hold controlling interest or exercise control, shall be required to fulfill the ‘fit and proper person’ criteria) are fitand proper person in terms of Schedule II of SEBI (Intermediaries) Regulations, 2008.
We bear integrity, honesty, ethical behaviour, reputation, fairness and character.
We do not incur following disqualifications mentioned in Clause 3(b) of Schedule
II of SEBI (Intermediaries) Regulations, 2008 i.e.
(i) No criminal complaint or information under section 154 of the Code of Criminal Procedure, 1973 (2 of 1974) has been filed against us by SEBI and which is pending. (ii) No charge sheet has been filed against us by any enforcement agency in matters concerning economic offences and is pending. (iii) No order of restraint, prohibition or debarment has been passed against us by SEBI or any other regulatory authority or enforcement agency in any matter concerning securities laws or financial markets and such order isin force. (iv) No recovery proceedings have been initiated by SEBI against us and are pending. (v) No order of conviction has been passed against us by a court for any offence involving moral turpitude. (vi) No winding up proceedings have been initiated or an order for winding up has been passed against us. (vii) We have not been declared insolvent.

(viii) We have not been found to be of unsound mind by a court ofcompetent jurisdiction and no such finding is in force. (ix) We have not been categorized as a wilful defaulter. (x) We have not been declared a fugitive economic offender.
4. We have not been declared as not ‘fit and proper person’ by an order of SEBI.
5. No notice to show cause has been issued for proceedings under SEBI
(Intermediaries) Regulations, 2008 or under section 11(4) or section 11B of the SEBI Act during last one year against us.
6. It is hereby declared that we and each of our promoters, directors, principal officer,
compliance officer and key managerial persons are not associated with vanishing companies.
7. We hereby undertake that there will not be any change in the Board of Directors
of incumbent, till the time prior approval is granted.
8. We hereby undertake that pursuant to grant of prior approval by SEBI, the
incumbent shall inform all the existing investors/ clients about the proposed change prior to effecting the same, in order to enable them to take informed decision regarding their continuance or otherwise with the new management. The said information is true to our knowledge. (stamped and signed by the Authorised Signatories)

Annexure 2
Letter of Representation for ESG Rating Provider Securities and Exchange Board of India Ma’am / Dear Sir, Sub: Surrender of Certificate of Registration as ESG Rating Provider, Registration No. .

We hereby surrender our certificate of registration as ESG Rating Provider.
We enclose the original certificate of registration (or indemnity in case the certificate is lost
or stolen) for cancellation.
We hereby confirm that:
a. no complaint /disciplinary proceeding is pending against us; b. no investigation / inquiry by SEBI is pending against us with respect to our activities as an ESG Rating Provider;
c. as on date of application, we have paid all fees;
d. we shall continue to be liable for all liabilities/obligations (including monetary penalties, if any) for violations, if any, of the provisions of the SEBI Act and the SEBI (Credit Rating Agencies) Regulations, 1999 that have taken place before our surrender of certificate of registration; e. all our current assignments as an ESG Rating Provider have been either duly terminated or transferred to another registered ESG Rating Provider with registration no.; f. we have issued a public notice in a widely circulated national and a vernacular daily dated informing surrender of our registration as ESG rating Provider (Please enclose a clipping of the said public notice); g. we have notified the Depositories and all the stock exchanges where our client companies are listed about the surrender of our registration.
*We hereby request SEBI to dispense with the procedure laid down in Regulation 16(1) of
the SEBI (Procedure for Holding Enquiry by Enquiry Officer and Imposing Penalty) Regulations, 2002 while processing our request for surrender of certificate of registration. Thanking you, Yours faithfully, Name:
(Whole time/Managing Director/Principal Officer)

Please strike off, if not applicable.

Annexure 3
List of ESG Parameters with an Indian Context E/S/G Pillar Factors Data Point Parameters Environmen t Energy Perform, Achieve and Trade (PAT) - Does the entity have any sites / facilities identified as designated consumers (DCs) under the Performance, Achieve and Trade (PAT) Scheme of the Government of India? (Y/N) If yes, disclose whether targets set under the PAT scheme have been achieved. In case targets have not been achieved, provide the remedial action taken, if any. Environmen t Water Zero Liquid Discharge - Has the entity implemented a mechanism for Zero Liquid Discharge Environmen t Waste Manageme nt Extended Producer Responsibility (EPR) - Extended Producer Responsibility (EPR) is applicable to the entity’s activities (Yes / No). If yes, whether the waste collection plan is in line with the Extended Producer Responsibility (EPR) plan submitted to Pollution Control Boards? Environmen t Land Use and Biodiversity Does the company have operations in or around ecologically sensitive areas (such as national parks, wildlife sanctuaries, biosphere reserves, wetlands, biodiversity hotspots, forests, coastal regulation zones etc.)? Environmen t and Social CSR Amount spent in CSR as a percentage of regulatory requirement on a look-through basis i.e. where CSR activities are undertaken by trusts / foundations, whether the funds have been actually utilized by these entities Social Inclusive developme nt Job creation in smaller towns Social Inclusive developme nt Percentage of input material (inputs to total inputs by value) sourced from suppliers: - (i) Directly sourced from MSMEs/ small producers, (ii) Directly from within India Social Diversity Disclosure of wages and salary by gender (%) Social Diversity Job creation and availability of infrastructure conducive for differently abled Governance Compliance Does the company have a RegTech / Systems solution for monitoring and evidencing compliance

E/S/G Pillar Factors Data Point
Governance Governanc e
Percentage of "against" votes amongst non-promoter shareholders on appointment of independent directors Governance Related Party Transaction s Percentage of "against" votes amongst non-promoter shareholders on RPTs Governance Royalty Royalty payments - Is the increase in royalty over the last five years higher than increase in PBT? If yes provide values for last 5 years and the reason for increased royalty. Governance Related Party Transaction s Share of RPTs (as respective %age) in -

Purchases
Sales
Loans & advances
Investments
(except for PSUs)
Guidance
ERPs should consider India specific standards/ laws/guidelines for rating of energy efficiency/green building initiatives (eg. GRIHA, IGBC or Energy Conservation Building Code (ECBC)etc.) ERPs should consider India specific standards/laws/guidelines for rating of air emissions (eg. ZED certifications, emission regulations under AIR Act, Continuous Emissions Monitoring System requirements etc.) ERPs should consider India specific standards/laws/guidelines for rating of GHG emissions (eg. Initiatives and targets under Perform, Achieve and Trade (PAT) scheme, National Action Plan on Climate Change, Environment Protection Act, Ozone Depleting Substances Rules, CPCB/SPCB Guidelines, India GHG Programme etc.) ERPs should consider India specific standards/laws/guidelines for rating of waste management (eg. Solid Waste Management Rules, Plastic Waste Management Rules, Bio-medical Waste Management Rules, Electronic Waste Management Rules, Hazardous Waste Management Rules, Fly Ash Utilization Policy, EPR Guidelines etc.) ERPs should consider India specific standards/laws/guidelines for rating of Chemical safety (eg. Ban on single use plastics, ban on 27 agri-chemicals etc.)

Guidance
ERPs should consider India specific standards/ laws/guidelines for rating of Effluent/Wastewater (eg. Zero Liquid Discharge policy, Common Effluent Treatment Plants related provisions etc.) ERPs should consider India specific standards/laws/guidelines for rating of Water (eg. Areas notified by the Central Ground Water Board (CGWB) as over exploited or critical area, implications of Water Act, Water Cess Act etc.) 8 All intensity ratios should be factored in after adjusting for PPP

ANNEXURE 4
Financial sector regulators/ authorities

Securities and Exchange Board of India
Reserve Bank of India
Insurance Regulatory and Development Authority of India
Pension Fund Regulatory and Development Authority

Annexure 5
Format for Yearly ESG Rating Summary Sheet
S.
No. Parameter No. of ratings

New Ratings
Upgrades
Downgrades
Change in Ratings assigned post request of
review/appeal by Issuer in surveillance cases a. Ratings wherein request of review/appeal by the Issuer b. Rating that have undergone revision post request of review/appeal by Issuer
Ratings Withdrawn
Rating Distribution for outstanding
ratings as on 31st March a 100-90 b 89-80 c 79-70 d 69-60 e 59-50 f 49-40 g 39-30 h 29-20 i 19-10 j 9-0

Annexure 6
Details of new ESG ratings assigned during year New Ratings assigned between Apr – Mar S. N o Nam e of the Issu er Sector Securities Type, if applicable Listing Status (Listed/ Propose d to be listed ) Whether the issuer requested for a review/ appeal of rating? Whether review/appeal of the rating was granted by ERP. Rating assigned prior to request for review/ appeal by the issuer Final Rating Assign ed

Annexure 7
Movement* of Each ESG rating
Upgrades
Rating Upgrades between Apr – Mar
S.
N o
Nam e of the issue r
Sect or
Security
Type, if applicab le
Listing
Status
(Listed
/
Propos ed to be listed)
Ratin g prior to revisi on
Ratin g post revisi on
Date of
Rating
Ration ale for
Rating upgrad e
Differen ce in
Ratings
Trigger
Event
Downgrades
Rating Upgrades between Apr– March
S
.
N o
Nam e of the issue r
Sect or
Securit y Type, if applica ble
Listing
Status
(Listed
/
Propos ed to be listed)
Ratin g prior to
Revisi on
Ratin g post
Revisi on
Date of
Rating
Rational e for
Rating downgra ded
Differen ce in
Ratings
Trigger
Event
*Will cover only rating changes. Reaffirmations shall be excluded

Annexure 8
History of all outstanding ESG ratings
History of ESG rating of all Outstanding Securities S.N o Name of the Issuer Sec tor Type of security , if applica ble Listing Status (Listed/ /Propos ed to be listed) Initial Rating Date of Initial Rating Rating after 1st Revisi on Date of 1st Revisi on Rating after 2nd Revisi on Date of 2nd Revisi on …Current Outstanding Rating

Annexure 9
Average one-year transition rates for ESG ratings for the last 3-Financial Year Period Rating Category 100-90 89-80 79-70 69-60 59-50 49-40 39-30 29-20 19-10 9-0 100-90 89-80 79-70 69-60 59-50 49-40 39-30 29-20 19-10 9-0 Note: The left-hand column identifies ratings outstanding at the beginning of the year. Each row provides information on the migration pattern of those ratings by end of the year.

Annexure 10
PRINCIPLES FOR OUTSOURCING FOR ERPs

An ERP seeking to outsource activities shall have in place a
comprehensive policy to guide the assessment of whether and how those activities can be appropriately outsourced. The Board / partners (as the case may be) {hereinafter referred to as the “the Board”} of the ERP shall have the responsibility for the outsourcing policy and related overall responsibility for activities undertaken under that policy.
1.1 The policy shall cover activities or the nature of activities that can be
outsourced, the authorities who can approve outsourcing of such activities, and the selection of third party to whom it can be outsourced. For example, an activity shall not be outsourced if it would impair the supervisory authority’s right to assess, or its ability to supervise the business of the ERP. The policy shall be based on an evaluation of risk concentrations, limits on the acceptable overall level of outsourced activities, risks arising from outsourcing multiple activities to the same entity, etc.
1.2 The Board shall mandate a regular review of outsourcing policy for such
activities in the wake of changing business environment. It shall also have overall responsibility for ensuring that all ongoing outsourcing decisions taken by the ERP and the activities undertaken by the third-party, are in keeping with its outsourcing policy.
The ERP shall establish a comprehensive outsourcing risk
management programme to address the outsourced activities and the relationship with the third party.
2.1 The ERP shall make an assessment of outsourcing risk which depends

on several factors, including the scope and materiality of the outsourced activity, etc. The factors that could help in considering materiality in a risk management programme includea) The impact of failure of a third party to adequately perform the activity on the financial, reputational and operational performance of the ERP and on the investors / clients; b) Ability of the ERP to cope up with the work, in case of nonperformance or failure by a third party by having suitable back-up arrangements; c) Regulatory status of the third party, including its fitness and probity status; d) Situations involving conflict of interest between the ERP and the third party and the measures put in place by the ERP to address such potential conflicts, etc.
2.2 While there shall not be any prohibition on a group entity / associate of
the ERP to act as the third party, systems shall be put in place to have an arm’s length distance between the ERP and the third party in terms of infrastructure, manpower, decision-making, record keeping, etc. for avoidance of potential conflict of interests. Necessary disclosures in this regard shall be made as part of the contractual agreement. It shall be kept in mind that the risk management practices expected to be adopted by the ERP while outsourcing to a related party or an associate would be identical to those followed while outsourcing to an unrelated party.
2.3 The records relating to all activities outsourced shall be preserved
centrally so that the same is readily accessible for review by the Board of the ERP and / or its senior management, as and when needed. Such records shall be regularly updated and may also form part of the corporate governance review by the management of the ERP.
2.4 Regular reviews by internal or external auditors of the outsourcing
policies, risk management system and requirements of the regulator shall

be mandated by the Board wherever felt necessary. The ERP shall review the financial and operational capabilities of the third party in order to assess its ability to continue to meet its outsourcing obligations.
3. The ERP shall ensure that outsourcing arrangements neither diminish
its ability to fulfill its obligations to customers and regulators, nor impede effective supervision by the regulators.
3.1 The ERP shall be fully liable and accountable for the activities that are
being outsourced to the same extent as if the service were provided inhouse.
3.2 Outsourcing arrangements shall not affect the rights of an investor or
client against the ERP in any manner. The ERP shall be liable to the investors for the loss incurred by them due to the failure of the third party and also be responsible for redressal of the grievances received from investors arising out of activities rendered by the third party.
3.3 The facilities / premises / data that are involved in carrying out the
outsourced activity by the service provider shall be deemed to be those of the registered ERP. The ERP itself and Regulator or the persons authorized by it shall have the right to access the same at any point of time.
3.4 Outsourcing arrangements shall not impair the ability of SEBI/SRO or
auditors to exercise its regulatory responsibilities such as supervision/inspection of the ERP.
4. The ERP shall conduct appropriate due diligence in selecting the third
party and in monitoring of its performance.
4.1It is important that the ERP exercises due care, skill, and diligence in the selection of the third party to ensure that the third party has the ability and capacity to undertake the provision of the service effectively.

4.2 The due diligence undertaken by an ERP shall include assessment of:
a) third party’s resources and capabilities, including financial soundness, to perform the outsourcing work within the timelines fixed; b) compatibility of the practices and systems of the third party with the ERP’s requirements and objectives; c) market feedback of the prospective third party’s business reputation and track record of their services rendered in the past; d) level of concentration of the outsourced arrangements with a single third party; and e) the environment of the foreign country where the third party is located.
5. Outsourcing relationships shall be governed by written contracts /
agreements / terms and conditions (as deemed appropriate) {hereinafter referred to as “contract”} that clearly describe all material aspects of the outsourcing arrangement, including the rights, responsibilities and expectations of the parties to the contract, client confidentiality issues, termination procedures, etc. 5.1Outsourcing arrangements shall be governed by a clearly defined and legally binding written contract between the ERP and each of the third parties, the nature and detail of which shall be appropriate to the materiality of the outsourced activity in relation to the ongoing business of the ERP.
5.2 Care shall be taken to ensure that the outsourcing contract:
a) clearly defines what activities are going to be outsourced, including appropriate service and performance levels; b) provides for mutual rights, obligations and responsibilities of the ERP and the third party, including indemnity by the parties; c) provides for the liability of the third party to the ERP for unsatisfactory performance/other breach of the contract

d) provides for the continuous monitoring and assessment by the ERP of the third party so that any necessary corrective measures can be taken up immediately, i.e., the contract shall enable the ERP to retain an appropriate level of control over the outsourcing and the right to intervene with appropriate measures to meet legal and regulatory obligations; e) includes, where necessary, conditions of sub-contracting by the thirdparty, i.e. the contract shall enable ERP to maintain a similar control over the risks when a third party outsources to further third parties as in the original direct outsourcing; f) has unambiguous confidentiality clauses to ensure protection of proprietary and customer data during the tenure of the contract and also after the expiry of the contract; g) specifies the responsibilities of the third party with respect to the IT security and contingency plans, insurance cover, business continuity and disaster recovery plans, force majeure clause, etc.; h) provides for preservation of the documents and data by third party ; i) provides for the mechanisms to resolve disputes arising from implementation of the outsourcing contract; j) provides for termination of the contract, termination rights, transfer of information and exit strategies; k) addresses additional issues arising from country risks and potential obstacles in exercisingoversight and management of the arrangements when ERP outsources its activities to foreign third party. For example, the contract shall include choice-oflaw provisions and agreement covenants and jurisdictional covenants that provide for adjudication of disputes between the parties under the laws of a specific jurisdiction; l) neither prevents nor impedes the ERP from meeting its respective regulatory obligations, nor the regulator from exercising its regulatory powers; and m) provides for the ERP and /or the regulator or the persons authorized by it to have the ability to inspect, access all books, records and

information relevant to the outsourced activity with the third party.
6. The ERP and its third parties shall establish and maintain contingency
plans, including a plan for disaster recovery and periodic testing of backup facilities.
6.1 Specific contingency plans shall be separately developed for each
outsourcing arrangement, as is done in individual business lines.
6.2 ERP shall take appropriate steps to assess and address the potential
consequence of a business disruption or other problems at the third party level. Notably, it shall consider contingency plans at the third party; coordination of contingency plans at both the ERP and the third party; and contingency plans of the ERP in the event of non-performance by the third party.
6.3 To ensure business continuity, robust information technology security is
a necessity. A breakdown in the IT capacity may impair the ability of the ERP to fulfill its obligations to other market participants/clients/regulators and could undermine the privacy interests of its customers, harm the ERP’s reputation, and may ultimately impact on its overall operational risk profile. Intermediaries shall, therefore, seek to ensure that third party maintains appropriate IT security and robust disaster recovery capabilities.
6.4 Periodic tests of the critical security procedures and systems and review
of the backup facilities shall be undertaken by the ERP to confirm the adequacy of the third party’s systems.
7. The ERP shall take appropriate steps to require that third parties
protect confidential information of both the ERP and its customers from intentional or inadvertent disclosure to unauthorized persons.

7.1ERP that engages in outsourcing is expected to take appropriate steps to protect its proprietary and confidential customer information and ensure that it is not misused or misappropriated.
7.2 The ERP shall prevail upon the third party to ensure that the employees
of the third party have limited access to the data handled and only on a “need to know” basis and the third party shall have adequate checks and balances to ensure the same.
7.3 In cases where the third party is providing similar services to multiple
entities, the ERP shall ensure that adequate care is taken by the third party to build safeguards for data security and confidentiality.
8. Potential risks posed where the outsourced activities of multiple
intermediaries are concentrated with a limited number of third parties.
8.1 In instances, where the third party acts as an outsourcing agent for
multiple intermediaries, it is the duty of the third party and the ERP to ensure that strong safeguards are put in place so that there is no comingling of information/documents, records and asset

Lineage: No known changes

Similar documents from other regulators