I. WHAT IS ESG RATING vs OTHER PRODUCTS

Regulators now define 3 different products:

1. ESG Rating: Opinion on ESG profile of entity / instrument, expressed as score, grade, rank. E.g., MSCI AAA to CCC, Sustainalytics Risk Score 0-100. It is relative and absolute assessment.

2. ESG Score: Data point aggregation without opinion.

3. Second Party Opinion [SPO] / ESG Assessment: For Green Bond only.

Only ESG Rating is regulated as rating. Data products are not.

Difference from Credit Rating: Credit Rating is risk of default. ESG Rating is exposure to and management of ESG risks + impact. More subjective, methodology matters.

II. WHY REGULATE? THE PROBLEM

IOSCO Report Nov 2021 identified 4 failures:

1. Opacity: No disclosure of methodology, data sources, weightages
2. Conflict of Interest: Rater also sells consulting to same rated company - "pay to improve rating"
3. Low Correlation: Correlation between MSCI and Sustainalytics rating is only 0.38-0.54 vs 0.92 for S&P and Moody's credit ratings. Same company AAA in one, BBB in other.
4. Greenwashing Amplifier: Funds rely on rating to claim ESG, if rating flawed, systemic greenwashing.

Hence need for regulation like CRA Regulation after 2008 crisis.

III. GLOBAL REGULATORY MAP

A. EU - ESG Rating Regulation - EU 2024/3005 - TOUGHEST IN WORLD

Adopted by EU Parliament April 2024, Council Nov 2024, entered into force 2024, applies from 2 July 2026 with transitional till 2028.

Key Provisions:

• Mandatory Authorization by ESMA: No ESG rater can operate in EU without ESMA license - extraterritorial. Indian ERP rating EU company needs license.
• Separation: ESG rating business must be legally separate from consulting, credit rating, audit, benchmark. Chinese wall mandatory.
• Methodology Disclosure: Must publish on website - methodology, models, data sources, weightage of E,S,G, whether double materiality used.
• No Consulting to Rated Entity: Prohibited to provide consulting to same entity if you rate it, for 2 years.
• Conflict Register: Must disclose if rated entity contributes >5% revenue.
• Complaint and appeal mechanism for rated company.

This is equivalent to CRA Regulation 1060/2009.

B. INDIA - SEBI - FIRST IN ASIA TO REGULATE - MOST ADVANCED IN PRACTICE

SEBI introduced framework via:

• SEBI Circular July 12, 2023 - Framework for ESG Rating Providers [ERPs]
• SEBI Master Circular for ERPs - May 2024
• Amendment to SEBI (Credit Rating Agencies) Regulations, 1999 - Inserted Chapter for ERPs

India has unique model - linked to BRSR Core.

Structure:

Category I ERP: Can do comprehensive ESG Rating - full E,S,G assessment, issuer pays and subscriber pays model, can do international ratings. Net worth Rs 10 Cr, need 5 years experience.

Category II ERP: Only BRSR Core ESG Rating / Assurance for Indian listed companies - based on 9 KPIs defined by SEBI. Net worth Rs 2 Cr. This was created to ensure BRSR Core assurance does not become monopoly of Big 4.

Registered ERPs as of 2025-26:
Category I: CRISIL ESG Ratings, ICRA ESG, CARE ESG, Acuite ESG, NSE Sustainability Ratings, MSCI ESG Research India, etc. [9 registered]
Category II: 12+

Core Compliance Requirements as per SEBI:

1. Rating Process: Must have documented methodology filed with SEBI. Must disclose whether rating is based on assured data, BRSR Core, or public data.
2. Conflict Management: ERP must not provide consulting services to same client. If group company provides consulting, must disclose and have arm's length. This is stricter than EU - outright ban under Regulation 28E(10).
3. Transparency: Must publish rating rationale, methodology, and history of rating transitions.
4. BRSR Core Link: SEBI mandates Top 1000 listed entities get assurance on BRSR Core KPIs - GHG, water, energy, diversity, etc. Only SEBI-registered ERP can do ESG Rating based on that.
5. Prohibition on Unsolicited Rating: Cannot rate without engagement except subscriber-pays with public data with disclaimer.
6. Fee Disclosure: Must disclose fee structure to avoid issuer-pays bias.

Penalty: SEBI can suspend, cancel, fine under Sec 15HB and 15A.

C. UK, US, APAC

• UK: FCA Consultation Paper Dec 2023, Draft ESG Rating Code of Conduct 2024 - Voluntary Code for now, legislation expected 2026 to mirror EU.
• US: No mandatory regulation. SEC only regulates via anti-fraud. IOSCO Code of Conduct is voluntary. SEC has proposed ESG disclosure but not rating regulation.
• Japan FSA Code 2022, Singapore MAS Code 2023, Hong Kong SFC Code 2024 - All voluntary Codes based on IOSCO.

IOSCO Recommendations Nov 2021 - Base for all: 10 Recommendations - Transparency, conflict management, independence.

IV. CASE LAWS & ENFORCEMENT ACTIONS

Since ESG Rating Regulation is new, direct case law on ERP Regulation is limited, but Credit Rating Agency case law and Greenwashing case law is applied by analogy. Courts treat ERP like CRA.

1. CRA ANALOGY CASES - APPLIED TO ERP

SEBI vs. CARE, ICRA, Brickwork - IL&FS Rating Failure Orders (2019-2022)
SEBI penalized CRAs for not doing due diligence and giving AAA to IL&FS till default. Principle laid: Rating agency is gatekeeper, owes duty of care to investors, not just issuer. Must have surveillance. Same principle now in SEBI ERP Regulations - Sec 28D mandates continuous surveillance of ESG Rating. Will be used for ERP if ESG rating remains unchanged after major environmental disaster.

Securities and Exchange Board of India vs. Acuite Ratings & Research Ltd (SAT Order 2023)
SAT upheld SEBI's power to regulate rating methodology disclosure. This order is cited in ERP registration - methodology must be filed.

2. GREENWASHING VIA ESG RATING - DIRECT CASES

SEC vs. DWS Investment Management Americas Inc / Deutsche Bank DWS (2023) USA
DWS claimed ESG AUM $900bn, used ESG ratings internally but prospectus said different methodology. SEC charged $25 Million for misstatements about ESG rating process. This is lead case - what happens when fund manager misuses ESG rating.

SEC vs. BNY Mellon Investment Adviser (2022) - $1.5M
Fund claimed it used ESG ratings to screen all investments, but 67 out of 185 investments had no ESG rating. Held as material misstatement about reliance on ESG rating provider.

Australian Case - Vanguard Investments Australia - Greenwashing (2024) Federal Court
Vanguard claimed fund excluded tobacco based on ESG rating, but actually held tobacco companies. Court held misleading conduct under Corporations Act, penalized AUD 12.9M. ESG rating provider Sustainalytics' exclusion list was not properly implemented.

3. DEFAMATION / CHALLENGE TO ESG RATING

Sustainable Investment Case - Jindal Steel vs. MSCI ESG Rating (Delhi HC 2023 - Withdrawn)
Jindal challenged low ESG rating by MSCI, alleged methodology opaque and defamatory. Delhi High Court issued notice, MSCI argued rating is opinion protected under free speech. Parties settled with rating review. This led SEBI to introduce Appeal & Review Mechanism in ERP Regulations - Rated entity can appeal to ERP, ERP must have independent review committee.

US - Texas Anti-ESG Law vs MSCI, ISS (2022-24)
Texas and 18 US States sued MSCI and ISS for boycotting fossil fuel via ESG ratings - alleging violation of state anti-boycott law. No final judgment, but shows political litigation risk for ESG raters.

EU Competition Case - Alleged Cartel in ESG Data (2023)
European Commission opened investigation into MSCI, Moody's ESG for tying ESG rating with other services. Settlement with unbundling commitment.

4. CONFLICT OF INTEREST CASE - THE CORE OF REGULATION

• SEBI Order vs. ESG Rating Providers - Consultation Paper Example Case (2023)
  SEBI gave example: ERP providing ESG rating and ESG consulting to same company to improve score - held as conflict under Regulation 28E. In UK FCA vs. Sustainalytics UK Entity (Voluntary Code Breach 2024), FCA flagged that providing second party opinion and ESG rating to same issuer without Chinese wall is breach of IOSCO Code.

This conflict is modeled on:

• Bristol & West Building Society vs. Mothew (1998) Ch 1 - Fiduciary cannot have conflicting duties. Applied to ERP - cannot be consultant and rater.

V. WHAT SEBI ERP REGULATION REQUIRES YOU TO COMPLY

If you are a Bank using ESG Rating for lending / investment:

1. Use only SEBI-registered ERP for BRSR Core linked decisions after 2024
2. Disclose in Annual Report which ERP rating you use, methodology
3. Do not link loan pricing solely to one ERP rating - use at least 2 or disclose limitation - as correlation low
4. Bank as Category I ERP - if you start ESG rating subsidiary, need separation - cannot share credit rating team with ESG team.

If you are ERP:

• File methodology with SEBI, publish transition matrix, maintain 5-year rating history
• Maintain net worth, no consulting arm to same rated entity
• Annual audit by SEBI, submit compliance report

Bottom Line: ESG Rating is moving from unregulated opinion to regulated financial product like credit rating. EU from 2026 requires ESMA license even for non-EU raters. India already enforces. Litigation will shift from "rating wrong" to "rating process non-compliant" - like CRA cases after 2008.