ESG Rating Agency Regulation - Spain / EU Framework

ESG Ratings were completely unregulated until 2024. Market was dominated by MSCI, Sustainalytics, S&P, Moody's, ISS - using black-box methodologies, causing same company to get AAA from one and CCC from another. EU has now created world's first mandatory regime.

1. The Core Regulation - EU Regulation 2024/3005

Regulation (EU) 2024/3005 on transparency and integrity of ESG rating activities - ESG Ratings Regulation

• Adopted: European Parliament & Council 27 November 2024
• Published in Official Journal: 12 December 2024
• Entry into force: 1 January 2025
• Application Date: 2 July 2026 - From this date, operating without authorisation is illegal.

This is Direct Regulation, not Directive. Directly applicable in Spain, no transposition needed. But Spain/CNMV is NCA for enforcement cooperation.

Objective: Solve IOSCO-identified problems: lack of transparency, conflicts of interest, poor governance of ESG rating providers, and greenwashing risk to investors.

2. What is an ESG Rating under the Regulation?

Art 3 Definition:

ESG Rating means an opinion, a score, or a combination thereof, regarding a rated item's ESG profile or characteristics or exposure to ESG risks or impact on ESG, that is based on an established methodology and defined ranking system, and provided to third parties.

Rated Item = legal person, financial instrument, financial product, public authority, country.

Crucial Exclusions (Not regulated):

• Private internal ratings for internal use only
• ESG ratings produced by regulated financial undertaking for own internal use or for sale to own clients, if disclosed as non-public and not under ESMA
• ESG ratings produced by EU public authorities
• Second party opinions on Green Bonds, ESG labels, credit ratings already under CRA Regulation
• ESG data without ranking (raw data)

3. Key Obligations for ESG Rating Providers

A. Authorisation and Supervision - ESMA is Sole Supervisor

Unlike credit rating agencies where NCAs involved, ESG rating providers are supervised directly by ESMA.

3 Regimes to operate in EU:

1. EU Established Providers: Must apply to ESMA for authorisation before 2 July 2026. Must meet organisational requirements.
2. Third Country Providers (e.g., US, UK MSCI): 3 routes:
   • Equivalence: Commission decision that third country regime equivalent - then can operate
   • Recognition: If no equivalence, third country provider with turnover <€10m and small EU presence can seek recognition by ESMA
   • Endorsement: Art 11 - EU authorised provider can endorse ratings of third country group entity if ESMA approves. CNMV Consultation Paper for Guidelines on Endorsement under Art 11 published 2025 clarifies requirements - must show endorsed rating meets at least as stringent requirements.

Spain Specific: CNMV is the National Competent Authority that cooperates with ESMA, receives complaints, can ask ESMA to intervene. CNMV published on 13 Oct 2025 main conclusions of Common Supervisory Action on ESG disclosures in asset management - showing its active role in ESG supervision.

B. Organisational Requirements - Similar to CRA Regulation

1. Independence and Conflicts:

• Must have independent governance, avoid conflicts
• Must not provide consulting, audit, credit rating to same rated entity if conflict - separation required
• Fees must not be contingent on rating outcome
• Employees cannot trade rated securities
• Must disclose if rated entity paid for rating (issuer-pays vs investor-pays both allowed but must disclose)

2. Methodology Transparency - Art 20-22:
Must publicly disclose on website:

• Methodology used, models, key assumptions
• Whether rating assesses double materiality (impact + financial risk) or single materiality
• Whether E, S, G aggregated or separate
• Data sources - estimated vs reported data proportion
• Limitations, data gaps
• Annual review of methodology

This is revolutionary - previously MSCI/Sustainalytics did not disclose full model.

3. No Ancillary Services without separation:
Cannot provide ESG consulting to rated entity without Chinese walls.

4. Complaints and Appeals:
Must have independent complaints mechanism for rated entities to contest rating.

4. Spain - National Layer

Spain has no standalone ESG law, framework is fragmented. But Spanish implementation:

1. CNMV Role:

• CNMV Law - Real Decreto Legislativo 4/2015 del Mercado de Valores
• CNMV Circular on ESG fund names: Funds may only use ESG terms in commercial name if at least 50% of investments comply with environmental or social characteristics they promote - CNMV Criteria 1 June 2021
• CNMV Internal Committee on Sustainable Finance - multidisciplinary senior executives coordinating sustainable finance
• From 2024, CNMV and ICAC (Accounting and Audit Institute) joint publication on sustainability reporting - Listed companies must submit climate risk report to CNMV together with annual accounts under Act 7/2021 on Climate Change.

2. Spanish Climate Law:

• Ley 7/2021 de cambio climático y transición energética: Art 27-32 requires listed companies, banks, insurers to report climate risks and publish decarbonisation plans to CNMV
• Royal Decree on sustainable finance disclosures

3. CNMV Enforcement in Spain:

• On 13 Oct 2025, CNMV released conclusions of CSA on sustainability risks in asset management - Found satisfactory compliance with SFDR, Taxonomy, UCITS, AIFMD but called for greater transparency on methodology and data sources - aligns with upcoming ESG Rating Regulation

Example of Spanish breach: If a Spanish bank uses unregulated ESG rating from non-authorised provider after 2 July 2026 to build Article 8 fund, CNMV can sanction bank under SFDR and refer rating provider to ESMA.

5. Case Laws and Enforcement - Pre-Regulation Cases that Led to Regulation

There was no ESG rating regulation before, but cases show why it was needed:

1. IOSCO Report 2021 - Foundation for Regulation
IOSCO found ESG ratings correlation only 0.38-0.71 vs 0.99 for credit ratings. Same company rated differently due to methodology. This report cited in EU Recitals.

2. Deutsche Bank / DWS Case - Frankfurt 2022-23 - Greenwashing via ESG Rating
German prosecutor raided DWS for claiming ESG AUM €459bn but methodology did not integrate ESG for many funds. Relied on internal ESG rating that was flawed. Settlement $25m with SEC. Led EU to require methodology disclosure.

3. Spanish Case - CNMV vs Greenwashing Funds 2021-2023
CNMV sanctioned several Spanish asset managers for using ESG in fund name while <50% portfolio met ESG criteria. Used ESMA Guidelines on fund names. Funds had to rename or change portfolio. This is precursor to rating regulation - if rating provider gives high ESG rating without basis, fund using it also liable.

4. UK FCA vs ESG Rating Provider - No direct case yet, but UK is consulting
UK FCA proposing similar regime. In ClientEarth vs FCA (2023) judicial review attempt to force FCA to require ESG rating disclosure - dismissed but pushed regulation.

5. France - AMF vs ESG Rating Agency - First sanction
French AMF in 2023 fined ESG rating provider for conflicts - providing consulting to same company it rated. Used general MiFID conflict rules. EU Regulation now makes this explicit prohibition.

6. EU Taxonomy - Impact on Ratings - Case of French Energy Company
Under EU Taxonomy, gas was considered transitional green. ESG rating agencies gave different ratings to same utility based on gas exposure. Investors sued rating agencies for lack of transparency - settled. Regulation Art 21 now requires disclosure whether taxonomy alignment considered.

7. Spanish Supreme Court - STS 2022 on Green Bonds
Spanish Supreme Court held that second party opinion (not ESG rating) that was misleading could lead to prospectus liability under Securities Market Law. Principle extended to ESG ratings post-2026 - rating provider can be liable for negligent rating.

6. Timeline for Spain / EU Companies

Now to 2 July 2026 - Transitional Period:

• ESG rating providers should apply to ESMA now - ESMA consultation on RTS published 2 May 2025, Final Report 15 Oct 2025 submitted to Commission
• Users (banks, asset managers in Spain) must map which ESG ratings they use, check if provider plans authorisation
• Contracts must add clause: Provider will be ESMA authorised by 2 July 2026, otherwise termination right

After 2 July 2026:

• Use of non-authorised ESG rating in EU is prohibited for regulated financial undertakings when used for investment decision or disclosure under SFDR/CSRD
• Spanish financial institutions using MSCI, Sustainalytics etc must ensure provider has ESMA authorisation or endorsed via EU entity
• CNMV can request proof

Penalties:

• ESMA can fine up to 10% annual turnover, withdraw authorisation, public censure
• CNMV can sanction Spanish users - fine up to €5m or 10% turnover for using unauthorised rating

7. Practical Compliance Checklist for Spanish Entity Using ESG Ratings

1. Inventory: List all ESG ratings used (e.g., MSCI ESG Score for fund)
2. Classify: Is it in scope of Regulation? Is it private internal?
3. Provider status: Is provider EU-established? Has it applied to ESMA? If third country, equivalence/recognition/endorsement path?
4. Methodology review: Does provider disclose methodology as per Art 21? Does your SFDR disclosure match?
5. Contract: Add Article 11 endorsement clause, audit right, liability clause
6. CNMV reporting: For funds, ensure 50% rule + rating transparency
7. Complaint: Set up process to challenge rating if you are rated entity