1. The Core Regulation

Regulation (EU) 2024/3005 on transparency and integrity of ESG rating activities - ESG Ratings Regulation

• Published in Official Journal 12 Dec 2024, entered into force 20 days after, on 1 Jan 2025, and will be applicable 18 months later, as of 2 July 2026
• First time ESG rating providers are under direct supervision of ESMA. Before, MSCI, S&P Global, Moody's, Morningstar Sustainalytics, EcoVadis were unregulated.
• Objective: curb greenwashing, mandate transparent rating methodologies, enforce strict conflict-of-interest controls.

What is ESG Rating? Art 3(1): An opinion, score, or combination thereof, regarding ESG profile or characteristics, or exposure to ESG risks, or impact on ESG, provided to third party, based on established methodology.

Includes: Aggregated E+S+G ratings, single pillar ratings like Climate rating, Double materiality ratings.

Excludes: ESG second-party opinions, assurance, ESG labels, investment research under MiFID.

2. Who Must Be Authorised?

Any legal person that wishes to operate as ESG rating provider in EU must obtain authorisation from ESMA if EU-established.

From November 2, 2026, only ESG rating providers with ESMA authorization, equivalence decision, or recognition can offer ratings in EU. Providers must apply to ESMA, which has 90 working days to assess application.

3+1 Access Routes:

Route 1: EU Authorisation - Art 6
For EU-based providers like EcoVadis, Inrate, ISS ESG EU entities. Requirements:

• Legal entity in EU
• Governance, independence, conflict-of-interest management, transparent methodologies
• Ownership disclosure, structure and business model
• Separation: Providers must stop providing consulting services to investors, sale of credit ratings and development of benchmarks among other things to avoid conflicts.
• Authorised providers will sit on public ESMA register under Art 14

Route 2: Equivalence - Art 10
For non-EU providers where Commission says third-country regime equivalent. e.g., US SEC ESG rating regime if adopted. MSCI, S&P Global US would rely on this if equivalence granted. Currently no equivalence decision exists.

Route 3: Recognition - Art 9
For small non-EU providers with consolidated turnover < EUR 12m. Must be certified by ESMA and have legal representative in EU.

Route 4: Endorsement - Art 11
Most important for US majors. Consultation paper for Guidelines on Endorsement under Article 11 of ESG Rating Regulation. For those entities that apply for authorisation there is possibility to also apply to endorse ESG ratings from legal entity established outside of EU. Requirements to endorse are set out in Article 11(1) and 11(2).

Example: MSCI UK Ltd or S&P EU entity gets authorised, then endorses ratings produced by MSCI Inc USA, S&P Global USA. Endorsing entity remains fully responsible.

Expected: Non-EU providers like MSCI, S&P Global and Morningstar Sustainalytics are expected to pursue equivalence, recognition or endorsement routes instead of direct EU authorisation

3. Timeline

• 2 July 2026: Regulation applicable. From this date, ESMA becomes direct supervisor
• 2 Aug 2026: Provider notifications due to continue operations under transitional period - must notify ESMA by 2 Aug 2026 to continue operations
• 2 Nov 2026: Full applications due - with ESMA authorization request deadline 2 Nov 2026
• ESMA has received authorization requests from 109 sustainability rating entities seeking to distribute ESG assessments across bloc. Surge marks shift toward tighter supervision

4. Spain - Role of CNMV

Spain has not yet fully transposed CSRD, but ESG Ratings Regulation does not need transposition - it is direct.

CNMV actions:

a) Joint CNMV-ICAC Communication 27 Nov 2024: On 27 November 2024, Spanish Securities Market Commission and Accounting and Audit Institute published joint statement recommending corporations publish sustainability reports in line with CSRD, despite fact CSRD had not yet been transposed into Spanish law. Shows Spanish approach: apply EU sustainability framework even before national law.

b) Consultation on Endorsement: CNMV via ESMA consultation paper for Guidelines on Endorsement under Art 11. CNMV will be consulted but ESMA decides. Spanish authorised entity can endorse non-EU ratings.

c) Supervision of Use: CNMV already supervises users of ESG ratings - asset managers. On 13 Oct 2025, CNMV released main conclusions of Common Supervisory Action on integration of sustainability risks and ESG disclosures within asset management sector, conducted with ESMA, assessing SFDR, Taxonomy, UCITS and AIFMD compliance. Found satisfactory compliance but called for greater transparency.

d) Fund Names Guidelines: CNMV notified ESMA of compliance with Guidelines on fund names using term ESG. From May 2025, ESMA guidelines require funds using ESG terms to demonstrably hold assets that reflect those terms. CNMV will consider guidelines for authorising funds that use term ESG. If fund uses MSCI ESG rating to justify name, rating must be from ESMA-authorised provider post July 2026.

e) Sustainability Preferences: CNMV conducted horizontal supervisory action regarding compliance with sustainability preferences by investment firms under MiFID - entities must ask clients whether they have sustainability preferences.

So in Spain: ESMA authorises provider, CNMV supervises Spanish banks, funds, advisers using the rating, and sanctions misuse.

5. Substantive Obligations - What Provider Must Do

1. Transparency: Publish methodology, models, key assumptions, data sources, whether rating based on estimated data, and limitations.
2. Conflict Management: Separate business lines - no consulting to rated entity, no credit rating provision in same entity, disclosure of ownership.
3. Governance: Independent oversight function, complaint handling.
4. No Cherry-picking: Must provide annual review.

Breach leads to ESMA fines up to 10% of annual turnover, public notice, withdrawal of authorisation.

6. Case Law - Early Enforcement (Pre-Regulation Greenwashing Cases That Drove Regulation)

No final court case under 2024/3005 yet because applicable July 2026, but case law that shaped it:

1. DWS / Deutsche Bank Greenwashing - Frankfurt Prosecutor 2024
DWS Asset Management marketed funds as ESG while ESG factors not considered. Settled with SEC $25m 2023, German prosecutor fine €25m 2024. Cited by Commission impact assessment: "providers must stop providing consulting services to avoid conflicts" - because rating agencies were selling consulting to same issuers they rated.

2. ESMA Fund Name Enforcement 2025
ESMA moved aggressively in 2025 to address greenwashing from fund naming side: guidelines came into force May 2025, require funds using ESG terms to demonstrably hold assets that reflect those terms. CNMV applying this. Funds using unregulated MSCI/Sustainalytics ratings to claim Article 8/9 status forced to divest or rename - over 300 funds renamed in EU in Q2 2025.

3. Dutch AFM vs Sustainalytics 2022 (Informal)
AFM investigated issuer-pays model: predominant business model is investor pays, but provision on issuer-pay basis indicated in around third of responses. Concern of conflict where rated entity pays for its own ESG rating - led to Art 14(7) prohibition of certain conflicts.

4. EU Court of Justice Potential - Future
Art 11 endorsement liability: endorsing EU entity fully liable for non-EU rating. Expected first cases 2027 will test if MSCI EU can be liable for methodology failures of MSCI USA.

7. Practical Impact for Spanish Entity

If you are:

• Spanish corporate buying ESG rating: From 2 July 2026, ensure provider is on ESMA public register. If not, you cannot use it for regulatory disclosure under CSRD/SFDR - CNMV will qualify your sustainability report.
• Spanish fintech offering ESG scores: You are ESG rating provider if you publish score to third party. Must apply to ESMA by 2 Nov 2026 via CNMV notification, unbundle consulting, create independent oversight.
• Non-EU provider selling in Spain: Appoint EU subsidiary in Spain/Ireland/Luxembourg for authorisation and endorsement, or apply for recognition.