Environmental, Social and Governance (ESG) Rating

The Regulation on the transparency and integrity of Environmental, Social and Governance (ESG) rating activities (ESG Rating Regulation (EU) 2024/3005) introduces a common regulatory approach to enhance the integrity, transparency, comparability where possible, responsibility, reliability, good governance and independence of ESG rating activities. This Regulation supports the EU’s sustainable finance goals by enhancing the quality of ESG ratings and protecting consumers and investors. It also aims to prevent greenwashing and misinformation by establishing clear rules for ESG rating providers.

In practical terms, this Regulation involves both a new authorisation regime and also detailed new governance and conduct of business requirements. To this end, the Regulation brings ESG rating providers within the supervisory perimeter of the European Securities and Markets Authority (ESMA), and rests on four operative pillars: authorisation, organisational separation, disclosure, and supervision/enforcement, each summarised with its concrete, numbered requirements in “What the Regulation requires” below.

Regulatory architecture

Level 1 Regulation (EU) 2024/3005 of 27 November 2024 on the transparency and integrity of ESG activities. In force 1 January 2025, applicable from 2 July 2026.

 Level 2 Commission Delegated Regulations

Within this Regulation the following key definitions apply:

• ESG rating means an opinion or a score, or a combination of both, regarding a rated item’s profile or characteristics with regard to environmental, social and human rights, or governance factors, or regarding a rated item’s exposure to risks or impact on environmental, social and human rights, or governance factors, that is based on both an established methodology and a defined ranking system of rating categories, irrespective of whether such ESG rating is labelled as “ESG rating”, “ESG opinion” or “ESG score”.
• ESG opinion means an ESG assessment that is based on a rule-based methodology and a defined ranking system of rating categories, and that directly involves a rating analyst in the rating process.
• ESG score means an ESG measure derived from data, using a rule-based methodology, and based only on a pre-established statistical or algorithmic system or model, without any additional substantial analytical input from a rating analyst.
• ESG rating provider means a legal person whose activities include the issuance, and the publication or distribution, of ESG ratings on a professional basis.

What the Regulation requires

Together with four already-in-force delegated acts (technical rules), and one still pending, the EU ESG Ratings Regulation – (EU 2024/3005) comes down to four practical requirements for anyone providing ESG ratings in the EU:

1. Getting permission to operate (C(2026)3334) and ((EU) 2026/910)

Before a firm can sell ESG ratings in the EU, it generally needs a licence, similar to needing a permit before you can open a business. The licence comes from ESMA, the EU’s markets regulator. This process depends on the nature of the ratings provider as outlined below:

• EU-based providers apply to ESMA and have to hand over information about who owns the company, how it’s governed, who’s on the senior team, and how it operates day-to-day. ESMA has 25 working days to check the paperwork is complete, then up to 90 days (or 120 in more complex cases, e.g. where the firm also wants to use outsourcing) to say yes or no. Once granted, the licence covers the whole EU, no need to apply country by country.
• Smaller providers get a lighter-touch option: instead of a full licence, they can simply register with ESMA and follow a reduced set of rules. That lasts for three years, or until they grow too big to count as “small”, whichever comes first, at which point they have six months to apply for the full licence.
• Providers based outside the EU have three ways in: (a) their home country’s regulatory regime can be formally recognised as equivalent to the EU’s, (b) an already-licensed EU provider can “endorse” their ratings, or (c) if they’re small enough, they can go through a simplified recognition process. 
• It isn’t free: a full EU licence costs €40,000 (or €20,000 for a smaller provider stepping up to full status), plus €5,000 for extras such as outsourcing approval. Overseas providers pay €10,000–€40,000 depending on the route in. On top of that, every provider pays an annual fee based on how much revenue it makes from ratings (capped at 2% of that revenue for smaller providers).

2. Keeping ratings independent from other business lines ((EU) 2026/872)

The concern here is conflicts of interest: a firm that rates companies on ESG shouldn’t also be advising those same companies, or have some other financial stake in the outcome.

• A ratings provider generally cannot also run, from the same legal entity: consulting services, credit ratings, benchmark administration, investment services, statutory audit, or banking/insurance.
• Two exceptions: a firm can keep investment services or banking/insurance in-house if it builds strong internal walls between that business and its ratings business. Running a benchmarks business alongside ratings needs ESMA’s sign-off first.
• What “building walls” actually means: separate teams and reporting lines, so the people writing the ratings aren’t mixed in with the other business; separate office space for rating staff; staff signing an annual declaration that they’re not involved in the other business; and, for banking/insurance specifically, extra IT security, staff training, and monitoring of communications. Firms have to check every two years that these walls are still working, and fix them if not.

3. What has to be published, and to whom ((EU) 2026/871)

There are two audiences, and two levels of detail.

• For everyone (published on the provider’s website): a plain overview of how the ratings are worked out, the methodology used, what data goes in, whether it looks backward or forward in time, who owns the company, and whether the rating measures risk, impact, or both.
• Ratings must be broken into separate Environmental, Social and Governance scores rather than one blended number, unless the provider clearly explains how it weighted the three factors together.
• For the company being rated, and anyone paying to use the rating: a deeper level of detail, the specific data and assumptions behind the numbers, why a rating changed, and whether it lines up with the EU’s sustainability taxonomy.
• All of this has to be laid out in the same order for every provider, so that two different ratings can be compared side by side rather than each provider using its own confusing format.

4. Who checks up on providers, and what happens if they break the rules ((EU) 2026/904)

• ESMA polices the whole market: it can ask questions, investigate, inspect offices, and pull a firm’s licence if things go wrong. It can hand day-to-day tasks to national regulators (like the CSSF in Luxembourg), but stays in charge overall.
• The system is funded by the ratings providers themselves, through the licence and annual fees above, not by investors or the companies being rated.
• Breaking the rules can mean fines, under a separate set of procedural rules.

The Regulation traces back to the Commission’s 2018 Action Plan on Financing Sustainable Growth, which sought to mainstream sustainability factors into risk management and reorient capital flows towards sustainable investment. As a follow-up, a 2021 Commission-commissioned study (‘Study on Sustainability-Related Ratings, Data and Research’) and a 2022 public consultation both confirmed concerns about conflicts of interest, and a lack of transparency and accuracy in ESG rating methodologies and terminology.

Following market consultations and research, it was acknowledged that ESG ratings play an important role in global capital markets, as investors, borrowers, and issuers increasingly use ESG ratings as part of the process of making informed decisions relating to sustainable investment and financing. Better comparability and increased reliability of ESG ratings would enhance the efficiency of that fast-growing market, thereby facilitating progress towards the objectives of the European Green Deal.

To that end, the objective of the ESG Rating Regulation is to enhance the transparency and reliability of ESG ratings. The Regulation ensures that investors and other stakeholders have access to clear, comparable, and trustworthy information about ESG ratings and their methodologies. By doing so, it aims to promote sustainable investments, and foster confidence in the sustainability performance of companies.

It aims to contribute to the smooth functioning of the internal market while achieving a high level of consumer and investor protection, and to prevent greenwashing and other types of misinformation, including ‘social washing’, by introducing transparency requirements for ESG ratings and rules on the organisation and conduct of ESG rating providers.

Within the boundaries of this Regulation, the ESG rating providers must disclose their methodologies, models, and key rating assumptions, ensuring greater transparency and comparability. The Regulation imposes governance requirements on ESG rating providers to manage conflicts of interest and ensure their independence, and it requires ESG rating providers offering services in the EU to be authorised and supervised by the ESMA.

The ESG Rating Regulation applies to ESG rating providers operating within the EU; however, the test for “operating in the Union” is not the same for providers established in the EU as it is for providers established outside the EU. For providers established in the Union, either of the following is enough to bring them into scope:

• issues and publishes ESG ratings on their website or through any other means (no subscription or contract needed, simply publishing is enough);
• or issues and distributes ESG ratings under subscription or another contractual relationship to EU regulated financial undertakings, large undertakings or listed companies (within the meaning of the Accounting Directive or the Transparency Directive), or EU/national public bodies

For providers established outside the Union, only the second limb applies; merely publishing ratings on a website is not enough to bring a non-EU provider into scope. A non-EU provider is only caught where it issues and distributes ratings by subscription or other contractual relationship to that same list of EU recipients.

Overview of regulatory pathways for all types of providers:

• EU-established providers must generally obtain authorisation from ESMA, though small providers (meeting the small-undertaking/small-group thresholds under the Accounting Directive) can instead use the lighter temporary registration regime under Article 5, rather than seeking full authorisation.
• Third-country providers can operate via (a) an equivalence decision for their home jurisdiction, followed by registration, (b) endorsement by an EU-authorised provider, or (c) recognition, available below a quantitative size threshold.

However, there are exemptions. These include private ESG ratings not intended for public disclosure or distribution, raw ESG data, ratings produced by regulated financial undertakings for internal use, ratings by EU and national public authorities, and certain European System of Central Banks (ESCB) ratings. The following provides a broader breakdown of those that the ESG Ratings Regulation does not apply to:

• Private ESG ratings that are not intended for public disclosure or distribution;
• ESG ratings issued by regulated financial undertakings in the Union that are used exclusively for internal purposes or for providing in-house or intragroup financial services or products;
• ESG ratings issued by regulated financial undertakings in the Union that are incorporated into a product or service already regulated under Union law (including under the SFDR, MiFID II, the Credit Rating Agencies Regulation, Solvency II, UCITS, AIFMD, the Benchmarks Regulation and the Taxonomy Regulation) and disclosed to third parties — provided that, where such a rating is disclosed as part of marketing communications, the institution publishes the point 1 of Annex III information on its website and includes a link to it in the communication (unless already subject to SFDR Article 13(3));
• ESG ratings issued by third-country providers not authorised or recognised under the Regulation, where the rating is distributed at the own exclusive initiative of a Union user, without any prior solicitation or promotion by the provider, and provided there is no substitute offered by an authorised provider;
• The publication or distribution of data on environmental, social and human rights, and governance factors;
• Credit ratings issued pursuant to Regulation (EC) No 1060/2009, and any ESG-related scores or assessments produced or published as part of credit-rating methodologies or as an input or output of creditworthiness assessment;
• Products or services that incorporate an element of an ESG rating, including investment research as laid down in Directive 2014/65/EU;
• External reviews of European Green Bonds, as provided for in Regulation (EU) 2023/2631;
• External reviews and second-party opinions on bonds marketed as environmentally sustainable, sustainability-linked, or sustainable, but only to the extent that they do not contain ESG ratings issued by the external reviewer or second-party opinion provider;
• ESG ratings issued by Union institutions, bodies, offices and agencies, or by Member State public authorities, where not published or distributed for commercial purposes;
• ESG ratings issued by members of the European System of Central Banks (ESCB), where not published or distributed for commercial purposes;
• Mandatory disclosures under Articles 6, 8, 9, 10, 11 and 13 of Regulation (EU) 2019/2088 (SFDR);
• Disclosures under Articles 5, 6 and 8 of Regulation (EU) 2020/852 (Taxonomy Regulation);
• ESG ratings issued by an authorised ESG rating provider where such ratings are published or distributed by a third party;
• ESG ratings developed exclusively for accreditation or certification processes, which do not target investment analysis, financial analysis, investment decision-making or financial decision-making;
• Labelling activities, provided that the labels granted to the relevant entities, financial instruments or financial products do not involve the disclosure of an ESG rating;
• ESG ratings published or distributed by non-profit organisations for non-commercial purposes, except where they charge rated items or issuers to report data or be rated, or charge users to access ESG rating information, in which case they are subject to the Regulation.

Where a financial institution develops and publishes its own ESG ratings, it must disclose its methodology, models and key rating assumptions in the same way an authorised ESG rating provider would, even where it is relying on one of the exemptions from full authorisation (see “To whom does it apply?” for when this applies).

Where a financial institution uses ESG ratings bought in from a rating provider, it benefits from a range of new protections built into the Regulation:

• Clear and comparable disclosure of the methodology behind the rating (Articles 23–24);
• Fees that must be fair, reasonable, transparent and non-discriminatory, with ESMA able to demand evidence of the provider’s pricing policy and fine it if fees don’t meet that standard (Article 27); and
• Organisational and staff-level safeguards designed to identify, manage and disclose conflicts of interest, so the rating isn’t compromised by the provider’s other business interests (Articles 25–26).

Where a financial institution is the subject of a rating (a “rated item,” or the issuer of one), it has two specific rights before a rating is first issued about it:

• Advance notice. The provider must notify the rated institution, during working hours, at least two full working days before the rating is first issued — giving it a chance to flag any factual errors before publication. This notice requirement only applies to the first issuance of a rating, not to later updates.
• Access to the underlying data. On request, and free of charge on a non-commercial basis, the provider must give the rated institution the specific data it used to rate it (including when that data was last updated). This is strictly a fact-checking mechanism — the institution can correct errors in the data, but has no right to influence the provider’s methodology or the resulting rating.

Where a financial institution has a complaint about a rating, whether as a user, a rated item, or an issuer, providers are required to maintain and publish a complaints-handling procedure, investigate complaints in a timely and fair manner, and communicate the outcome within a reasonable period (Article 19).

The ESG Rating Regulation does not operate in isolation; it sits alongside, and in places directly amends, several other pillars of the EU sustainable finance framework:

• SFDR (Regulation (EU) 2019/2088): Article 49 of the ESG Rating Regulation amends Article 13 of the SFDR. Where a financial market participant or financial adviser discloses to third parties, as part of its marketing communications, an ESG rating that it has issued, it must publish on its website the same core information (point 1 of Annex III) that an authorised ESG rating provider would disclose, and include a link to that disclosure in the marketing communication. Conversely, mandatory disclosures made under SFDR Articles 6, 8, 9, 10, 11 and 13 are themselves exempted from the ESG Rating Regulation, to avoid duplication.
• ESAP (Regulation (EU) 2023/2859): The ESG Rating Regulation also amends the European Single Access Point Regulation. From 1 January 2028, ESG rating providers must submit to the relevant collection body, at the same time as they make it public, any information required under the Regulation, so that it becomes accessible through the
• Taxonomy Regulation (Regulation (EU) 2020/852): an ESG rating provider may use alignment with the EU Taxonomy as a relevant factor or key performance indicator within its methodology, but an ESG rating is not, and must not be presented as, a label certifying Taxonomy alignment or compliance with any other sustainability standard. Mandatory disclosures made under Articles 5, 6 and 8 of the Taxonomy Regulation fall outside the scope of the ESG Rating Regulation.
• CSRD (Directive (EU) 2022/2464): alongside SFDR and the Taxonomy Regulation, the CSRD is recognised by the ESG Rating Regulation as one of the landmark EU initiatives that improves the availability, quality and consistency of the ESG data flowing through the value chain of financial market participants, data which, in turn, feeds into and improves the quality of ESG ratings.
• Credit Rating Agencies Regulation ((EC) No 1060/2009): given the significant similarities between credit rating and ESG rating activities, the ESG Rating Regulation’s supervisory framework is closely aligned with the CRA Regulation, and ESMA, already responsible for supervising credit rating agencies, has correspondingly been entrusted with the supervision of ESG rating providers. Credit ratings themselves, and any ESG-related scores or assessments produced as part of a credit-rating methodology, fall outside the ESG Rating Regulation’s scope.
• Benchmarks Regulation (Regulation (EU) 2016/1011): to safeguard independence, Article 16 of the ESG Rating Regulation generally prevents an ESG rating provider from also acting as a benchmark administrator from within the same legal entity, subject to a limited carve-out that requires ESMA approval.
• MiFID II (Directive 2014/65/EU): investment research and other products or services that merely incorporate an element of an ESG rating (rather than constituting a standalone ESG rating) fall outside scope, and investment services and activities as defined under MiFID II benefit from a carve-out from the Article 16 separation-of-activities requirement.
• European Green Bonds Regulation (Regulation (EU) 2023/2631): external reviews of European Green Bonds, and external reviews or second-party opinions on bonds, loans and other debt instruments marketed as sustainable, fall outside the scope of the ESG Rating Regulation, provided they do not themselves contain an ESG rating issued by the reviewer or opinion provider.

As an EU Regulation, the ESG Rating Regulation is directly applicable in Luxembourg and does not need to be transposed into national law.

That said, the CSSF published a Communication to market participants on 1 July 2026 on the application of the ESG Ratings Regulation and the new SFDR disclosure requirements. In it, the CSSF:

• flags that Article 49 of the ESG Rating Regulation amends Article 13 of SFDR;
• confirms that Luxembourg financial market participants and financial advisers within SFDR’s scope must, where they disclose an ESG rating to third parties as part of marketing communications, publish the same core information (point 1 of Annex III) on their website, with a link from the marketing communication, and expects compliance from 2 July 2026;
• says it will take a proportionate approach in its supervisory practice, given remaining uncertainties in the regulatory landscape; and
• cross-references ESMA’s Public Statement of 1 July 2026, which clarifies the transitional treatment of third parties publishing or distributing ratings from existing (not-yet-authorised) providers between 2 July and 2 November 2026.

Beyond this Communication, there are no Luxembourg-specific gold-plating measures or additional national requirements under the ESG Rating Regulation.

• 27 November 2024: The Regulation was adopted by the European Parliament and the Council;
• 12 December 2024: The Regulation was published in the Official Journal of the European Union (OJ L, 2024/3005);
• 01 January 2025: The Regulation enters into force;
• 02 May 2025: ESMA published its Consultation Paper on the draft regulatory technical standards (feedback open until 20 June 2025);
• 02 October 2025: Deadline for ESMA to submit its draft regulatory technical standards to the Commission (Articles 6(3), 12(9), 16(5), 23(4), 24(3));
• 02 July 2026: Application date of the ESG Rating Regulation;
• 28–30 July 2026: Publication in the Official Journal of the four disclosure/separation/fees/fines delegated regulations (entering into force between 31 July and 19 August 2026);
• 02 August 2026: Deadline for existing ESG rating providers that operated in the Union at the date of entry into force to notify ESMA of their intention to continue operating (Article 51(1));
• 02 November 2026: Deadline for those providers to submit a full application for authorisation or recognition (within four months of 2 July 2026); small providers under the Article 5 proportionate regime must notify ESMA by this date (Article 51(3));
• 01 January 2028: When making public any information required by the Regulation, the ESG rating provider shall submit that information at the same time to the collection body for the purpose of making it accessible on the European single access point (ESAP);
• 02 January 2029: The Commission shall evaluate the application of the ESG Rating Regulation.

• 06 July 2021: Renewed EU Sustainable Finance Strategy, including a pledge to improve reliability, comparability and transparency of ESG ratings;
• 03 February 2022: ESMA Call for Evidence and targeted consultation on ESG ratings;
• 04 April 2022: The Commission launches of a call for evidence to gather stakeholders’ views about the use of ESG ratings, its functioning and potential issue;
• 27 June 2022: ESMA publishes results of its Call for Evidence on ESG ratings;
• 13 June 2023: The Commission presented a proposal on a Regulation on transparency and integrity of ESG rating activities, as part of its renewed sustainable finance strategy;
• 05 February 2024: The Council and European Parliament reached provisional agreement on proposed EU ESG Rating Regulation;
• 27 November 2024: The Regulation was adopted by the European Parliament and the Council;
• 12 December 2024: The Regulation was published in the Official Journal of the European Union (OJ L, 2024/3005);
• 01 January 2025: The Regulation enters into force.
• 02 May 2025: ESMA published its Consultation Paper on the draft regulatory technical standards (feedback open until 20 June 2025);
• 15 October 2025: ESMA published its Final Report on the technical standards under the ESG Rating Regulation;
• 16 January 2026: The Commission launched a public feedback collection covering ESMA fees and ESMA fines/penalties procedures for ESG rating providers.
• 21 April 2026: The Commission adopted the disclosure RTS ((EU) 2026/871) and the separation-of-activities RTS ((EU) 2026/872);
• 24 April 2026: The Commission adopted the ESMA fees RTS ((EU) 2026/910) and the fines procedure delegated regulation ((EU) 2026/904);
• 29 April 2026: ESMA launched a public consultation on draft guidelines for the endorsement of ESG ratings developed outside the EU.
• 26 May 2026: The Commission adopted the authorisation and recognition RTS (C(2026)3334), specifying the information to be included in applications for authorisation and recognition (including endorsement);
• 02 July 2026: Application date of the ESG Rating Regulation — from this date, any entity that professionally issues, publishes or distributes ESG ratings in the Union must be authorised, recognised or registered by ESMA;
• 28–30 July 2026: The four disclosure/separation/fees/fines delegated regulations were published in the Official Journal (entering into force between 31 July and 19 August 2026);
• 02 August 2026: Deadline for existing ESG rating providers operating in the Union to notify ESMA of their intention to continue operating (Article 51(1));
• 02 November 2026: Deadline for those providers to submit a full application for authorisation or recognition (within four months of 2 July 2026); small providers under the Article 5 proportionate regime must notify ESMA by this date (Article 51(3)).

There is currently no open consultation process.

EU Level:

Level 1- Regulation

• Regulation (EU) 2024/3005 — EUR-Lex(adopted 27 November 2024, published 12 December 2024, in force 1 January 2025, applies from 2 July 2026)

Level 2 – Commission Delegated Regulations

• Delegated Regulation (EU) 2026/871 — disclosure RTS (Art. 23–24, Annex III)(ELI: europa.eu/eli/reg/2026/871/oj) : adopted 21 April 2026, in force 17 August 2026
• Delegated Regulation (EU) 2026/872 — separation-of-activities RTS (Art. 16)(ELI: europa.eu/eli/reg/2026/872/oj) : adopted 21 April 2026, in force 17 August 2026
• Delegated Regulation (EU) 2026/910 — ESMA fees RTS (Art. 42)(ELI: europa.eu/eli/reg/2026/910/oj) : adopted 24 April 2026, in force 31 July 2026
• Delegated Regulation (EU) 2026/904 — fines procedure (Art. 39)(ELI: europa.eu/eli/reg/2026/904/oj) : adopted 24 April 2026, in force 19 August 2026
• Delegated Regulation C(2026)3334 — authorisation/recognition RTS (Art. 6, 12, Annex I): adopted 26 May 2026, applies from 2 July 2026, pending OJ publication

ESMA materials

• ESMA: ESG Rating Providers hub
• ESMA Consultation Paper (2 May 2025) (feedback closed 20 June 2025)
• ESMA Final Report (15 October 2025)
• ESMA Master Application Template (May 2026)
• ESMA Consultation Paper Guidelines on Endorsement under Article 11 (29 April 2026) (feedback closed 29 May 2026)
• ESMA Public Statement — transition period publication/distribution of ESG ratings (July 2026)
• ESMA Q&As (ESG Rating Regulation):
  • Q&A 2737 — group-affiliated small providers
  • Q&A 2738 — ESMA assessment of temporary regime notification
  • Q&A 2739 — content of temporary regime notification
  • Q&A 2740 — small provider no longer meeting size requirements

National / supervisory

• CSSF communication to market participants (1 July 2026)

Related EU instruments amended by the Regulation

• SFDR — Regulation (EU) 2019/2088(Article 13 amended by ESG Ratings Regulation Art. 49)
• ESAP — Regulation (EU) 2023/2859