EUROPEAN COURT OF AUDITORS

12, rue Alcide De Gasperi

1615 Luxembourgp

LUXEMBOURG

Tel. +352 4398-1

Email: eca-info@eca.europa.eu

Internet: http://eca.europa.eu

Twitter: @EUAuditorsECA

YouTube: EUAuditorsECA

More information on the European Union is available on the internet (http://europa.eu).

Luxembourg: Publications Office of the European Union, 2015

Print | ISBN 978-92-872-3585-5 | ISSN 1831-0834 | doi:10.2865/330292 | QJ-AB-15-022-EN-C
PDF | ISBN 978-92-872-3591-6 | ISSN 1977-5679 | doi:10.2865/922715 | QJ-AB-15-022-EN-N
EPUB | ISBN 978-92-872-3586-2 | ISSN 1977-5679 | doi:10.2865/524378 | QJ-AB-15-022-EN-E

© European Union, 2015

Reproduction is authorised provided the source is acknowledged.

HOW TO OBTAIN EU PUBLICATIONS

Free publications:

•one copy:
via EU Bookshop (http://bookshop.europa.eu);

•more than one copy or posters/maps:
from the European Union’s representations (http://ec.europa.eu/represent_en.htm);
from the delegations in non-EU countries (http://eeas.europa.eu/delegations/index_en.htm);
by contacting the Europe Direct service (http://europa.eu/europedirect/index_en.htm) or
calling 00 800 6 7 8 9 10 11 (freephone number from anywhere in the EU) (*).

(*)The information given is free, as are most calls (though some operators, phone boxes or hotels may charge you).

Priced publications:

•via EU Bookshop (http://bookshop.europa.eu).

EN
2015

NO 22

Special Report

EU supervision of
credit rating agencies –
well established but not
yet fully effective

(pursuant to Article 287(4), second subparagraph, TFEU)

Audit team

The ECA’s special reports set out the results of its performance and compliance audits of specific budgetary areas or management topics. The ECA selects and designs these audit tasks to be of maximum impact by considering the risks to performance or compliance, the level of income or spending involved, forthcoming developments and political and public interest.

This performance audit was produced by Audit Chamber IV — headed by ECA Member Milan Martin Cvikl — which specialises in auditing revenue, research and internal policies, financial and economic governance and the European Union’s institutions and bodies. The audit was led by ECA Member Baudilio Tomé Muguruza, supported by the head of his private office, Daniel Costa de Magalhães and Ignacio García de Parada, attaché; Zacharias Kolias, director; Daniela Hristova, team leader, Irene Madsen, team leader; Christian Detry, Adrian Savin, Matthias Blaas, auditors.

From left to right: D. Costa de Magalhães, C. Detry, I. Madsen, M. Blaas, B. Tomé Muguruza, Z. Kolias, D. Hristova, A. Savin.

Contents

Abbreviations

Executive summary

Introduction

Regulatory reforms

The main characteristics of the CRA regulation

ESMA’s role

Audit approach

Part I — Registration and perimeter activities

Introduction

ESMA shortened the registration process, but the assessment of some criteria remains challenging

ESMA has well-established registration procedures for CRAs

ESMA shortened the registration process, but it remains cumbersome due to the regulatory requirements

The level of detail provided by the CRAs on the methodologies varied

ESMA did not have a structured approach to monitoring perimeter activities

The current approach of the Eurosystem does not guarantee that all ESMA-registered CRAs are on an equal footing

Part II — Planning and risk management

The risk-oriented planning process does not provide full assurance that ESMA gets the most out of its resources

Comprehensive risk identification, but difficult to trace

High-risk areas were not always sufficiently covered

ESMA resources make it difficult to satisfy all demanding regulatory requirements

Part III — Supervision

ESMA’s ongoing supervision and investigations

Supervision process designed and implemented, but needs time to mature

ESMA laid down good foundations for effective supervision of CRAs

Internal guidelines and monitoring tools could be further developed to support ongoing supervisory work

ESMA manages a huge volume of supervisory information, but does not have a dedicated IT tool for registering and processing this data

Getting a description of the supervisory checks performed is difficult

Real progress, but not yet adequate coverage in analysed thematic areas

Methodologies supervised, but not all areas covered and requirements not always clear

ESMA has not yet examined certain types of conflict of interest

Part IV — Disclosures

ESMA’s supervision of CRAs’ general disclosures

ESMA regularly checked the individual CRAs’ general public disclosures, but a detailed assessment across CRAs of the general disclosure was carried out for the first time in late 2014

Market transparency impeded by restrictions and varying CRAs’ disclosure practices

CEREP does not disclose sufficient information on CRAs’ ratings performance

ESMA does not disclose sufficient information to ratings users on its website

Conclusions and recommendations

Registration

Risk management and planning

Ongoing supervision and investigations

Methodologies

Conflicts of Interest

General disclosure

CEREP disclosures

ESMA website disclosure

Annex I | — | ESMA’s governance structure
Annex II | — | Audit approach
Annex III | — | Main findings and recommendations of ESMA’s investigations
Annex IV | — | Comparison of the websites of the supervisors in the EU and the US

Replies of ESMA, the ECB and the Commission

Abbreviations

ABS: Asset-backed security

CEREP: Central repository

CESR: Committee of European Securities Regulators

CRA: Credit rating agency

CRAR: Credit rating agency regulation

ECAI: External credit assessment institution

ECAF: Eurosystem credit assessment framework

ECB: European Central Bank

ESMA: European Securities and Markets Authority

IOSCO: International Organisation of Securities Commissions

NCA: National Competent Authority

NRSRO: Nationally Recognised Statistical Rating Organisation

RMBS: Residential mortgage-backed securities

SEC: Securities and Exchange Commission (United States)

Socrat: Supervision of Credit Rating Agencies Tool

Executive summary

I

The global financial crisis in 2008 focused attention on the role of credit rating agencies (CRAs) and the impact of their ratings on financial markets. The activities of CRAs, which at that time were barely regulated in Europe, entered onto the EU’s legislative agenda.

II

The European Securities and Markets Authority (ESMA) was established on 1 January 2011. One of its main tasks is to regulate credit rating agencies registered in the EU. To do so, ESMA has been given exclusive powers to register the credit rating agencies, to monitor their performance, and to take supervisory decisions. Currently, ESMA supervises 23 credit rating agencies registered in the EU.

III

Has ESMA succeeded in establishing itself as the credit rating agency (CRA) watchdog in the EU? Our overall conclusion is that ESMA has laid down good foundations for carrying out supervision of the CRAs in the EU in a short period of time. However, there is still room for improvement.

IV

ESMA took over the registration of credit rating agencies from the national competent authorities and managed to reduce the average duration of the registration process. However, the process remains complex due to current regulatory framework. Although credit rating methodologies should be rigorous, systematic, continuous and subject to validation, ESMA’s documentation audited with regard to the registration process focused mainly on their rigorousness. Moreover, because the CRA regulation is unclear as regards the definition of methodological criteria, ESMA faces additional challenges in interpreting them and building common understanding with the CRAs.

V

The current rules of the Eurosystem do not guarantee that all ESMA-registered CRAs are on an equal footing. The Eurosystem only accepts ratings issued by four ESMA-registered CRAs as external credit assessment institutions under the Eurosystem credit assessment framework, which creates a two-tier market structure and puts small CRAs in an unfavourable situation.

VI

ESMA has a well-established procedure for risk identification. However, the lack of a documentation trail made it hard to understand why certain risks were reprioritised. Also, a documented motivation on why ESMA did limited investigations in certain high-risk areas is missing.

VII

Although ESMA laid down good foundations for its supervision approach, its rules and guidelines are not complete. Whereas documentation and internal monitoring tools are rather rudimentary, it was not always possible to trace the ongoing supervisory work performed, or the analysis and conclusions derived from it. The documentation of certain intermediate steps of the investigations was also incomplete.

VIII

We reviewed ESMA’s supervision in two areas: assessment of methodologies and potential conflicts of interest. ESMA assessed a number of related aspects based on the regulatory criteria during its ongoing supervision work and investigations. However, the scope of ESMA’s supervisory activities is not yet comprehensive, and there remain areas which could be further examined in the future.

IX

Public disclosure is especially important because it enables potential investors to undertake their own analysis before deciding whether to rely on credit ratings. ESMA checked the CRAs’ general public disclosure as part of the ongoing supervision work. A detailed assessment across CRAs was started in late 2014.

X

ESMA’s online central repository (CEREP) has no equivalent in other regulatory jurisdictions. Through this database, ESMA provides harmonised and readily accessible information on all registered and certified CRAs’ ratings performance. However, we are concerned about the adequacy of the summary statistics disclosed and the checks carried out by ESMA regarding the data reported to CEREP.

Our recommendations

XI

ESMA should:

(a)adequately document its assessment of all the regulatory requirements regarding the credit rating methodologies during the registration process;

(b)enhance the traceability of the risk identification process, maintain a log of the changes to the risk level and document the prioritisation of risks together with reasons.

ESMA should also follow up all the high risk areas, which would benefit from further supervisory work;

(c)continuously update its supervisory manual and supervisory handbook in order to incorporate knowledge and experience gained.

ESMA should establish internal guidance for the effective documentation of the investigations so as to demonstrate and ensure that all conclusions are supported by adequate analyses of the evidence;

The implementation of a dedicated supervisory IT tool would improve knowledge sharing, clarify the ownership of tasks, facilitate the review of the work done, and improve communication within the supervisory teams;

(d)examine all important aspects of the design and implementation of CRA methodologies which have not yet been covered;

(e)examine in a structured manner the systems put in place by the CRAs for dealing with conflicts of interest and in particular those relating to rating analysts’ trading activities and financial transactions. In addition, ESMA should test the accuracy of the information received from the CRAs on conflicts of interest;

(f)consider developing additional guidance on disclosure requirements in order to improve the overall disclosure practices of credit rating agencies;

(g)monitor and improve the information content of CEREP disclosures based on best practices for disclosing ratings performance; and

(h)publish all applicable legislation and relevant documents and make the website more user-friendly.

Introduction

01

Credit rating agencies (CRAs) issue opinions that help reduce the asymmetry of information among borrowers, lenders and other market participants. Credit ratings are an important tool in the equity and bond markets as they contain information for investors and market participants, in some cases even replacing investors’ due diligence.

Regulatory reforms

02

Even though regulators were relying on credit ratings in many cases, CRAs were practically unregulated for many years. The main approach was self-regulation based on generally accepted best practices developed by the International Organisation of Securities Commissions (IOSCO), which was recognised as the global standard-setter for the securities sector.

03

In 2006, the Commission concluded in its Communication on Credit Rating Agencies that light regulation, combined with self-regulation by the CRAs on the basis of the IOSCO standards, was sufficient to address the major issues of concern in relation to CRAs¹. CRAs were only regulated in a few areas, such as insider trading and market manipulation, business of credit institutions or capital adequacy of credit institutions. The Committee of European Securities Regulators (CESR)² was instructed to monitor CRAs’ compliance with the IOSCO Standards, while the Commission was expected to continuously monitor developments in the area. However, the 2008 financial crisis prompted considerable discussion concerning the operation of CRAs, which led the Commission to launch in November 2008 a proposal to regulate credit rating agencies.

04

The CRA regulation was adopted in September 2009³ and required CRAs to:

—register with a national supervisor when operating in the EU;

—disclose models, methodologies and key assumptions on which they based their ratings; and

—be subject to supervision by national securities regulators based on the home-host model⁴.

05

The de Larosière Report⁵ encouraged the EU to strengthen regulation and supervision of CRAs. The report recommended transferring the registration and supervision of CRAs from the national competent authorities to a centralised European body.

06

ESMA was established on 1 January 2011⁶ as part of the European System of Financial Supervision (ESFS). The ESFS comprises ESMA, the European Banking Authority (EBA)⁷ and the European Insurance and Occupational Pensions Authority (EIOPA) which, together with the national supervisory authorities (NSAs), the European Systemic Risk Board (ESRB) and the Joint Committee of the European Supervisory Authorities form the current European supervisory architecture. The main objective of ESMA, in particular, is to protect public interest by ensuring the integrity, transparency, efficiency and orderly functioning of securities markets.

07

In July 2011 ESMA was given exclusive supervisory powers over CRAs registered in the EU⁸.

08

Most recently (May 2013) a third round of legislation was approved, with the aim of reducing investors’ overreliance on credit ratings and improving the quality of sovereign debt rating for EU Member States⁹.

The main characteristics of the CRA regulation

09

The principal aim of the CRA regulation is to protect investors and ensure the stability of financial markets in the EU. It applies to any CRA established in the EU issuing credit ratings disclosed publicly or distributed by subscription¹⁰.

10

The regulation contains a significant level of prescriptive detail on how CRAs should manage conflicts of interest.

11

The regulation governs the preparation processes and methodologies for generating credit ratings. CRAs must use rating methodologies that are ‘rigorous, systematic, continuous and subject to validation based on historical experience, including back-testing’.¹¹ However, the CRA regulation does not interfere with the content of credit ratings.¹²

12

The CRA regulation aims to increase transparency by requiring CRAs to disclose their rating methodologies and the critical assumptions used. The aim of this transparency is to allow market participants to assess more accurately whether the ratings properly reflect risks.

13

The CRA regulation also gives ESMA new powers and responsibilities:

—CRAs are required to register with ESMA when rating EU financial products;

—CRAs are subject to ongoing supervision by ESMA; and

—CRAs are subject to sanctions by ESMA if they do not comply with the regulation.

ESMA’s role

14

Table 1 provides an overview of ESMA’s main activities in connection with the registration and supervision of CRAs.

Table 1

Overview of the tasks of ESMA

Registration and perimeter activities¹
Supervisory framework
Disclosure

Risk assessment and planning
Supervision

•All CRAs established in the EU must apply for registration with ESMA.

•CRAs established in non-EU countries and whose credit ratings are used in the EU should be certified by ESMA.

•The registration is a two-phase process: (i) completeness; and (ii) compliance.

•ESMA should develop draft regulatory technical standards regarding the registration process.

•ESMA should verify that there are no non-registered/certified CRAs issuing credit ratings in the EU.

•ESMA performs market intelligence and research to allow it to identify trends and risks in the CRA industry.

•ESMA carries out a risk assessment based on the market intelligence and knowledge built up via the supervision of CRAs.

•Development of risk scorecards for each CRA and an overall risk dashboard.

•Development of work programme

•ESMA is responsible for the ongoing supervision of CRAs.

•ESMA monitors periodic reporting by CRAs.

•Monitoring of CRAs’ notifications of changes to their initial conditions for registration.

•ESMA can conduct an individual, thematic or ad hoc investigation in the event of a risk of non-compliance being identified.

•Follow up on previous investigations and thematic reviews.

•ESMA must ensure that CRAs disclose their rating methodologies and related key assumptions.

•ESMA manages CEREP (a public database on rating performance).

•ESMA manages Socrat (an internal database) to which CRAs report all rating actions on a monthly basis.

1The identification of entities which are operating as a CRA in the EU without being registered is what ESMA considers perimeter activities.

Source: ECA, based on the provisions of CRAR and information provided by ESMA.

1Communication from the Commission on Credit Rating Agencies (OJ C 59, 11.3.2006, p. 2).

2The predecessor to ESMA, established in 2001.

3Regulation (EC) No 1060/2009 of the European Parliament and of the Council of 16 September 2009 on credit rating agencies, hereafter the CRA regulation (OJ L 302, 17.11.2009, p. 1).

4The model consists of a board of supervisors including all the national supervisors from the countries in which the CRA is operating. This model was also used for banking supervision in the EU.

5In November 2008, the Commission authorised a high-level group chaired by Jacques de Larosière to make recommendations on how to strengthen European supervisory arrangements with a view to better protecting citizens and rebuilding trust in the financial system. In February 2009, the de Larosière Group published its final report.

6Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84).

7In July 2014 the European Court of Auditors published SR No 5/2014 ‘European Banking Supervision taking shape — EBA and its changing context’ (http://eca.europa.eu), which is the first special report of ECA regarding the reforms in the regulatory and supervisory framework of the financial sector in the EU.

8This amendment to the CRA regulation is also referred to as CRA II.

9This amendment to the CRA regulation is also referred to as CRA III.

10Article 2(1) of the CRA regulation.

11Article 8(3) of the CRA regulation.

12The regulation states that ‘In carrying out their duties under this Regulation, ESMA, the Commission or any public authorities of a Member State shall not interfere with the content of credit ratings or methodologies.’

Audit approach

15

The audit examined whether ESMA’s registration process and supervision of CRAs was effective. In particular, we analysed whether:

—the registrations of all possible CRAs had been done correctly and efficiently;

—ESMA had developed and implemented a sound planning and risk assessment for its supervisory activities;

—the implementation of the supervisory framework captured the problems revealed in the CRAs’ business¹³, including those related to the independence of rating boards and preventing conflicts of interest; and

—ESMA and the CRAs publish sufficient and value adding information to its stakeholders.

16

The audit criteria were derived from the following sources:

(i)Legal requirements and objectives in the CRA regulation as well as complementary delegated regulations (technical standards).

(ii)ESMA’s supervision manual and supervisory handbook.

(iii)ESMA’s handbook for CRA registrations.

(iv)Relevant IOSCO guidelines and principles.

(v)Documents from the SEC, the corresponding supervisor in the US, with a view to comparing practices in both jurisdictions.

17

We collected our audit evidence from a file review of a sample of registration files and supervisory files. We also conducted interviews with key supervisory and risk management staff of ESMA. Based on the evidence obtained we analysed the registration process, the risk assessment and planning of resources, the organisation of supervisory work and the adequacy of disclosure of CRAs.

18

Besides the work performed at ESMA, information-gathering visits were conducted at three CRAs and an inquiry was made with 10 national competent authorities (NCAs)¹⁴ regarding their supervisory approach and methodology.

19

Finally, external experts assessed the public disclosure requirements concerning the methodologies, models and key rating assumptions of five credit rating agencies and reviewed the rating performance indicators published by ESMA in the CEREP database. A more detailed description of the audit approach is provided in Annex II.

13E.g. potential conflicts of interest and lack of transparency.

14National competent authorities (NCAs) are national agencies that are responsible, under their respective national law, for supervising and regulating (part of) the financial sector.

Part I – Registration and perimeter activities

Introduction

20

CRAs established in the EU must be registered with ESMA in order to conduct business activities. Before the creation of ESMA, the NCAs were in charge of the registration process. Figure 1 lists the 23 registered CRAs¹⁵ as at June 2015.

21

In addition to the management of the registration process, ESMA has to ensure that companies not registered as credit rating agencies are not providing credit ratings.

Figure 1

Registered CRAs in the EU

Source: ECA, based on information provided by ESMA.

ESMA shortened the registration process, but the assessment of some criteria remains challenging

ESMA has well-established registration procedures for CRAs

22

When a company established in the EU enters the credit ratings business, it has to apply for registration at ESMA. The registration process has two phases: (i) a completeness phase; and (ii) a compliance phase (see Figure 2 for an overview of these two phases).

Figure 2

CRA Registration Process

d: working day
* It can be extended to 60 working days in case of endorsing, outsourcing or exception request.

Source: ECA, based on information provided by ESMA.

23

ESMA has produced a separate handbook describing the registration phase. It describes the procedures which must be followed from the first contact of the credit rating agency with ESMA until the end of the registration process. ESMA also has predefined draft emails and templates for pre-application, notifications of completeness, requests for information, final decisions of the Board of Supervisors, fees, etc.; these make the process more efficient.

24

The process of analysing information and requesting additional information from the CRA can be repeated as many times as ESMA considers it necessary. Once the application file is complete, ESMA may ask for further clarification and/or make on-site visits to the CRA during the compliance phase.

ESMA shortened the registration process, but it remains cumbersome due to the regulatory requirements

25

Although the regulation requires a two-phase approach (see Figure 2), ESMA managed to significantly reduce the average duration of the registration process from 373 calendar days to 227. Table 2 provides an overview of the applications processed by NCAs and ESMA till December 2014.

Table 2

Average number of calendar days needed for assessing an application for registration and average number of additional requests for information

| ALL APPLICATIONS | ACCEPTED APPLICATIONS | REJECTED APPLICATIONS
| Average days for assessing an application | Average No of additional requests for information | Average days for assessing an application | Average No of additional requests for information | Average days for assessing an application | Average No of additional requests for information
NCA | 373 | 1.8 | 375 | 1.8 | 342 | 1.0
(19 applications) | (18 accepted applications) | (1 rejected application)
ESMA | 227 | 2.1 | 209 | 2.0 | 254 | 2.3
(10 applications) | (6 accepted applications) | (4 rejected applications)

Source: ECA, based on information provided by ESMA.

26

During the completeness phase, if the documents sent by the CRA are deemed to be insufficient, ESMA can ask for additional information. Each time the CRA sends additional information, ESMA has up to 20 working days to assess the documents and notify the CRA of the completeness or incompleteness of the application. Splitting the registration process into two phases makes the process rather cumbersome and lengthy, as the assessment of completeness involves an evaluation of the content of the documentation sent by the CRA. ESMA must therefore conduct double work as it has to make a brief compliance assessment during the completeness phase. Figure 3 shows the usual procedure followed during the completeness phase.

Figure 3

Average duration of the completeness phase in working days

Source: ECA, based on information provided by ESMA.

27

ESMA’s CRA Registration Handbook requires each CRA application to be processed on the basis of the four eyes principle¹⁶. However, it was not possible to see in the documentation that this was applied in all registration files examined.

28

ESMA does not sufficiently document its assessment of methodologies during the registration process. Credit rating methodologies have to be rigorous, systematic, continuous and subject to validation based on historical experience (including back-testing). Each of these requirements is further detailed in the supplementing Delegated Regulation on methodologies (for an overview see Figure 4). On the other hand, the CRA regulation stipulates that ESMA is not allowed to interfere with the content of a rating or methodology.

29

ESMA has to assess the compliance of CRAs’ methodologies with the above requirements during the registration process. We noted that the information included in the registration files examined supported mainly the verification of ESMA that the credit rating methodologies were rigorous (see green shading in Figure 4).

Figure 4

Credit rating methodologies according to the CRA regulation

Source: ECA, based on the provisions of CRAR.

The level of detail provided by the CRAs on the methodologies varied

30

ESMA has not developed a detailed list of documentation required during the registration process for assessing credit rating methodologies, nor has it defined the minimum acceptable level of detail. The registration files examined showed significant differences in the level of detail in the documentation on the methodologies. For one registration file examined, for instance, there is no information on modelling or quantitative techniques, as referred to in the Delegated Regulation on methodologies, nor a statement of the importance of each qualitative of quantitative factor used, including a description of and justification for related weightings assigned to those factors.

ESMA did not have a structured approach to monitoring perimeter activities

31

Companies that only produce private credit ratings, credit scores or credit ratings produced by central banks fall outside the scope of the CRA regulation. Box 1 illustrates the difference between a credit rating and a credit score.

32

Many companies provide credit scores, export credit assessments, or act as investment advisors in general. Companies operating in financial services are registered and supervised by their respective NCAs.

Box 1

Credit rating and credit score

‘Credit rating’ means an opinion regarding the creditworthiness of an entity, a debt or financial obligation, debt security, preferred share or other financial instrument, or of an issuer of such a debt or financial obligation, debt security, preferred share or other financial instrument, issued using an established and defined ranking system of rating categories.

‘Credit score’ means a measure of creditworthiness derived from summarising and expressing data based only on a pre-established statistical system or model, without any additional substantial rating-specific analytical input from a rating analyst.

33

ESMA has a CRA Technical Committee¹⁷ that meets every 1-2 months. Perimeter activity is a standing point in its agenda. The committee is an important network for ESMA as a means of identifying entities which should be registered as CRAs. Some of the detected entities were indeed carrying out activities falling within the scope of the CRA regulation and were consequently registered as a CRA. Although issuing ratings without being registered is a breach of the CRA regulation for which ESMA has the authority to impose a fine, ESMA has not yet used this power.

34

ESMA’s monitoring of perimeter activities was not structured and was mainly carried out on a case-by-case basis. In March 2015 ESMA adopted a specific strategy and work programme¹⁸ for perimeter activities.

The current approach of the Eurosystem does not guarantee that all ESMA-registered CRAs are on an equal footing

35

CRAs are private firms with a significant role in financial markets. Various factors make entry into the credit rating market difficult. Reputation built over a long period of time is a competitive advantage. Investors tend to prefer credit ratings from well-known CRAs, as understanding the methodology behind the ratings requires resources. Similarly, the issuers tend to demand credit ratings only from a credit rating agency that is the most used and trusted by investors.

36

A benefit of a supervision of the credit rating market is that it provides the users of credit ratings with some assurance as to the quality of the CRAs’ work. In fact, the lack of competition in the credit rating market was a concern¹⁹ and to provide a true level playing field for all actors in the credit rating market was one of the key rationales for establishing ESMA.

37

The Eurosystem²⁰ is an important player in the financial markets. It provides liquidity to the financial system through its monetary policy operations. It provides credit to eligible counterparties²¹ only against collateral²², which must meet high credit standards. To make this credit assessment²³, the Eurosystem takes into account information from several sources:

οCredit ratings issued by external credit assessment institutions (ECAIs)²⁴;

οNational central banks’ in-house credit assessment systems;

οInternal ratings-based systems;

οThird-party providers of rating tools.

38

The Eurosystem currently accepts ratings by only four ECAIs. To have ratings accepted by the Eurosystem, the CRA has to be registered or certified by ESMA as well as fulfilling certain operational criteria and providing relevant coverage. In addition, the Eurosystem accepts currently two smaller CRAs as a rating tool provider. However, these tools are of a limited value for these CRAs in comparison with the acceptance as ECAI.

39

Based on our interviews with credit-rating market participants, smaller European CRAs consider registration as an ECAI with the Eurosystem as very important for the future development of their business, especially in connection with entering the credit rating market for structured finance²⁵, which is by far the most important market segment for CRAs’ revenues and profits. However, the Eurosystem’s approach effectively upholds the two-tier market structure, in which small CRAs cannot compete on an equal footing with the large CRAs. In particular the criterion of ‘relevant coverage’ represents an effective barrier to entry.²⁶

40

The Eurosystem’s current approach of ‘recognising’ the credit rating agencies resembles the supervision of credit rating agencies — a task entrusted by the EU legislator solely to ESMA — rather than just an administrative process for accepting ‘suppliers’ of credit ratings. In comparison to the Eurosystem’s approach, the US Federal Reserve accepts in most of the cases ratings from all 10 CRAs that are registered by the SEC.

15Moody’s appears twice in the table because, after the initial registration of several Moody’s Group CRAs at NCA level, in 2014 ESMA registered Moody’s Investor Services EMEA Ltd.

16The requirement that a business transaction be approved by at least two individuals. For example: segregation of various functions, cross-checking, dual control of assets, double signatures, etc.

17The Technical Committee consists of representatives of NCAs and has been established to assist ESMA in preparing policy decisions regarding the supervision of CRAs. The committee provides technical advice by contributing to the drafting of technical standards, guidelines and recommendations.

18ESMA will, for example, ask registered CRAs and other stakeholders on a regular basis whether they have any information about potential rating providers in the EU and conduct semi-annual internet sweep searches.

19The EU has taken steps to increase market competition for credit ratings in Europe. The CRA regulation addresses increased competition in several paragraphs. The European Parliament has asked the Commission on several occasions to investigate the possibility of establishing a European Rating Agencies Network. On 5 May 2014, the Commission approved a report addressed to the European Parliament and the Council on the feasibility of a network of smaller credit rating agencies in the EU (COM(2014) 248 final).

20The Eurosystem is the monetary authority of the euro area. It comprises the European Central Bank and the national central banks of the Member States. The Eurosystem’s primary objective is maintaining price stability. It also aims to safeguard financial stability and promote European financial integration.

21These eligible counterparties have to fulfil certain requirements set out in Articles 55 to 57 of Guideline ECB/2014/60.

22Assets that are pledged to the Eurosystem as a security in the central bank credit operations must fulfil certain criteria.

23The Eurosystem credit assessment framework defines procedures, rules and techniques to ensure high credit standards for all eligible assets.

24External Credit Assessment Institutions are CRAs, which provide ratings and related probabilities of default for regulatory purposes.

25Structured finance instruments use complex legal and corporate entities to transfer risks. They result, for instance, from a securitisation transaction, in which a pool of assets is used to create a new financial instrument with specific characteristics.

26Fulfilling such a criterion requires a demand for credit ratings from a broad set of issuers, in particular from those in the structured finance market segment. However, these issuers are unlikely to ask for such service if the CRA is not yet accepted by the Eurosystem.

Part II – Planning and risk management

The risk-oriented planning process does not provide full assurance that ESMA gets the most out of its resources

41

Supervised entities cannot be investigated all the time; it is therefore very important to have a rational system for deciding which issues should be targeted, and when. ESMA therefore uses a risk-oriented planning process for supervisory activities to ensure that its limited resources are deployed in the most effective way possible. The process can be broken down into three phases (see Figure 5):

(i)Risk analysis should identify areas of possible non-compliance.

(ii)Prioritisation of risks should identify high-risk areas which should be targeted by the supervisory activities.

(iii)Work plan of supervisory activities should allocate resources according to priorities for the coming year.

Figure 5

ESMA’s annual risk assessment process

Source: ECA, based on information provided by ESMA.

Comprehensive risk identification, but difficult to trace

ESMA has a comprehensive approach to identifying risks …

42

ESMA organises its risk assessment along a matrix of 13 risk areas, which are grouped into four risk categories (see Figure 6). The risk areas address broad topics, which encompass more detailed topics. For instance, the risk area ‘management of conflicts of interest’ comprises more than nine detailed topics such as the influence of shareholders or board members and the adequacy of disclosures.

Figure 6

From risk categories to risk areas and topics

Source: ECA, based on information provided by ESMA.

43

The annual risk assessment is the key way of identifying risks. It draws on the knowledge acquired during the year about the CRAs and the analysis of documents the CRAs submit during the year. On the basis of this information the risk analysis staff, together with the supervisory staff, prepare a scorecard for each supervised CRA. These scorecards aggregate all known risks and score them to show their importance.

44

The scorecards are incorporated into an annual risk dashboard which gives the risk level per risk area for each supervised CRA. Separate specific dashboards are created for the major CRAs and for all smaller CRAs to account for different market impact. These risk dashboards are used to identify systematic risks in the CRA market.

45

In addition to the annual risk assessment, ESMA uses ad hoc risk analyses. These analyses can be triggered by any relevant news in the CRA market, the analysis of rating data or credit market data. Its purpose is to identify, in a timely manner, specific areas of concern for individual CRAs or groups of CRAs active in the same rating product, or any market developments that could trigger a re-prioritisation of supervisory activities.

46

ESMA progressively increased the use of ad hoc risk analyses. Recently, more of these were triggered as a result of ESMA’s findings. All analyses helped ESMA to identify high-risk areas and areas where the supervisory team should improve its knowledge of specific topics.

… but the documentation is in several aspects insufficient

47

In the field of risk management, the available knowledge should be properly documented in an understandable way. In addition, the detailed concerns and findings as well as the justification for changing risk levels should be well documented. To ensure effective supervision, the framework should provide the supervisory staff with the possibility to review the evolution of risks and how the risks were addressed²⁷.

48

The scorecards provide an aggregated assessment for each risk area. While an outcome of the aggregated assessment is recorded, there is no documentation of the assessments of the detailed topics within each risk area. This can lead to a loss of knowledge and a difficulty to follow how the sub-risks have been translated into the higher risk.

49

The risk assessment guidelines prescribe the documents to be consulted when scorecards are prepared. However, any underlying work is not properly documented and there is no evidence that anyone checks it.

50

If a risk level in a scorecard changes, ESMA does not keep any records of the reasons for the change. Decisions on such changes take place verbally in informal meetings between the supervisory staff and the risk analysis team.

High-risk areas were not always sufficiently covered

51

On the basis of the scorecards, the risk dashboards and the information from the ad hoc risk analyses ESMA prepares a risk report for the Board of Supervisors. This report identifies the high-risk areas — i.e. fundamental issues which are intended to be treated as a key priority in the supervisory work. The annual work programme sets out the areas that ESMA will focus on in its supervisory activities.

52

ESMA’s risk-based approach was introduced after its first year of supervision. However, in the beginning, it was not always consistently applied. Some high-risk areas mentioned in the risk scorecards and the risk reports to the Board of Supervisors would have benefited from further supervisory actions.

53

Limited coverage of some high risks would be justified if ESMA’s supervision resources had been deployed to cover other high-risk areas or where an immediate action was unreasonably resource intensive. However, also lower-risk areas were included in certain investigations, while higher-risk areas would have benefited from further assessments.

54

Furthermore, the investigations did not fully cover the risks prioritised in the annual risk assessment process because of an asymmetry between the risk areas and the way that investigations are carried out. The scorecards, dashboards and risk report organise the risks according to the topics such as strategic risks or outsourcing risks. However, the topics of the investigations are mostly structured around asset classes such as sovereign or bank debt. Thus, the objectives in the investigations do not completely match with the identified risks.

ESMA resources make it difficult to satisfy all demanding regulatory requirements

55

At the end of 2014, 26 employees were working in the CRA Unit, 15 of which were responsible for supervision and four were allocated to the risk analysis. The remaining staff were allocated mainly to policy work. The number of staff combined with the increasing volume of regulatory requirements made it very difficult for ESMA to provide adequate coverage of compliance checks with the regulation²⁸.

27International Standard IEC 31010:2009, section 5.5.

28E.g. in areas such as IT, internal controls, methodologies, conflicts of interest.

Part III – Supervision

ESMA’s ongoing supervision and investigations

56

All CRAs are subject to ongoing supervision once they have been registered. The objective of the ongoing supervision is rapid identification of supervised entities which might not be compliant with the applicable requirements.

57

ESMA follows a risk-oriented supervisory approach. The intensity, extent and types of supervisory activities depend on the risks posed by the various market participants (see Figure 7. Potential problems identified during the desk-based ongoing supervision are analysed and, where necessary, further investigatory activities are conducted.

Figure 7

Supervisory activities

Source: ECA, based on the provisions of CRAR.

58

ESMA’s ongoing supervisory work comprises analysis of the information received periodically from the entities supervised, analysis of information received from external sources (authorities, competitors, complaints, press, etc.), follow-ups of questions received from CRAs, and communication with the management of the CRAs throughout the supervisory cycle. Table 3 shows ESMA’s supervisory tasks as part of the ongoing supervision process.

Table 3

ESMA’s tasks in ongoing supervision

Analysis of information
Review of periodic information sent by the CRAs — quarterly, semi-annually

Review of CRAs’ periodic public disclosures

Review of notifications received from the CRAs pursuant to the CRA regulation (e.g. notification of material changes to the conditions for initial registration)

Regular monitoring of information disclosed to the public on CRAs’ websites

Reports/alerts received from ESMA’s risk analysis team

Regular engagements
Periodic calls to CRAs (organised after receiving the semi-annual information)

Cycle of engagement calls to CRAs (periodic calls and meetings with key personnel in the CRAs: Head of Compliance, Internal Review Function, Internal Audit, Risk management, Chief Executive Officer and Independent Non-Executive Directors. The frequency of the engagement calls depends on the size of the CRA)

Other tasks
Deep dives (follow-up of potential risk areas identified during analysis of information and regular engagement activities)

Handling complaints from third parties

Follow-up of remedial action plans from investigations

Interaction with CRAs — providing feedback to queries from CRAs on an ad hoc basis

Source: ECA, based on information provided by ESMA.

59

In addition to ongoing supervision, ESMA regularly selects CRAs’ compliance risk areas for further investigatory action (mainly general investigations), based on its own risk assessments. General investigations usually involve on-site inspections. An overview of ESMA’s on-site investigations is provided in Annex III. They can be broadly classified into two groups:

—thematic investigations focused on certain issues common to several large CRAs; and

—individual investigations in certain CRAs covering specific issues.

Supervision process designed and implemented, but needs time to mature

60

Effective supervision requires:

(i)a comprehensive supervision policy that broadly sets out the supervision process, combining both off-site and on-site methods of supervisory activities;

(ii)comprehensive internal guidelines and methodologies to assist staff in their daily tasks;

(iii)collection and analysis of information;

(iv)effective oversight of the work done and corrective actions taken by the CRAs in response to the findings.

ESMA laid down good foundations for effective supervision of CRAs

61

Best practices state that supervisors should have a methodology for determining and assessing the nature, impact and scope of the risks to which the supervised entities are exposed, including the business focus, the risk profile and the internal control environment. Off-site and on-site work is prioritised based on the results of that assessment²⁹.

62

ESMA set out its general principles in the Supervision Manual and Supervision Handbook. These documents serve as useful reference tools and practical guidance to ESMA’s supervision teams on how to implement effective and efficient supervision within the framework of the CRA regulation. ESMA’s supervision manual gives a detailed description of the investigation as a method of supervision. It details the different phases and lists the minimum information required in the project plan and all other necessary steps to be followed on-site and during the reporting phase (see Figure 8).

Figure 8

Main steps of an investigation

Source: ECA, based on ESMA’s supervisory manual and handbook.

Internal guidelines and monitoring tools could be further developed to support ongoing supervisory work

63

The internal guidelines should clearly specify the frequency and scope of examinations. In addition, examination policies and procedures should be developed in order to ensure that examinations are conducted in a thorough and consistent manner, with clear objectives.

64

The Supervision Manual and the Supervision Handbook give only a broad description of the ongoing supervision process and do not define the exact types of supervisory tasks to be undertaken by ESMA, nor do they provide any information regarding the frequency of these tasks.

65

ESMA sets up supervisory plans on a yearly basis for the period ahead. However, ESMA did not have individual supervision plans for each CRA with information about the supervisory tasks to be performed on an annual basis. Moreover, we did not find any sufficient predefined timetables setting the minimum frequency of regular supervisory checks to be conducted for each CRA.

66

The CRA regulation establishes a clear set of rules that ESMA must supervise, however, ESMA does not systematically use checklists as a supervisory tool. Moreover, many NCAs use questionnaires and checklists in their supervisory work.

67

Moreover, the different supervisory teams do not document their work in a standardised format, and it is difficult to track the ongoing supervisory work that has been performed and the analysis and conclusions which have been derived from it.

68

ESMA has also established a ‘criteria folder’. Its purpose is ‘to ensure consistency’ by allowing assessors to ‘consult decisions adopted by ESMA in the past’ during the registration process and later in the ongoing supervisory work. The ‘criteria folder’ contains, amongst others, emails from the legal service, ESMA’s previous decisions and internal correspondence regarding issues encountered during registration and supervisory work. This is a good initiative; however, the structure of the criteria folder does not ensure that it is used as comprehensive guidance to supervisors in their daily work.

ESMA manages a huge volume of supervisory information, but does not have a dedicated IT tool for registering and processing this data

69

ESMA deals with two sets of information:

—ad hoc information (material changes to the initial conditions for registration, complaints from third parties, questions from CRAs, etc.); and

—periodic information provided to ESMA quarterly and semi-annually (information about CRAs’ revenue and costs, changes to key CRA staff, Board minutes, internal audit reports, internal review function reports, etc.).

70

ESMA set up a file to record the analysis of the information received periodically from all supervised CRAs (see Box 2).

71

The file is a good initiative to keep track of the huge volume of supervisory information received, but it is cumbersome and hard to follow. Moreover, the file does not have an ‘owner’ and anyone from the supervisory team can edit, modify or delete its content without keeping track of the changes and who made them.

72

As ESMA does not have a dedicated IT tool to serve as a register of information received and for documenting and analysing supervisory work, ESMA has created a structure which seems to be used mostly as a storage tool for the information received from the CRAs. However, we did not find in all cases evidence of detailed analysis having been made of the information received. The NCAs stated that they all had a supervisory IT system in place to document their supervisory work and to facilitate knowledge retention within the organisation.

Box 2

Examples of data monitored

οConference calls and meetings held with CRAs;

οNotifications;

οNews about changes to methodologies, rating scales and corporate structure from CRA staff and websites;

οCRA revenues, costs, staff turnover and other staff data;

οCompliance reports, internal audit reports, audited financial statements, Board minutes; and

οCRA transparency reports.

Source: ECA, based on information provided by ESMA.

Getting a description of the supervisory checks performed is difficult

73

ESMA’s documentation of the investigations does not provide sufficient evidence of all the intermediate steps carried out. It is therefore difficult for ESMA to monitor and prove that all tasks are properly undertaken in accordance with the objectives of the investigations. In particular, the working papers did not show how all necessary evidence was assessed.

74

After an investigation, ESMA sends letters to the CRAs with the preliminary and/or final findings. The Supervision Manual suggests that the letters should make reference to the relevant legislation. A reference to the specific legal basis of each finding would allow CRAs to better understand the compliance risks that are spotted in the letters. However, ESMA routinely communicated its findings without any legal references to specific articles of the regulations.

75

ESMA follows up on the CRAs’ implementation of the remedial action plans. This is documented in a follow-up table for each investigation and CRA. ESMA does not have a harmonised approach to documenting the staff’s analyses and comments in these tables (e.g. identifying the specific supporting evidence that a CRA had sufficiently implemented a required action).

Real progress, but not yet adequate coverage in analysed thematic areas

76

The risk-oriented supervisory approach implies that only some risks can be covered by ESMA’s supervision work. Supervisory checks will thus differ from one topic to another. To complete our assessment of ESMA’s supervision process, we chose two thematic areas for a detailed review:

(i)CRAs’ methodologies, models and key rating assumptions; and

(ii)Conflict of interest in the CRA market.

77

The choice was motivated by the importance of these topics for the functioning of the CRA market. The methodologies are the backbone for the CRAs’ assignment of ratings and rating outlooks. Conflict of interest was identified as one of the main weaknesses in the credit ratings market before the sub-prime crisis. The analysis allowed us also to take stock of ESMA’s work over the last 4 years since ESMA was established.

Methodologies supervised, but not all areas covered and requirements not always clear

78

A CRA must specify in its application for registration which types of credit ratings it will issue³⁰. The applicant must also provide the necessary documentation for its methodologies and models. On this basis, ESMA assesses whether the CRA’s methodologies and models at the time of registration comply with the CRA regulation and the supporting Delegated Regulation.

79

CRAs have the obligation to use methodologies which are rigorous, systematic, continuous, and subject to validation based on historical experience, including back-testing. ESMA has the obligation to regularly examine each CRA’s compliance with these regulatory requirements.

Regulatory requirements regarding methodologies are not always defined

80

The CRA regulation does not provide any definitions or criteria concerning regulatory requirements for methodologies. A Commission Delegated Regulation³¹ lays down regulatory technical standards for ESMA’s assessment of the regulatory requirements regarding methodologies. In the published reports presenting conclusions for the investigations carried out in the area of methodologies, ESMA gave examples of methodological content in order to provide guidance to the industry on its expectations in this area. Nonetheless, some of the terms used in these standards would benefit from further clarification, with a view to improving the common understanding of the regulatory requirements regarding methodologies between ESMA and the credit rating agencies.

ESMA’s supervision of methodologies did not cover all aspects of CRAs’ methodologies

81

ESMA verifies the CRAs’ implementation of the regulatory requirements regarding methodologies during ongoing supervision and in-depth investigations.

82

ESMA’s ongoing supervision is designed in such a way that the assessment of credit rating agencies’ compliance with regulatory requirements regarding methodologies focuses on whether CRAs have appropriate internal controls in place, such as:

—an independent internal function responsible for periodically reviewing methodologies, models and key rating assumptions;

—independent members on CRAs’ administrative or supervisory boards responsible for monitoring the effectiveness of their CRA’s internal control systems, including the efficiency of the internal review function; and

—documentation of periodic methodology reviews and of their underlying procedures.

83

Therefore, ESMA’s assessment of methodological requirements needs to be complemented by in-depth investigations. In view of ESMA’s resources and the large number of methodologies to be supervised³², ESMA makes use of risk assessments to select the topics of the investigations relating to methodological requirements. Table 4 presents an overview of ESMA’s assessments of compliance with regulatory technical standards regarding methodologies carried out during thematic investigations. The table is based on ESMA’s documentation.

Table 4

Overview of ESMA’s assessments in the area of methodological requirements as part of the thematic investigations

Regulatory requirements
Rating process examination
(2012)¹
Bank ratings investigation
(2013)
Sovereign ratings investigation
(2013)
Small and medium-sized CRA investigations
(2014)
Structured finance ratings investigation
(2014)

Rigorous
N/A
Partial
No
Partial
Partial

Systematic and continuous in time
N/A
Partial
No
No
Yes

Continuous across asset classes
N/A
No
No
No
No

Subject to validation based on historical experience
N/A
Partial
No
Partial
Partial

1This investigation was completed before the regulatory technical standards had been adopted.

Source: ECA, based on information provided by ESMA.

84

Some important regulatory requirements regarding methodologies have therefore not yet been examined during ESMA’s thematic investigations, for instance:

—in 2014 ESMA began an in-depth analysis of industry practices to validate methodologies; and

—ESMA did not verify the regulatory requirements relating to continuity of ratings across asset classes.

ESMA did not have a formal procedure to examine a change in a CRA’s methodology, or cases when a CRA issues a new type of rating

85

When a CRA, after being registered, makes a material change to a methodology or it expands its business by issuing new types of credit ratings, it has to notify ESMA. However, the CRA regulation does not define the term ‘material change’. In 2010, CESR issued a guideline³³ defining what was considered as a material change. In 2014 ESMA communicated its definition of material change in its ‘Questions and Answers’ on the implementation of the CRA regulation. In March 2015, ESMA updated this definition of a material change³⁴, specifying the changes in the initial registration conditions regarding ‘rating methodologies, models or key rating assumptions’.

86

Although ESMA clarified when the CRAs had to send a notification on material change, it did not have a formal procedure for examining these notifications of new methodologies or material changes to existing ones during the audited period. In June 2015 ESMA adopted a procedure describing the steps to be followed when a notification on a methodology is received from a CRA.

ESMA has not yet examined certain types of conflict of interest

87

OECD defines a conflict of interest as a situation where ‘an individual or a corporation (either private or governmental) is in a position to exploit his or their own professional or official capacity in some way for personal or corporate benefit’.

88

In the credit ratings market, conflicts of interest are mainly related to possible influences of affected parties on the rating. Both the Financial Crisis Inquiry Commission³⁵ and the International Organisation of Securities Commissions³⁶ identified this as one of the main weaknesses in the credit ratings sector before the sub-prime crisis.

89

In this context ESMA assessed the measures put in place by CRAs to avoid conflicts of interest, among others, the adequacy, the effectiveness and the independence of a number of internal control functions. However, there are areas which could be further examined in the future:

(i)ESMA did not sufficiently examine whether CRAs’ ancillary services may have influenced the rating. ESMA only conducted limited supervisory actions in this area.³⁷

(ii)Limited evidence was found that ESMA had examined possible conflicts of interests between CRAs and consulting companies under the same holding company.

(iii)ESMA did not examine in a structured manner conflicts of interest relating to rating analysts’ trading activities and financial transactions. CRA staff involved in a rating action have privileged information prior to the publication of the rating action. The CRAs should therefore have procedures in place to monitor the rating analysts’ trading activities and securities holdings in order to mitigate the risk of insider trading. ESMA receives information on the results of this monitoring, but ESMA did not test the procedures in place at the CRAs to verify the correctness of the information received.

29By analogy the ‘Core Principles for Effective Banking Supervision’ issued by BIS could be applied also the supervision of CRAs.

30Annex II, point 8 of Delegated Regulation on Registration.

31Commission Delegated Regulation (EU) No 447/2012 of 21 March 2012 supplementing Regulation (EC) No 1060/2009 of the European Parliament and of the Council on credit rating agencies by laying down regulatory technical standards for the assessment of compliance of credit rating methodologies (OJ L 140, 30.5.2012, p. 14).

32For the three largest CRAs, ESMA counts more than 800 methodologies for different asset classes and market segments.

33CESR’s Guidance on Registration Process, Functioning of Colleges, Mediation Protocol, Information set out in Annex II, Information set for the application for Certification and for the assessment of CRAs systemic importance, p. 16, ref. CESR/10-347.

34Guideline on periodic information to be submitted to ESMA by credit rating agencies of 19 March 2015.

35The Financial Crisis Inquiry Commission examined the reasons for the financial crisis as part of the Fraud Enforcement and Recovery Act in the US. The report was published in January 2011.

36Technical Committee of IOSCO, Report on the subprime crisis, May 2008.

37For instance, ESMA found that CRAs’ publication of research papers may limit the independence of the rating analysts. If a rating committee has to approve a rating shortly after the publication of a research paper, it is difficult for the committee to take a decision that is not in line with the conclusions of the research paper.

Part IV – Disclosures

ESMA’s supervision of CRAs’ general disclosures

90

One of the objectives of the CRA III regulation is to enhance transparency of CRAs and the market for credit ratings, notably in respect of CRAs’ pricing policies, the fees they receive, the way they conduct their rating process and how they reach their conclusions. Transparency is ensured by complete and readily accessible public disclosure.

91

The CRA regulation requires the CRAs to make two types of disclosure: general disclosure and periodic disclosure. The general disclosure refers to information that the CRAs must disclose publicly, mainly through their websites. Periodic disclosure refers to the regular supervisory information that the CRAs must send to ESMA. Another important source of information is the ESMA’s own disclosure of their supervisory work to stakeholders.

ESMA regularly checked the individual CRAs’ general public disclosures, but a detailed assessment across CRAs of the general disclosure was carried out for the first time in late 2014

92

The CRA regulation requires CRAs to publicly disclose various types of general information (see Figure 9).

93

The general public disclosure is an important tool for communication between the CRAs and the users of the credit ratings. Users should be able to undertake their own analysis and conduct appropriate due diligence when assessing whether to rely or not on a given credit rating. They should be able to assess the risks a CRA is exposed to, e.g. risks of conflicts of interest, risk of poor quality input in ratings, risks embedded in the methodologies, etc.

94

ESMA reviewed CRAs’ general public disclosure during its ongoing supervision work and as a part of its investigations. However, a detailed analysis of the CRAs’ general disclosure practices was started for the first time in December 2014.

Figure 9

Requirements for general disclosure

Source: ECA, based on the provisions of CRAR.

Market transparency impeded by restrictions and varying CRAs’ disclosure practices

95

We observed weaknesses in general disclosure practices.

96

CRAs must disclose specific information to the public (see Figure 9). They primarily do so using websites. We found that to users must set up an account using personal data to access some of these websites. The privacy policies of these CRAs state that personal data collected from users may be given to third parties, which may discourage potential users from setting up an account.

97

The CRA regulation does not oblige CRAs to disclose proprietary information. In practice this means that certain parts of a methodology do not have to be disclosed. This gives rise to a paradox, as a CRA may not choose to disclose its full methodology if some information is proprietary and affects the ability of users to perform their own due diligence.

98

CRAs must disclose ‘methodologies, models and key rating assumptions which they use in their credit rating activities’. We evaluated the CRAs’ general disclosure in the methodology area, focusing on four types of credit rating: corporate financial institutions (Banks), sovereigns, structured finance products (master methodology, ABS consumer finance and RMBS) and covered bonds.

99

CRAs generally complied with the regulation by disclosing methodologies. The format of disclosure varied greatly between the CRAs, limiting comparability. This could have been partially avoided if a standardised reporting format had been provided for CRAs to present their methodologies. The ease with which documentation can be found varied between CRAs and between rating types. For many sub-classes within the structured finance category, the CRAs provided only an overview of the rating process and important information on the methodology was missing. It was therefore not possible to reproduce the rating.

CEREP does not disclose sufficient information on CRAs’ ratings performance

Half-year data reporting

100

ESMA’s online central repository (CEREP) has no equivalent in other regulatory jurisdictions. Through this database, ESMA provides harmonised and readily accessible information on all registered and certified CRAs’ ratings performance. In CEREP CRAs make available information on their historical ratings. ESMA publishes half-yearly summary statistics on CRAs’ ratings performance based on data reported by CRAs. This includes, for a given time horizon and asset class: rating activity statistics, default rates, and transition matrices. CEREP provides useful summary statistics for investors and researchers based on multiple filter queries which they can adapt to their needs. CEREP does not:

—publish the disclosure of other statistics which are useful to users, such as average default rates, and average transition matrices, or

—include filtering options which allow users to download summary statistics resulting from several queries at once.

101

The CRA regulation stipulates that ESMA has to make the information reported by CRAs in CEREP available to the public³⁸. While the qualitative information reported by the CRAs is published in CEREP, the underlying data as reported by CRAs is not. The public availability of these data would have several benefits for CEREP users. For example, they could better understand the predictive power of the summary statistics.

102

The CRA regulation does not require CRAs to monitor issuers/financial instruments after their respective ratings have been withdrawn. As such CEREP summary statistics do not consider default events occurring after rating withdrawals. In order to mitigate such lack of information, CEREP discloses statistics by type of reasons for withdrawal³⁹. However, some rating activity statistics show a high proportion of unexplained rating withdrawals. This undermines the credibility of the predictive power of the respective summary statistics.

103

ESMA performs certain automatic controls of the new data reported to CEREP in order to check their integrity before being published. However, ESMA does not perform any accuracy checks (such as reconciliations with other public databases, with the CRAs’ internal databases, etc.) before publication. These checks would be useful because:

—There were cases of data errors and revisions in CEREP.

—There is no public scrutiny on them. CEREP does not disclose whether there are corrections of errors or other revisions in the historical data reported to CEREP by CRAs.

Qualitative information reported

104

The information has no comparable structure among the reporting CRAs and does not allow users to see when changes to methodologies occurred and when they affected ratings and their performance. This is important as CEREP summary statistics cover past ratings which may have been issued using different methodologies to the ones currently presented in CEREP.

ESMA does not disclose sufficient information to ratings users on its website

105

ESMA should regularly publish information relating to its fields of activities and to ensure that the information is easily available. We compared the information available on the websites of ESMA and of the SEC’s Office of Credit Ratings, which supervises CRAs registered in the US (NRSROs).

106

ESMA, for instance, does not publish on its website all relevant legislation (six delegated regulations are not available), while the SEC’s Office of Credit Ratings has a specific section with links to all the regulations regarding the NRSROs (see Annex IV for more details).

107

ESMA’s documentation concerning CRAs can be consulted in two ways: a simple list of some two hundred documents without any selection possibility, or a list with two filters which only marginally improve accessibility. The SEC website, in contrast, works with specific sections for each type of information, which makes it more user-friendly.

108

The analysis of ESMA’s website shows that some of the applicable legislation is not available on the website. Also, some useful documents, e.g. the registration template and guidance for whistleblowers, are not available (see Annex IV).

38Article 11(2) of the CRA regulation.

39E.g. incorrect or insufficient information, maturity of debt obligation, bankruptcy, reorganisation of rated entity, other reasons (unexplained), etc.

Conclusions and recommendations

109

Our overall conclusion is that ESMA laid down good foundations for effective supervision of the CRAs in the EU in a short period of time. Nevertheless, there is still room for improvement.

Registration

110

ESMA has well-developed registration procedures. Nevertheless, it remains cumbersome, due to the split into completeness and compliance phases as required by the regulation. Credit rating methodologies should be rigorous, systematic, continuous and subject to validation. However, the evidence audited supported mainly the rigorousness of the methodologies (paragraphs 20 to 30).

Recommendation 1

During the registration process, ESMA should adequately document its assessment of all the regulatory requirements regarding the credit rating methodologies.

111

The current rules of the Eurosystem do not guarantee that all ESMA-registered CRAs are on an equal footing. The Eurosystem currently accepts ratings issued by four ESMA-registered CRAs as ECAIs under the ECAF. In order to have their ratings accepted by the Eurosystem, CRAs must fulfil extra operational criteria in addition to being registered or certified by ESMA. This approach creates a two-tier market structure, in which small CRAs cannot compete on an equal footing with larger CRAs (paragraphs 35 to 40).

Risk management and planning

112

ESMA has a well-established procedure for risk identification. However, the lack of documentation trail creates difficulties in understanding the rationale for reprioritising certain risks. ESMA did not investigate all high-risk areas in a sufficient and consistent way. We found that the supervision resources did not adequately keep up with the increasing requirements in the regulation (paragraphs 41 to 55).

Recommendation 2

ESMA should enhance the traceability of the risk identification process. ESMA should maintain a log of the changes to the risk level and document the prioritisation of risks together with reasons.

ESMA should follow up all the high-risk areas, which would benefit from further supervisory work.

Ongoing supervision and investigations

113

ESMA laid down good foundations for its supervision approach. However, ESMA’s supervision guidelines do not define the exact types of ongoing supervisory tasks to be undertaken, nor do they provide information regarding the frequency of these tasks. ESMA set up an annual supervisory plan for the period ahead. Detailed plans of the ongoing supervisory tasks per CRAs were not available. ESMA does not have adequate internal standards for documenting supervisory work, and it is difficult to track ongoing supervisory work that has been performed or the analysis and conclusions derived from it (paragraphs 56 to 77).

114

Similarly, the documentation of certain intermediate steps of the investigations is not complete. ESMA’s documentation of the audited investigations does not show how all necessary evidence was assessed (paragraphs 56 to 77).

Recommendation 3

The ESMA supervisory manual and supervisory handbook should be subject to continuous updating to incorporate knowledge and experience gained.

ESMA should establish internal guidance for the effective documentation of the investigations so as to demonstrate and ensure that all conclusions are supported by adequate analyses of the evidence.

The implementation of a dedicated supervisory IT tool would improve knowledge sharing, clarify the ownership of tasks, facilitate the review of the work done, and improve communication within the supervisory teams.

Methodologies

115

ESMA examined CRAs’ methodologies based on the regulatory criteria through both ongoing supervision and investigations. However, ESMA does not have a procedure to examine the new methodologies or material changes to methodologies notified by the CRAs. ESMA faces challenges in interpreting the methodological criteria and building common understanding with the CRAs on compliance with them. Certain criteria remain to be examined in depth (paragraphs 78 to 86).

Recommendation 4

ESMA should examine all important aspects of the design and implementation of CRA methodologies which have not yet been covered.

Conflicts of Interest

116

ESMA did not sufficiently examine certain potential conflicts of interest. Although ESMA receives a lot of information from the CRAs regarding the trading activities and securities holdings of their staff, it did not examine this information in a structured way. Also, during the thematic and individual reviews, this issue was only discussed sporadically (paragraphs 87 to 89).

Recommendation 5

ESMA should examine in a structured manner the systems put in place by the CRAs for dealing with conflicts of interest, and in particular those relating to rating analysts’ trading activities and financial transactions.

In addition, ESMA should test the accuracy of the information received from the CRAs on conflicts of interest.

General disclosure

117

ESMA regularly checked the CRA general disclosure during the ongoing supervision and investigations, but a first detailed assessment across CRAs was started in late 2014 (paragraphs 90 to 94).

118

We found that CRAs’ general disclosure is not always at the highest standard and that disclosure, especially when it concerns methodologies and descriptions of models and key rating assumptions, does not always enable potential users of credit ratings to perform their own due diligence (paragraphs 95 to 99).

Recommendation 6

ESMA should work on further alignment of disclosure practices across the CRAs. ESMA should consider developing additional guidance on disclosure requirements in accordance with Article 16 of Regulation 1095/2010 in order to improve the overall disclosure practices of credit rating agencies.

CEREP disclosures

119

ESMA’s disclosures in the online central repository (CEREP) provide harmonised and readily accessible information on all registered and certified CRAs’ ratings performance which has no equivalent in other regulatory jurisdictions. However, we have concerns about the sufficiency of disclosure and about the absence of adequate checks performed by ESMA on the data reported to CEREP (paragraphs 100 to 104).

Recommendation 7

ESMA should monitor and improve the information content of CEREP disclosures based on best practices for disclosing ratings performance.

ESMA website disclosure

120

ESMA’s website lacks certain useful information for CRAs, potential new market participants and credit rating users. The website is not well structured and the available information is difficult to find (paragraphs 105 to 108).

Recommendation 8

ESMA should publish all applicable legislation and relevant documents and make the website more user-friendly.

This report was adopted by Chamber IV, headed by Mr Milan Martin CVIKL, Member of the Court of Auditors, in Luxembourg at its meeting of 24 November 2015.

For the Court of Auditors

Vítor Manuel da SILVA CALDEIRA
President

Annexes

Annex I

ESMA’s governance structure

ESMA’s supervisory governance structure is composed of four levels. An overview of the responsibilities at each level is presented in the table below.

The Board of Supervisors
The Management Board
Executive Director
Head of Unit/Division

Composition:
The heads of the 28 national authorities of the EU + ESMA’s chairperson + EIOPA + EBA+ ESBR+ EC+ EEA (Iceland, Liechtenstein and Norway)

It has the ultimate decision-taking responsibility in ESMA.

Responsibilities:

–Approving the annual supervisory plan which describes all planned investigations as well as the expected ongoing supervisory work. For this purpose they receive a risk report prepared by ESMA’s supervisory team. The risk report contains specific risks to individual CRAs in anonymised form.

–Approving ESMA’s annual report that describes ESMA’s supervisory activities based on the annual activity report from the supervisory team.

–Approving other public reports (the information provided to the Board of Supervisors includes more detailed findings than what is published in the public report).

Composition:
Six members selected from the Board of Supervisors by its members + ESMA’s chairperson.

Responsibilities:

–Overseeing ESMA’s multi-annual work programme, the budget and staff resources.

–Controlling the implementation of the supervisory work plan.

–Discussing the quarterly information provided by the Executive Director on the supervisory work: registrations, ongoing investigations, findings and remedial actions.

Responsibilities:

–Overseeing ESMA’s supervisory work.

–Implementing the annual supervisory work plan.

–Ensuring the functioning of the supervisory divisions/units.

–Signing the written authorisations or decisions for investigations or inspections.

–Signing decisions requesting information.

–Approving remedial action plans.

–Reporting on ESMA’s supervisory activities to the Management Board and Board of Supervisors.

Responsibilities:

–Proposing an annual supervisory work plan and implementing it after its approval.

–Signing simple requests for information.

–Drafting remedial action plans, decisions and public reports that are submitted to the Executive Director for signature or escalation.

–Ensuring that supervisory decisions are sufficiently challenged through discussions on the findings.

–Proposing remedial actions with the relevant supervisory team.

–Putting in place communication channels that enable supervisors to raise their views and/or concerns at any stage of the supervisory process.

–Ensuring that supervised CRAs are given the opportunity to comment on the findings, and the remedial actions before the final report.

Source: ECA, based on information provided by ESMA.

Annex II

Audit approach

In addition to the work carried out by the Court, two experts were contracted to analyse specific topics in the audit field. Furthermore, we asked a selection of national competent authorities for information allowing us to compare supervisory practices.

Some of the statements in the report are based on the contributions of these expert reports and on the results of the inquiries made at the national competent authorities.

Expert reports

Some aspects of the audited subject are of a complex and specialised nature which required the Court to hire two experts. The expert contributions relate to:

οthe analysis of the requirements for disclosure of CRAs’ methodologies, models and key rating assumptions

οthe analytical quantitative work regarding the performance of the ratings based on the rating data available in ESMA’s CEREP database.

Analysis of the requirements for disclosure of CRAs methodologies, models and key rating assumptions

The experts carried out the following tasks:

οAnalysis of the requirements for disclosure of CRAs’ methodologies, models and key rating assumptions and critical assessment of whether ESMA’s rules and guidelines give enough and clear guidance for disclosure;

οComparison of EU requirements for disclosure of CRAs’ methodologies, models and key rating assumptions with the corresponding SEC rules (rules of the US Securities and Exchange Commission);

οFor a sample of five CRAs (which were selected by the European Court of Auditors) and on the basis of the information that is publicly available:

•performed an analysis of the information disclosed regarding the methodologies, models and key rating assumptions, to compare with the disclosure requirements set out in the CRA regulation and to conclude whether the regulation is respected, in particular in the cases of sovereign bonds and structured finance instruments;

•critically assessed whether the disclosed information gave sufficient details to investors in order to assess methodologies, models and key rating assumptions, i.e. could an investor re-perform the calculations for a rating using the disclosed information on the CRA’s methodologies, models and key assumptions and reach the same result?;

•assessed whether the disclosed information gave an investor the possibility to compare CRAs’ methodologies, models and key assumptions for a specific rating (a sample of ratings were selected by the European Court of Auditors); and

•identified good disclosure practices that could be shared between the CRAs.

Quantitative performance measurement of the credit ratings issued by the credit rating agencies

Based on performance measures disclosed by CEREP, the expert assessed:

οthe relevance, coherence (e.g. completeness of the data, data quality) and comparability of the performance indicators on credit ratings published by ESMA in CEREP;

οweaknesses or difficulties with these disclosures, and recommended improvements/alternatives which could be useful for investors’ information and/or academic research;

οdifferent aspects of comparability of quantitative measures of ratings performance, such as comparability over time, across CRAs, across asset classes, across geographic regions of the issued ratings, in order to examine the discriminatory and predictive power of the disclosed measures; and

οquantitative information disclosed in CEREP, and comparing it to other disclosures/databases available to investors/academics.

Inquiry at a selection of national competent authorities

The audit team asked 10 national competent authorities about their supervisory practices. The questions related to their general approach to supervising of financial institutions and to their tasks in the registration of CRAs.

The main questions of the inquiry are listed below:

οPlease list the types and the frequency of the supervisory activities that your institution performs.

οHow are ongoing supervisory activities identified in your institution?

οIs there a dedicated supervisory IT system in your institution that is used for documenting the supervisory work and for knowledge retention?

οHow is the analysis of the periodic disclosure documented in your institution?

οDoes your institution develop instructions and guidelines for the supervised entities, and if so, how are those communicated to them?

οDid your institution perform on-site visits in the CRA during the registration process?

οHow did your institution assess that the CRA methodologies were compliant with the requirements in the CRA regulation?

οHow do you, as a financial supervisor, identify whether a rating from a credit rating agency is a private rating or a public rating? How do you ensure that private ratings are not used for regulatory purposes?

Summary of the audit approach

Audit subjects
Audit criteria
Audit evidence

(i)Were the registrations of all possible CRAs done correctly and as efficiently as possible?

(i)Legal requirements and objectives in the CRA regulation as well as complementing delegated regulations (technical standards);

(ii)ESMA's handbook for CRA Registrations.

(i)Analysis of the registration process;

(ii)Analysis of a selection of registration files;

(iii)Interviews with key staff;

(iv)Information gathering visits to a selection of CRAs;

(v)Consultation of NCA via an inquiry on their practices;

(vi)Comparison with practices at the SEC (US).

(ii)Did ESMA develop and implement a sound planning and risk assessment for its supervisory activities?

(i)ESMA’s internal supervision manual and supervisory handbook.

(i)Analysis of the risk assessment conducted by ESMA;

(ii)Analysis of ESMA’s internal planning documents;

(iii)Interviews with key staff;

(v)Consultation of NCA via an inquiry on their practices.

(iii)Does the implementation of the supervisory framework capture the problems revealed in the CRA business, including those related to independency of rating boards and preventing conflicts of interest?

(i)Legal requirements and objectives in the CRA regulation as well as complementing delegated regulations (technical standards);

(ii)ESMA’s internal supervision manual and supervisory handbook;

(iii)Relevant IOSCO guidelines and principles.

(i)Analysis of the files regarding the ongoing supervisory work;

(ii)Analysis of the supervisory files and internal documents, especially the thematic and individual reviews;

(iii)Interviews with key staff;

(iv)Information gathering visits to a selection of CRAs;

(v)Consultation of NCA via an inquiry on their practices;

(vi)Comparison with practices at the SEC (US).

(iv)Did ESMA and the CRAs publish sufficient and value adding information to its stakeholders, in particular the European Parliament, about its supervisory activities?

(i)Legal requirements and objectives in the CRA regulation as well as complementing delegated regulations (technical standards);

(ii)ESMA’s internal supervision manual and supervisory handbook.

(i)Quantitative analysis of the rating information in the CEREP database;

(ii)Analysis of the Socrat database;

(iii)External experts assessed the public disclosure requirements concerning the methodologies, models and key rating assumptions;

(iv)Review by external expert of the rating performance indicators in the CEREP database;

(v)Consultation of NCA via an inquiry on their practices.

Source: ECA.

Annex III

Main findings and recommendations of ESMA’s investigations

2012
2013
2014

Thematic investigation:
The rating process for sovereign, bank and covered bond ratings at S&P, Moody’s and Fitch
Individual investigation:
Corporate governance and internal controls at a CRA
Thematic investigation:
Process to review, implement and disclose banking rating methodologies at S&P, Moody’s and Fitch
Individual investigation:
Rating publication controls in a CRA
Thematic Investigation:
Sovereign Ratings Process at S&P, Moody’s, and Fitch
Thematic investigation:
Structured finance ratings at Fitch, Moody’s, S&P and DBRS
Two thematic investigations: Corporate governance and control functions at 14 and 4 small and medium-sized CRAs

–CRA’s internal processes not sufficiently recorded.

–High staff turnover and insufficient staff in specific business lines.

–Internal control functions should be improved.

–The roles and tasks of the independent members of the Board should be improved.

–Methodology papers were divided into multiple documents and they were not easy to find on the CRAs’ websites.

–IT systems should be adequately implemented and checked.

–The independence of certain directors was not ensured.

–The Board of Directors should continuously assess the internal control systems and increase communication with control functions.

–Resources in the internal control functions should be monitored in terms of adequacy.

–Clarify the empowerment and the working procedures of the internal review function.

–Clarify the documentation to be sent to rating committees.

–Not all elements that influenced the ratings were incorporated in the methodology.

–Not enough disclosure; some new tools, criteria and old methodologies were not disclosed.

–The qualitative and quantitative factors, models and historical evidence were not adequately recorded.

–The annual review of methodologies was not sufficient.

–Ratings were not monitored after changing the methodology of a rating.

–Some information used to support credit ratings was outdated.

–The disclosure of changes to ratings should be transparent and timely.

–IT architecture and control mechanism should properly support the continuity and regularity of ratings disclosures.

–The rating dissemination process should be monitored.

–The responsibilities in the rating publication process should be clearly allocated and documented.

–Board of Directors and review function were involved in rating activities.

–Conflicts of interests not sufficiently controlled for sovereign analysts involved in research activities.

–Rated entities did not always have the opportunity to appeal before the publication of the rating.

–Unauthorised third parties had access to upcoming rating actions.

–Inadequacies found in the IT systems’ authorisation and access controls.

–Significant delays between the rating decisions and their publication.

–Junior and new staff had considerable analytical responsibilities.

–Lack of quality controls over information used and received from data providers.

–Incomplete application of the full methodology during the rating monitoring process.

–Insufficient disclosure of the different analytical frameworks used.

–Delays in the completion of the annual reviews of ratings.

–The internal review function, including the review of methodologies, models and key rating assumptions, should be strengthened in order to ensure independence.

–Board members have limited knowledge of regulatory obligations, insufficient meetings and limited interaction with the control function.

–The monitoring activities of the independent directors of the supervisory board should be reinforced.

–Administrative and Supervisory Boards should be in compliance with the CRA regulation.

–The compliance and the internal review functions should be independent. Rating analysts, shareholders or business development staff should not been involved in the approval of methodologies.

–The compliance function should have adequate resources and its functions and responsibilities should be clearly allocated.

–The internal procedures for validation and back-testing of methodologies should be clearer and more detailed.

–The notification of the rating action to the rated entity was not compliant with the regulation for some CRAs and increased the risk of confidential information being leaked and of the issuer influencing the CRA’s decision.

Source: ECA, based on information provided by ESMA.

Annex IV

Comparison of the websites of the supervisors in the EU and the US

ESMA (CRA section)
SEC’s website (Office of Credit Rating (OCR) section)

1.Availability and accessibility of the relevant regulations:

The Code of Good Practices on Transparency in Monetary and Financial Policies of the IMF recommends that ‘texts of regulations and any other generally applicable directives and guidelines issued by financial agencies¹ should be readily available to the public.’

–Only the CRA regulation (EU Regulation No 1060/2009) and one of the three amendments are available.

–The six Delegated Regulations supplementing the CRA regulation are not available.

–The regulations are not easy to find because there is no specific section. Two options exist:

•Scrolling down through the 180 documents in the subsection CRAs, without any option to filter.

•Leaving the CRA section and going to the generic ‘Documents’ tab, where two filters can be used (and one of these is not alphabetically sorted).

–There is a specific ‘securities laws’ section on the OCR webpage where there are direct links to all the regulations regarding the NRSROs.

2.Availability and accessibility of CRA reports:

‘Financial agencies should issue periodic public reports on how their overall policy objectives are being pursued’² and ‘financial agencies should issue a periodic public report on the major developments of the sector(s) of the financial system for which they carry designated responsibility.’³

–There are two types of reports:

•ESMA supervision of credit rating agencies, annual report.

•Ad hoc reports

–There is no specific section for these reports. The same two options exist:

•Scrolling down the CRAs’ documents section

•Leaving the CRA section and going to the ‘Documents’ tab and then using the filters.

–There is a specific ‘public report’ section, on the OCR website, and they are classified by type of report:

•Staff reports and Studies

•Staff guidance

•Annual reports to Congress

•Annual Examination Reports

3.Disclosure of the registered CRAs:

In the EU, the CRA regulation provides that ‘ESMA shall publish on its website a list of credit rating agencies registered in accordance with this regulation.’⁴

–There is a specific ‘List of registered and certified CRAs’ section where users can find the name of the CRA, the country of residence, the status (registered, certified) and the effective registration date.

–There is a specific ‘Division Resources’ section where users can see the registered NRSROs and the registration date.

4.Disclosure of the types of rating issued by each CRA:

In the EU, the CRA regulation states that its objective is to ‘enhance the integrity, transparency [..] of credit rating activities, contributing […] to smooth functioning of the internal market, while achieving a high level of consumer and investor protection.’⁵ The disclosure of the different types of ratings contributes to enhanced transparency of credit ratings.

–There is no information readily available on which types of ratings CRAs currently issue.

–However, ESMA publishes an annual report called ‘market share calculations for the purpose of the Article 8d of the CRA regulation’ where users can find this information. If the ratings are unsolicited or there are no revenues for the CRA in the current year for that type of rating, they will not appear in the report.

–In the section for registered NRSROs, there is ‘the order granting registration’ for each NRSRO which specifies the type of ratings the CRA issue at the registration time as well as any later withdrawals.

5.Disclosure of the form or template for registration:

Direct access to the registration template could give new CRAs a better understanding of the registration process and encourage them to apply.

–The registration template is not publicly available on the website.

–The CRA team sends the template after the applicant has contacted ESMA

–The NRSRO registration form is publicly available on the website and is easy to find under the Examination Resources section.

6.Accessibility to the CRAs’ regulatory public disclosures:

CRAs must disclose several types of information to the public. For example, in the EU, the CRA regulation requires CRAs to publish an annual transparency report with information on legal structure and ownership, internal control mechanisms, statistics on staff allocation, etc. In order to be a useful resource and help the users of credit ratings to ‘not rely blindly on credit ratings but […] to perform own analysis and conduct appropriate due diligence’, the investors should be aware of these public disclosures.

–ESMA’s website does not make any reference to the regulatory public disclosures on CRAs’ websites.

–NRSROs are required to make publicly available some parts of the registration form and the annual certification form. The ‘Forms NRSRO’ section on the OCR’s website contains links to the individual CRA websites where users can find these forms.

7.Guidance for whistle-blowers:

Specific information and guidance for whistle-blowers lowers the threshold to inform the regulator on possible misconduct and/or infringements of the regulations.

–No specific guidance available. Under the CRA section, there is an email address for queries: CRA-info@esma.europa.eu, which can also be used to submit a complaint

–There is a link to the Office of the Whistle-blower website, which has plenty of information

1Financial agencies refer to the institutional arrangements for the regulation, supervision, and oversight of the financial and payment systems, including markets and institutions, with a view to promoting financial stability, market efficiency and client-asset and consumer protection — Annex: Definitions of certain terms, Code of Good Practices on Transparency in Monetary and Financial Policies: Declaration of Principles, International Monetary Fund, 1999.

2Principle 6.3 of IMF’s Code of Good Practices on Transparency in Monetary and Financial Policies: Declaration of Principles, International Monetary Fund, 1999.

3Principle 7.1 of IMF’s Code of Good Practices on Transparency in Monetary and Financial Policies: Declaration of Principles, International Monetary Fund, 1999.

4Article 18(3).

5Recital 1.

Source: ECA.

Reply of ESMA

Executive summary

VI

ESMA made a conscious decision to be a risk-based supervisor, assuming that not all risks can be removed, but rather that supervisory actions must aim at identifying and addressing those with the greatest potential to cause harm to investors and more generally to financial stability.

ESMA’s risk-based approach is designed to allocate resources to those areas that matter most and was introduced after its first year of supervision.

Since then all high-risk areas that have been identified for high impact CRAs have been addressed either through investigations or ongoing supervision.

ESMA’s risk-based framework comprises three interdependent phases:

(i)Risk identification and assessment;

(ii)Risk Prioritisation; and

(iii)Definition of supervisory actions to address the prioritised risks.

This framework is built around 13 risk indicators and on an annual basis ESMA conducts a strategic exercise to define the annual supervisory work plan that sets priorities and actions for the year ahead. Since 2012, in total 39 times a risk indicator was identified as high risk for high impact CRAs.

Four of these identified risks were addressed through ongoing supervision. The other 35 risk areas were followed up through an individual or thematic investigation in the year following the identification.

The type of the investigation (individual vs thematic) depends, amongst other considerations, on the complexity and level of idiosyncrasy of the identified risk. Moreover, while the focus of the investigation is on the observed high-risk areas, the interdependent nature of risk areas can trigger inclusion of risk areas that are identified as lower risk as part of the investigation.

In addition to the annual strategic exercise, ESMA monitors and assesses risks on an ongoing basis. If outside of the strategic exercise, new risks are observed through our ongoing supervision (analysis of periodic information, analysis of complaints, notifications to changes to the initial conditions of registration, periodic interviews, etc.) and market monitoring, a (re)prioritisation exercise will take place to ensure that resources are allocated to risks with the greatest potential to cause harm to investors and more generally to financial stability.

ESMA acknowledges that a more comprehensive documentation trail is necessary to support the prioritisation of risk throughout the year.

VII

ESMA’s Supervision Manual and Handbook are intended to set out ESMA’s supervisory framework, describe the supervisory processes and describe the common steps and principles to be followed within these processes.

These documents set out the minimum supervisory tasks to be performed throughout the year which can be planned. However the exact types of supervisory tasks and their frequency cannot be established in advance due to the unpredictable nature of some supervisory actions which are driven by the evolving risk profile of each CRA.

Supervision is by its nature a dynamic exercise and, in line with its risk-based framework, ESMA needs to adapt the focus of its supervisory activity to the evolving nature of the industry and the risks observed. For this reason the Supervision Manual and Handbook are now always complemented by: strategies and workplans set for the riskiest CRAs on an annual basis including the actions to be undertaken with deadlines; periodic meetings under a cycle of engagement that is annually established and communicated to the CRAs; and project plans for each investigation.

In ESMA’s view all these documents constitute a complete set of rules and guidelines that allows for the necessary flexibility to adapt ESMA’s supervisory approach and to use supervisory tools in the most effective way.

ESMA acknowledges that the record of the analysis that it conducts on the periodic information received from CRAs could be enhanced. In this regard, the CRA Unit is developing a new tool for continuous monitoring of information and risk assessment purposes. This tool will allow the storage of supervisors’ input and analyses within dedicated documents through the implementation of structured templates, thus enhancing record-keeping practices both of the analysis undertaken and of the risks identified.

However ESMA notes that the record-keeping practices it has established over the past years have supported its regulatory obligations and reflected the internal needs of the organisation. For example, while ESMA may not document internally all the intermediate steps of its analysis during the investigations, all the findings and the supporting evidence are thoroughly documented in the letters sent to the CRAs.

Therefore, while ESMA acknowledges that its documentation and monitoring tools could be further improved, ESMA believes that so far they have been effective and allowed ESMA to retain the relevant information supporting its decision making process.

VIII

ESMA has implemented a risk-based approach which aims at prioritising supervisory activities according to the identified risks, in order to ensure an efficient and effective allocation of resources.

Conflicts of interest and methodologies are part of the risk indicators assessed within ESMA’s risk framework.

ESMA continuously assesses the methodological risk as part of its ongoing supervision where it regularly receives and analyses a wide range of information related to methodologies. When these risk indicators have been identified as high risk in CRAs, ESMA has systematically covered them through its supervisory actions, including for example the thematic investigation into bank methodologies under which ESMA assessed compliance with the requirements of using methodologies that are rigorous, systematic, continuous and subject to validation.

In addition, ESMA has assessed the compliance of methodologies with the CRAR requirements also as part of other investigations, although the methodological risk was not the main focus and the level of analysis performed varied depending on the scope of the investigation. In 2015 ESMA has also conducted an investigation into the validation of methodologies. For further details see ESMA’s reply to paragraphs 81-84.

With reference to conflicts of interest, the entire CRAR is designed to address conflicts of interests and most of the provisions established under CRAR are linked to the CRA’s duty to ensure the independence of its rating activities (avoidance, identification, management and disclosure of conflicts). Since the inception of its supervisory activity ESMA focused significant supervisory efforts on assessing the measures put in place by CRAs to avoid conflicts of interest. Therefore the majority of the interactions with the CRAs and the findings following ESMA’s investigations are linked to the provisions of the CRAR concerning independence and avoidance of conflicts of interest. This is also clear from ESMA’s public annual reports and work plans where ESMA identifies the major supervisory risks on which it will focus in the coming years and provides information on the main issues identified in the course of past investigations. Similarly the two public notices issued by ESMA respectively in June 2014 and June 2015 both refer to infringements of CRAR provisions concerning measures to ensure independence and avoid potential conflicts of interest. For further details see ESMA’s reply to paragraphs 87-89.

Given all the above, ESMA is satisfied that it has allocated the necessary resources to address the risks that it identified regarding methodologies and conflicts of interest. ESMA will continue to monitor these areas and will take appropriate actions in the areas where significant risks emerge.

X

ESMA’s mandate for CEREP under the CRA regulation is to collect historical performance data from each single CRA and make this available to users on a central website.

While CEREP does not include an exhaustive list of all possible statistics, through running multiple queries users can actually retrieve various additional statistics that are commonly used in industry. This approach was chosen as the usefulness of statistics is highly subjective in nature and heavily depends on the final objective of the user which can vary significantly.

ESMA would like to stress that only data that passes extensive validation checks embedded in the data collection tool (50 checks at level 1 and 50 checks at level 2) and systematic completeness checks, is stored in the database and ultimately made available on CEREP. In addition to ensuring quality of data, these steps ensure standardisation and comparability of the submitted data, as well as consistency over time.

Once the data passes these initial checks and is saved in the database, ad hoc checks are run on an ongoing basis to further ensure the consistency and quality of the data. The fact that there is no systematic reconciliation with other databases is a direct consequence of the limitation that CEREP data lacks common identifiers. This issue will be solved as part of the implementation of the European Rating Platform (ERP) as the related Regulatory Technical Standard (RTS) includes the requirement of reporting — where applicable — global identifiers (such as Legal Entity Identifiers, BIC codes, ISINs, etc.).

Furthermore it should be noted that on an ad hoc basis and to the extent possible ESMA does check the validity of the data against other databases.

XI(a)

ESMA accepts this recommendation.

ESMA acknowledges that the documentation of its assessment could be enhanced to provide full evidence in its working documents of the assessment performed and to facilitate an audit trail of its analysis.

XI(b)

ESMA accepts this recommendation.

XI(c)

ESMA partially accepts this recommendation.

ESMA will update its supervisory manual and supervisory handbook when needed, in order to incorporate knowledge and experience gained.

ESMA remains confident that in the context of the investigations all the conclusions and findings reported to the CRAs and the supporting evidence are thoroughly documented.

ESMA acknowledges that the record of the analysis that it conducts on the periodic information received from CRAs could be enhanced and it is currently improving its record-keeping practices both of the analysis undertaken and of the risks identified. However given that the number of registered CRAs remains limited, ESMA does not consider that at this stage a dedicated IT tool is necessary.

XI(d)

ESMA partially accepts this recommendation.

ESMA will continue to regularly assess the methodological risk as part of its ongoing supervision and will perform dedicated supervisory actions when risks are identified, in line with ESMA’s risk-based approach.

XI(e)

ESMA partially accepts this recommendation.

ESMA will continue to regularly assess the risks related to potential conflicts of interest as part of its ongoing supervision — including the measures and controls put in place by the CRAs to monitor rating analysts’ trading activities and financial transactions — and will conduct dedicated supervisory actions when risks are identified, in line with ESMA’s risk-based approach.

XI(f)

ESMA partially accepts this recommendation.

ESMA will address identified weaknesses by specific CRAs through its supervisory mandate. Additional guidance for all CRAs on disclosure requirements will be considered where necessary and in line with the regulation.

XI(g)

ESMA accepts this recommendation.

ESMA will continue its ongoing dialogue with stakeholders to identify how CEREP can be enhanced to further support the needs of its users.

XI(h)

ESMA accepts this recommendation.

ESMA is currently revamping its website. The future version will incorporate the improvements suggested in this recommendation.

Part I – Registration and perimeter activities

27

ESMA consistently allocates at least two assessors to work on each application for registration to ensure the 4 eyes principle. Furthermore, each decision on incompleteness, completeness and compliance (registration or refusal) is challenged through an approval process that involves the coordinator of applications for registration, the Team Leader, the Head of the CRA Unit and the Executive Director of ESMA.

Evidence that at least two assessors have been working on a registration file can be found in ESMA’s internal correspondence and in all formal correspondence with the applicants.

Evidence of ESMA’s approval process can be found in ESMA’s internal correspondence. Moreover the decisions on incompleteness and completeness are signed by ESMA’s Executive Director, while the registration and refusal decisions are formally approved by ESMA’s Board of Supervisors and signed by ESMA’s Chair.

Nonetheless, ESMA acknowledges that the documentation of its internal practices could be improved.

Common reply to paragraphs 28-29

Since ESMA took over the supervision of CRAs in July 2011 and until September 2015, it has assessed 17 applications for registration. Four applicants withdrew their application, six applications were refused and seven CRAs were registered.

During the compliance phase ESMA assesses all the relevant provisions under the CRAR including the compliance with the requirement of using methodologies that are rigorous, systematic, continuous and subject to validation. The Commission Delegated Regulation (EU) No 447/2012 (the RTS on methodologies) provides the framework for ESMA to assess these requirements.

Each requirement is assessed separately and ESMA takes into consideration not only the specific methodology being assessed but also all other documents submitted by the applicant such as the policies and procedures governing the rating process and the results from the validation of the methodology conducted by the applicant. Whenever ESMA deems that additional information is necessary in order to perform its analysis, such information is requested in the context of the compliance phase.

In ESMA’s view the documentation that was received as part of the registration processes allowed it to fully assess all the requirements set forth in the CRAR and in the RTS on methodologies.

In this respect, ESMA did not focus only on the assessment of the rigorousness of the methodologies during the registration process but assessed all the relevant provisions.

For example, ESMA refused a number of applications for registration because of non-compliance with the following requirements: rigorousness (3 cases); systematic (2 cases); subject to validation (4 cases).

These figures show that the most common reason for refusal of applications for registration because of non-compliance with the articles of the RTS on methodologies was the non-compliance with the provision that requires having methodologies that are subject to validation.

With reference to the documentation of its analysis, ESMA has applied the provisions of the CRAR. Article 18 of the CRAR states that where ESMA refuses to register a CRA it shall provide full reasons for its decision; in that respect ESMA thoroughly documented its assessment in the refusal decisions adopted by the Board of Supervisors.

However ESMA acknowledges that — even if not requested by the CRAR — the documentation of its assessment could be enhanced to provide full evidence in its working documents of the assessment performed and to facilitate an audit trail of its analysis.

30

According to the provisions of the CRAR, ESMA shall not impose requirements regarding registration which are not provided for in the regulation. Therefore ESMA cannot require a predefined set of information or define a minimum acceptance level of detail. However ESMA would like to note that whenever it deemed that additional information was necessary in order to perform its compliance assessment, such information was requested in the framework of the registration process.

With reference to the differences in the level of detail in the documentation of methodologies, ESMA would like to highlight that the registration files examined referred to different CRAs active in different sectors. The content of the methodologies is by nature different from CRA to CRA and — within the same CRA — from asset class to asset class and there is no provision in the CRAR that requires the CRAs to prepare their methodologies according to a predefined format.

As regards the possible absence in the methodologies of some information included in the RTS (i.e. modelling or quantitative techniques, statement of the importance of each qualitative of quantitative factor, etc.), the RTS does not set regulatory disclosure requirements but rather lays down rules to be used by ESMA in the assessment of compliance of credit rating methodologies with the requirements set out in Article 8(3) of the CRAR. With reference to these requirements, in addition to the information available to the public, ESMA received all the CRA’s internal documentation that allowed ESMA to assess whether the methodology met the requirements set forth in the RTS.

Finally, in relation to the specific registration file, ESMA received the information on modelling and quantitative techniques in the preregistration phase but indeed it was not included in the registration file examined.

Common reply to paragraphs 31-34

ESMA has conducted perimeter activity since its inception and, in parallel to the notifications from NCAs, it has regularly carried out independent analysis.

ESMA has been in contact with several potential credit rating providers and the majority of these entities had been directly identified by ESMA. This activity allowed ESMA to timely identify companies which should be registered as CRAs.

In ESMA’s view, both activities — ESMA’s internal assessment and contribution from NCAs — are equally important.

Some of the detected entities were indeed carrying out activities falling within the scope of the CRAR and were consequently registered as a CRA. All these entities were identified before ESMA published its Guidelines on the Scope of the CRA Regulation on 30 July 2013. In those Guidelines, ESMA made clear to the public that issuing ratings without being registered is a breach of the CRAR for which ESMA has the authority to impose a fine. ESMA has not used this power so far because it has not identified any company carrying out credit rating activities after the publication of the Guidelines.

Common reply to paragraphs 35-40

ESMA notes that it is responsible solely for the registration and the supervision of the CRAs in the EU and that the functioning of the Eurosystem is outside ESMA’s mandate.

The outcome of ESMA’s registration process has no influence on the rules governing the acceptance of the credit ratings in the Eurosystem.

Part II – Planning and risk management

48

ESMA’s framework is designed in such a way that under each risk category the key concerns identified are listed. Typically, it is the most significant concern that will then drive the overall assessment for a particular risk area. Furthermore, all risks that are identified are documented.

49

The fact whether all necessary documents were analysed, and with what results, is systematically checked during bilateral discussions between the risk and the supervisory staff. However ESMA acknowledges that it lacks formal documentation of this interaction.

50

The input for the fundamental strategic analysis that takes place at least on an annual basis is documented in the scorecards. The reason that a change in the risk assessment that may occur following the consistency check meetings between the risk team and the supervisory team is not documented is that these meetings are part of the finalisation phase of the risk dashboard compilation.

ESMA acknowledges that a more comprehensive documentation trail is necessary to support the prioritisation of risk throughout the year. In this respect ESMA is currently developing a new repository which is designed so as to record changes in risk assessment on an ongoing basis.

Common reply to paragraphs 52-53

ESMA’s risk-based approach was introduced after its first year of supervision. Since then all high-risk areas that have been identified for high impact CRAs have been addressed either through investigations or ongoing supervision.

ESMA’s risk-based framework comprises three interdependent phases (i) Risk identification and assessment, (ii) Risk Prioritisation and (iii) Definition of supervisory actions to address the prioritised risks. This framework is built around 13 risk indicators and at least on an annual basis ESMA conducts a strategic exercise with the purpose to define the annual supervisory work plan that sets priorities and actions for the coming year.

Since 2012, in total 39 times a risk indicator was identified as high risk for the four high impact CRAs.

Four of these identified risks were addressed through ongoing supervision. The other 35 risk areas were followed up through an individual or thematic investigation in the year following the identification.

The type of the investigation (individual vs thematic) depends amongst others on complexity and level of idiosyncrasy of the identified risk. Moreover, while the focus of the investigation is on the observed high-risk areas, the interdependent nature of risk areas can trigger inclusion of risk areas that are identified as lower risk as part of the investigation.

For example ESMA launched an investigation into structured finance credit ratings based on a high risk identified in the risk category associated to the portfolio risk. However to have a comprehensive view of this asset class and of the relevant practices adopted by the CRAs, ESMA had to consider all the aspects underlying the rating process, which evidently also included aspects covered by other risk indicators (e.g. the resource allocation to the rating monitoring activity, the information used during the rating process, as well as the application and review of the relevant methodologies).

In addition to the annual strategic exercise that takes place, ESMA monitors and assesses risks on an ongoing basis. If outside of the strategic exercise new risks are observed through our ongoing supervision (analysis of periodic information, analysis of complaints, notifications to changes to the initial conditions of registration, periodic interviews, etc.) and market monitoring, a (re)prioritisation exercise will take place to ensure that resources are allocated to risks with the greatest potential to cause harm to investors and more generally to financial stability.

54

ESMA structured some past investigation around ratings of specific asset classes, however this does not mean that the investigation did not focus on the business risk aspects identified by the risk assessment framework. On the contrary, specific asset classes (which emerge as important in the Environmental Risk/Portfolio Risk assessment) are used in order to build a consistent and meaningful sample through which the investigation can assess the key risks identified for the relevant CRA(s). In addition, while we might assess a specific risk in detail for a particular asset class, typically the remedial action plan will ask for the remediation of the relevant issues observed across all the asset classes, and not only for the one subject to the investigation.

55

ESMA made a conscious decision to be a risk-based supervisor, assuming that not all risks can be removed, but rather that supervisory actions must aim at identifying and addressing those with the greatest potential to cause harm to investors and to financial stability.

Part III – Supervision

Common reply to paragraphs 63-64

ESMA notes that the Supervision Manual and Handbook are intended to set ESMA’s supervisory framework, describe the supervisory processes and define the common steps and principles to be followed within these processes. These documents set out the minimum supervisory tasks to be performed throughout the year which can be planned a priori.

ESMA believes that the exact types of supervisory tasks and their frequency cannot be established in these documents due to the unpredictable nature of some supervisory activities which are driven by the risk profile of each CRA. For this reason the Supervision Manual and Handbook are now always complemented by: annual strategies and workplans for the riskiest CRAs which include the actions to be undertaken with deadlines; meetings under a cycle of engagement that is annually established and communicated to the CRAs; project plans per investigation.

ESMA believes that going further than that and hard-wiring supervisory task and their timelines — by means of including them in ESMA’s manuals and handbooks — would undesirably constrain the effectiveness of its supervision.

65

ESMA notes that it has recently established individual supervisory plans for the riskiest CRAs.

Nevertheless, also before introducing individual supervisory plans, ESMA has always defined on an annual basis the timing of regular supervisory checks. For example the frequency of meetings under the cycle of engagement was established on an annual basis and communicated to the relevant CRA. Similarly the analysis of the periodic information received from the CRAs was scheduled in accordance with the timing of submission and the related analysis was recorded in a dedicated file.

However, some interactions with the CRAs only take place if ESMA needs further clarifications or if a specific event occurs — for instance notifications received from the CRAs, submission of complaints, discussions following the analysis of the periodic information — and therefore cannot be planned in advance.

ESMA believes that its supervisory approach should remain sufficiently flexible in order to adjust the frequency and intensity of interaction with the CRAs based on the events or risks observed.

66

ESMA believes that it should select the supervisory tool that it considers to be the most effective in order to achieve its supervisory objectives.

In the past ESMA has used checklists and questionnaires where appropriate, to conduct its verifications. However ESMA considers checklists as a tool that works effectively only for certain supervisory activities.

ESMA continuously seeks to enhance its supervisory practices, also looking at the practices of other supervisors. However any comparison with the supervisory tools used by the NCAs should consider the differences in terms of mandate, supervisory objectives, nature of the industry supervised and number of supervised entities.

67

ESMA acknowledges that the record of the analysis that is conducted on the periodic information received from CRAs could be enhanced. In this regard, ESMA is developing a new tool for continuous monitoring of information and risk assessment purposes. This tool will allow the storage of supervisors’ input and analyses within dedicated documents through the implementation of structured templates, thus enhancing record-keeping practices both of the analysis undertaken and of the risks identified.

68

ESMA believes that the ‘criteria folder’ has so far served the purpose of ensuring consistency in its decisions. While ESMA agrees that the documentation could be improved, the supervision of CRAs by ESMA started in late 2011 and only after a sufficient amount of decisions had been taken, did ESMA feel the need to start developing a more structured database. After 4 years of supervisory activities, the information included in the folder has reached a sufficient critical mass and ESMA has recently implemented a wiki-based tool to facilitate an effective use of this information.

Common reply to paragraphs 69-72

ESMA acknowledges that the record of the analysis it conducts on the periodic information received from CRAs could be enhanced and, as explained in previous paragraphs, it is developing a new tool for continuous monitoring of information and risk assessment purposes.

While not all activities have been fully documented, ESMA’s working documents contain nevertheless evidence of the analysis conducted. In this respect ESMA notes that it is operating with limited resources and the time dedicated to documentation needs to be proportionate.

ESMA has assessed whether a dedicated IT system would provide benefits and weighted those benefits against the installation and maintenance costs. Given that the number of registered CRAs remains limited, ESMA does not consider that at this stage a dedicated IT tool is necessary and believes that a comparison with the NCAs is not proportionate in light of the number of registered CRAs and the size of ESMA’s supervisory team compared to the respective figures for most NCAs.

73

ESMA systematically analyses and follows up on all the information requested as part of its investigations. Its working documents show that all relevant information is systematically collected both in the course of the investigations and as part of the remedial action plans.

ESMA does not document all the intermediate steps of its analysis; this is a conscious decision considering that ESMA has a limited number of resources and needs to use them in the most effective way. However the outcomes of the investigations as well as the supporting evidence are thoroughly documented in the letters sent to the CRAs. As such, ESMA retains sufficient records to demonstrate and ensure that the conclusions of the investigations are supported by a thorough analysis of the evidence collected.

74

ESMA’s letters to the CRAs are drafted in compliance with its Supervision Manual, which does not require the inclusion of a reference to the articles and paragraphs of the CRAR from which each finding originates.

ESMA believes that its letters and remedial action plans clearly identify the concerned areas of non-compliance and does not see added value in explicitly mentioning the applicable article of the CRAR for each finding.

75

The follow-up tables are ESMA’s internal working documents; they are prepared in a standard format across all the investigations and the supporting evidence is systematically saved in dedicated folders. However, the standardisation can only refer to the format used; the analyses and comments included in the tables vary in terms of content depending on the relevant topic analysed.

80

ESMA acknowledges that there are a number of terms used in the CRAR which are not defined. However ESMA can only develop specific guidance within the remit of CRAR. ESMA has done so in the past, in order to provide transparency and further clarifications on its supervisory views, for example through guidelines and recommendations, Q&As and public reports.

Common reply to paragraphs 81-84

In order to ensure that CRAs comply with the regulatory requirements to use rigorous, systematic and continuous methodologies which are subject to validation and back-testing, ESMA uses a risk-based approach which allows focusing resources on those areas that matter the most. Methodologies are part of the risk indicators assessed within ESMA’s risk framework.

ESMA continuously assesses the methodological risk as part of its ongoing supervision where it regularly receives and analyses a wide range of information related to methodology. This allows for a comprehensive view of the developments of the methodologies universe for each CRA.

Whenever the methodological risk indicator has been identified as high risk in CRAs, ESMA has systematically covered it through its supervisory actions, including for example the thematic investigation into bank methodologies.

In addition, ESMA has assessed the compliance of methodologies with the CRAR requirements also as part of other investigations, although the methodological risk was not the main focus and the level of analysis performed varied depending on the scope of the investigation.

In this respect ESMA notes that Table 4 — concerning the activity performed by ESMA as part of some investigations conducted in the past — does not reflect the full activity conducted by ESMA regarding methodologies.

As a general point, ESMA would like to note that in all the investigations referred to in the table, it extensively reviewed the activity of the Internal Review Function which is key to ensure that CRA use methodologies that are rigorous, systematic, continuous and subject to validation. In this context ESMA requested and assessed information, conducted interviews and issued recommendations on the activity of such a function. Moreover in all these investigations ESMA verified that the CRA used a unique rating scale to allow comparability of ratings across different asset classes as well as that the Internal Review Function adopted the same procedures for all asset classes reviewed (‘continuous across asset classes’ in the table).

While the bank rating investigation specifically focused on methodologies, the other past investigations did not have as their main objective to cover methodological risks. Nevertheless ESMA has assessed how the methodologies are developed, approved, reviewed and/or applied across the different asset classes and through various rating actions for the selected samples in these investigations. Following these investigations ESMA also issued specific recommendations to the CRAs concerning the methodology area.

In light of the above, ESMA is of the view that Table 4 does not sufficiently reflect the supervision of methodologies conducted within thematic investigations.

Against this background ESMA believes that its supervision of methodologies has so far been adequate and effective. ESMA will continue to regularly assess the methodological risk as part of its ongoing supervision and will perform dedicated supervisory actions when risks are identified, in accordance with ESMA’ risk-based approach.

Common reply to paragraphs 85-86

While ESMA acknowledges that until recently it did not have a formal procedure for examining the notifications of material changes to existing methodologies, ESMA did have a procedure describing in detail the recording and monitoring activities that the CRA Unit needs to follow concerning the notifications of material changes to the conditions for initial registration, which includes the issuance of a new type/class of credit ratings.

Common reply to paragraphs 87-89

ESMA would like to highlight that the entire CRAR is designed to address conflicts of interests and therefore, since the inception of its supervisory activity, ESMA focused significant supervisory efforts on assessing the measures put in place by CRAs to avoid conflicts of interest.

Annex I of the CRAR is entitled ‘Independence and avoidance of conflicts of interest’. ESMA has conducted analyses for each of the sections included in this Annex. Such verifications were performed firstly during the registration process, and thereafter on an ongoing basis through the periodic information received from CRAs as well as during ad hoc thematic and individual investigations. Consequently the majority of the interactions with the CRAs and the findings following ESMA’s investigations are linked to the provisions of the CRAR concerning independence and avoidance of conflicts of interest.

This is also clear from ESMA’s public annual reports and work plans where ESMA identifies the major supervisory risks on which it will focus in the coming years and provides information on the main issues identified in the course of past investigations. Similarly, the two public notices issued by ESMA respectively in June 2014 and June 2015 both refer to infringements of CRAR provisions concerning measures to ensure independence and avoidance of potential conflicts of interest.

As previously explained ESMA has implemented a risk-based approach which aims at identifying risks and prioritising supervisory activities accordingly. Conflicts of interest are part of the risk indicators assessed within ESMA’s risk framework. Where these indicators have been identified as high risk in CRAs, ESMA has systematically covered them through its supervisory actions.

The potential conflicts presented by the provision of ancillary services, services provided by sister companies and securities holding by analysts, constitute one aspect of the potential conflicts of interest faced by a CRA. Moreover, non-compliance with the requirements regarding these potential conflicts was not identified by ESMA as a high risk, therefore ESMA did not conduct dedicated supervisory action in these specific areas. Nevertheless, these areas have been monitored through ongoing supervision and analysed in the context of some investigations conducted in the past. In particular:

—ESMA had several interactions with the CRAs as part of its ongoing supervision concerning the provision of services other than credit ratings and the related potential conflicts of interest. An analysis of these areas was also performed in the context of two investigations conducted by ESMA in the past.

—With reference to the measures and controls put in place by CRAs to prevent disclosure of confidential information to third parties or to sister companies, already as part of the registration process the CRAs were asked to put in place strong safeguards to ensure a strict separation between the CRAs’ business and other activities performed by sister companies. As part of its ongoing supervision ESMA regularly monitors the application of the related controls and of any failures of the confidentiality measures. Moreover, an analysis of the measures to ensure that confidential information is not shared with third parties was carried out as part of several investigations conducted by ESMA.

—With reference to the measures put in place by the CRAs to prevent conflicts of interest relating to rating analysts’ trading activities and financial transactions, ESMA examined the related policies and procedures during the registration process and, where applicable, updates received thereafter during ongoing supervision. ESMA regularly receives the results of the controls performed by the CRAs in this area and follows up if necessary. In this respect ESMA relies on the internal control system of the supervised entities and reacts when it believes that such controls do not perform appropriately or when specific risks have been identified in the concerned area.

Part IV – Disclosures

Common reply to paragraphs 92-94

In addition to the general public disclosures, the CRAR includes other important disclosure requirements, notably the disclosure requirements concerning rules on the presentation of credit ratings and rating outlooks, which ESMA regularly checks as part of its ongoing supervision and in the context of the investigations and that are essential for the users of ratings to undertake their own analysis. In 2014 ESMA conducted an analysis with the objective to check the level of harmonisation of the CRAs in complying with certain disclosure requirements included in the CRAR. The purpose of that exercise was to ensure consistency across all the CRAs.

As a matter of fact ESMA regularly conducts cross-CRAs assessments to verify the harmonisation in the implementation of certain requirements of the CRAR, such as the supervisory work conducted by ESMA on the compliance of CRAs issuing sovereign ratings with the new disclosure requirements introduced by the 2013 amendments to the CRA regulation (see ESMA Annual Report and work plan of 16 February 2015).

Common reply to paragraphs 95-99

ESMA notes that the content of these paragraphs is not related to ESMA’s supervision. ESMA’s role is to ensure that CRAs comply with the CRAR and it cannot go beyond the provisions included in the regulation.

In particular, the assessment of whether the current disclosure requirements provided by the CRAR allow the users of ratings to perform specific tasks, namely to conduct their own due diligence, is not part of ESMA’s duties. For example

There is no provision in the CRAR that requires the CRAs to prepare their methodologies according to a predefined format; consequently ESMA cannot impose any standardised disclosure in that respect.

ESMA would also like to note that, especially in the structured finance category, CRA may publish methodologies which include general principles applicable to various asset classes (master methodologies). These cross-sectorial methodologies contain only general principles and must be read in conjunction with the relevant methodology for the specific asset class. In assessing compliance with the disclosure requirements set forth in the CRAR, ESMA verifies all the relevant methodologies applicable to a given asset class.

100

CEREP centralises standardised historical performance statistics that apply to all types of ratings and CRAs. It offers full flexibility to users in running reports on any combination of data, depending on the interest of the user. According to the legal mandate, CRAs do not have to make ‘historical ratings’ available but rather are obliged to report ‘historical performance data’. As a direct consequence ESMA does not have a mandate to publish information on individual credit ratings through CEREP.

While CEREP does not include an exhaustive list of all possible statistics, through running multiple queries, users can actually retrieve additional statistics, including the ones suggested in the Court’s report. This approach was chosen as the usefulness of statistics is highly subjective in nature and heavily depends on the final objective of the user.

ESMA acknowledges that it would be useful to further facilitate data extraction from CEREP. However, the feasibility to implement more flexible download functions and filtering options has to be assessed by ESMA against: the restrictions of its legal mandate, the possibility to calculate these statistics within the existing CEREP data structure and diversity of data while keeping the tool’s search flexibility, the synergies with the new disclosure requirements for publication on the European Rating Platform (ERP) as well as budgetary and other resource constraints.

101

ESMA’s mandate under the CRAR is to collect historical performance data from each single CRA and make this available to users on a central website. Article 11(2) of the CRAR indicates that a credit rating agency shall make available in a central repository established by ESMA information on its historical performance data including the ratings transition frequency and information about credit ratings issued in the past and on their changes. A credit rating agency shall provide information to that repository on a standard form as provided for by ESMA. ESMA shall make that information accessible to the public and shall publish summary information on the main developments observed on an annual basis.

In that respect ESMA publishes information about the credit ratings issued in the past and on their changes in the form of standardised activity tables. This information includes, amongst others, the number of new ratings issued, the number of withdrawals (split per reason for withdrawal), number of upgrades and downgrades, number of defaults, upgrade/downgrade ratio, and average number of notches for upgrade/downgrades.

In addition, ESMA publishes CRAs’ historical performance data including transition matrices. To ensure a sufficient level of standardisation and comparability across the published statistics, ESMA’s technical working group appointed at the time of the CEREP implementation decided to collect raw data and calculate the statistics centrally rather than to collect the pre-calculated statistics. However, in line with the CRA regulation ESMA does not have a mandate to publish the underlying data. This was confirmed also in various pieces of advice that ESMA received in preparation for CEREP implementation. While ESMA would agree that investors could benefit from such publication, in our view this was not in the scope of the CRA regulation and ESMA would have faced significant legal risks in relation to copyright provisions and misuse of information.

The fact that the 2013 amendments to the CRAR introduced the European Rating Platform that stipulates that ESMA shall publish the individual credit ratings submitted to it, is indicative in this respect.

102

Although ESMA is not requested to monitor the events occurring after a rating withdrawal, in 2014 ESMA has conducted supervisory work to understand the reasons for rating withdrawals. This resulted in amending the reporting standards for the ‘withdrawal reasons’ in the draft RTS related to the ERP. This now provides a more extensive choice of reasons, including the requirement of specifying the reason in case the withdrawal cannot be classified in one of the listed categories.

Once the data will be reported under the new requirements (that is for ratings withdrawn after 1 July 2015), ESMA will monitor the reasons provided and, if considered necessary, will follow up with the CRA for clarifications and/or to create additional categories for withdrawal reasons.

103

ESMA would like to stress that only data that passes extensive validation checks embedded in the data collection tool (50 checks at level 1 and 50 checks at level 2) and systematic completeness checks, is stored into the database and ultimately made available on CEREP. In addition to ensuring quality of data, these steps ensure standardisation and comparability of the submitted data, as well as consistency over time.

Once the data passes these initial checks and is saved in the database, ad hoc checks are run on an ongoing basis to further ensure the consistency and quality of the data. The fact that there is no systematic reconciliation with other databases is a direct consequence of the limitation that CEREP data lacks common identifiers. This issue will be solved as part of the implementation of the ERP as the related RTS includes the requirement of reporting, where applicable, global identifiers (such as Legal Entity Identifiers, BIC codes, ISINs, etc.)

Furthermore it should be noted that occasionally and to the extent possible ESMA does check the validity of the data against other databases.

CEREP technically makes it possible for CRAs to update their previously reported data. Both the old and the new information are kept in the database. ESMA acknowledges the value of information related to corrections and revisions and is considering alternatives for the disclosure of such information on the ERP.

104

The qualitative data made available in CEREP includes the rating scales, default definitions and an overview of methodologies by CRA. This is intended to be a comprehensive summary of the methodologies, including changes. It was never the intention of CEREP to contain an exhaustive repository of information about the CRAs’ methodologies and users should consult the individual CRAs’ websites for complete information. Furthermore, while CRAs are requested to report the same information, a harmonisation in terms of content is not meaningful as it would undermine the objective of reflecting the CRA’s specific definitions and rating scales.

Currently CEREP only discloses the most up-to-date qualitative data. ESMA will consider the possibility of disclosing historical changes to the qualitative data during the development the European Rating Platform.

Common reply to paragraphs 105-108

ESMA is currently revamping its website. The future version of ESMA’s website is aimed at ensuring that this information source meets the needs of ESMA’s stakeholders in terms of the information provided but also in the manner of its presentation. A general update of the content is planned, the list of external documents available will be updated and the user friendliness will be enhanced.

While ESMA is continuously seeking to enhance the level and quality of information that it makes available, ESMA regularly publishes information relating to its fields of activities and the information disclosed so far on its website was compliant with ESMA’s regulatory obligations.

Conclusions and recommendations

110

See ESMA’s reply to paragraphs 20 to 30.

111

See ESMA’s reply to paragraphs 35 to 40.

Recommendation 1

ESMA accepts this recommendation.

ESMA acknowledges that the documentation of its assessment could be enhanced to provide full evidence in its working documents of the assessment performed and to facilitate audit trail of its analysis.

112

See ESMA’s reply to point VI of the Executive Summary and to paragraphs 41 to 55.

Recommendation 2

ESMA accepts this recommendation.

Common reply to paragraphs 113-114

See ESMA’s reply to point VII of the Executive Summary and to paragraphs 56 to 77.

Recommendation 3

ESMA partially accepts this recommendation.

ESMA will update its supervisory manual and supervisory handbook when needed, in order to incorporate knowledge and experience gained.

ESMA remains confident that in the context of the investigations all the conclusions and findings reported to the CRAs and the supporting evidence are thoroughly documented.

ESMA acknowledges that the record of the analysis that it conducts on the periodic information received from CRAs could be enhanced and it is currently improving its record-keeping practices both of the analysis undertaken and of the risks identified. However given that the number of registered CRAs remains limited, ESMA does not consider that at this stage a dedicated IT tool is necessary.

115

See ESMA’s reply to point VIII of the Executive Summary and to paragraphs 78 to 86.

Recommendation 4

ESMA partially accepts this recommendation.

ESMA will continue to regularly assess the methodological risk as part of its ongoing supervision and will perform dedicated supervisory actions when risks are identified, in line with ESMA’ risk-based approach.

116

See ESMA’s reply to point VIII of the Executive Summary and to paragraphs 87 to 89.

Recommendation 5

ESMA partially accepts this recommendation.

ESMA will continue to regularly assess the risks related to potential conflicts of interest as part of its ongoing supervision — including the measures and controls put in place by the CRAs to monitor rating analysts’ trading activities and financial transactions — and will conduct dedicated supervisory actions when risks are identified, in line with ESMA’s risk-based approach.

117

See ESMA’s reply to paragraphs 92 to 94.

118

See ESMA’s reply to paragraphs 95 to 99.

Recommendation 6

ESMA partially accepts this recommendation.

ESMA will address identified weaknesses by specific CRAs through its supervisory mandate. Additional guidance for all CRAs on disclosure requirements will be considered where necessary and in line with the regulation.

119

See ESMA’s reply to point X of the Executive Summary and to paragraphs 100 to 104.

Recommendation 7

ESMA accepts this recommendation.

ESMA will continue its ongoing dialogue with stakeholders to identify how CEREP can be enhanced to further support the needs of its users.

120

See ESMA’s reply to paragraphs 105 to 108

Recommendation 8

ESMA accepts this recommendation.

ESMA is currently revamping its website. The future version will incorporate the improvements suggested in this recommendation.

Reply of the ECB

Executive summary

V

The ECB has received from the European Court of Auditors (ECA) paragraph V of the Executive Summary, and paragraphs 35 to 40 and 111 of the report, and would like to add the following clarifications:

—First, the Eurosystem has a statutory obligation to ensure that the credit operations it conducts are secured by adequate collateral¹. For this purpose, the Eurosystem Credit Assessment Framework (ECAF) is an important instrument for mitigating financial risks for the Eurosystem, and its definition is part of the operational independence of the Eurosystem when conducting monetary policy operations. The procedures, rules and techniques defined in the ECAF are key to ensuring that the Eurosystem’s requirement of high credit standards for all assets that are eligible as collateral in Eurosystem monetary policy operations is met. The legal provisions underlying the ECAF are specified in the ECB Guideline on the implementation of the Eurosystem monetary policy framework (recast) (ECB/2014/60)².

—Second, for the assessment of collateral, the Eurosystem does not rely exclusively on four credit rating agencies (CRAs) registered by the European Securities and Markets Authority (ESMA). As noted by the Court in paragraph 37, the Eurosystem actually takes into account information from credit assessment systems belonging to various sources: external credit assessment institutions (ECAls), rating tools (RTs), national central banks’ in-house credit assessment systems and banks’ internal ratings-based (lRB) systems. Among the systems accepted as RTs, there are also some small European CRAs registered by ESMA.

—Third, it is worth noting that the ECAF is actually open to additional credit rating agencies if they request ECAF acceptance and comply with the minimum requirements for ECAF acceptance of credit assessment systems. The ECAF acceptance criteria aim to ensure that a new system is suitable for the specific purpose of the Eurosystem’s monetary policy operations. This protects the Eurosystem against financial risks and creates a level playing field for the different systems that provide the Eurosystem with credit assessment information. In this context, the Eurosystem acts as a user of credit ratings, not as a regulator or supervisor.

The acceptance processes include checks on quality, whether coverage is sufficient for an efficient implementation of the ECAF and take into account the respective regulatory situation. For example, the criteria for accepting credit rating agencies as ECAls³ include:

(a)that ECAls must be registered or certified by ESMA in accordance with Regulation (EC) No 1060/2009, and

(b)that ECAls must fulfil operational criteria and provide relevant coverage so as to ensure the efficient implementation of the ECAF.

In particular, the use of an ECAl’s credit quality assessment is subject to the availability of information on these assessments to the Eurosystem. In addition, information is requested for the comparison and the assignment (i.e. ‘mapping’) of the credit assessments to the Eurosystem’s credit quality steps and for the purposes of monitoring their performance. The Eurosystem’s due diligence on ECAls thus builds on the supervisory work undertaken by ESMA, but goes in some dimensions beyond it. In a context of limited internal resources, the Eurosystem also needs to ensure that the use of these rating agencies in the implementation of its monetary policy framework is efficient.

In addition, it should be noted that the ECAF and the due diligence on information provided by credit rating agencies have been enhanced in recent years. This is in line with the ECB’s commitment to implementing the Financial Stability Board’s principles for reducing reliance on external ratings.⁴

—Fourth, many factors affect market access for CRAs; of these, ECAF acceptance is only a small one. The Court also acknowledges this as it refers to ‘various factors’ that make entry into the credit rating market difficult (paragraph 35) and the European Parliament’s initiatives to investigate the possibility of establishing a European Rating Agencies Network (paragraph 36). The EU Commission’s report on the feasibility of such a network identified multiple obstacles as well as a lack of support, under the current conditions, by industry representatives for any form of network of smaller CRAs⁵.

For example, the use of credit ratings by banks for capital requirements purposes is not covered by the scope of the Court’s audit. At the moment, a limited number of often three CRAs appear to be used for banks’ capital requirements purposes in the respective European Union Member State⁶. Only when the relevant Implementing Technical Standards of the capital requirements regulation (CRR)⁷ have been adopted⁸ can all ESMA-registered or certified CRAs be used for capital requirements purposes under the ‘standardised approach’. A similar approach will be followed for insurance firms under the Solvency II Directive.⁹ The ECB will consider the effects of these regulatory changes on the market for CRAs, in particular in terms of the quantities and qualities of credit ratings.

Part I – Registration and perimeter activities

Findings

38

The Eurosystem accepts several RTs subject to a set of acceptance criteria¹⁰, including some small European CRAs. The business model of the accepted RTs has focused on the assessment of non-financial companies, for which they have been accepted by the Eurosystem.

40

The Eurosystem accepts CRAs that are registered or certified by ESMA as ECAls or RTs if the CRAs contribute to the efficient implementation of the ECAF for monetary policy operations (see above). The Eurosystem does not act as a regulator or supervisor in this context.¹¹

Moreover, the statement that ‘The US Federal Reserve accepts ratings from all 10 CRAs that are registered by the SEC’ does not tally with the information available to the ECB. In this respect, it is noted that the Federal Reserve System does not publicly state which rating agencies it uses to determine the eligibility and treatment of collateral. One exception was the use of credit ratings for the Term Asset-Backed Securities Loan Facility (TALF), for which the Federal Reserve publicly announced its requirements, which included a rating methodology for ABS, sufficient experience (demonstrated by the provision of a minimum number of relevant public ratings) and registration with the Securities and Exchange Commission as a Nationally Recognized Statistical Rating Organisation.¹² Regardless of the differences between the US and the euro area in the frameworks for monetary policy implementation as well as the regulatory and market situation of CRAs, these requirements comprise some features similar to those of the Eurosystem.

Conclusion

Given the clarifications presented above, the ECB would have found it beneficial if the audit had had the opportunity to cover the various factors affecting the market for small CRAs, of which the ECAF is only a single aspect.

Conclusions and recommendations

111

See the ECB’s comments on paragraph V of the Executive Summary.

1See Article 18.1 of the Statute of the European System of Central Banks and of the European Central Bank.

2Available at https://www.ecb.europa.eu/ecb/legal/pdf/oj_jol_2015_091_r_0002_en_txt.pdf. Additional information on the ECAF is available in the ECB’s recent publication ‘The financial risk management of the Eurosystem monetary policy operations’ and on the ECB’s website at http://www.ecb.europa.eu/mopo/assets/risk/ecaf/html/index.en.html.

3See Article 120 of Guideline ECB/2014/60.

4See, for example, Financial Stability Board, Principles for Reducing Reliance on CRA Ratings, October 2010, available at http://www.financialstabilityboard.org/publications/r_101027.pdf.

5See the Commission report addressed to the European Parliament and the Council on the feasibility of a network of smaller credit rating agencies in the EU (COM(2014) 248 final), available at http://ec.europa.eu/transparency/regdoc/rep/1/2014/EN/1-2014-248-EN-F1-1.Pdf

6See the list of eligible CRAs in the different Member States, available at www.eba.europa.eu/documents/10180/585167/ecai_recognition.xls

7See Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms.

8See the draft Implementing Technical Standards on the mapping of ECAIs’ credit assessments under Article 136(1) and (3) of Regulation (EU) No 575/2013 (Capital Requirements Regulation — CRR). For securitisation positions, see the Consultation Paper on ITS on Mapping of ECAIs Credit Assessments (EBA/CP/2015/08). See also the draft Implementing Technical Standards on the allocation of credit assessments of ECAIs to an objective scale of credit quality steps under Article 109(a) of Directive 2009/138/EC (Solvency II).

9See Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II).

10See Article 124 of Guideline ECB/2014/60 and https://www.ecb.europa.eu/pub/pdf/other/acceptancecriteriaratingtools201505.en.pdf.

11Article 119(4) of Guideline ECB/2014/60 explicitly states that ‘By publishing information on the accepted credit assessment systems in conjunction with its Eurosystem credit operations, the Eurosystem shall not assume any responsibility for its evaluation of accepted credit assessment systems’.

12See § 201.3 (e) (1) of Regulation A of the Federal Reserve Board of Governors, available at https://www.frbdiscountwindow.org/en/Pages/General-Information/Regulation-A-Federal-Reserve-Board-Governors.aspx.

Reply of the Commission

Part IV – Disclosures

Common reply to paragraphs 95 and 96

As a response to the financial crisis, Regulation 1060/2009 on credit rating agencies has considerably improved the transparency in the way credit rating agencies operate on the European market. In particular, the transparency of credit ratings, rating methodologies and the historical performance of registered and authorised credit rating agencies has been enhanced. While there might be some differences in the way that credit rating agencies disclose information, credit rating agencies are generally complying with the disclosure obligations of Regulation 1060/2009. If necessary and appropriate, additional guidance in accordance with Article 16 of Regulation 1095/2010 by the European Securities and Markets Authority to credit rating agencies on disclosure requirements could be considered to improve the overall disclosure practices of credit rating agencies.

97

The Regulation 1060/2009 on credit rating agencies aims to strike the balance between the need to disclose information on rating methodologies while protecting proprietary information of credit rating agencies at the same time.

For users to conduct their due diligence, the Regulation not only requires publishing information on the rating methodologies, but also requires the European Securities and Markets Authority to publish information on the historical performance of credit rating agencies. This also facilitates investors to conduct their own due diligence.

99

It is important to note that in line with Article 23 of Regulation 1060/2009, public authorities shall not interfere with the content of the rating methodologies. If necessary and appropriate, additional guidance in accordance with Article 16 of Regulation 1095/2010 by the European Securities and Markets Authority to credit rating agencies could be considered to improve the presentation of credit rating methodologies and allowing for a more easy comparison of methodologies across credit rating agencies.

Conclusions and recommendations

118

Regulation 1060/2009 on credit rating agencies has improved the transparency of credit rating agencies operating in the European market, subject to effective supervision by the European Securities and Markets Authority (ESMA). These rules have considerably improved the transparency of credit ratings and rating methodologies and combined with the publication of data on the historic performance of credit ratings in a central repository operated by ESMA, users are in a much better position to conduct their own due diligence. Furthermore the new rules also aim to reduce the sole and mechanistic reliance of investors on external credit ratings.

QJ-AB-15-022-EN-E    ISSN 1977-5679

The 2008 financial crisis focused attention on the credit rating agencies and their impact on financial markets. At the time, there was very little regulation of the agencies in Europe. In 2011, the European Securities and Markets Authority (ESMA) was created to register, monitor and supervise them. This report examines whether ESMA has successfully established itself as the credit rating agencies watchdog for the EU. We conclude that while ESMA has laid down good foundations, its rules and guidelines are not yet complete and significant risks remain to be addressed in the future.