Special Report No 22 // 2015#EU supervision of credit rating agencies – well established but not yet fully effective #(pursuant to Article 287(4), second subparagraph, TFEU)
Date: 2015-11-24
Institutions: European Court of Auditors
Subjects: EU office or agency, access to information, economic analysis, economic forecasting, financial control, financial market, market supervision, supervisory body

EN 

2015 

NO 22

Special Report  EU supervision of 

credit rating agencies –  
well established but not  
yet fully effective

EUROPEAN
COURT
OF AUDITORS

 
EUROPEAN COURT OF AUDITORS 
12, rue Alcide De Gasperi 
1615 Luxembourgp 
LUXEMBOURG

Tel. +352 4398-1

Email: eca-info@eca.europa.eu 
Internet: http://eca.europa.eu

Twitter: @EUAuditorsECA 
YouTube: EUAuditorsECA

More information on the European Union is available on the internet (http://europa.eu).

Luxembourg: Publications Office of the European Union, 2015

Print 
PDF 
EPUB 

ISBN 978-92-872-3585-5 
ISBN 978-92-872-3591-6 
ISBN 978-92-872-3586-2 

ISSN 1831-0834 
ISSN 1977-5679 
ISSN 1977-5679 

doi:10.2865/330292 
doi:10.2865/922715 
doi:10.2865/524378 

QJ-AB-15-022-EN-C
QJ-AB-15-022-EN-N
QJ-AB-15-022-EN-E

© European Union, 2015
Reproduction is authorised provided the source is acknowledged.

Printed in Luxembourg

EN 

2015 

NO 22

Special Report

EU supervision of 
credit rating agencies – 
well established but not 
yet fully effective 

(pursuant to Article 287(4), second subparagraph, TFEU)

Audit team

02

The ECA’s special reports set out the results of its performance and compliance audits of specific budgetary areas or 
management topics. The ECA selects and designs these audit tasks to be of maximum impact by considering the risks 
to performance or compliance, the level of income or spending involved, forthcoming developments and political and 
public interest.

This performance audit was produced by Audit Chamber IV — headed by ECA Member Milan Martin Cvikl — which spe-
cialises in auditing revenue, research and internal policies, financial and economic governance and the European Union’s 
institutions and bodies. The audit was led by ECA Member Baudilio Tomé Muguruza, supported by the head of his private 
office, Daniel Costa de Magalhães and Ignacio García de Parada, attaché; Zacharias Kolias, director; Daniela Hristova, team 
leader, Irene Madsen, team leader; Christian Detry, Adrian Savin, Matthias Blaas, auditors.

From left to right: D. Costa de Magalhães, C. Detry, I. Madsen, M. Blaas, B. Tomé Muguruza,  
Z. Kolias, D. Hristova, A. Savin.

Contents

03

Paragraph

Abbreviations

I–XI 

Executive summary

1–14 

Introduction

2–8 

Regulatory reforms

9–13 

The main characteristics of the CRA regulation

14 

ESMA’s role

15–19  Audit approach

20–40  Part I — Registration and perimeter activities

20–21 

Introduction

22–34 

ESMA shortened the registration process, but the assessment of some criteria remains challenging

22–24 

ESMA has well-established registration procedures for CRAs

25–29 

ESMA shortened the registration process, but it remains cumbersome due to the regulatory requirements

30 

The level of detail provided by the CRAs on the methodologies varied

31–34 

ESMA did not have a structured approach to monitoring perimeter activities

35–40 

The current approach of the Eurosystem does not guarantee that all ESMA-registered CRAs are on 
an equal footing

41–55  Part II — Planning and risk management

41–55 

The risk-oriented planning process does not provide full assurance that ESMA gets the most out of 
its resources

42–50 

Comprehensive risk identification, but difficult to trace

51–54 

High-risk areas were not always sufficiently covered

55 

ESMA resources make it difficult to satisfy all demanding regulatory requirements

 
Contents

04

56–89  Part III — Supervision

56–59 

ESMA’s ongoing supervision and investigations

60–75 

Supervision process designed and implemented, but needs time to mature

61–62 

ESMA laid down good foundations for effective supervision of CRAs

63–68 

Internal guidelines and monitoring tools could be further developed to support ongoing supervisory work

69–72 

ESMA manages a huge volume of supervisory information, but does not have a dedicated IT tool for 
registering and processing this data

73–75 

Getting a description of the supervisory checks performed is difficult

76–89 

Real progress, but not yet adequate coverage in analysed thematic areas

78–86  Methodologies supervised, but not all areas covered and requirements not always clear

87–89 

ESMA has not yet examined certain types of conflict of interest

90–108  Part IV — Disclosures

90–108  ESMA’s supervision of CRAs’ general disclosures

92–94 

ESMA regularly checked the individual CRAs’ general public disclosures, but a detailed assessment across 
CRAs of the general disclosure was carried out for the first time in late 2014

95–99  Market transparency impeded by restrictions and varying CRAs’ disclosure practices

100–104  CEREP does not disclose sufficient information on CRAs’ ratings performance

105–108  ESMA does not disclose sufficient information to ratings users on its website

109–120  Conclusions and recommendations

110–111  Registration

112 

Risk management and planning

113–114  Ongoing supervision and investigations

115 

116 

Methodologies

Conflicts of Interest

117–118  General disclosure

119 

120 

CEREP disclosures

ESMA website disclosure

Contents

05

Annex I  —  ESMA’s governance structure

Annex II  —  Audit approach

Annex III  —  Main findings and recommendations of ESMA’s investigations

Annex IV  —  Comparison of the websites of the supervisors in the EU and the US

Replies of ESMA, the ECB and the Commission

 
 
 
 
 
Abbreviations

06

ABS: Asset-backed security

CEREP: Central repository

CESR: Committee of European Securities Regulators

CRA: Credit rating agency

CRAR: Credit rating agency regulation

ECAI: External credit assessment institution

ECAF: Eurosystem credit assessment framework

ECB: European Central Bank

ESMA: European Securities and Markets Authority

IOSCO: International Organisation of Securities Commissions

NCA: National Competent Authority

NRSRO: Nationally Recognised Statistical Rating Organisation

RMBS: Residential mortgage-backed securities

SEC: Securities and Exchange Commission (United States)

Socrat: Supervision of Credit Rating Agencies Tool

Executive  
summary

I
The global financial crisis in 2008 focused attention 
on the role of credit rating agencies (CRAs) and the 
impact of their ratings on financial markets. The activi-
ties of CRAs, which at that time were barely regulated 
in Europe, entered onto the EU’s legislative agenda.

II
The European Securities and Markets Authority (ESMA) 
was established on 1 January 2011. One of its main 
tasks is to regulate credit rating agencies registered in 
the EU. To do so, ESMA has been given exclusive pow-
ers to register the credit rating agencies, to monitor 
their performance, and to take supervisory decisions. 
Currently, ESMA supervises 23 credit rating agencies 
registered in the EU.

III
Has ESMA succeeded in establishing itself as the credit 
rating agency (CRA) watchdog in the EU? Our overall 
conclusion is that ESMA has laid down good founda-
tions for carrying out supervision of the CRAs in the EU 
in a short period of time. However, there is still room 
for improvement.

IV
ESMA took over the registration of credit rating agen-
cies from the national competent authorities and man-
aged to reduce the average duration of the registra-
tion process. However, the process remains complex 
due to current regulatory framework. Although credit 
rating methodologies should be rigorous, systematic, 
continuous and subject to validation, ESMA’s docu-
mentation audited with regard to the registration 
process focused mainly on their rigorousness. Moreo-
ver, because the CRA regulation is unclear as regards 
the definition of methodological criteria, ESMA faces 
additional challenges in interpreting them and build-
ing common understanding with the CRAs.

07

V
The current rules of the Eurosystem do not guarantee 
that all ESMA-registered CRAs are on an equal footing. 
The Eurosystem only accepts ratings issued by four 
ESMA-registered CRAs as external credit assessment 
institutions under the Eurosystem credit assessment 
framework, which creates a two-tier market structure 
and puts small CRAs in an unfavourable situation.

VI
ESMA has a well-established procedure for risk iden-
tification. However, the lack of a documentation trail 
made it hard to understand why certain risks were 
reprioritised. Also, a documented motivation on why 
ESMA did limited investigations in certain high-risk 
areas is missing.

VII
Although ESMA laid down good foundations for its 
supervision approach, its rules and guidelines are not 
complete. Whereas documentation and internal moni-
toring tools are rather rudimentary, it was not always 
possible to trace the ongoing supervisory work per-
formed, or the analysis and conclusions derived from 
it. The documentation of certain intermediate steps of 
the investigations was also incomplete.

VIII
We reviewed ESMA’s supervision in two areas: assess-
ment of methodologies and potential conflicts of 
interest. ESMA assessed a number of related aspects 
based on the regulatory criteria during its ongoing 
supervision work and investigations. However, the 
scope of ESMA’s supervisory activities is not yet com-
prehensive, and there remain areas which could be 
further examined in the future.

Executive summary 

08

(d)  examine all important aspects of the design and 
implementation of CRA methodologies which 
have not yet been covered;

(e)  examine in a structured manner the systems put 
in place by the CRAs for dealing with conflicts of 
interest and in particular those relating to rating 
analysts’ trading activities and financial transac-
tions. In addition, ESMA should test the accuracy 
of the information received from the CRAs on 
conflicts of interest;

(f)  consider developing additional guidance on 
disclosure requirements in order to improve 
the overall disclosure practices of credit rating 
agencies;

(g)  monitor and improve the information content 
of CEREP disclosures based on best practices for 
disclosing ratings performance; and

(h)  publish all applicable legislation and relevant doc-
uments and make the website more user-friendly.

IX
Public disclosure is especially important because it 
enables potential investors to undertake their own 
analysis before deciding whether to rely on credit 
ratings. ESMA checked the CRAs’ general public 
disclosure as part of the ongoing supervision work. 
A detailed assessment across CRAs was started in 
late 2014.

X
ESMA’s online central repository (CEREP) has no 
equivalent in other regulatory jurisdictions. Through 
this database, ESMA provides harmonised and readily 
accessible information on all registered and certified 
CRAs’ ratings performance. However, we are con-
cerned about the adequacy of the summary statistics 
disclosed and the checks carried out by ESMA regard-
ing the data reported to CEREP.

Our recommendations

XI
ESMA should:

(a)  adequately document its assessment of all the 
regulatory requirements regarding the credit 
rating methodologies during the registration 
process;

(b)  enhance the traceability of the risk identification 
process, maintain a log of the changes to the 
risk level and document the prioritisation of risks 
together with reasons.
ESMA should also follow up all the high risk areas, 
which would benefit from further supervisory 
work;

(c)  continuously update its supervisory manual and 
supervisory handbook in order to incorporate 
knowledge and experience gained.
ESMA should establish internal guidance for the 
effective documentation of the investigations so 
as to demonstrate and ensure that all conclu-
sions are supported by adequate analyses of the 
evidence;
The implementation of a dedicated supervisory 
IT tool would improve knowledge sharing, clarify 
the ownership of tasks, facilitate the review of the 
work done, and improve communication within 
the supervisory teams;

 
 
 
Introduction

09

1  Communication from the 

Commission on Credit Rating 
Agencies (OJ C 59, 11.3.2006, 
p. 2).

2 

The predecessor to ESMA, 
established in 2001.

3  Regulation (EC) No 1060/2009 
of the European Parliament 
and of the Council of 16 
September 2009 on credit 
rating agencies, hereafter the 
CRA regulation (OJ L 302, 
17.11.2009, p. 1).

4 

5 

The model consists of a board 
of supervisors including all the 
national supervisors from the 
countries in which the CRA is 
operating. This model was 
also used for banking 
supervision in the EU.

In November 2008, the 
Commission authorised 
a high-level group chaired by 
Jacques de Larosière to make 
recommendations on how to 
strengthen European 
supervisory arrangements 
with a view to better 
protecting citizens and 
rebuilding trust in the financial 
system. In February 2009, the 
de Larosière Group published 
its final report.

01 
Credit rating agencies (CRAs) issue 
opinions that help reduce the asym-
metry of information among borrow-
ers, lenders and other market partici-
pants. Credit ratings are an important 
tool in the equity and bond markets as 
they contain information for inves-
tors and market participants, in some 
cases even replacing investors’ due 
diligence.

Regulatory reforms

02 
Even though regulators were rely-
ing on credit ratings in many cases, 
CRAs were practically unregulated for 
many years. The main approach was 
self-regulation based on generally 
accepted best practices developed 
by the International Organisation of 
Securities Commissions (IOSCO), which 
was recognised as the global standard-
setter for the securities sector.

03 
In 2006, the Commission concluded in 
its Communication on Credit Rating 
Agencies that light regulation, com-
bined with self-regulation by the CRAs 
on the basis of the IOSCO standards, 
was sufficient to address the major 
issues of concern in relation to CRAs1. 
CRAs were only regulated in a few 
areas, such as insider trading and mar-
ket manipulation, business of credit 

institutions or capital adequacy of 
credit institutions. The Committee of 
European Securities Regulators (CESR)2 
was instructed to monitor CRAs’ 
compliance with the IOSCO Standards, 
while the Commission was expected to 
continuously monitor developments in 
the area. However, the 2008 financial 
crisis prompted considerable discus-
sion concerning the operation of CRAs, 
which led the Commission to launch in 
November 2008 a proposal to regulate 
credit rating agencies.

04 
The CRA regulation was adopted in 
September 20093 and required CRAs 
to:

—  register with a national supervisor 

when operating in the EU;

—  disclose models, methodologies 
and key assumptions on which 
they based their ratings; and

—  be subject to supervision by na-

tional securities regulators based 
on the home-host model4.

05 
The de Larosière Report5 encouraged 
the EU to strengthen regulation and 
supervision of CRAs. The report recom-
mended transferring the registration 
and supervision of CRAs from the 
national competent authorities to 
a centralised European body.

10

6  Regulation (EU) No 1095/2010 
of the European Parliament 
and of the Council of 
24 November 2010 
establishing a European 
Supervisory Authority 
(European Securities and 
Markets Authority), amending 
Decision No 716/2009/EC and 
repealing Commission 
Decision 2009/77/EC (OJ L 331, 
15.12.2010, p. 84).

7 

8 

9 

In July 2014 the European 
Court of Auditors published SR 
No 5/2014 ‘European Banking 
Supervision taking shape — 
EBA and its changing context’ 
(http://eca.europa.eu), which is 
the first special report of ECA 
regarding the reforms in the 
regulatory and supervisory 
framework of the financial 
sector in the EU.

This amendment to the CRA 
regulation is also referred to as 
CRA II.

This amendment to the CRA 
regulation is also referred to as 
CRA III.

10  Article 2(1) of the CRA 

regulation.

11  Article 8(3) of the CRA 

regulation.

12  The regulation states that 

‘In carrying out their duties 
under this Regulation, ESMA, 
the Commission or any public 
authorities of a Member State 
shall not interfere with the 
content of credit ratings or 
methodologies.’

Introduction

06 
ESMA was established on 1 January 
20116 as part of the European System 
of Financial Supervision (ESFS). The 
ESFS comprises ESMA, the European 
Banking Authority (EBA)7 and the 
European Insurance and Occupational 
Pensions Authority (EIOPA) which, 
together with the national supervisory 
authorities (NSAs), the European Sys-
temic Risk Board (ESRB) and the Joint 
Committee of the European Superviso-
ry Authorities form the current Europe-
an supervisory architecture. The main 
objective of ESMA, in particular, is to 
protect public interest by ensuring 
the integrity, transparency, efficiency 
and orderly functioning of securities 
markets.

07 
In July 2011 ESMA was given exclusive 
supervisory powers over CRAs regis-
tered in the EU8.

08 
Most recently (May 2013) a third round 
of legislation was approved, with the 
aim of reducing investors’ overreliance 
on credit ratings and improving the 
quality of sovereign debt rating for EU 
Member States9.

The main characteristics 
of the CRA regulation

09 
The principal aim of the CRA regula-
tion is to protect investors and ensure 
the stability of financial markets in 
the EU. It applies to any CRA estab-
lished in the EU issuing credit ratings 
disclosed publicly or distributed by 
subscription10.

10 
The regulation contains a significant 
level of prescriptive detail on how 
CRAs should manage conflicts of 
interest.

11 
The regulation governs the prepara-
tion processes and methodologies 
for generating credit ratings. CRAs 
must use rating methodologies that 
are ‘rigorous, systematic, continuous 
and subject to validation based on 
historical experience, including back-
testing’.11 However, the CRA regulation 
does not interfere with the content of 
credit ratings.12

12 
The CRA regulation aims to increase 
transparency by requiring CRAs to dis-
close their rating methodologies and 
the critical assumptions used. The aim 
of this transparency is to allow market 
participants to assess more accurately 
whether the ratings properly reflect 
risks.

Introduction

11

ESMA’s role

14 
Table 1 provides an overview of 
ESMA’s main activities in connection 
with the registration and supervision 
of CRAs.

13 
The CRA regulation also gives ESMA 
new powers and responsibilities:

—  CRAs are required to register with 
ESMA when rating EU financial 
products;

—  CRAs are subject to ongoing su-

pervision by ESMA; and

—  CRAs are subject to sanctions by 
ESMA if they do not comply with 
the regulation.

1 Overview of the tasks of ESMA
e
l
b
a
T

Registration and  
perimeter activities1
•  All CRAs established in the EU must 
apply for registration with ESMA.

•  CRAs established in non-EU coun-
tries and whose credit ratings are 
used in the EU should be certified 
by ESMA.

• 

• 

• 

The registration is  
a two-phase process:  
(i) completeness; and 
(ii) compliance.

ESMA should develop draft regula-
tory technical standards regarding 
the registration process.

ESMA should verify that there are 
no non-registered/certified CRAs 
issuing credit ratings in the EU.

Supervisory framework

Risk assessment and planning
ESMA performs market intel-
• 
ligence and research to allow it 
to identify trends and risks in 
the CRA industry.

• 

ESMA carries out a risk assess-
ment based on the market 
intelligence and knowledge 
built up via the supervision of 
CRAs.

•  Development of risk scorecards 
for each CRA and an overall risk 
dashboard.

•  Development of work 

programme

• 

• 

Supervision
ESMA is responsible for the 
ongoing supervision of CRAs.

ESMA monitors periodic report-
ing by CRAs.

•  Monitoring of CRAs’ notifica-

tions of changes to their initial 
conditions for registration.

• 

• 

• 

• 

• 

ESMA can conduct an individual, 
thematic or ad hoc investigation 
in the event of a risk of non-
compliance being identified.

Follow up on previous investiga-
tions and thematic reviews.

Disclosure

ESMA must ensure that CRAs dis-
close their rating methodologies 
and related key assumptions.

ESMA manages CEREP (a 
public database on rating 
performance).

ESMA manages Socrat (an 
internal database) to which 
CRAs report all rating actions on 
a monthly basis.

1 The identification of entities which are operating as a CRA in the EU without being registered is what ESMA considers perimeter activities.

Source: ECA, based on the provisions of CRAR and information provided by ESMA.

 
Audit approach

12

13  E.g. potential conflicts of 
interest and lack of 
transparency.

14  National competent 

authorities (NCAs) are national 
agencies that are responsible, 
under their respective national 
law, for supervising and 
regulating (part of) the 
financial sector.

17 
We collected our audit evidence from 
a file review of a sample of registra-
tion files and supervisory files. We also 
conducted interviews with key super-
visory and risk management staff of 
ESMA. Based on the evidence obtained 
we analysed the registration process, 
the risk assessment and planning of 
resources, the organisation of supervi-
sory work and the adequacy of disclo-
sure of CRAs.

18 
Besides the work performed at ESMA, 
information-gathering visits were con-
ducted at three CRAs and an inquiry 
was made with 10 national competent 
authorities (NCAs)14 regarding their su-
pervisory approach and methodology.

19 
Finally, external experts assessed the 
public disclosure requirements con-
cerning the methodologies, models 
and key rating assumptions of five 
credit rating agencies and reviewed 
the rating performance indicators pub-
lished by ESMA in the CEREP database. 
A more detailed description of the 
audit approach is provided in Annex II.

15 
The audit examined whether ESMA’s 
registration process and supervision 
of CRAs was effective. In particular, we 
analysed whether:

—  the registrations of all possible 

CRAs had been done correctly and 
efficiently;

—  ESMA had developed and imple-
mented a sound planning and 
risk assessment for its supervisory 
activities;

—  the implementation of the super-
visory framework captured the 
problems revealed in the CRAs’ 
business13, including those related 
to the independence of rating 
boards and preventing conflicts of 
interest; and

—  ESMA and the CRAs publish suffi-

cient and value adding information 
to its stakeholders.

16 
The audit criteria were derived from 
the following sources:

(i)  Legal requirements and objectives 
in the CRA regulation as well as 
complementary delegated regula-
tions (technical standards).

(ii)  ESMA’s supervision manual and 

supervisory handbook.

(iii)  ESMA’s handbook for CRA 

registrations.

(iv)  Relevant IOSCO guidelines and 

principles.

(v)  Documents from the SEC, the cor-
responding supervisor in the US, 
with a view to comparing practices 
in both jurisdictions.

Part I – Registration 
and perimeter activities

13

Introduction

20 
CRAs established in the EU must be 
registered with ESMA in order to 
conduct business activities. Before 
the creation of ESMA, the NCAs were 
in charge of the registration process. 
Figure 1 lists the 23 registered CRAs15 
as at June 2015.

21 
In addition to the management of the 
registration process, ESMA has to en-
sure that companies not registered as 
credit rating agencies are not provid-
ing credit ratings.

15  Moody’s appears twice in the 
table because, after the initial 
registration of several Moody’s 
Group CRAs at NCA level, in 
2014 ESMA registered Moody’s 
Investor Services EMEA Ltd.

1 Registered CRAs in the EU
e
r
u
g
i
F

Registered  CRAs in the European Union … 

By National Competent Authorities, from 2010-2012

By ESMA, from 2012-2015

(cid:127)  Euler Hermes Rating GmbH
(cid:127)  BCRA-Credit Rating Agency AD
(cid:127)  Feri EuroRating Services AG
(cid:127)  Creditreform Rating AG
(cid:127)  Scope Ratings GmbH
(cid:127)  ICAP Group SA
(cid:127)  GBB-Rating Gesellschaft für 
   Bonitätsbeurteilung GmbH
(cid:127)  ASSEKURATA
(cid:127)  ARC Ratings, S.A. 

(cid:127)  AM Best Europe-Rating Services Ltd. 
(cid:127)  DBRS Ratings Limited
(cid:127)  Fitch Group.
(cid:127)  Moody’s Group
(cid:127)  Standard & Poor’s Group
(cid:127)  CRIF S.p.A.
(cid:127)  Capital Intelligence (Cyprus) Ltd
(cid:127)  European Rating Agency, a.s.
(cid:127)  Cerved Rating Agency S.p.A. 

(cid:127)  Asexor
(cid:127)  The Economist Intelligence Unit Ltd
(cid:127)  Dagong Europe
(cid:127)  Spread Research
(cid:127)  EuroRatin Sp. Z o.o
(cid:127)  Moody’s Investor Services EMEA Ltd.

… All of them supervised by ESMA.

Source: ECA, based on information provided by ESMA.

 
Part I – Registration and perimeter activities

14

ESMA shortened the 
registration process, but 
the assessment of some 
criteria remains 
challenging

ESMA has well-established 
registration procedures for 
CRAs

22 
When a company established in the 
EU enters the credit ratings business, it 
has to apply for registration at ESMA. 
The registration process has two 
phases: (i) a completeness phase; and 
(ii) a compliance phase (see Figure 2 
for an overview of these two phases).

2 CRA Registration Process
e
r
u
g
i
F

+1 d

x

+20 d

+45 d*

+5 d

Completeness Phase

Compliance Phase

ESMA examines the compliance 
of the application to the CRA 
Regulation

CRA sends the 
application for 
registration 
to ESMA

ESMA 
acknowledges 
the reception 
of the 
application 
by email

If application 
is incomplete: 
ESMA sends 
a letter to 
request 
additional 
information

If application 
is complete: 
ESMA sends 
a letter to 
the CRA and 
starts the 
compliance 
phase

CRA can be 
asked to 
provide 
additional 
Information

ESMA’s Board 
of Supervisors 
adopt a decision 
whether to 
approve the 
application 
or not

CRA sends the 
additional 
information

+20 d

d: working day
* It can be extended to 60 working days in case of endorsing, outsourcing or exception request.

Source: ECA, based on information provided by ESMA.

Notiﬁcation of 
the decision to:
(cid:127)  the CRA
(cid:127)  European 
   Commission
(cid:127)  European 
   Supervisory 
   Authorities
(cid:127)  Technical 
   Committee 
   members
Publication on 
ESMA’s website.

 
Part I – Registration and perimeter activities

15

23 
ESMA has produced a separate hand-
book describing the registration 
phase. It describes the procedures 
which must be followed from the first 
contact of the credit rating agency 
with ESMA until the end of the regis-
tration process. ESMA also has pre-
defined draft emails and templates 
for pre-application, notifications of 
completeness, requests for informa-
tion, final decisions of the Board of 
Supervisors, fees, etc.; these make the 
process more efficient.

ESMA shortened the 
registration process, but it 
remains cumbersome due to 
the regulatory requirements

25 
Although the regulation requires 
a two-phase approach (see Figure 2), 
ESMA managed to significantly reduce 
the average duration of the registra-
tion process from 373 calendar days 
to 227. Table 2 provides an overview 
of the applications processed by NCAs 
and ESMA till December 2014.

24 
The process of analysing information 
and requesting additional information 
from the CRA can be repeated as many 
times as ESMA considers it necessary. 
Once the application file is complete, 
ESMA may ask for further clarification 
and/or make on-site visits to the CRA 
during the compliance phase.

2 Average number of calendar days needed for assessing an application for 
e
l
b
a
T

registration and average number of additional requests for information

ALL APPLICATIONS

ACCEPTED APPLICATIONS

REJECTED APPLICATIONS

Average days 
for assessing 
an application

Average No of  
additional requests 
for information

Average days 
for assessing an 
application

Average No of  
additional requests 
for information

Average days 
for assessing an 
application

Average No of  
additional requests 
for information

NCA

ESMA

373

227

1.8

2.1

(19 applications)

(10 applications)

375

1.8

(18 accepted applications)

209

2.0

(6 accepted applications)

342

254

(1 rejected application)

1.0

2.3

(4 rejected applications)

Source: ECA, based on information provided by ESMA.

 
Part I – Registration and perimeter activities

16

26 
During the completeness phase, if 
the documents sent by the CRA are 
deemed to be insufficient, ESMA can 
ask for additional information. Each 
time the CRA sends additional infor-
mation, ESMA has up to 20 working 
days to assess the documents and 
notify the CRA of the completeness 
or incompleteness of the application. 
Splitting the registration process into 

two phases makes the process rather 
cumbersome and lengthy, as the as-
sessment of completeness involves 
an evaluation of the content of the 
documentation sent by the CRA. ESMA 
must therefore conduct double work 
as it has to make a brief compliance 
assessment during the completeness 
phase. Figure 3 shows the usual pro-
cedure followed during the complete-
ness phase.

3 Average duration of the completeness phase in working days
e
r
u
g
i
F

(cid:127)  Start of the Completeness Phase

(cid:127)  ESMA assesses the completeness of the application
(cid:127)  1st Request for Information

(cid:127)  CRA sends new documentation

(cid:127)  ESMA assesses the completeness of the application
(cid:127)  2nd Request for Information

(cid:127)  CRA sends new documentation

(cid:127)  ESMA assesses the completeness of the application

(cid:127)  ESMA starts the Compliance Phase

20 working
days

Up to 20
working
days

20 working
days

Up to 20
working
days

20 working
days

Up to 45
working
days

Source: ECA, based on information provided by ESMA.

 
Part I – Registration and perimeter activities

17

16  The requirement that 

a business transaction be 
approved by at least two 
individuals. For example: 
segregation of various 
functions, cross-checking, 
dual control of assets, double 
signatures, etc.

27 
ESMA’s CRA Registration Handbook 
requires each CRA application to be 
processed on the basis of the four eyes 
principle16. However, it was not pos-
sible to see in the documentation that 
this was applied in all registration files 
examined.

28 
ESMA does not sufficiently docu-
ment its assessment of methodolo-
gies during the registration process. 
Credit rating methodologies have to 
be rigorous, systematic, continuous 
and subject to validation based on 
historical experience (including back-
testing). Each of these requirements is 
further detailed in the supplementing 
Delegated Regulation on methodolo-
gies (for an overview see Figure 4). On 
the other hand, the CRA regulation 
stipulates that ESMA is not allowed to 
interfere with the content of a rating 
or methodology.

29 
ESMA has to assess the compliance of 
CRAs’ methodologies with the above 
requirements during the registration 
process. We noted that the information 
included in the registration files exam-
ined supported mainly the verification 
of ESMA that the credit rating meth-
odologies were rigorous (see green 
shading in Figure 4).

Part I – Registration and perimeter activities

18

4 Credit rating methodologies according to the CRA regulation
e
r
u
g
i
F

Rating methodologies should be rigorous, systematic, continuous and subject to validation based on 
historical experience, including back-testing.

(cid:127)  Clear and robust controls and processes.
(cid:127)  Relevant driving factors.
(cid:127)  Modelled relationship between rated entities and factors.
(cid:127)  Reliable, relevant and quality related analytical models, 
  key credit rating assumptions and criteria
(cid:127)  Qualitative factors explained:  scope of judgement, 
  related weightings assigned to.
(cid:127)  Quantitative  factors explained:  key variables,  
  data sources, key assumptions, modelling and 
  quantitative techniques, related weights.
(cid:127)  Prompt incorporation of findings or outcomes 

from internal review functions.

(cid:127)  Systematic application of methodologies, analytical 
  models, key  credit rating assumptions and criteria,  

in the formulation of  all credit ratings in a given asset 

  class or market segment.
(cid:127)  Capable of promptly incorporating findings from any 
  review of its appropriateness.

Article 4:
RIGOROUS

Article 5:  
SYSTEMATIC

Delegated 
regulation on 
methodologies

(cid:127)  Continue to be used unless there is 
  an objective reason to change  or 
  discontinue the methodology.
(cid:127)  Capable of promptly incorporating any 

Article 6:
  CONTINOUS

finding from ongoing monitoring or a review , 
in particular changes in structural macroeconomic 
  or financial  market conditions would be capable of 
  affecting credit produced by that methodology. 
(cid:127)  Compare credit ratings across different assets.

Source: ECA, based on the provisions of CRAR.

  Article 7:  
          VALIDATION, 
including
BACK TESTING

(cid:127)  Examination of the sensitivity of the 

rating methodology to changes 

in assumptions.

                (cid:127)  Assessment of historic credit ratings 

  produced by the methodology.
(cid:127)  Use of reliable inputs, including appropriate size 
  of data samples..
(cid:127)  Take into account the main geographical areas or 
  rated entities for each rating category.
(cid:127)  Identification and remedy of systemic credit rating 
  anomalies highlighted by back testing.
(cid:127)  Regular credit rating and performance reviews.
(cid:127)  In-sample and out-of-sample testing.
(cid:127)  Historic information on validation or back testing.

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Part I – Registration and perimeter activities

19

The level of detail provided 
by the CRAs on the 
methodologies varied

ESMA did not have 
a structured approach 
to monitoring perimeter 
activities

30 
ESMA has not developed a detailed 
list of documentation required during 
the registration process for assessing 
credit rating methodologies, nor has it 
defined the minimum acceptable level 
of detail. The registration files exam-
ined showed significant differences in 
the level of detail in the documenta-
tion on the methodologies. For one 
registration file examined, for instance, 
there is no information on modelling 
or quantitative techniques, as referred 
to in the Delegated Regulation on 
methodologies, nor a statement of 
the importance of each qualitative 
of quantitative factor used, including 
a description of and justification for 
related weightings assigned to those 
factors.

31 
Companies that only produce private 
credit ratings, credit scores or credit 
ratings produced by central banks fall 
outside the scope of the CRA regula-
tion. Box 1 illustrates the difference 
between a credit rating and a credit 
score.

32 
Many companies provide credit scores, 
export credit assessments, or act as 
investment advisors in general. Com-
panies operating in financial services 
are registered and supervised by their 
respective NCAs.

1
x
o
B

Credit rating and credit score

‘Credit rating’ means an opinion regarding the creditworthiness of an entity, a debt or financial obligation, 
debt security, preferred share or other financial instrument, or of an issuer of such a debt or financial obliga-
tion, debt security, preferred share or other financial instrument, issued using an established and defined 
ranking system of rating categories.

‘Credit score’ means a measure of creditworthiness derived from summarising and expressing data based 
only on a pre-established statistical system or model, without any additional substantial rating-specific ana-
lytical input from a rating analyst.

 
Part I – Registration and perimeter activities

20

33 
ESMA has a CRA Technical Committee17 
that meets every 1-2 months. Perim-
eter activity is a standing point in its 
agenda. The committee is an impor-
tant network for ESMA as a means 
of identifying entities which should 
be registered as CRAs. Some of the 
detected entities were indeed carrying 
out activities falling within the scope 
of the CRA regulation and were conse-
quently registered as a CRA. Although 
issuing ratings without being regis-
tered is a breach of the CRA regulation 
for which ESMA has the authority to 
impose a fine, ESMA has not yet used 
this power.

34 
ESMA’s monitoring of perimeter activi-
ties was not structured and was mainly 
carried out on a case-by-case basis. In 
March 2015 ESMA adopted a specific 
strategy and work programme18 for 
perimeter activities.

The current approach of 
the Eurosystem does not 
guarantee that all ESMA- 
registered CRAs are on an 
equal footing

35 
CRAs are private firms with a signifi-
cant role in financial markets. Various 
factors make entry into the credit rat-
ing market difficult. Reputation built 
over a long period of time is a com-
petitive advantage. Investors tend to 
prefer credit ratings from well-known 
CRAs, as understanding the meth-
odology behind the ratings requires 
resources. Similarly, the issuers tend 
to demand credit ratings only from 
a credit rating agency that is the most 
used and trusted by investors.

36 
A benefit of a supervision of the credit 
rating market is that it provides the 
users of credit ratings with some as-
surance as to the quality of the CRAs’ 
work. In fact, the lack of competi-
tion in the credit rating market was 
a concern19 and to provide a true level 
playing field for all actors in the credit 
rating market was one of the key ra-
tionales for establishing ESMA.

17  The Technical Committee 

consists of representatives of 
NCAs and has been 
established to assist ESMA in 
preparing policy decisions 
regarding the supervision of 
CRAs. The committee provides 
technical advice by 
contributing to the drafting of 
technical standards, 
guidelines and 
recommendations.

18  ESMA will, for example, ask 
registered CRAs and other 
stakeholders on a regular basis 
whether they have any 
information about potential 
rating providers in the EU and 
conduct semi-annual internet 
sweep searches.

19  The EU has taken steps to 

increase market competition 
for credit ratings in Europe. 
The CRA regulation addresses 
increased competition in 
several paragraphs. The 
European Parliament has 
asked the Commission on 
several occasions to 
investigate the possibility of 
establishing a European 
Rating Agencies Network. On 
5 May 2014, the Commission 
approved a report addressed 
to the European Parliament 
and the Council on the 
feasibility of a network of 
smaller credit rating agencies 
in the EU (COM(2014) 
248 final).

Part I – Registration and perimeter activities

21

39 
Based on our interviews with credit-
rating market participants, smaller 
European CRAs consider registration 
as an ECAI with the Eurosystem as 
very important for the future develop-
ment of their business, especially in 
connection with entering the credit 
rating market for structured finance25, 
which is by far the most important 
market segment for CRAs’ revenues 
and profits. However, the Eurosystem’s 
approach effectively upholds the two-
tier market structure, in which small 
CRAs cannot compete on an equal 
footing with the large CRAs. In particu-
lar the criterion of ‘relevant coverage’ 
represents an effective barrier to 
entry.26

40 
The Eurosystem’s current approach of 
‘recognising’ the credit rating agencies 
resembles the supervision of credit rat-
ing agencies — a task entrusted by the 
EU legislator solely to ESMA — rather 
than just an administrative process for 
accepting ‘suppliers’ of credit ratings. 
In comparison to the Eurosystem’s ap-
proach, the US Federal Reserve accepts 
in most of the cases ratings from all 10 
CRAs that are registered by the SEC.

37 
The Eurosystem20 is an important 
player in the financial markets. It 
provides liquidity to the financial 
system through its monetary policy 
operations. It provides credit to 
eligible counterparties21 only against 
collateral22, which must meet high 
credit standards. To make this credit 
assessment23, the Eurosystem takes 
into account information from several 
sources:

 ο Credit ratings issued by external 
credit assessment institutions 
(ECAIs)24;

 ο National central banks’ in-house 
credit assessment systems;

 ο

Internal ratings-based systems;

 ο

Third-party providers of rating 
tools.

38 
The Eurosystem currently accepts rat-
ings by only four ECAIs. To have ratings 
accepted by the Eurosystem, the CRA 
has to be registered or certified by 
ESMA as well as fulfilling certain opera-
tional criteria and providing relevant 
coverage. In addition, the Eurosystem 
accepts currently two smaller CRAs as 
a rating tool provider. However, these 
tools are of a limited value for these 
CRAs in comparison with the accept-
ance as ECAI.

20  The Eurosystem is the 

monetary authority of the 
euro area. It comprises the 
European Central Bank and 
the national central banks of 
the Member States. The 
Eurosystem’s primary 
objective is maintaining price 
stability. It also aims to 
safeguard financial stability 
and promote European 
financial integration.

21  These eligible counterparties 

have to fulfil certain 
requirements set out in 
Articles 55 to 57 of Guideline 
ECB/2014/60.

22  Assets that are pledged to the 
Eurosystem as a security in the 
central bank credit operations 
must fulfil certain criteria.

23  The Eurosystem credit 

assessment framework defines 
procedures, rules and 
techniques to ensure high 
credit standards for all eligible 
assets.

24  External Credit Assessment 
Institutions are CRAs, which 
provide ratings and related 
probabilities of default for 
regulatory purposes.

25  Structured finance 

instruments use complex legal 
and corporate entities to 
transfer risks. They result, for 
instance, from a securitisation 
transaction, in which a pool of 
assets is used to create a new 
financial instrument with 
specific characteristics.

26  Fulfilling such a criterion 

requires a demand for credit 
ratings from a broad set of 
issuers, in particular from 
those in the structured finance 
market segment. However, 
these issuers are unlikely to 
ask for such service if the CRA 
is not yet accepted by the 
Eurosystem.

Part II – Planning 
and risk management

22

(ii)  Prioritisation of risks should iden-
tify high-risk areas which should 
be targeted by the supervisory 
activities.

(iii)  Work plan of supervisory activities 

should allocate resources accord-
ing to priorities for the coming 
year.

The risk-oriented 
planning process does not 
provide full assurance 
that ESMA gets the most 
out of its resources

41 
Supervised entities cannot be investi-
gated all the time; it is therefore very 
important to have a rational system 
for deciding which issues should be 
targeted, and when. ESMA therefore 
uses a risk-oriented planning process 
for supervisory activities to ensure that 
its limited resources are deployed in 
the most effective way possible. The 
process can be broken down into three 
phases (see Figure 5):

(i)  Risk analysis should identify areas 
of possible non-compliance.

5 ESMA’s annual risk assessment process
e
r
u
g
i
F

Risk identification

Risk prioritisation

Planning

Scorecards

Risk dashboards

Ad-hoc analyses

Risk report for the 
Board of Supervisors

Annual work plan

(cid:127)  Selecting supervisory activities
(cid:127)  Allocating staﬀ 

Source: ECA, based on information provided by ESMA.

 
Part II – Planning and risk management

23

Comprehensive risk 
identification, but difficult 
to trace

ESMA has a comprehensive 
approach to identifying risks …

42 
ESMA organises its risk assessment 
along a matrix of 13 risk areas, which 

are grouped into four risk categories 
(see Figure 6). The risk areas address 
broad topics, which encompass more 
detailed topics. For instance, the risk 
area ‘management of conflicts of inter-
est’ comprises more than nine detailed 
topics such as the influence of share-
holders or board members and the 
adequacy of disclosures.

6 From risk categories to risk areas and topics
e
r
u
g
i
F

RISK CATEGORIES (4)

GOVERNANCE RISKS

BUSINESS MODEL RISKS

ENVIRONMENTAL RISKS

OPERATIONAL RISKS

Management quality risk

Strategy risk

Portfolio risk

Information Technology risk

)
3
1
(

s
a
e
r
a
k
s
i
R

Internal Risk framework
methodological risk 

Concentration risk

Human resources risk

Outsourcing risk

Structural and procedural risk

Rating process risk

Risk management quality risk

Management of conﬂicts 
of interest risks 

Audit and compliance risk

Source: ECA, based on information provided by ESMA.

Each risk area still encompasses number of topics

(cid:127)  Internal control functions 
(cid:127)  Independent non-executive directors 
(cid:127)  Separation of commercial and analytical staff
(cid:127)  Shareholder influence 
(cid:127)  Influence of board members 
(cid:127)  Influence of ancillary services 
(cid:127)  Adequacy of disclosures 
(cid:127)  Adequacy of policies addressing conflicts of interest 
(cid:127)  Internal discussions on identified conflicts of interest
(cid:127)  and other topics

 
 
 
Part II – Planning and risk management

24

27 

International Standard IEC 
31010:2009, section 5.5.

43 
The annual risk assessment is the key 
way of identifying risks. It draws on 
the knowledge acquired during the 
year about the CRAs and the analysis 
of documents the CRAs submit during 
the year. On the basis of this informa-
tion the risk analysis staff, together 
with the supervisory staff, prepare 
a scorecard for each supervised CRA. 
These scorecards aggregate all known 
risks and score them to show their 
importance.

44 
The scorecards are incorporated into 
an annual risk dashboard which gives 
the risk level per risk area for each su-
pervised CRA. Separate specific dash-
boards are created for the major CRAs 
and for all smaller CRAs to account for 
different market impact. These risk 
dashboards are used to identify sys-
tematic risks in the CRA market.

45 
In addition to the annual risk assess-
ment, ESMA uses ad hoc risk analyses. 
These analyses can be triggered by 
any relevant news in the CRA market, 
the analysis of rating data or credit 
market data. Its purpose is to identify, 
in a timely manner, specific areas of 
concern for individual CRAs or groups 
of CRAs active in the same rating 
product, or any market developments 
that could trigger a re-prioritisation of 
supervisory activities.

46 
ESMA progressively increased the use 
of ad hoc risk analyses. Recently, more 
of these were triggered as a result of 
ESMA’s findings. All analyses helped 
ESMA to identify high-risk areas and 
areas where the supervisory team 
should improve its knowledge of spe-
cific topics.

… but the documentation is in 
several aspects insufficient

47 
In the field of risk management, the 
available knowledge should be prop-
erly documented in an understandable 
way. In addition, the detailed concerns 
and findings as well as the justifica-
tion for changing risk levels should be 
well documented. To ensure effective 
supervision, the framework should 
provide the supervisory staff with 
the possibility to review the evolu-
tion of risks and how the risks were 
addressed27.

48 
The scorecards provide an aggregated 
assessment for each risk area. While 
an outcome of the aggregated assess-
ment is recorded, there is no docu-
mentation of the assessments of the 
detailed topics within each risk area. 
This can lead to a loss of knowledge 
and a difficulty to follow how the 
sub-risks have been translated into the 
higher risk.

Part II – Planning and risk management

25

28  E.g. in areas such as IT, internal 
controls, methodologies, 
conflicts of interest.

49 
The risk assessment guidelines pre-
scribe the documents to be consulted 
when scorecards are prepared. Howev-
er, any underlying work is not properly 
documented and there is no evidence 
that anyone checks it.

50 
If a risk level in a scorecard changes, 
ESMA does not keep any records of 
the reasons for the change. Decisions 
on such changes take place verbally in 
informal meetings between the super-
visory staff and the risk analysis team.

High-risk areas were not 
always sufficiently covered

51 
On the basis of the scorecards, the risk 
dashboards and the information from 
the ad hoc risk analyses ESMA prepares 
a risk report for the Board of Supervi-
sors. This report identifies the high-risk 
areas — i.e. fundamental issues which 
are intended to be treated as a key 
priority in the supervisory work. The 
annual work programme sets out the 
areas that ESMA will focus on in its 
supervisory activities.

52 
ESMA’s risk-based approach was in-
troduced after its first year of super-
vision. However, in the beginning, it 
was not always consistently applied. 
Some high-risk areas mentioned in the 
risk scorecards and the risk reports to 
the Board of Supervisors would have 
benefited from further supervisory 
actions.

53 
Limited coverage of some high risks 
would be justified if ESMA’s supervi-
sion resources had been deployed to 
cover other high-risk areas or where 
an immediate action was unreason-
ably resource intensive. However, 
also lower-risk areas were included in 
certain investigations, while higher- 
risk areas would have benefited from 
further assessments.

54 
Furthermore, the investigations did 
not fully cover the risks prioritised in 
the annual risk assessment process 
because of an asymmetry between the 
risk areas and the way that investiga-
tions are carried out. The scorecards, 
dashboards and risk report organise 
the risks according to the topics such 
as strategic risks or outsourcing risks. 
However, the topics of the investiga-
tions are mostly structured around 
asset classes such as sovereign or bank 
debt. Thus, the objectives in the in-
vestigations do not completely match 
with the identified risks.

ESMA resources make 
it difficult to satisfy all 
demanding regulatory 
requirements

55 
At the end of 2014, 26 employees were 
working in the CRA Unit, 15 of which 
were responsible for supervision and 
four were allocated to the risk analysis. 
The remaining staff were allocated 
mainly to policy work. The number 
of staff combined with the increasing 
volume of regulatory requirements 
made it very difficult for ESMA to pro-
vide adequate coverage of compliance 
checks with the regulation28.

Part III – Supervision

26

ESMA’s ongoing 
supervision and 
investigations

56 
All CRAs are subject to ongoing su-
pervision once they have been regis-
tered. The objective of the ongoing 
supervision is rapid identification of 
supervised entities which might not 
be compliant with the applicable 
requirements.

57 
ESMA follows a risk-oriented supervi-
sory approach. The intensity, extent 
and types of supervisory activities 
depend on the risks posed by the vari-
ous market participants (see Figure 7. 
Potential problems identified during 
the desk-based ongoing supervision 
are analysed and, where necessary, 
further investigatory activities are 
conducted.

7 Supervisory activities
e
r
u
g
i
F

Desk-based 
on-going supervision

Risk analysis

Further
investigatory
actions

Request for information

General investigation

On-site inspection

Source: ECA, based on the provisions of CRAR.

58 
ESMA’s ongoing supervisory work 
comprises analysis of the information 
received periodically from the entities 
supervised, analysis of information re-
ceived from external sources (authori-
ties, competitors, complaints, press, 
etc.), follow-ups of questions received 
from CRAs, and communication with 
the management of the CRAs through-
out the supervisory cycle. Table 3 
shows ESMA’s supervisory tasks as part 
of the ongoing supervision process.

 
Part III – Supervision

27

3 ESMA’s tasks in ongoing supervision
e
l
b
a
T

Analysis of information

Regular engagements

Other tasks

Review of periodic information sent by the CRAs — quarterly, semi-annually
Review of CRAs’ periodic public disclosures
Review of notifications received from the CRAs pursuant to the CRA regulation (e.g. notification of material changes to the 
conditions for initial registration)
Regular monitoring of information disclosed to the public on CRAs’ websites
Reports/alerts received from ESMA’s risk analysis team
Periodic calls to CRAs (organised after receiving the semi-annual information)
Cycle of engagement calls to CRAs (periodic calls and meetings with key personnel in the CRAs: Head of Compliance, Inter-
nal Review Function, Internal Audit, Risk management, Chief Executive Officer and Independent Non-Executive Directors. 
The frequency of the engagement calls depends on the size of the CRA)
Deep dives (follow-up of potential risk areas identified during analysis of information and regular engagement activities)
Handling complaints from third parties
Follow-up of remedial action plans from investigations
Interaction with CRAs — providing feedback to queries from CRAs on an ad hoc basis

Source: ECA, based on information provided by ESMA.

59 
In addition to ongoing supervision, 
ESMA regularly selects CRAs’ compli-
ance risk areas for further investigatory 
action (mainly general investigations), 
based on its own risk assessments. 
General investigations usually involve 
on-site inspections. An overview of 
ESMA’s on-site investigations is pro-
vided in Annex III. They can be broadly 
classified into two groups:

—  thematic investigations focused on 
certain issues common to several 
large CRAs; and

— 

individual investigations in certain 
CRAs covering specific issues.

 
Part III – Supervision

28

Supervision process 
designed and 
implemented, but needs 
time to mature

ESMA laid down good 
foundations for effective 
supervision of CRAs

29  By analogy the ‘Core Principles 

for Effective Banking 
Supervision’ issued by BIS 
could be applied also the 
supervision of CRAs.

60 
Effective supervision requires:

(i)  a comprehensive supervision 

policy that broadly sets out the 
supervision process, combining 
both off-site and on-site methods 
of supervisory activities;

(ii)  comprehensive internal guidelines 

and methodologies to assist staff 
in their daily tasks;

(iii)  collection and analysis of 

information;

(iv)  effective oversight of the work 

done and corrective actions taken 
by the CRAs in response to the 
findings.

61 
Best practices state that supervi-
sors should have a methodology for 
determining and assessing the nature, 
impact and scope of the risks to which 
the supervised entities are exposed, 
including the business focus, the risk 
profile and the internal control envi-
ronment. Off-site and on-site work is 
prioritised based on the results of that 
assessment29.

62 
ESMA set out its general principles in 
the Supervision Manual and Supervi-
sion Handbook. These documents 
serve as useful reference tools and 
practical guidance to ESMA’s supervi-
sion teams on how to implement ef-
fective and efficient supervision within 
the framework of the CRA regulation. 
ESMA’s supervision manual gives a de-
tailed description of the investigation 
as a method of supervision. It details 
the different phases and lists the mini-
mum information required in the pro-
ject plan and all other necessary steps 
to be followed on-site and during the 
reporting phase (see Figure 8).

Part III – Supervision

29

8 Main steps of an investigation
e
r
u
g
i
F

Requests for information
On-site phase

Project plan

Final letter (remedial action plan)
Sanctions and Follow-up

Preliminary letter

CRA’s reply

Timeline

Source: ECA, based on ESMA’s supervisory manual and handbook.

Internal guidelines and 
monitoring tools could be 
further developed to support 
ongoing supervisory work

63 
The internal guidelines should clearly 
specify the frequency and scope of 
examinations. In addition, examina-
tion policies and procedures should 
be developed in order to ensure that 
examinations are conducted in a thor-
ough and consistent manner, with 
clear objectives.

64 
The Supervision Manual and the Su-
pervision Handbook give only a broad 
description of the ongoing supervi-
sion process and do not define the 
exact types of supervisory tasks to 
be undertaken by ESMA, nor do they 
provide any information regarding the 
frequency of these tasks.

65 
ESMA sets up supervisory plans on 
a yearly basis for the period ahead. 
However, ESMA did not have individual 
supervision plans for each CRA with 
information about the supervisory 
tasks to be performed on an annual 
basis. Moreover, we did not find any 
sufficient predefined timetables set-
ting the minimum frequency of regular 
supervisory checks to be conducted 
for each CRA.

66 
The CRA regulation establishes a clear 
set of rules that ESMA must supervise, 
however, ESMA does not systematical-
ly use checklists as a supervisory tool. 
Moreover, many NCAs use question-
naires and checklists in their supervi-
sory work.

 
Part III – Supervision

30

67 
Moreover, the different supervisory 
teams do not document their work in 
a standardised format, and it is dif-
ficult to track the ongoing supervisory 
work that has been performed and the 
analysis and conclusions which have 
been derived from it.

—  periodic information provided to 

ESMA quarterly and semi-annually 
(information about CRAs’ revenue 
and costs, changes to key CRA 
staff, Board minutes, internal audit 
reports, internal review function 
reports, etc.).

68 
ESMA has also established a ‘criteria 
folder’. Its purpose is ‘to ensure con-
sistency’ by allowing assessors to ‘con-
sult decisions adopted by ESMA in the 
past’ during the registration process 
and later in the ongoing supervisory 
work. The ‘criteria folder’ contains, 
amongst others, emails from the legal 
service, ESMA’s previous decisions and 
internal correspondence regarding 
issues encountered during registration 
and supervisory work. This is a good 
initiative; however, the structure of the 
criteria folder does not ensure that it 
is used as comprehensive guidance to 
supervisors in their daily work.

ESMA manages a huge 
volume of supervisory 
information, but does not 
have a dedicated IT tool for 
registering and processing 
this data

69 
ESMA deals with two sets of 
information:

—  ad hoc information (material 

changes to the initial conditions 
for registration, complaints from 
third parties, questions from CRAs, 
etc.); and

70 
ESMA set up a file to record the analy-
sis of the information received peri-
odically from all supervised CRAs (see 
Box 2).

71 
The file is a good initiative to keep 
track of the huge volume of superviso-
ry information received, but it is cum-
bersome and hard to follow. Moreover, 
the file does not have an ‘owner’ and 
anyone from the supervisory team 
can edit, modify or delete its content 
without keeping track of the changes 
and who made them.

72 
As ESMA does not have a dedicated IT 
tool to serve as a register of informa-
tion received and for documenting 
and analysing supervisory work, ESMA 
has created a structure which seems 
to be used mostly as a storage tool 
for the information received from the 
CRAs. However, we did not find in all 
cases evidence of detailed analysis 
having been made of the information 
received. The NCAs stated that they all 
had a supervisory IT system in place 
to document their supervisory work 
and to facilitate knowledge retention 
within the organisation.

Part III – Supervision

31

2
x
o
B

Examples of data monitored

 ο Conference calls and meetings held with CRAs;

 ο Notifications;

 ο News about changes to methodologies, rating scales and corporate structure from CRA staff and websites;

 ο CRA revenues, costs, staff turnover and other staff data;

 ο Compliance reports, internal audit reports, audited financial statements, Board minutes; and

 ο CRA transparency reports.

Source: ECA, based on information provided by ESMA.

75 
ESMA follows up on the CRAs’ im-
plementation of the remedial action 
plans. This is documented in a follow-
up table for each investigation and 
CRA. ESMA does not have a harmo-
nised approach to documenting the 
staff’s analyses and comments in these 
tables (e.g. identifying the specific 
supporting evidence that a CRA had 
sufficiently implemented a required 
action).

Getting a description of 
the supervisory checks 
performed is difficult

73 
ESMA’s documentation of the inves-
tigations does not provide sufficient 
evidence of all the intermediate steps 
carried out. It is therefore difficult for 
ESMA to monitor and prove that all 
tasks are properly undertaken in ac-
cordance with the objectives of the in-
vestigations. In particular, the working 
papers did not show how all necessary 
evidence was assessed.

74 
After an investigation, ESMA sends let-
ters to the CRAs with the preliminary 
and/or final findings. The Supervi-
sion Manual suggests that the letters 
should make reference to the relevant 
legislation. A reference to the spe-
cific legal basis of each finding would 
allow CRAs to better understand the 
compliance risks that are spotted in 
the letters. However, ESMA routinely 
communicated its findings without 
any legal references to specific articles 
of the regulations.

 
Part III – Supervision

32

Real progress, but not yet 
adequate coverage in 
analysed thematic areas

Methodologies supervised, 
but not all areas covered and 
requirements not always 
clear

30  Annex II, point 8 of Delegated 
Regulation on Registration.

78 
A CRA must specify in its application 
for registration which types of credit 
ratings it will issue30. The applicant 
must also provide the necessary docu-
mentation for its methodologies and 
models. On this basis, ESMA assesses 
whether the CRA’s methodologies and 
models at the time of registration com-
ply with the CRA regulation and the 
supporting Delegated Regulation.

79 
CRAs have the obligation to use 
methodologies which are rigorous, 
systematic, continuous, and subject to 
validation based on historical experi-
ence, including back-testing. ESMA has 
the obligation to regularly examine 
each CRA’s compliance with these 
regulatory requirements.

76 
The risk-oriented supervisory ap-
proach implies that only some risks 
can be covered by ESMA’s supervision 
work. Supervisory checks will thus 
differ from one topic to another. To 
complete our assessment of ESMA’s 
supervision process, we chose two the-
matic areas for a detailed review:

(i)  CRAs’ methodologies, models and 

key rating assumptions; and

(ii)  Conflict of interest in the CRA 

market.

77 
The choice was motivated by the im-
portance of these topics for the func-
tioning of the CRA market. The meth-
odologies are the backbone for the 
CRAs’ assignment of ratings and rating 
outlooks. Conflict of interest was iden-
tified as one of the main weaknesses 
in the credit ratings market before the 
sub-prime crisis. The analysis allowed 
us also to take stock of ESMA’s work 
over the last 4 years since ESMA was 
established.

Part III – Supervision

33

31  Commission Delegated 

Regulation (EU) No 447/2012 
of 21 March 2012 
supplementing Regulation 
(EC) No 1060/2009 of the 
European Parliament and of 
the Council on credit rating 
agencies by laying down 
regulatory technical standards 
for the assessment of 
compliance of credit rating 
methodologies (OJ L 140, 
30.5.2012, p. 14).

32  For the three largest CRAs, 
ESMA counts more than 
800 methodologies for 
different asset classes and 
market segments.

Regulatory requirements 
regarding methodologies are 
not always defined

80 
The CRA regulation does not provide 
any definitions or criteria concerning 
regulatory requirements for methodol-
ogies. A Commission Delegated Regu-
lation31 lays down regulatory technical 
standards for ESMA’s assessment of 
the regulatory requirements regard-
ing methodologies. In the published 
reports presenting conclusions for the 
investigations carried out in the area of 
methodologies, ESMA gave examples 
of methodological content in order to 
provide guidance to the industry on 
its expectations in this area. Nonethe-
less, some of the terms used in these 
standards would benefit from further 
clarification, with a view to improving 
the common understanding of the 
regulatory requirements regarding 
methodologies between ESMA and the 
credit rating agencies.

ESMA’s supervision of 
methodologies did not cover all 
aspects of CRAs’ methodologies

81 
ESMA verifies the CRAs’ implementa-
tion of the regulatory requirements 
regarding methodologies during 
ongoing supervision and in-depth 
investigations.

82 
ESMA’s ongoing supervision is de-
signed in such a way that the assess-
ment of credit rating agencies’ com-
pliance with regulatory requirements 
regarding methodologies focuses on 
whether CRAs have appropriate inter-
nal controls in place, such as:

—  an independent internal function 

responsible for periodically review-
ing methodologies, models and 
key rating assumptions;

— 

independent members on CRAs’ 
administrative or supervisory 
boards responsible for monitor-
ing the effectiveness of their CRA’s 
internal control systems, includ-
ing the efficiency of the internal 
review function; and

—  documentation of periodic meth-
odology reviews and of their 
underlying procedures.

83 
Therefore, ESMA’s assessment of meth-
odological requirements needs to be 
complemented by in-depth investiga-
tions. In view of ESMA’s resources and 
the large number of methodologies 
to be supervised32, ESMA makes use 
of risk assessments to select the top-
ics of the investigations relating to 
methodological requirements. Table 4 
presents an overview of ESMA’s assess-
ments of compliance with regulatory 
technical standards regarding meth-
odologies carried out during thematic 
investigations. The table is based on 
ESMA’s documentation.

Part III – Supervision

34

4 Overview of ESMA’s assessments in the area of methodological requirements as part 
e
l
b
a
T

of the thematic investigations

Rating process  
examination 
(2012)1
N/A

Bank ratings 
investigation 
(2013)
Partial

Sovereign ratings 
investigation 
(2013)
No

Small and medium-sized 
CRA investigations 
(2014)
Partial

Structured finance  
ratings investigation 
(2014)
Partial

N/A

N/A

N/A

Partial

No

Partial

No

No

No

No

No

Yes

No

Partial

Partial

Regulatory 
requirements

Rigorous
Systematic and  
continuous in time
Continuous across 
asset classes
Subject to validation based 
on historical experience

1 This investigation was completed before the regulatory technical standards had been adopted.

Source: ECA, based on information provided by ESMA.

84 
Some important regulatory require-
ments regarding methodologies have 
therefore not yet been examined dur-
ing ESMA’s thematic investigations, for 
instance:

— 

in 2014 ESMA began an in-depth 
analysis of industry practices to 
validate methodologies; and

—  ESMA did not verify the regulatory 
requirements relating to continuity 
of ratings across asset classes.

33  CESR’s Guidance on 
Registration Process, 
Functioning of Colleges, 
Mediation Protocol, 
Information set out in Annex II, 
Information set for the 
application for Certification 
and for the assessment of 
CRAs systemic importance, p. 
16, ref. CESR/10-347.

34  Guideline on periodic 

information to be submitted 
to ESMA by credit rating 
agencies of 19 March 2015.

ESMA did not have a formal 
procedure to examine a change 
in a CRA’s methodology, or 
cases when a CRA issues a new 
type of rating

85 
When a CRA, after being registered, 
makes a material change to a meth-
odology or it expands its business by 
issuing new types of credit ratings, it 
has to notify ESMA. However, the CRA 
regulation does not define the term 
‘material change’. In 2010, CESR issued 
a guideline33 defining what was con-
sidered as a material change. In 2014 
ESMA communicated its definition of 
material change in its ‘Questions and 
Answers’ on the implementation of the 
CRA regulation. In March 2015, ESMA 
updated this definition of a material 
change34, specifying the changes in 
the initial registration conditions re-
garding ‘rating methodologies, models 
or key rating assumptions’.

 
Part III – Supervision

35

35  The Financial Crisis Inquiry 
Commission examined the 
reasons for the financial crisis 
as part of the Fraud 
Enforcement and Recovery 
Act in the US. The report was 
published in January 2011.

36  Technical Committee of 
IOSCO, Report on the 
subprime crisis, May 2008.

37  For instance, ESMA found that 
CRAs’ publication of research 
papers may limit the 
independence of the rating 
analysts. If a rating committee 
has to approve a rating shortly 
after the publication of 
a research paper, it is difficult 
for the committee to take 
a decision that is not in line 
with the conclusions of the 
research paper.

86 
Although ESMA clarified when the 
CRAs had to send a notification on 
material change, it did not have a for-
mal procedure for examining these 
notifications of new methodologies or 
material changes to existing ones dur-
ing the audited period. In June 2015 
ESMA adopted a procedure describing 
the steps to be followed when a noti-
fication on a methodology is received 
from a CRA.

ESMA has not yet examined 
certain types of conflict of 
interest

87 
OECD defines a conflict of interest 
as a situation where ‘an individual or 
a corporation (either private or gov-
ernmental) is in a position to exploit 
his or their own professional or official 
capacity in some way for personal or 
corporate benefit’.

88 
In the credit ratings market, conflicts 
of interest are mainly related to pos-
sible influences of affected parties on 
the rating. Both the Financial Crisis 
Inquiry Commission35 and the Interna-
tional Organisation of Securities Com-
missions36 identified this as one of the 
main weaknesses in the credit ratings 
sector before the sub-prime crisis.

89 
In this context ESMA assessed the 
measures put in place by CRAs to avoid 
conflicts of interest, among others, the 
adequacy, the effectiveness and the 
independence of a number of internal 
control functions. However, there are 
areas which could be further examined 
in the future:

(i)  ESMA did not sufficiently examine 
whether CRAs’ ancillary services 
may have influenced the rating. 
ESMA only conducted limited 
supervisory actions in this area.37

(ii)  Limited evidence was found that 
ESMA had examined possible con-
flicts of interests between CRAs 
and consulting companies under 
the same holding company.

(iii)  ESMA did not examine in a struc-

tured manner conflicts of interest 
relating to rating analysts’ trading 
activities and financial transac-
tions. CRA staff involved in a rating 
action have privileged informa-
tion prior to the publication of the 
rating action. The CRAs should 
therefore have procedures in place 
to monitor the rating analysts’ 
trading activities and securities 
holdings in order to mitigate the 
risk of insider trading. ESMA re-
ceives information on the results of 
this monitoring, but ESMA did not 
test the procedures in place at the 
CRAs to verify the correctness of 
the information received.

Part IV – Disclosures

36

ESMA’s supervision of 
CRAs’ general disclosures

90 
One of the objectives of the CRA III 
regulation is to enhance transpar-
ency of CRAs and the market for credit 
ratings, notably in respect of CRAs’ 
pricing policies, the fees they receive, 
the way they conduct their rating 
process and how they reach their con-
clusions. Transparency is ensured by 
complete and readily accessible public 
disclosure.

91 
The CRA regulation requires the CRAs 
to make two types of disclosure: gen-
eral disclosure and periodic disclosure. 
The general disclosure refers to infor-
mation that the CRAs must disclose 
publicly, mainly through their web-
sites. Periodic disclosure refers to the 
regular supervisory information that 
the CRAs must send to ESMA. Another 
important source of information is the 
ESMA’s own disclosure of their supervi-
sory work to stakeholders.

ESMA regularly checked the 
individual CRAs’ general 
public disclosures, but 
a detailed assessment 
across CRAs of the general 
disclosure was carried out for 
the first time in late 2014

92 
The CRA regulation requires CRAs to 
publicly disclose various types of gen-
eral information (see Figure 9).

93 
The general public disclosure is an 
important tool for communication 
between the CRAs and the users of the 
credit ratings. Users should be able 
to undertake their own analysis and 
conduct appropriate due diligence 
when assessing whether to rely or not 
on a given credit rating. They should 
be able to assess the risks a CRA is 
exposed to, e.g. risks of conflicts of 
interest, risk of poor quality input in 
ratings, risks embedded in the meth-
odologies, etc.

94 
ESMA reviewed CRAs’ general public 
disclosure during its ongoing supervi-
sion work and as a part of its investiga-
tions. However, a detailed analysis of 
the CRAs’ general disclosure practices 
was started for the first time in Decem-
ber 2014.

Part IV – Disclosures

37

9 Requirements for general disclosure
e
r
u
g
i
F

Ancillary services

Codes of conduct 
and annual 
transparency report

Policies of publication 
of credit ratings
 and outlooks

Resources 
and procedures

CRAs’ 
General
disclosure

General nature 
of the compensation 
agreements

Modiﬁcations to systems

Methodologies and description of
models and key rating assumptions

Source: ECA, based on the provisions of CRAR.

97 
The CRA regulation does not oblige 
CRAs to disclose proprietary infor-
mation. In practice this means that 
certain parts of a methodology do not 
have to be disclosed. This gives rise to 
a paradox, as a CRA may not choose to 
disclose its full methodology if some 
information is proprietary and affects 
the ability of users to perform their 
own due diligence.

Market transparency 
impeded by restrictions and 
varying CRAs’ disclosure 
practices

95 
We observed weaknesses in general 
disclosure practices.

96 
CRAs must disclose specific informa-
tion to the public (see Figure 9). They 
primarily do so using websites. We 
found that to users must set up an 
account using personal data to access 
some of these websites. The privacy 
policies of these CRAs state that per-
sonal data collected from users may 
be given to third parties, which may 
discourage potential users from set-
ting up an account.

 
Part IV – Disclosures

38

98 
CRAs must disclose ‘methodologies, 
models and key rating assumptions 
which they use in their credit rating 
activities’. We evaluated the CRAs’ 
general disclosure in the methodology 
area, focusing on four types of credit 
rating: corporate financial institutions 
(Banks), sovereigns, structured finance 
products (master methodology, ABS 
consumer finance and RMBS) and cov-
ered bonds.

99 
CRAs generally complied with the reg-
ulation by disclosing methodologies. 
The format of disclosure varied greatly 
between the CRAs, limiting compara-
bility. This could have been partially 
avoided if a standardised reporting 
format had been provided for CRAs 
to present their methodologies. The 
ease with which documentation can 
be found varied between CRAs and 
between rating types. For many sub-
classes within the structured finance 
category, the CRAs provided only an 
overview of the rating process and 
important information on the method-
ology was missing. It was therefore not 
possible to reproduce the rating.

CEREP does not disclose 
sufficient information on 
CRAs’ ratings performance

Half-year data reporting

100 
ESMA’s online central repository 
(CEREP) has no equivalent in other 
regulatory jurisdictions. Through this 
database, ESMA provides harmonised 
and readily accessible information on 
all registered and certified CRAs’ rat-
ings performance. In CEREP CRAs make 
available information on their histori-
cal ratings. ESMA publishes half-yearly 
summary statistics on CRAs’ ratings 
performance based on data reported 
by CRAs. This includes, for a given time 
horizon and asset class: rating activity 
statistics, default rates, and transi-
tion matrices. CEREP provides useful 
summary statistics for investors and 
researchers based on multiple filter 
queries which they can adapt to their 
needs. CEREP does not:

—  publish the disclosure of other 

statistics which are useful to users, 
such as average default rates, and 
average transition matrices, or

— 

include filtering options which 
allow users to download summary 
statistics resulting from several 
queries at once.

39

38  Article 11(2) of the CRA 

regulation.

39  E.g. incorrect or insufficient 

information, maturity of debt 
obligation, bankruptcy, 
reorganisation of rated entity, 
other reasons (unexplained), 
etc.

Part IV – Disclosures

101 
The CRA regulation stipulates that 
ESMA has to make the information 
reported by CRAs in CEREP available 
to the public38. While the qualitative 
information reported by the CRAs is 
published in CEREP, the underlying 
data as reported by CRAs is not. The 
public availability of these data would 
have several benefits for CEREP users. 
For example, they could better un-
derstand the predictive power of the 
summary statistics.

102 
The CRA regulation does not require 
CRAs to monitor issuers/financial 
instruments after their respective 
ratings have been withdrawn. As 
such CEREP summary statistics do not 
consider default events occurring after 
rating withdrawals. In order to miti-
gate such lack of information, CEREP 
discloses statistics by type of reasons 
for withdrawal39. However, some rating 
activity statistics show a high propor-
tion of unexplained rating withdraw-
als. This undermines the credibility of 
the predictive power of the respective 
summary statistics.

103 
ESMA performs certain automatic 
controls of the new data reported to 
CEREP in order to check their integrity 
before being published. However, 
ESMA does not perform any accuracy 
checks (such as reconciliations with 
other public databases, with the CRAs’ 
internal databases, etc.) before publi-
cation. These checks would be useful 
because:

—  There were cases of data errors 

and revisions in CEREP.

—  There is no public scrutiny on 
them. CEREP does not disclose 
whether there are corrections of 
errors or other revisions in the 
historical data reported to CEREP 
by CRAs.

Qualitative information 
reported

104 
The information has no comparable 
structure among the reporting CRAs 
and does not allow users to see when 
changes to methodologies occurred 
and when they affected ratings and 
their performance. This is important as 
CEREP summary statistics cover past 
ratings which may have been issued 
using different methodologies to the 
ones currently presented in CEREP.

Part IV – Disclosures

40

ESMA does not disclose 
sufficient information to 
ratings users on its website

105 
ESMA should regularly publish infor-
mation relating to its fields of activities 
and to ensure that the information 
is easily available. We compared the 
information available on the websites 
of ESMA and of the SEC’s Office of 
Credit Ratings, which supervises CRAs 
registered in the US (NRSROs).

106 
ESMA, for instance, does not publish 
on its website all relevant legislation 
(six delegated regulations are not 
available), while the SEC’s Office of 
Credit Ratings has a specific section 
with links to all the regulations regard-
ing the NRSROs (see Annex IV for more 
details).

107 
ESMA’s documentation concerning 
CRAs can be consulted in two ways: 
a simple list of some two hundred 
documents without any selection pos-
sibility, or a list with two filters which 
only marginally improve accessibility. 
The SEC website, in contrast, works 
with specific sections for each type 
of information, which makes it more 
user-friendly.

108 
The analysis of ESMA’s website shows 
that some of the applicable legisla-
tion is not available on the website. 
Also, some useful documents, e.g. the 
registration template and guidance for 
whistleblowers, are not available (see 
Annex IV).

Conclusions and 
recommendations

41

109 
Our overall conclusion is that ESMA 
laid down good foundations for effec-
tive supervision of the CRAs in the EU 
in a short period of time. Nevertheless, 
there is still room for improvement.

Registration

110 
ESMA has well-developed registra-
tion procedures. Nevertheless, it 
remains cumbersome, due to the split 
into completeness and compliance 
phases as required by the regulation. 
Credit rating methodologies should 
be rigorous, systematic, continuous 
and subject to validation. However, the 
evidence audited supported mainly 
the rigorousness of the methodologies 
(paragraphs 20 to 30).

Recommendation 1

During the registration process, ESMA 
should adequately document its as-
sessment of all the regulatory require-
ments regarding the credit rating 
methodologies.

111 
The current rules of the Eurosystem do 
not guarantee that all ESMA-registered 
CRAs are on an equal footing. The Eu-
rosystem currently accepts ratings is-
sued by four ESMA-registered CRAs as 
ECAIs under the ECAF. In order to have 
their ratings accepted by the Eurosys-
tem, CRAs must fulfil extra operational 
criteria in addition to being registered 
or certified by ESMA. This approach 
creates a two-tier market structure, 
in which small CRAs cannot compete 
on an equal footing with larger CRAs 
(paragraphs 35 to 40).

Risk management 
and planning

112 
ESMA has a well-established procedure 
for risk identification. However, the 
lack of documentation trail creates dif-
ficulties in understanding the rationale 
for reprioritising certain risks. ESMA 
did not investigate all high-risk areas 
in a sufficient and consistent way. We 
found that the supervision resources 
did not adequately keep up with the 
increasing requirements in the regula-
tion (paragraphs 41 to 55).

Conclusions and recommendations

42

Recommendation 2

Recommendation 3

The ESMA supervisory manual and su-
pervisory handbook should be subject 
to continuous updating to incorporate 
knowledge and experience gained.

ESMA should establish internal guid-
ance for the effective documentation 
of the investigations so as to demon-
strate and ensure that all conclusions 
are supported by adequate analyses of 
the evidence.

The implementation of a dedicated 
supervisory IT tool would improve 
knowledge sharing, clarify the owner-
ship of tasks, facilitate the review of 
the work done, and improve communi-
cation within the supervisory teams.

Methodologies

115 
ESMA examined CRAs’ methodolo-
gies based on the regulatory criteria 
through both ongoing supervision 
and investigations. However, ESMA 
does not have a procedure to examine 
the new methodologies or material 
changes to methodologies notified 
by the CRAs. ESMA faces challenges 
in interpreting the methodological 
criteria and building common under-
standing with the CRAs on compliance 
with them. Certain criteria remain to 
be examined in depth (paragraphs 78 
to 86).

ESMA should enhance the traceability 
of the risk identification process. ESMA 
should maintain a log of the changes 
to the risk level and document the 
prioritisation of risks together with 
reasons.

ESMA should follow up all the high- 
risk areas, which would benefit from 
further supervisory work.

Ongoing supervision and 
investigations

113 
ESMA laid down good foundations for 
its supervision approach. However, 
ESMA’s supervision guidelines do not 
define the exact types of ongoing su-
pervisory tasks to be undertaken, nor 
do they provide information regarding 
the frequency of these tasks. ESMA set 
up an annual supervisory plan for the 
period ahead. Detailed plans of the 
ongoing supervisory tasks per CRAs 
were not available. ESMA does not 
have adequate internal standards for 
documenting supervisory work, and 
it is difficult to track ongoing supervi-
sory work that has been performed or 
the analysis and conclusions derived 
from it (paragraphs 56 to 77).

114 
Similarly, the documentation of certain 
intermediate steps of the investiga-
tions is not complete. ESMA’s docu-
mentation of the audited investiga-
tions does not show how all necessary 
evidence was assessed (paragraphs 56 
to 77).

Conclusions and recommendations

43

Recommendation 4

General disclosure

ESMA should examine all important 
aspects of the design and implementa-
tion of CRA methodologies which have 
not yet been covered.

Conflicts of Interest

116 
ESMA did not sufficiently examine 
certain potential conflicts of inter-
est. Although ESMA receives a lot of 
information from the CRAs regarding 
the trading activities and securities 
holdings of their staff, it did not ex-
amine this information in a structured 
way. Also, during the thematic and 
individual reviews, this issue was only 
discussed sporadically (paragraphs 87 
to 89).

Recommendation 5

ESMA should examine in a structured 
manner the systems put in place by 
the CRAs for dealing with conflicts of 
interest, and in particular those relat-
ing to rating analysts’ trading activities 
and financial transactions.

In addition, ESMA should test the accu-
racy of the information received from 
the CRAs on conflicts of interest.

117 
ESMA regularly checked the CRA 
general disclosure during the ongoing 
supervision and investigations, but 
a first detailed assessment across CRAs 
was started in late 2014 (paragraphs 90 
to 94).

118 
We found that CRAs’ general disclosure 
is not always at the highest standard 
and that disclosure, especially when it 
concerns methodologies and descrip-
tions of models and key rating assump-
tions, does not always enable potential 
users of credit ratings to perform their 
own due diligence (paragraphs 95 
to 99).

Recommendation 6

ESMA should work on further align-
ment of disclosure practices across the 
CRAs. ESMA should consider develop-
ing additional guidance on disclosure 
requirements in accordance with 
Article 16 of Regulation 1095/2010 in 
order to improve the overall disclosure 
practices of credit rating agencies.

Conclusions and recommendations

44

CEREP disclosures

ESMA website disclosure

119 
ESMA’s disclosures in the online central 
repository (CEREP) provide harmonised 
and readily accessible information on 
all registered and certified CRAs’ rat-
ings performance which has no equiv-
alent in other regulatory jurisdictions. 
However, we have concerns about the 
sufficiency of disclosure and about 
the absence of adequate checks per-
formed by ESMA on the data reported 
to CEREP (paragraphs 100 to 104).

Recommendation 7

ESMA should monitor and improve 
the information content of CEREP 
disclosures based on best practices for 
disclosing ratings performance.

120 
ESMA’s website lacks certain useful in-
formation for CRAs, potential new mar-
ket participants and credit rating users. 
The website is not well structured and 
the available information is difficult to 
find (paragraphs 105 to 108).

Recommendation 8

ESMA should publish all applica-
ble legislation and relevant docu-
ments and make the website more 
user-friendly.

This report was adopted by Chamber IV, headed by Mr Milan Martin CVIKL, Member 
of the Court of Auditors, in Luxembourg at its meeting of 24 November 2015.

For the Court of Auditors

Vítor Manuel da SILVA CALDEIRA
President

 
 
 
Annexes

45

I
x
e
n
n
A

ESMA’s governance structure

ESMA’s supervisory governance structure is composed of four levels. An overview of the responsibilities at each 
level is presented in the table below.

The Board of Supervisors

The Management Board

Executive Director

Head of Unit/Division

Composition: 
The heads of the 28 national authori-
ties of the EU + ESMA’s chairperson 
+ EIOPA + EBA+ ESBR+ EC+ EEA 
(Iceland, Liechtenstein and Norway)

It has the ultimate decision-taking 
responsibility in ESMA.

Responsibilities:
– 

Approving the annual super-
visory plan which describes 
all planned investigations as 
well as the expected ongoing 
supervisory work. For this pur-
pose they receive a risk report 
prepared by ESMA’s supervisory 
team. The risk report contains 
specific risks to individual CRAs 
in anonymised form.
Approving ESMA’s annual 
report that describes ESMA’s 
supervisory activities based on 
the annual activity report from 
the supervisory team.
Approving other public reports 
(the information provided 
to the Board of Supervisors 
includes more detailed findings 
than what is published in the 
public report).

– 

– 

Composition: 
Six members selected from the Board 
of Supervisors by its members + 
ESMA’s chairperson.

Responsibilities:
– 

– 

– 

– 

– 

– 

– 

Overseeing ESMA’s supervisory 
work.
Implementing the annual 
supervisory work plan.
Ensuring the functioning of the 
supervisory divisions/units.
Signing the written authorisa-
tions or decisions for investiga-
tions or inspections.
Signing decisions requesting 
information.
Approving remedial action 
plans.
Reporting on ESMA’s superviso-
ry activities to the Management 
Board and Board of Supervisors.

Responsibilities:
– 

– 

– 

Overseeing ESMA’s multi-annu-
al work programme, the budget 
and staff resources.
Controlling the implementation 
of the supervisory work plan.
Discussing the quarterly infor-
mation provided by the Execu-
tive Director on the supervisory 
work: registrations, ongoing 
investigations, findings and 
remedial actions.

Responsibilities:
– 

– 

– 

– 

– 

– 

– 

Proposing an annual supervi-
sory work plan and implement-
ing it after its approval.
Signing simple requests for 
information.
Drafting remedial action plans, 
decisions and public reports 
that are submitted to the 
Executive Director for signature 
or escalation.
Ensuring that supervisory deci-
sions are sufficiently challenged 
through discussions on the 
findings.
Proposing remedial actions 
with the relevant supervisory 
team.
Putting in place communication 
channels that enable supervi-
sors to raise their views and/
or concerns at any stage of the 
supervisory process.
Ensuring that supervised CRAs 
are given the opportunity to 
comment on the findings, and 
the remedial actions before the 
final report.

Source: ECA, based on information provided by ESMA.

 
Annexes

46

I
I
x
e
n
n
A

Audit approach

In addition to the work carried out by the Court, two experts were contracted to analyse specific topics in the 
audit field. Furthermore, we asked a selection of national competent authorities for information allowing us to 
compare supervisory practices.

Some of the statements in the report are based on the contributions of these expert reports and on the results 
of the inquiries made at the national competent authorities.

Expert reports

Some aspects of the audited subject are of a complex and specialised nature which required the Court to hire 
two experts. The expert contributions relate to:

 ο

 ο

the analysis of the requirements for disclosure of CRAs’ methodologies, models and key rating assumptions

the analytical quantitative work regarding the performance of the ratings based on the rating data available in 
ESMA’s CEREP database.

Analysis of the requirements for disclosure of CRAs methodologies, models and key 
rating assumptions

The experts carried out the following tasks:

 ο

 ο

 ο

Analysis of the requirements for disclosure of CRAs’ methodologies, models and key rating assumptions and critical 
assessment of whether ESMA’s rules and guidelines give enough and clear guidance for disclosure;

Comparison of EU requirements for disclosure of CRAs’ methodologies, models and key rating assumptions with 
the corresponding SEC rules (rules of the US Securities and Exchange Commission);

For a sample of five CRAs (which were selected by the European Court of Auditors) and on the basis of the infor-
mation that is publicly available:

 •

 •

performed an analysis of the information disclosed regarding the methodologies, models and key 
rating assumptions, to compare with the disclosure requirements set out in the CRA regulation and 
to conclude whether the regulation is respected, in particular in the cases of sovereign bonds and 
structured finance instruments;

critically assessed whether the disclosed information gave sufficient details to investors in order 
to assess methodologies, models and key rating assumptions, i.e. could an investor re-perform the 
calculations for a rating using the disclosed information on the CRA’s methodologies, models and key 
assumptions and reach the same result?;

 
Annexes

47

I
I
x
e
n
n
A

 •

assessed whether the disclosed information gave an investor the possibility to compare CRAs’ meth-
odologies, models and key assumptions for a specific rating (a sample of ratings were selected by the 
European Court of Auditors); and

 •

identified good disclosure practices that could be shared between the CRAs.

Quantitative performance measurement of the credit ratings issued by the credit rating 
agencies

Based on performance measures disclosed by CEREP, the expert assessed:

 ο

 ο

 ο

 ο

the relevance, coherence (e.g. completeness of the data, data quality) and comparability of the performance indi-
cators on credit ratings published by ESMA in CEREP;

weaknesses or difficulties with these disclosures, and recommended improvements/alternatives which could be 
useful for investors’ information and/or academic research;

different aspects of comparability of quantitative measures of ratings performance, such as comparability over 
time, across CRAs, across asset classes, across geographic regions of the issued ratings, in order to examine the 
discriminatory and predictive power of the disclosed measures; and

quantitative information disclosed in CEREP, and comparing it to other disclosures/databases available to investors/
academics.

Inquiry at a selection of national competent authorities

The audit team asked 10 national competent authorities about their supervisory practices. The questions related 
to their general approach to supervising of financial institutions and to their tasks in the registration of CRAs.

The main questions of the inquiry are listed below:

 ο

 ο

 ο

 ο

 ο

Please list the types and the frequency of the supervisory activities that your institution performs.

How are ongoing supervisory activities identified in your institution?

Is there a dedicated supervisory IT system in your institution that is used for documenting the supervisory work 
and for knowledge retention?

How is the analysis of the periodic disclosure documented in your institution?

Does your institution develop instructions and guidelines for the supervised entities, and if so, how are those 
communicated to them?

 
Annexes

48

I
I
x
e
n
n
A

 ο

 ο

 ο

Did your institution perform on-site visits in the CRA during the registration process?

How did your institution assess that the CRA methodologies were compliant with the requirements in the CRA 
regulation?

How do you, as a financial supervisor, identify whether a rating from a credit rating agency is a private rating or 
a public rating? How do you ensure that private ratings are not used for regulatory purposes?

Summary of the audit approach

Audit subjects

Audit criteria 

Audit evidence

(i)  Were the registrations of all possible 
CRAs done correctly and as efficiently 
as possible?

(i) 

Legal requirements and objectives in the 
CRA regulation as well as complement-
ing delegated regulations (technical 
standards);

(ii)  ESMA's handbook for CRA Registrations.

Analysis of the registration process;
(i) 
(ii)  Analysis of a selection of registration files;
(iii) 
(iv) 
(v)  Consultation of NCA via an inquiry on their practices;
(vi)  Comparison with practices at the SEC (US).

Interviews with key staff;
Information gathering visits to a selection of CRAs;

(ii)  Did ESMA develop and implement a 
sound planning and risk assessment 
for its supervisory activities?

(i) 

ESMA’s internal supervision manual and 
supervisory handbook.

(iii)  Does the implementation of the 
supervisory framework capture 
the problems revealed in the CRA 
business, including those related to 
independency of rating boards and 
preventing conflicts of interest?

(i) 

Legal requirements and objectives in the 
CRA regulation as well as complement-
ing delegated regulations (technical 
standards);

(ii)  ESMA’s internal supervision manual and 

supervisory handbook;

(iii)  Relevant IOSCO guidelines and principles.

(iv)  Did ESMA and the CRAs publish suf-
ficient and value adding information 
to its stakeholders, in particular 
the European Parliament, about its 
supervisory activities?

(i) 

Legal requirements and objectives in the 
CRA regulation as well as complement-
ing delegated regulations (technical 
standards);

(ii)  ESMA’s internal supervision manual and 

supervisory handbook.

Source: ECA.

Analysis of the risk assessment conducted by ESMA;

(i) 
(ii)  Analysis of ESMA’s internal planning documents;
(iii) 
(v)  Consultation of NCA via an inquiry on their practices.

Interviews with key staff;

(i) 

Analysis of the files regarding the ongoing supervisory 
work;

(ii)  Analysis of the supervisory files and internal docu-

ments, especially the thematic and individual reviews;
Interviews with key staff;
Information gathering visits to a selection of CRAs;

(iii) 
(iv) 
(v)  Consultation of NCA via an inquiry on their practices;
(vi)  Comparison with practices at the SEC (US).

(i)  Quantitative analysis of the rating information in the 

CEREP database;

(ii)  Analysis of the Socrat database;
(iii)  External experts assessed the public disclosure 

requirements concerning the methodologies, models 
and key rating assumptions;

(iv)  Review by external expert of the rating performance 

indicators in the CEREP database;

(v)  Consultation of NCA via an inquiry on their practices.

 
Annexes

49

I
I
I
x
e
n
n
A

Main findings and recommendations of ESMA’s investigations

2012

Thematic investigation:
The rating process for 
sovereign, bank and 
covered bond ratings at 
S&P, Moody’s and Fitch

Individual investigation:
Corporate governance 
and internal controls at 
a CRA

Thematic investigation:
Process to review, imple-
ment and disclose bank-
ing rating methodologies 
at S&P, Moody’s and Fitch

2013

Individual investigation:
Rating publication 
controls in a CRA

Thematic Investigation:
Sovereign Ratings 
Process at S&P, Moody’s, 
and Fitch

– 

– 

– 

– 

CRA’s internal pro-
cesses not sufficiently 
recorded.
High staff turnover 
and insufficient staff in 
specific business lines.
Internal control 
functions should be 
improved.
The roles and tasks 
of the independent 
members of the Board 
should be improved.
–  Methodology papers 
were divided into 
multiple documents 
and they were not easy 
to find on the CRAs’ 
websites.
IT systems should be 
adequately imple-
mented and checked.

– 

– 

– 

– 

– 

– 

The independence of 
certain directors was 
not ensured.
The Board of Directors 
should continuously 
assess the internal 
control systems and in-
crease communication 
with control functions.
Resources in the inter-
nal control functions 
should be monitored in 
terms of adequacy.
Clarify the empower-
ment and the working 
procedures of the inter-
nal review function.
Clarify the documenta-
tion to be sent to rating 
committees.

– 

– 

– 

– 

– 

– 

– 

– 

– 

– 

Not all elements that 
influenced the ratings 
were incorporated in 
the methodology.
Not enough dis-
closure; some new 
tools, criteria and old 
methodologies were 
not disclosed.
The qualitative and 
quantitative factors, 
models and historical 
evidence were not 
adequately recorded.
The annual review of 
methodologies was not 
sufficient.
Ratings were not 
monitored after chang-
ing the methodology of 
a rating.
Some information 
used to support credit 
ratings was outdated.

The disclosure of 
changes to ratings 
should be transparent 
and timely.
IT architecture and 
control mechanism 
should properly sup-
port the continuity and 
regularity of ratings 
disclosures.
The rating dissemina-
tion process should be 
monitored.
The responsibilities in 
the rating publication 
process should be 
clearly allocated and 
documented.

– 

– 

– 

– 

– 

– 

– 

Board of Directors and 
review function were 
involved in rating 
activities.
Conflicts of interests 
not sufficiently con-
trolled for sovereign 
analysts involved in 
research activities.
Rated entities did 
not always have the 
opportunity to appeal 
before the publication 
of the rating.
Unauthorised third 
parties had access 
to upcoming rating 
actions.
Inadequacies found 
in the IT systems’ au-
thorisation and access 
controls.
Significant delays 
between the rating 
decisions and their 
publication.
Junior and new staff 
had considerable ana-
lytical responsibilities.

Source: ECA, based on information provided by ESMA.

 
Annexes

50

I
I
I
x
e
n
n
A

2014

Thematic investigation: 
Structured finance ratings at Fitch,  
Moody’s, S&P and DBRS

Two thematic investigations:  
Corporate governance and control functions  
at 14 and 4 small and medium-sized CRAs

– 

– 

– 

– 

– 

Lack of quality controls over information used 
and received from data providers.
Incomplete application of the full methodology 
during the rating monitoring process.
Insufficient disclosure of the different analytical 
frameworks used.
Delays in the completion of the annual reviews of 
ratings.
The internal review function, including the 
review of methodologies, models and key rating 
assumptions, should be strengthened in order to 
ensure independence.

– 

– 

– 

– 

– 

– 

– 

Board members have limited knowledge of 
regulatory obligations, insufficient meetings and 
limited interaction with the control function.
The monitoring activities of the independent 
directors of the supervisory board should be 
reinforced.
Administrative and Supervisory Boards should be 
in compliance with the CRA regulation.
The compliance and the internal review functions 
should be independent. Rating analysts, share-
holders or business development staff should not 
been involved in the approval of methodologies.
The compliance function should have adequate 
resources and its functions and responsibilities 
should be clearly allocated.
The internal procedures for validation and back-
testing of methodologies should be clearer and 
more detailed.
The notification of the rating action to the rated 
entity was not compliant with the regulation for 
some CRAs and increased the risk of confidential 
information being leaked and of the issuer 
influencing the CRA’s decision.

Source: ECA, based on information provided by ESMA.

 
Annexes

51

V

I
x
e
n
n
A

Comparison of the websites of the supervisors in the EU and the US

ESMA  
(CRA section)

SEC’s website (Office of  
Credit Rating (OCR) section)

1. 

 Availability and accessibility of the relevant 
regulations:

 The Code of Good Practices on Transparency in 
Monetary and Financial Policies of the IMF recom-
mends that ‘texts of regulations and any other 
generally applicable directives and guidelines 
issued by financial agencies1 should be readily 
available to the public.’

– 

– 

– 

2. 

 Availability and accessibility of CRA reports:

– 

 ‘Financial agencies should issue periodic public 
reports on how their overall policy objectives are 
being pursued’2 and ‘financial agencies should 
issue a periodic public report on the major devel-
opments of the sector(s) of the financial system 
for which they carry designated responsibility.’3

3. 

 Disclosure of the registered CRAs:

 In the EU, the CRA regulation provides that ‘ESMA 
shall publish on its website a list of credit rating 
agencies registered in accordance with this 
regulation.’4

– 

– 

Only the CRA regulation (EU Regulation No 
1060/2009) and one of the three amend-
ments are available.
The six Delegated Regulations sup-
plementing the CRA regulation are not 
available.
The regulations are not easy to find 
because there is no specific section. 
Two options exist:
• 

Scrolling down through the 
180 documents in the subsection 
CRAs, without any option to filter.
Leaving the CRA section and going 
to the generic ‘Documents’ tab, 
where two filters can be used (and 
one of these is not alphabetically 
sorted).

• 

There are two types of reports:
• 

ESMA supervision of credit rating 
agencies, annual report.
Ad hoc reports

• 
There is no specific section for these 
reports. The same two options exist:
• 

Scrolling down the CRAs’ documents 
section
Leaving the CRA section and going 
to the ‘Documents’ tab and then 
using the filters.

• 

– 

There is a specific ‘securities laws’ section 
on the OCR webpage where there are 
direct links to all the regulations regarding 
the NRSROs.

– 

There is a specific ‘public report’ section, 
on the OCR website, and they are classified 
by type of report:
• 
• 
• 
• 

Staff reports and Studies
Staff guidance
Annual reports to Congress
Annual Examination Reports

There is a specific ‘List of registered and 
certified CRAs’ section where users can 
find the name of the CRA, the country of 
residence, the status (registered, certified) 
and the effective registration date.

– 

There is a specific ‘Division Resources’ 
section where users can see the registered 
NRSROs and the registration date.

1 

2 

3 

 Financial agencies refer to the institutional arrangements for the regulation, supervision, and oversight of the financial and payment 
systems, including markets and institutions, with a view to promoting financial stability, market efficiency and client-asset and consumer 
protection — Annex: Definitions of certain terms, Code of Good Practices on Transparency in Monetary and Financial Policies: Declaration of 
Principles, International Monetary Fund, 1999.

 Principle 6.3 of IMF’s Code of Good Practices on Transparency in Monetary and Financial Policies: Declaration of Principles, International Mon-
etary Fund, 1999.

 Principle 7.1 of IMF’s Code of Good Practices on Transparency in Monetary and Financial Policies: Declaration of Principles, International Mon-
etary Fund, 1999.

4  Article 18(3).

 
 
 
 
Annexes

52

V

I
x
e
n
n
A

4. 

 Disclosure of the types of rating issued  
by each CRA:

 In the EU, the CRA regulation states that its objec-
tive is to ‘enhance the integrity, transparency [..] 
of credit rating activities, contributing […] to 
smooth functioning of the internal market, while 
achieving a high level of consumer and investor 
protection.’5 The disclosure of the different types 
of ratings contributes to enhanced transparency of 
credit ratings.

5. 

 Disclosure of the form or template for 
registration:

 Direct access to the registration template could 
give new CRAs a better understanding of the 
registration process and encourage them to apply.

6. 

 Accessibility to the CRAs’ regulatory public 
disclosures:

– 

– 

– 

– 

– 

 CRAs must disclose several types of information 
to the public. For example, in the EU, the CRA 
regulation requires CRAs to publish an annual 
transparency report with information on legal 
structure and ownership, internal control mecha-
nisms, statistics on staff allocation, etc. In order to 
be a useful resource and help the users of credit 
ratings to ‘not rely blindly on credit ratings but [...] 
to perform own analysis and conduct appropriate 
due diligence’, the investors should be aware of 
these public disclosures.

ESMA  
(CRA section)

There is no information readily available 
on which types of ratings CRAs currently 
issue.
However, ESMA publishes an annual 
report called ‘market share calculations 
for the purpose of the Article 8d of the 
CRA regulation’ where users can find this 
information. If the ratings are unsolicited 
or there are no revenues for the CRA in the 
current year for that type of rating, they 
will not appear in the report.

The registration template is not publicly 
available on the website.
The CRA team sends the template after 
the applicant has contacted ESMA

ESMA’s website does not make any refer-
ence to the regulatory public disclosures 
on CRAs’ websites.

– 

– 

– 

SEC’s website (Office of  
Credit Rating (OCR) section)

In the section for registered NRSROs, there 
is ‘the order granting registration’ for each 
NRSRO which specifies the type of ratings 
the CRA issue at the registration time as 
well as any later withdrawals.

The NRSRO registration form is publicly 
available on the website and is easy to find 
under the Examination Resources section.

NRSROs are required to make publicly 
available some parts of the registration 
form and the annual certification form. 
The ‘Forms NRSRO’ section on the OCR’s 
website contains links to the individual 
CRA websites where users can find these 
forms.

7. 

Guidance for whistle-blowers:

– 

 Specific information and guidance for whistle-
blowers lowers the threshold to inform the 
regulator on possible misconduct and/or infringe-
ments of the regulations.

No specific guidance available. Under the 
CRA section, there is an email address 
for queries: CRA-info@esma.europa.eu, 
which can also be used to submit a com-
plaint

– 

There is a link to the Office of the Whistle-
blower website, which has plenty of 
information

5  Recital 1.

Source: ECA.

 
 
 
 
 
Reply of ESMA

53

Executive summary

VI
ESMA made a conscious decision to be a risk-based 
supervisor, assuming that not all risks can be 
removed, but rather that supervisory actions must 
aim at identifying and addressing those with the 
greatest potential to cause harm to investors and 
more generally to financial stability.

ESMA’s risk-based approach is designed to allocate 
resources to those areas that matter most and was 
introduced after its first year of supervision.

Since then all high-risk areas that have been 
identified for high impact CRAs have been 
addressed either through investigations or ongoing 
supervision.

ESMA’s risk-based framework comprises three inter-
dependent phases:

(i)  Risk identification and assessment;

(ii)  Risk Prioritisation; and

(iii)  Definition of supervisory actions to address the 

prioritised risks.

This framework is built around 13 risk indicators and 
on an annual basis ESMA conducts a strategic exer-
cise to define the annual supervisory work plan that 
sets priorities and actions for the year ahead. Since 
2012, in total 39 times a risk indicator was identified 
as high risk for high impact CRAs.

Four of these identified risks were addressed 
through ongoing supervision. The other 35 risk 
areas were followed up through an individual or 
thematic investigation in the year following the 
identification.

The type of the investigation (individual vs the-
matic) depends, amongst other considerations, 
on the complexity and level of idiosyncrasy of the 
identified risk. Moreover, while the focus of the 
investigation is on the observed high-risk areas, 
the interdependent nature of risk areas can trigger 
inclusion of risk areas that are identified as lower 
risk as part of the investigation.

In addition to the annual strategic exercise, ESMA 
monitors and assesses risks on an ongoing basis. 
If outside of the strategic exercise, new risks are 
observed through our ongoing supervision (analy-
sis of periodic information, analysis of complaints, 
notifications to changes to the initial conditions of 
registration, periodic interviews, etc.) and market 
monitoring, a (re)prioritisation exercise will take 
place to ensure that resources are allocated to risks 
with the greatest potential to cause harm to inves-
tors and more generally to financial stability.

ESMA acknowledges that a more comprehensive 
documentation trail is necessary to support the 
prioritisation of risk throughout the year.

VII
ESMA’s Supervision Manual and Handbook are 
intended to set out ESMA’s supervisory framework, 
describe the supervisory processes and describe the 
common steps and principles to be followed within 
these processes.

These documents set out the minimum supervisory 
tasks to be performed throughout the year which 
can be planned. However the exact types of super-
visory tasks and their frequency cannot be estab-
lished in advance due to the unpredictable nature 
of some supervisory actions which are driven by the 
evolving risk profile of each CRA.

Reply of ESMA

54

Supervision is by its nature a dynamic exercise and, 
in line with its risk-based framework, ESMA needs 
to adapt the focus of its supervisory activity to 
the evolving nature of the industry and the risks 
observed. For this reason the Supervision Manual 
and Handbook are now always complemented by: 
strategies and workplans set for the riskiest CRAs on 
an annual basis including the actions to be under-
taken with deadlines; periodic meetings under 
a cycle of engagement that is annually established 
and communicated to the CRAs; and project plans 
for each investigation.

In ESMA’s view all these documents constitute 
a complete set of rules and guidelines that allows 
for the necessary flexibility to adapt ESMA’s super-
visory approach and to use supervisory tools in the 
most effective way.

ESMA acknowledges that the record of the analy-
sis that it conducts on the periodic information 
received from CRAs could be enhanced. In this 
regard, the CRA Unit is developing a new tool 
for continuous monitoring of information and 
risk assessment purposes. This tool will allow the 
storage of supervisors’ input and analyses within 
dedicated documents through the implementation 
of structured templates, thus enhancing record-
keeping practices both of the analysis undertaken 
and of the risks identified.

However ESMA notes that the record-keeping 
practices it has established over the past years have 
supported its regulatory obligations and reflected 
the internal needs of the organisation. For exam-
ple, while ESMA may not document internally all 
the intermediate steps of its analysis during the 
investigations, all the findings and the supporting 
evidence are thoroughly documented in the letters 
sent to the CRAs.

Therefore, while ESMA acknowledges that its docu-
mentation and monitoring tools could be further 
improved, ESMA believes that so far they have been 
effective and allowed ESMA to retain the relevant 
information supporting its decision making process.

VIII
ESMA has implemented a risk-based approach 
which aims at prioritising supervisory activities 
according to the identified risks, in order to ensure 
an efficient and effective allocation of resources.

Conflicts of interest and methodologies are part 
of the risk indicators assessed within ESMA’s risk 
framework.

ESMA continuously assesses the methodological 
risk as part of its ongoing supervision where it regu-
larly receives and analyses a wide range of infor-
mation related to methodologies. When these risk 
indicators have been identified as high risk in CRAs, 
ESMA has systematically covered them through its 
supervisory actions, including for example the the-
matic investigation into bank methodologies under 
which ESMA assessed compliance with the require-
ments of using methodologies that are rigorous, 
systematic, continuous and subject to validation.

In addition, ESMA has assessed the compliance of 
methodologies with the CRAR requirements also 
as part of other investigations, although the meth-
odological risk was not the main focus and the level 
of analysis performed varied depending on the 
scope of the investigation. In 2015 ESMA has also 
conducted an investigation into the validation of 
methodologies. For further details see ESMA’s reply 
to paragraphs 81-84.

With reference to conflicts of interest, the entire 
CRAR is designed to address conflicts of interests 
and most of the provisions established under CRAR 
are linked to the CRA’s duty to ensure the independ-
ence of its rating activities (avoidance, identifica-
tion, management and disclosure of conflicts). 
Since the inception of its supervisory activity ESMA 
focused significant supervisory efforts on assessing 
the measures put in place by CRAs to avoid conflicts 
of interest. Therefore the majority of the interac-
tions with the CRAs and the findings following 
ESMA’s investigations are linked to the provisions of 
the CRAR concerning independence and avoidance 
of conflicts of interest. This is also clear from ESMA’s 
public annual reports and work plans where ESMA 

Reply of ESMA

55

identifies the major supervisory risks on which it 
will focus in the coming years and provides informa-
tion on the main issues identified in the course of 
past investigations. Similarly the two public notices 
issued by ESMA respectively in June 2014 and June 
2015 both refer to infringements of CRAR provi-
sions concerning measures to ensure independence 
and avoid potential conflicts of interest. For further 
details see ESMA’s reply to paragraphs 87-89.

Given all the above, ESMA is satisfied that it has 
allocated the necessary resources to address the 
risks that it identified regarding methodologies and 
conflicts of interest. ESMA will continue to monitor 
these areas and will take appropriate actions in the 
areas where significant risks emerge.

X
ESMA’s mandate for CEREP under the CRA regula-
tion is to collect historical performance data from 
each single CRA and make this available to users on 
a central website.

While CEREP does not include an exhaustive list of 
all possible statistics, through running multiple que-
ries users can actually retrieve various additional 
statistics that are commonly used in industry. This 
approach was chosen as the usefulness of statistics 
is highly subjective in nature and heavily depends 
on the final objective of the user which can vary 
significantly.

ESMA would like to stress that only data that passes 
extensive validation checks embedded in the data 
collection tool (50 checks at level 1 and 50 checks 
at level 2) and systematic completeness checks, is 
stored in the database and ultimately made avail-
able on CEREP. In addition to ensuring quality of 
data, these steps ensure standardisation and com-
parability of the submitted data, as well as consist-
ency over time.

Once the data passes these initial checks and is 
saved in the database, ad hoc checks are run on an 
ongoing basis to further ensure the consistency and 
quality of the data. The fact that there is no system-
atic reconciliation with other databases is a direct 
consequence of the limitation that CEREP data lacks 
common identifiers. This issue will be solved as 
part of the implementation of the European Rating 
Platform (ERP) as the related Regulatory Technical 
Standard (RTS) includes the requirement of report-
ing — where applicable — global identifiers (such 
as Legal Entity Identifiers, BIC codes, ISINs, etc.). 

Furthermore it should be noted that on an ad hoc 
basis and to the extent possible ESMA does check 
the validity of the data against other databases.

XI(a)
ESMA accepts this recommendation.

ESMA acknowledges that the documentation of 
its assessment could be enhanced to provide full 
evidence in its working documents of the assess-
ment performed and to facilitate an audit trail of its 
analysis.

XI(b)
ESMA accepts this recommendation.

XI(c)
ESMA partially accepts this recommendation.

ESMA will update its supervisory manual and super-
visory handbook when needed, in order to incorpo-
rate knowledge and experience gained.

ESMA remains confident that in the context of the 
investigations all the conclusions and findings 
reported to the CRAs and the supporting evidence 
are thoroughly documented.

Reply of ESMA

56

ESMA acknowledges that the record of the analy-
sis that it conducts on the periodic information 
received from CRAs could be enhanced and it is cur-
rently improving its record-keeping practices both 
of the analysis undertaken and of the risks identi-
fied. However given that the number of registered 
CRAs remains limited, ESMA does not consider that 
at this stage a dedicated IT tool is necessary.

XI(d) 
ESMA partially accepts this recommendation.

ESMA will continue to regularly assess the method-
ological risk as part of its ongoing supervision and 
will perform dedicated supervisory actions when 
risks are identified, in line with ESMA’s risk-based 
approach.

XI(e) 
ESMA partially accepts this recommendation.

ESMA will continue to regularly assess the risks 
related to potential conflicts of interest as part of its 
ongoing supervision — including the measures and 
controls put in place by the CRAs to monitor rating 
analysts’ trading activities and financial transac-
tions — and will conduct dedicated supervisory 
actions when risks are identified, in line with ESMA’s 
risk-based approach.

XI(f) 
ESMA partially accepts this recommendation.

ESMA will address identified weaknesses by specific 
CRAs through its supervisory mandate. Additional 
guidance for all CRAs on disclosure requirements 
will be considered where necessary and in line with 
the regulation.

XI(g) 
ESMA accepts this recommendation.

ESMA will continue its ongoing dialogue with stake-
holders to identify how CEREP can be enhanced to 
further support the needs of its users.

XI(h) 
ESMA accepts this recommendation.

ESMA is currently revamping its website. The future 
version will incorporate the improvements sug-
gested in this recommendation.

Part I – Registration and 
perimeter activities 

27
ESMA consistently allocates at least two assessors to 
work on each application for registration to ensure 
the 4 eyes principle. Furthermore, each decision 
on incompleteness, completeness and compliance 
(registration or refusal) is challenged through an 
approval process that involves the coordinator of 
applications for registration, the Team Leader, the 
Head of the CRA Unit and the Executive Director of 
ESMA.

Evidence that at least two assessors have been 
working on a registration file can be found in 
ESMA’s internal correspondence and in all formal 
correspondence with the applicants.

Evidence of ESMA’s approval process can be found 
in ESMA’s internal correspondence. Moreover the 
decisions on incompleteness and completeness 
are signed by ESMA’s Executive Director, while 
the registration and refusal decisions are formally 
approved by ESMA’s Board of Supervisors and 
signed by ESMA’s Chair.

Nonetheless, ESMA acknowledges that the 
documentation of its internal practices could be 
improved.

Reply of ESMA

57

With reference to the documentation of its analy-
sis, ESMA has applied the provisions of the CRAR. 
Article 18 of the CRAR states that where ESMA 
refuses to register a CRA it shall provide full reasons 
for its decision; in that respect ESMA thoroughly 
documented its assessment in the refusal decisions 
adopted by the Board of Supervisors.

However ESMA acknowledges that — even if not 
requested by the CRAR — the documentation of 
its assessment could be enhanced to provide full 
evidence in its working documents of the assess-
ment performed and to facilitate an audit trail of its 
analysis.

30
According to the provisions of the CRAR, ESMA 
shall not impose requirements regarding registra-
tion which are not provided for in the regulation. 
Therefore ESMA cannot require a predefined set of 
information or define a minimum acceptance level 
of detail. However ESMA would like to note that 
whenever it deemed that additional information 
was necessary in order to perform its compliance 
assessment, such information was requested in the 
framework of the registration process.

With reference to the differences in the level of 
detail in the documentation of methodologies, 
ESMA would like to highlight that the registration 
files examined referred to different CRAs active in 
different sectors. The content of the methodolo-
gies is by nature different from CRA to CRA and — 
within the same CRA — from asset class to asset 
class and there is no provision in the CRAR that 
requires the CRAs to prepare their methodologies 
according to a predefined format.

Common reply to paragraphs 28-29
Since ESMA took over the supervision of CRAs in 
July 2011 and until September 2015, it has assessed 
17 applications for registration. Four applicants 
withdrew their application, six applications were 
refused and seven CRAs were registered.

During the compliance phase ESMA assesses all the 
relevant provisions under the CRAR including the 
compliance with the requirement of using meth-
odologies that are rigorous, systematic, continu-
ous and subject to validation. The Commission 
Delegated Regulation (EU) No 447/2012 (the RTS on 
methodologies) provides the framework for ESMA 
to assess these requirements.

Each requirement is assessed separately and ESMA 
takes into consideration not only the specific meth-
odology being assessed but also all other docu-
ments submitted by the applicant such as the poli-
cies and procedures governing the rating process 
and the results from the validation of the methodol-
ogy conducted by the applicant. Whenever ESMA 
deems that additional information is necessary in 
order to perform its analysis, such information is 
requested in the context of the compliance phase.

In ESMA’s view the documentation that was 
received as part of the registration processes 
allowed it to fully assess all the requirements set 
forth in the CRAR and in the RTS on methodologies.

In this respect, ESMA did not focus only on the 
assessment of the rigorousness of the methodolo-
gies during the registration process but assessed all 
the relevant provisions.

For example, ESMA refused a number of applica-
tions for registration because of non-compliance 
with the following requirements: rigorousness 
(3 cases); systematic (2 cases); subject to validation 
(4 cases).

These figures show that the most common reason 
for refusal of applications for registration because 
of non-compliance with the articles of the RTS on 
methodologies was the non-compliance with the 
provision that requires having methodologies that 
are subject to validation.

Reply of ESMA

58

As regards the possible absence in the methodolo-
gies of some information included in the RTS (i.e. 
modelling or quantitative techniques, statement of 
the importance of each qualitative of quantitative 
factor, etc.), the RTS does not set regulatory disclo-
sure requirements but rather lays down rules to be 
used by ESMA in the assessment of compliance of 
credit rating methodologies with the requirements 
set out in Article 8(3) of the CRAR. With reference 
to these requirements, in addition to the informa-
tion available to the public, ESMA received all the 
CRA’s internal documentation that allowed ESMA to 
assess whether the methodology met the require-
ments set forth in the RTS.

Finally, in relation to the specific registration file, 
ESMA received the information on modelling and 
quantitative techniques in the preregistration phase 
but indeed it was not included in the registration 
file examined.

Common reply to paragraphs 31-34
ESMA has conducted perimeter activity since its 
inception and, in parallel to the notifications from 
NCAs, it has regularly carried out independent 
analysis.

ESMA has been in contact with several potential 
credit rating providers and the majority of these 
entities had been directly identified by ESMA. This 
activity allowed ESMA to timely identify companies 
which should be registered as CRAs.

In ESMA’s view, both activities — ESMA’s internal 
assessment and contribution from NCAs — are 
equally important.

Some of the detected entities were indeed carry-
ing out activities falling within the scope of the 
CRAR and were consequently registered as a CRA. 
All these entities were identified before ESMA 
published its Guidelines on the Scope of the CRA 
Regulation on 30 July 2013. In those Guidelines, 
ESMA made clear to the public that issuing ratings 
without being registered is a breach of the CRAR 
for which ESMA has the authority to impose a fine. 
ESMA has not used this power so far because it has 
not identified any company carrying out credit rat-
ing activities after the publication of the Guidelines.

Common reply to paragraphs 35-40
ESMA notes that it is responsible solely for the 
registration and the supervision of the CRAs in the 
EU and that the functioning of the Eurosystem is 
outside ESMA’s mandate.

The outcome of ESMA’s registration process has no 
influence on the rules governing the acceptance of 
the credit ratings in the Eurosystem.

Part II – Planning and risk 
management 

48
ESMA’s framework is designed in such a way that 
under each risk category the key concerns identi-
fied are listed. Typically, it is the most significant 
concern that will then drive the overall assessment 
for a particular risk area. Furthermore, all risks that 
are identified are documented.

49
The fact whether all necessary documents were 
analysed, and with what results, is systematically 
checked during bilateral discussions between 
the risk and the supervisory staff. However ESMA 
acknowledges that it lacks formal documentation of 
this interaction.

Reply of ESMA

59

50
The input for the fundamental strategic analysis 
that takes place at least on an annual basis is docu-
mented in the scorecards. The reason that a change 
in the risk assessment that may occur following the 
consistency check meetings between the risk team 
and the supervisory team is not documented is that 
these meetings are part of the finalisation phase of 
the risk dashboard compilation.

ESMA acknowledges that a more comprehensive 
documentation trail is necessary to support the 
prioritisation of risk throughout the year. In this 
respect ESMA is currently developing a new reposi-
tory which is designed so as to record changes in 
risk assessment on an ongoing basis.

Common reply to paragraphs 52-53
ESMA’s risk-based approach was introduced after 
its first year of supervision. Since then all high-risk 
areas that have been identified for high impact 
CRAs have been addressed either through investi-
gations or ongoing supervision.

ESMA’s risk-based framework comprises three 
interdependent phases (i) Risk identification and 
assessment, (ii) Risk Prioritisation and (iii) Definition 
of supervisory actions to address the prioritised 
risks. This framework is built around 13 risk indica-
tors and at least on an annual basis ESMA conducts 
a strategic exercise with the purpose to define the 
annual supervisory work plan that sets priorities 
and actions for the coming year. 

Since 2012, in total 39 times a risk indicator was 
identified as high risk for the four high impact CRAs.

Four of these identified risks were addressed 
through ongoing supervision. The other 35 risk 
areas were followed up through an individual or 
thematic investigation in the year following the 
identification.

The type of the investigation (individual vs the-
matic) depends amongst others on complexity 
and level of idiosyncrasy of the identified risk. 
Moreover, while the focus of the investigation is 
on the observed high-risk areas, the interdepend-
ent nature of risk areas can trigger inclusion of risk 
areas that are identified as lower risk as part of the 
investigation.

For example ESMA launched an investigation into 
structured finance credit ratings based on a high 
risk identified in the risk category associated to the 
portfolio risk. However to have a comprehensive 
view of this asset class and of the relevant practices 
adopted by the CRAs, ESMA had to consider all the 
aspects underlying the rating process, which evi-
dently also included aspects covered by other risk 
indicators (e.g. the resource allocation to the rating 
monitoring activity, the information used during 
the rating process, as well as the application and 
review of the relevant methodologies).

In addition to the annual strategic exercise that 
takes place, ESMA monitors and assesses risks on 
an ongoing basis. If outside of the strategic exercise 
new risks are observed through our ongoing super-
vision (analysis of periodic information, analysis of 
complaints, notifications to changes to the initial 
conditions of registration, periodic interviews, etc.) 
and market monitoring, a (re)prioritisation exercise 
will take place to ensure that resources are allocated 
to risks with the greatest potential to cause harm to 
investors and more generally to financial stability.

54
ESMA structured some past investigation around 
ratings of specific asset classes, however this does 
not mean that the investigation did not focus on 
the business risk aspects identified by the risk 
assessment framework. On the contrary, specific 
asset classes (which emerge as important in the 
Environmental Risk/Portfolio Risk assessment) are 
used in order to build a consistent and meaningful 
sample through which the investigation can assess 

Reply of ESMA

60

the key risks identified for the relevant CRA(s). 
In addition, while we might assess a specific risk 
in detail for a particular asset class, typically the 
remedial action plan will ask for the remediation 
of the relevant issues observed across all the asset 
classes, and not only for the one subject to the 
investigation.

55
ESMA made a conscious decision to be a risk-based 
supervisor, assuming that not all risks can be 
removed, but rather that supervisory actions must 
aim at identifying and addressing those with the 
greatest potential to cause harm to investors and to 
financial stability.

Part III – Supervision 

Common reply to paragraphs 63-64
ESMA notes that the Supervision Manual and 
Handbook are intended to set ESMA’s supervisory 
framework, describe the supervisory processes 
and define the common steps and principles to be 
followed within these processes. These documents 
set out the minimum supervisory tasks to be per-
formed throughout the year which can be planned 
a priori.

ESMA believes that the exact types of supervisory 
tasks and their frequency cannot be established in 
these documents due to the unpredictable nature 
of some supervisory activities which are driven 
by the risk profile of each CRA. For this reason the 
Supervision Manual and Handbook are now always 
complemented by: annual strategies and workplans 
for the riskiest CRAs which include the actions to 
be undertaken with deadlines; meetings under 
a cycle of engagement that is annually established 
and communicated to the CRAs; project plans per 
investigation.

ESMA believes that going further than that and 
hard-wiring supervisory task and their timelines — 
by means of including them in ESMA’s manuals and 
handbooks — would undesirably constrain the 
effectiveness of its supervision.

65
ESMA notes that it has recently established individ-
ual supervisory plans for the riskiest CRAs.

Nevertheless, also before introducing individual 
supervisory plans, ESMA has always defined on 
an annual basis the timing of regular supervisory 
checks. For example the frequency of meetings 
under the cycle of engagement was established on 
an annual basis and communicated to the relevant 
CRA. Similarly the analysis of the periodic infor-
mation received from the CRAs was scheduled in 
accordance with the timing of submission and the 
related analysis was recorded in a dedicated file.

However, some interactions with the CRAs only 
take place if ESMA needs further clarifications or if 
a specific event occurs — for instance notifications 
received from the CRAs, submission of complaints, 
discussions following the analysis of the periodic 
information — and therefore cannot be planned in 
advance.

ESMA believes that its supervisory approach should 
remain sufficiently flexible in order to adjust the 
frequency and intensity of interaction with the 
CRAs based on the events or risks observed.

66
ESMA believes that it should select the supervisory 
tool that it considers to be the most effective in 
order to achieve its supervisory objectives.

In the past ESMA has used checklists and question-
naires where appropriate, to conduct its verifica-
tions. However ESMA considers checklists as a tool 
that works effectively only for certain supervisory 
activities.

Reply of ESMA

61

ESMA continuously seeks to enhance its supervi-
sory practices, also looking at the practices of other 
supervisors. However any comparison with the 
supervisory tools used by the NCAs should consider 
the differences in terms of mandate, supervisory 
objectives, nature of the industry supervised and 
number of supervised entities.

67
ESMA acknowledges that the record of the analy-
sis that is conducted on the periodic information 
received from CRAs could be enhanced. In this 
regard, ESMA is developing a new tool for continu-
ous monitoring of information and risk assessment 
purposes. This tool will allow the storage of super-
visors’ input and analyses within dedicated docu-
ments through the implementation of structured 
templates, thus enhancing record-keeping practices 
both of the analysis undertaken and of the risks 
identified.

68
ESMA believes that the ‘criteria folder’ has so far 
served the purpose of ensuring consistency in its 
decisions. While ESMA agrees that the documenta-
tion could be improved, the supervision of CRAs by 
ESMA started in late 2011 and only after a sufficient 
amount of decisions had been taken, did ESMA feel 
the need to start developing a more structured 
database. After 4 years of supervisory activities, 
the information included in the folder has reached 
a sufficient critical mass and ESMA has recently 
implemented a wiki-based tool to facilitate an 
effective use of this information.

Common reply to paragraphs 69-72
ESMA acknowledges that the record of the analysis 
it conducts on the periodic information received 
from CRAs could be enhanced and, as explained 
in previous paragraphs, it is developing a new tool 
for continuous monitoring of information and risk 
assessment purposes.

While not all activities have been fully documented, 
ESMA’s working documents contain neverthe-
less evidence of the analysis conducted. In this 
respect ESMA notes that it is operating with limited 
resources and the time dedicated to documentation 
needs to be proportionate.

ESMA has assessed whether a dedicated IT system 
would provide benefits and weighted those ben-
efits against the installation and maintenance costs. 
Given that the number of registered CRAs remains 
limited, ESMA does not consider that at this stage 
a dedicated IT tool is necessary and believes that 
a comparison with the NCAs is not proportionate 
in light of the number of registered CRAs and the 
size of ESMA’s supervisory team compared to the 
respective figures for most NCAs.

73
ESMA systematically analyses and follows up on all 
the information requested as part of its investiga-
tions. Its working documents show that all relevant 
information is systematically collected both in the 
course of the investigations and as part of the reme-
dial action plans.

ESMA does not document all the intermediate steps 
of its analysis; this is a conscious decision consider-
ing that ESMA has a limited number of resources 
and needs to use them in the most effective way. 
However the outcomes of the investigations as well 
as the supporting evidence are thoroughly docu-
mented in the letters sent to the CRAs. As such, 
ESMA retains sufficient records to demonstrate and 
ensure that the conclusions of the investigations are 
supported by a thorough analysis of the evidence 
collected.

74
ESMA’s letters to the CRAs are drafted in compli-
ance with its Supervision Manual, which does not 
require the inclusion of a reference to the articles 
and paragraphs of the CRAR from which each find-
ing originates.

Reply of ESMA

62

ESMA believes that its letters and remedial action 
plans clearly identify the concerned areas of non-
compliance and does not see added value in explic-
itly mentioning the applicable article of the CRAR 
for each finding.

Whenever the methodological risk indicator has 
been identified as high risk in CRAs, ESMA has 
systematically covered it through its supervisory 
actions, including for example the thematic investi-
gation into bank methodologies.

75
The follow-up tables are ESMA’s internal working 
documents; they are prepared in a standard format 
across all the investigations and the supporting evi-
dence is systematically saved in dedicated folders. 
However, the standardisation can only refer to the 
format used; the analyses and comments included 
in the tables vary in terms of content depending on 
the relevant topic analysed.

80
ESMA acknowledges that there are a number of 
terms used in the CRAR which are not defined. 
However ESMA can only develop specific guidance 
within the remit of CRAR. ESMA has done so in the 
past, in order to provide transparency and further 
clarifications on its supervisory views, for example 
through guidelines and recommendations, Q&As 
and public reports.

Common reply to paragraphs 81-84
In order to ensure that CRAs comply with the regu-
latory requirements to use rigorous, systematic and 
continuous methodologies which are subject to 
validation and back-testing, ESMA uses a risk-based 
approach which allows focusing resources on those 
areas that matter the most. Methodologies are part 
of the risk indicators assessed within ESMA’s risk 
framework.

ESMA continuously assesses the methodologi-
cal risk as part of its ongoing supervision where 
it regularly receives and analyses a wide range of 
information related to methodology. This allows for 
a comprehensive view of the developments of the 
methodologies universe for each CRA.

In addition, ESMA has assessed the compliance of 
methodologies with the CRAR requirements also as 
part of other investigations, although the methodo-
logical risk was not the main focus and the level of 
analysis performed varied depending on the scope 
of the investigation.

In this respect ESMA notes that Table 4 — concern-
ing the activity performed by ESMA as part of some 
investigations conducted in the past — does not 
reflect the full activity conducted by ESMA regard-
ing methodologies.

As a general point, ESMA would like to note that 
in all the investigations referred to in the table, it 
extensively reviewed the activity of the Internal 
Review Function which is key to ensure that CRA 
use methodologies that are rigorous, systematic, 
continuous and subject to validation. In this con-
text ESMA requested and assessed information, 
conducted interviews and issued recommendations 
on the activity of such a function. Moreover in all 
these investigations ESMA verified that the CRA 
used a unique rating scale to allow comparability 
of ratings across different asset classes as well as 
that the Internal Review Function adopted the same 
procedures for all asset classes reviewed (‘continu-
ous across asset classes’ in the table).

While the bank rating investigation specifically 
focused on methodologies, the other past inves-
tigations did not have as their main objective to 
cover methodological risks. Nevertheless ESMA has 
assessed how the methodologies are developed, 
approved, reviewed and/or applied across the 
different asset classes and through various rating 
actions for the selected samples in these investiga-
tions. Following these investigations ESMA also 
issued specific recommendations to the CRAs con-
cerning the methodology area.

Reply of ESMA

63

In light of the above, ESMA is of the view that 
Table 4 does not sufficiently reflect the supervi-
sion of methodologies conducted within thematic 
investigations.

Against this background ESMA believes that its 
supervision of methodologies has so far been ade-
quate and effective. ESMA will continue to regularly 
assess the methodological risk as part of its ongo-
ing supervision and will perform dedicated supervi-
sory actions when risks are identified, in accordance 
with ESMA’ risk-based approach.

Common reply to paragraphs 85-86
While ESMA acknowledges that until recently it 
did not have a formal procedure for examining the 
notifications of material changes to existing meth-
odologies, ESMA did have a procedure describing 
in detail the recording and monitoring activities 
that the CRA Unit needs to follow concerning the 
notifications of material changes to the conditions 
for initial registration, which includes the issuance 
of a new type/class of credit ratings.

Common reply to paragraphs 87-89
ESMA would like to highlight that the entire CRAR is 
designed to address conflicts of interests and there-
fore, since the inception of its supervisory activity, 
ESMA focused significant supervisory efforts on 
assessing the measures put in place by CRAs to 
avoid conflicts of interest.

Annex I of the CRAR is entitled ‘Independence and 
avoidance of conflicts of interest’. ESMA has con-
ducted analyses for each of the sections included 
in this Annex. Such verifications were performed 
firstly during the registration process, and thereaf-
ter on an ongoing basis through the periodic infor-
mation received from CRAs as well as during 
ad hoc thematic and individual investigations. Con-
sequently the majority of the interactions with the 
CRAs and the findings following ESMA’s investiga-
tions are linked to the provisions of the CRAR con-
cerning independence and avoidance of conflicts of 
interest.

This is also clear from ESMA’s public annual reports 
and work plans where ESMA identifies the major 
supervisory risks on which it will focus in the com-
ing years and provides information on the main 
issues identified in the course of past investigations. 
Similarly, the two public notices issued by ESMA 
respectively in June 2014 and June 2015 both refer 
to infringements of CRAR provisions concerning 
measures to ensure independence and avoidance of 
potential conflicts of interest.

As previously explained ESMA has implemented 
a risk-based approach which aims at identifying 
risks and prioritising supervisory activities accord-
ingly. Conflicts of interest are part of the risk indica-
tors assessed within ESMA’s risk framework. Where 
these indicators have been identified as high risk 
in CRAs, ESMA has systematically covered them 
through its supervisory actions.

The potential conflicts presented by the provision 
of ancillary services, services provided by sister 
companies and securities holding by analysts, 
constitute one aspect of the potential conflicts of 
interest faced by a CRA. Moreover, non-compliance 
with the requirements regarding these potential 
conflicts was not identified by ESMA as a high risk, 
therefore ESMA did not conduct dedicated super-
visory action in these specific areas. Nevertheless, 
these areas have been monitored through ongoing 
supervision and analysed in the context of some 
investigations conducted in the past. In particular:

—  ESMA had several interactions with the CRAs as 
part of its ongoing supervision concerning the 
provision of services other than credit ratings 
and the related potential conflicts of interest. 
An analysis of these areas was also performed in 
the context of two investigations conducted by 
ESMA in the past.

Reply of ESMA

64

—  With reference to the measures and controls put 
in place by CRAs to prevent disclosure of confi-
dential information to third parties or to sister 
companies, already as part of the registration 
process the CRAs were asked to put in place 
strong safeguards to ensure a strict separation 
between the CRAs’ business and other activi-
ties performed by sister companies. As part of 
its ongoing supervision ESMA regularly moni-
tors the application of the related controls and 
of any failures of the confidentiality measures. 
Moreover, an analysis of the measures to ensure 
that confidential information is not shared with 
third parties was carried out as part of several 
investigations conducted by ESMA.

—  With reference to the measures put in place by 

the CRAs to prevent conflicts of interest relating 
to rating analysts’ trading activities and finan-
cial transactions, ESMA examined the related 
policies and procedures during the registra-
tion process and, where applicable, updates 
received thereafter during ongoing supervi-
sion. ESMA regularly receives the results of the 
controls performed by the CRAs in this area and 
follows up if necessary. In this respect ESMA 
relies on the internal control system of the 
supervised entities and reacts when it believes 
that such controls do not perform appropriately 
or when specific risks have been identified in 
the concerned area.

Part IV – Disclosures

Common reply to paragraphs 92-94
In addition to the general public disclosures, the 
CRAR includes other important disclosure require-
ments, notably the disclosure requirements con-
cerning rules on the presentation of credit ratings 
and rating outlooks, which ESMA regularly checks 
as part of its ongoing supervision and in the con-
text of the investigations and that are essential for 
the users of ratings to undertake their own analysis.

In 2014 ESMA conducted an analysis with the objec-
tive to check the level of harmonisation of the CRAs 
in complying with certain disclosure requirements 
included in the CRAR. The purpose of that exercise 
was to ensure consistency across all the CRAs.

As a matter of fact ESMA regularly conducts cross-
CRAs assessments to verify the harmonisation in 
the implementation of certain requirements of the 
CRAR, such as the supervisory work conducted by 
ESMA on the compliance of CRAs issuing sovereign 
ratings with the new disclosure requirements intro-
duced by the 2013 amendments to the CRA regula-
tion (see ESMA Annual Report and work plan of 16 
February 2015).

Common reply to paragraphs 95-99
ESMA notes that the content of these paragraphs 
is not related to ESMA’s supervision. ESMA’s role is 
to ensure that CRAs comply with the CRAR and it 
cannot go beyond the provisions included in the 
regulation.

In particular, the assessment of whether the cur-
rent disclosure requirements provided by the CRAR 
allow the users of ratings to perform specific tasks, 
namely to conduct their own due diligence, is not 
part of ESMA’s duties. For example

There is no provision in the CRAR that requires the 
CRAs to prepare their methodologies according to 
a predefined format; consequently ESMA cannot 
impose any standardised disclosure in that respect.

ESMA would also like to note that, especially in 
the structured finance category, CRA may publish 
methodologies which include general principles 
applicable to various asset classes (master meth-
odologies). These cross-sectorial methodologies 
contain only general principles and must be read in 
conjunction with the relevant methodology for the 
specific asset class. In assessing compliance with 
the disclosure requirements set forth in the CRAR, 
ESMA verifies all the relevant methodologies appli-
cable to a given asset class.

Reply of ESMA

65

100
CEREP centralises standardised historical perfor-
mance statistics that apply to all types of ratings 
and CRAs. It offers full flexibility to users in running 
reports on any combination of data, depending on 
the interest of the user. According to the legal man-
date, CRAs do not have to make ‘historical ratings’ 
available but rather are obliged to report ‘historical 
performance data’. As a direct consequence ESMA 
does not have a mandate to publish information on 
individual credit ratings through CEREP.

While CEREP does not include an exhaustive list of 
all possible statistics, through running multiple que-
ries, users can actually retrieve additional statistics, 
including the ones suggested in the Court’s report. 
This approach was chosen as the usefulness of 
statistics is highly subjective in nature and heavily 
depends on the final objective of the user.

ESMA acknowledges that it would be useful to 
further facilitate data extraction from CEREP. 
However, the feasibility to implement more flex-
ible download functions and filtering options has 
to be assessed by ESMA against: the restrictions of 
its legal mandate, the possibility to calculate these 
statistics within the existing CEREP data structure 
and diversity of data while keeping the tool’s search 
flexibility, the synergies with the new disclosure 
requirements for publication on the European Rat-
ing Platform (ERP) as well as budgetary and other 
resource constraints.

101
ESMA’s mandate under the CRAR is to collect his-
torical performance data from each single CRA and 
make this available to users on a central website.

Article 11(2) of the CRAR indicates that a credit 
rating agency shall make available in a central 
repository established by ESMA information on its 
historical performance data including the ratings 
transition frequency and information about credit 
ratings issued in the past and on their changes. 
A credit rating agency shall provide information to 
that repository on a standard form as provided for 
by ESMA. ESMA shall make that information accessi-
ble to the public and shall publish summary infor-
mation on the main developments observed on an 
annual basis.

In that respect ESMA publishes information about 
the credit ratings issued in the past and on their 
changes in the form of standardised activity tables. 
This information includes, amongst others, the 
number of new ratings issued, the number of with-
drawals (split per reason for withdrawal), number 
of upgrades and downgrades, number of defaults, 
upgrade/downgrade ratio, and average number of 
notches for upgrade/downgrades.

In addition, ESMA publishes CRAs’ historical perfor-
mance data including transition matrices. To ensure 
a sufficient level of standardisation and comparabil-
ity across the published statistics, ESMA’s technical 
working group appointed at the time of the CEREP 
implementation decided to collect raw data and 
calculate the statistics centrally rather than to col-
lect the pre-calculated statistics. However, in line 
with the CRA regulation ESMA does not have a man-
date to publish the underlying data. This was con-
firmed also in various pieces of advice that ESMA 
received in preparation for CEREP implementation. 
While ESMA would agree that investors could ben-
efit from such publication, in our view this was not 
in the scope of the CRA regulation and ESMA would 
have faced significant legal risks in relation to copy-
right provisions and misuse of information.

The fact that the 2013 amendments to the CRAR 
introduced the European Rating Platform that stipu-
lates that ESMA shall publish the individual credit 
ratings submitted to it, is indicative in this respect.

Reply of ESMA

66

102
Although ESMA is not requested to monitor the 
events occurring after a rating withdrawal, in 2014 
ESMA has conducted supervisory work to under-
stand the reasons for rating withdrawals. This 
resulted in amending the reporting standards for 
the ‘withdrawal reasons’ in the draft RTS related to 
the ERP. This now provides a more extensive choice 
of reasons, including the requirement of specifying 
the reason in case the withdrawal cannot be classi-
fied in one of the listed categories.

Once the data will be reported under the new 
requirements (that is for ratings withdrawn after 
1 July 2015), ESMA will monitor the reasons pro-
vided and, if considered necessary, will follow up 
with the CRA for clarifications and/or to create addi-
tional categories for withdrawal reasons.

103
ESMA would like to stress that only data that passes 
extensive validation checks embedded in the data 
collection tool (50 checks at level 1 and 50 checks 
at level 2) and systematic completeness checks, 
is stored into the database and ultimately made 
available on CEREP. In addition to ensuring qual-
ity of data, these steps ensure standardisation and 
comparability of the submitted data, as well as 
consistency over time.

Once the data passes these initial checks and is 
saved in the database, ad hoc checks are run on an 
ongoing basis to further ensure the consistency and 
quality of the data. The fact that there is no system-
atic reconciliation with other databases is a direct 
consequence of the limitation that CEREP data lacks 
common identifiers. This issue will be solved as part 
of the implementation of the ERP as the related 
RTS includes the requirement of reporting, where 
applicable, global identifiers (such as Legal Entity 
Identifiers, BIC codes, ISINs, etc.)

Furthermore it should be noted that occasionally 
and to the extent possible ESMA does check the 
validity of the data against other databases.

CEREP technically makes it possible for CRAs to 
update their previously reported data. Both the 
old and the new information are kept in the data-
base. ESMA acknowledges the value of information 
related to corrections and revisions and is consider-
ing alternatives for the disclosure of such informa-
tion on the ERP.

104
The qualitative data made available in CEREP 
includes the rating scales, default definitions and an 
overview of methodologies by CRA. This is intended 
to be a comprehensive summary of the methodolo-
gies, including changes. It was never the intention 
of CEREP to contain an exhaustive repository of 
information about the CRAs’ methodologies and 
users should consult the individual CRAs’ websites 
for complete information. Furthermore, while CRAs 
are requested to report the same information, a har-
monisation in terms of content is not meaningful as 
it would undermine the objective of reflecting the 
CRA’s specific definitions and rating scales.

Currently CEREP only discloses the most up-to-date 
qualitative data. ESMA will consider the possibility 
of disclosing historical changes to the qualitative 
data during the development the European Rating 
Platform.

Common reply to paragraphs 105-108
ESMA is currently revamping its website. The future 
version of ESMA’s website is aimed at ensuring that 
this information source meets the needs of ESMA’s 
stakeholders in terms of the information provided 
but also in the manner of its presentation. A general 
update of the content is planned, the list of external 
documents available will be updated and the user 
friendliness will be enhanced.

Reply of ESMA

67

While ESMA is continuously seeking to enhance 
the level and quality of information that it makes 
available, ESMA regularly publishes information 
relating to its fields of activities and the information 
disclosed so far on its website was compliant with 
ESMA’s regulatory obligations.

Conclusions and recommendations

110
See ESMA’s reply to paragraphs 20 to 30.

111
See ESMA’s reply to paragraphs 35 to 40.

Recommendation 1
ESMA accepts this recommendation.

Recommendation 3
ESMA partially accepts this recommendation.

ESMA will update its supervisory manual and super-
visory handbook when needed, in order to incorpo-
rate knowledge and experience gained.

ESMA remains confident that in the context of the 
investigations all the conclusions and findings 
reported to the CRAs and the supporting evidence 
are thoroughly documented.

ESMA acknowledges that the record of the analy-
sis that it conducts on the periodic information 
received from CRAs could be enhanced and it is cur-
rently improving its record-keeping practices both 
of the analysis undertaken and of the risks identi-
fied. However given that the number of registered 
CRAs remains limited, ESMA does not consider that 
at this stage a dedicated IT tool is necessary.

ESMA acknowledges that the documentation of its 
assessment could be enhanced to provide full evi-
dence in its working documents of the assessment 
performed and to facilitate audit trail of its analysis.

115
See ESMA’s reply to point VIII of the Executive Sum-
mary and to paragraphs 78 to 86.

112
See ESMA’s reply to point VI of the Executive Sum-
mary and to paragraphs 41 to 55.

Recommendation 2
ESMA accepts this recommendation.

Recommendation 4
ESMA partially accepts this recommendation.

ESMA will continue to regularly assess the method-
ological risk as part of its ongoing supervision and 
will perform dedicated supervisory actions when 
risks are identified, in line with ESMA’ risk-based 
approach.

Common reply to paragraphs 113-114
See ESMA’s reply to point VII of the Executive Sum-
mary and to paragraphs 56 to 77.

116
See ESMA’s reply to point VIII of the Executive Sum-
mary and to paragraphs 87 to 89.

Reply of ESMA

68

Recommendation 5
ESMA partially accepts this recommendation.

ESMA will continue to regularly assess the risks 
related to potential conflicts of interest as part of its 
ongoing supervision — including the measures and 
controls put in place by the CRAs to monitor rating 
analysts’ trading activities and financial transac-
tions — and will conduct dedicated supervisory 
actions when risks are identified, in line with ESMA’s 
risk-based approach.

119
See ESMA’s reply to point X of the Executive Sum-
mary and to paragraphs 100 to 104.

Recommendation 7
ESMA accepts this recommendation.

ESMA will continue its ongoing dialogue with stake-
holders to identify how CEREP can be enhanced to 
further support the needs of its users.

117
See ESMA’s reply to paragraphs 92 to 94.

120
See ESMA’s reply to paragraphs 105 to 108

118
See ESMA’s reply to paragraphs 95 to 99.

Recommendation 8
ESMA accepts this recommendation.

Recommendation 6
ESMA partially accepts this recommendation.

ESMA will address identified weaknesses by specific 
CRAs through its supervisory mandate. Additional 
guidance for all CRAs on disclosure requirements 
will be considered where necessary and in line with 
the regulation.

ESMA is currently revamping its website. The future 
version will incorporate the improvements sug-
gested in this recommendation.

Reply of the ECB

69

Executive summary

—  Third, it is worth noting that the ECAF is actu-

V
The ECB has received from the European Court 
of Auditors (ECA) paragraph V of the Executive 
Summary, and paragraphs 35 to 40 and 111 of 
the report, and would like to add the following 
clarifications:

—  First, the Eurosystem has a statutory obligation 
to ensure that the credit operations it conducts 
are secured by adequate collateral1. For this 
purpose, the Eurosystem Credit Assessment 
Framework (ECAF) is an important instrument 
for mitigating financial risks for the Eurosys-
tem, and its definition is part of the opera-
tional independence of the Eurosystem when 
conducting monetary policy operations. The 
procedures, rules and techniques defined in the 
ECAF are key to ensuring that the Eurosystem’s 
requirement of high credit standards for all as-
sets that are eligible as collateral in Eurosystem 
monetary policy operations is met. The legal 
provisions underlying the ECAF are specified in 
the ECB Guideline on the implementation of the 
Eurosystem monetary policy framework (recast) 
(ECB/2014/60)2.

—  Second, for the assessment of collateral, the 
Eurosystem does not rely exclusively on four 
credit rating agencies (CRAs) registered by the 
European Securities and Markets Authority 
(ESMA). As noted by the Court in paragraph 
37, the Eurosystem actually takes into account 
information from credit assessment systems 
belonging to various sources: external credit as-
sessment institutions (ECAls), rating tools (RTs), 
national central banks’ in-house credit assess-
ment systems and banks’ internal ratings-based 
(lRB) systems. Among the systems accepted as 
RTs, there are also some small European CRAs 
registered by ESMA.

1 

2 

 See Article 18.1 of the Statute of the European System of Central 
Banks and of the European Central Bank.

 Available at https://www.ecb.europa.eu/ecb/legal/pdf/
oj_jol_2015_091_r_0002_en_txt.pdf. Additional information 
on the ECAF is available in the ECB’s recent publication ‘The 
financial risk management of the Eurosystem monetary policy 
operations’ and on the ECB’s website at http://www.ecb.europa.
eu/mopo/assets/risk/ecaf/html/index.en.html.

ally open to additional credit rating agencies if 
they request ECAF acceptance and comply with 
the minimum requirements for ECAF accept-
ance of credit assessment systems. The ECAF 
acceptance criteria aim to ensure that a new 
system is suitable for the specific purpose of the 
Eurosystem’s monetary policy operations. This 
protects the Eurosystem against financial risks 
and creates a level playing field for the different 
systems that provide the Eurosystem with credit 
assessment information. In this context, the 
Eurosystem acts as a user of credit ratings, not 
as a regulator or supervisor.

The acceptance processes include checks on 
quality, whether coverage is sufficient for an 
efficient implementation of the ECAF and take 
into account the respective regulatory situation. 
For example, the criteria for accepting credit 
rating agencies as ECAls3 include:

(a)  that ECAls must be registered or certified by 
ESMA  in  accordance  with  Regulation  (EC) 
No 1060/2009, and

(b)  that ECAls must fulfil operational criteria and 
provide relevant coverage so as to ensure the 
efficient implementation of the ECAF.

In particular, the use of an ECAl’s credit qual-
ity assessment is subject to the availability of 
information on these assessments to the Euro-
system. In addition, information is requested for 
the comparison and the assignment (i.e. ‘map-
ping’) of the credit assessments to the Eurosys-
tem’s credit quality steps and for the purposes 
of monitoring their performance. The Eurosys-
tem’s due diligence on ECAls thus builds on 
the supervisory work undertaken by ESMA, but 
goes in some dimensions beyond it. In a context 
of limited internal resources, the Eurosystem 
also needs to ensure that the use of these rating 
agencies in the implementation of its monetary 
policy framework is efficient.

3  See Article 120 of Guideline ECB/2014/60.

 
 
Reply of the ECB

70

ESMA-registered or certified CRAs be used for 
capital requirements purposes under the ‘stand-
ardised approach’. A similar approach will be 
followed for insurance firms under the Solvency 
II Directive.9 The ECB will consider the effects 
of these regulatory changes on the market for 
CRAs, in particular in terms of the quantities and 
qualities of credit ratings.

Part I – Registration and 
perimeter activities

Findings

38
The Eurosystem accepts several RTs subject to a set 
of acceptance criteria10, including some small Euro-
pean CRAs. The business model of the accepted 
RTs has focused on the assessment of non-financial 
companies, for which they have been accepted by 
the Eurosystem.

40
The Eurosystem accepts CRAs that are registered or 
certified by ESMA as ECAls or RTs if the CRAs con-
tribute to the efficient implementation of the ECAF 
for monetary policy operations (see above). The 
Eurosystem does not act as a regulator or supervi-
sor in this context.11

9 

 See Directive 2009/138/EC of the European Parliament and of 
the Council of 25 November 2009 on the taking-up and pursuit 
of the business of Insurance and Reinsurance (Solvency II).

10   See Article 124 of Guideline ECB/2014/60 and https://www.ecb.
europa.eu/pub/pdf/other/acceptancecriteriaratingtools201505.
en.pdf.

11   Article 119(4) of Guideline ECB/2014/60 explicitly states that 

‘By publishing information on the accepted credit assessment 
systems in conjunction with its Eurosystem credit operations, 
the Eurosystem shall not assume any responsibility for its 
evaluation of accepted credit assessment systems’.

In addition, it should be noted that the ECAF 
and the due diligence on information provided 
by credit rating agencies have been enhanced 
in recent years. This is in line with the ECB’s 
commitment to implementing the Financial 
Stability Board’s principles for reducing reliance 
on external ratings.4

—  Fourth, many factors affect market access for 

CRAs; of these, ECAF acceptance is only a small 
one. The Court also acknowledges this as it re-
fers to ‘various factors’ that make entry into the 
credit rating market difficult (paragraph 35) and 
the European Parliament’s initiatives to investi-
gate the possibility of establishing a European 
Rating Agencies Network (paragraph 36). The 
EU Commission’s report on the feasibility of 
such a network identified multiple obstacles 
as well as a lack of support, under the current 
conditions, by industry representatives for any 
form of network of smaller CRAs5.

For example, the use of credit ratings by banks 
for capital requirements purposes is not covered 
by the scope of the Court’s audit. At the moment, 
a limited number of often three CRAs appear to 
be used for banks’ capital requirements pur-
poses in the respective European Union Member 
State6. Only when the relevant Implementing 
Technical Standards of the capital requirements 
regulation (CRR)7 have been adopted8 can all

4 

5 

6 

7 

8 

 See, for example, Financial Stability Board, Principles for Reducing 
Reliance on CRA Ratings, October 2010, available at http://www.
financialstabilityboard.org/publications/r_101027.pdf.

 See the Commission report addressed to the European 
Parliament and the Council on the feasibility of a network 
of smaller credit rating agencies in the EU (COM(2014) 248 
final), available at http://ec.europa.eu/transparency/regdoc/
rep/1/2014/EN/1-2014-248-EN-F1-1.Pdf

 See the list of eligible CRAs in the different Member States, 
available at www.eba.europa.eu/documents/10180/585167/
ecai_recognition.xls

 See Regulation (EU) No 575/2013 of the European Parliament 
and of the Council of 26 June 2013 on prudential requirements 
for credit institutions and investment firms.

 See the draft Implementing Technical Standards on the mapping 
of ECAIs’ credit assessments under Article 136(1) and (3) of 
Regulation (EU) No 575/2013 (Capital Requirements Regulation — 
CRR). For securitisation positions, see the Consultation Paper on 
ITS on Mapping of ECAIs Credit Assessments (EBA/CP/2015/08). 
See also the draft Implementing Technical Standards on the 
allocation of credit assessments of ECAIs to an objective scale of 
credit quality steps under Article 109(a) of Directive 2009/138/EC 
(Solvency II).

 
 
 
Reply of the ECB

71

Moreover, the statement that ‘The US Federal 
Reserve accepts ratings from all 10 CRAs that are 
registered by the SEC’ does not tally with the 
information available to the ECB. In this respect, 
it is noted that the Federal Reserve System does 
not publicly state which rating agencies it uses to 
determine the eligibility and treatment of collateral. 
One exception was the use of credit ratings for the 
Term Asset-Backed Securities Loan Facility (TALF), 
for which the Federal Reserve publicly announced 
its requirements, which included a rating methodol-
ogy for ABS, sufficient experience (demonstrated 
by the provision of a minimum number of relevant 
public ratings) and registration with the Securities 
and Exchange Commission as a Nationally Recog-
nized Statistical Rating Organisation.12 Regardless of 
the differences between the US and the euro area 
in the frameworks for monetary policy implemen-
tation as well as the regulatory and market situa-
tion of CRAs, these requirements comprise some 
features similar to those of the Eurosystem.

Conclusion
Given the clarifications presented above, the ECB 
would have found it beneficial if the audit had had 
the opportunity to cover the various factors affect-
ing the market for small CRAs, of which the ECAF is 
only a single aspect.

Conclusions and recommendations

111
See the ECB’s comments on paragraph V of the 
Executive Summary.

12   See § 201.3 (e) (1) of Regulation A of the Federal Reserve Board 
of Governors, available at https://www.frbdiscountwindow.org/
en/Pages/General-Information/Regulation-A-Federal-Reserve-
Board-Governors.aspx.

Reply of the  
Commission

Part IV – Disclosures

Common reply to paragraphs 95 and 96
As a response to the financial crisis, Regulation 
1060/2009 on credit rating agencies has consider-
ably improved the transparency in the way credit 
rating agencies operate on the European market. In 
particular, the transparency of credit ratings, rating 
methodologies and the historical performance of 
registered and authorised credit rating agencies 
has been enhanced. While there might be some 
differences in the way that credit rating agencies 
disclose information, credit rating agencies are gen-
erally complying with the disclosure obligations of 
Regulation 1060/2009. If necessary and appropriate, 
additional guidance in accordance with Article 16 
of Regulation 1095/2010 by the European Securi-
ties and Markets Authority to credit rating agencies 
on disclosure requirements could be considered to 
improve the overall disclosure practices of credit 
rating agencies.

97
The Regulation 1060/2009 on credit rating agen-
cies aims to strike the balance between the need to 
disclose information on rating methodologies while 
protecting proprietary information of credit rating 
agencies at the same time.

For users to conduct their due diligence, the Regu-
lation not only requires publishing information on 
the rating methodologies, but also requires the 
European Securities and Markets Authority to pub-
lish information on the historical performance of 
credit rating agencies. This also facilitates investors 
to conduct their own due diligence.

72

99
It is important to note that in line with Article 23 
of Regulation 1060/2009, public authorities shall 
not interfere with the content of the rating meth-
odologies. If necessary and appropriate, additional 
guidance in accordance with Article 16 of Regula-
tion 1095/2010 by the European Securities and 
Markets Authority to credit rating agencies could 
be considered to improve the presentation of credit 
rating methodologies and allowing for a more easy 
comparison of methodologies across credit rating 
agencies.

Conclusions and recommendations

118
Regulation 1060/2009 on credit rating agencies has 
improved the transparency of credit rating agencies 
operating in the European market, subject to effec-
tive supervision by the European Securities and 
Markets Authority (ESMA). These rules have consid-
erably improved the transparency of credit ratings 
and rating methodologies and combined with the 
publication of data on the historic performance of 
credit ratings in a central repository operated by 
ESMA, users are in a much better position to con-
duct their own due diligence. Furthermore the new 
rules also aim to reduce the sole and mechanistic 
reliance of investors on external credit ratings.

HOW TO OBTAIN EU PUBLICATIONS

Free publications:

(cid:127) 

one copy: 
via EU Bookshop (http://bookshop.europa.eu);

(cid:127)   more than one copy or posters/maps: 

from the European Union’s representations (http://ec.europa.eu/represent_en.htm);  
from the delegations in non-EU countries (http://eeas.europa.eu/delegations/index_en.htm);  
by contacting the Europe Direct service (http://europa.eu/europedirect/index_en.htm) or  
calling 00 800 6 7 8 9 10 11 (freephone number from anywhere in the EU) (*).

(*) 

The information given is free, as are most calls (though some operators, phone boxes or hotels may charge you).

Priced publications:

(cid:127) 

via EU Bookshop (http://bookshop.europa.eu).

 
The 2008 financial crisis focused attention on the credit 
rating agencies and their impact on financial markets. 
At the time, there was very little regulation of the agencies 
in Europe. In 2011, the European Securities and Markets 
Authority (ESMA) was created to register, monitor and 
supervise them. This report examines whether ESMA has 
successfully established itself as the credit rating agencies 
watchdog for the EU. We conclude that while ESMA has 
laid down good foundations, its rules and guidelines 
are not yet complete and significant risks remain 
to be addressed in the future.

EUROPEAN
COURT
OF AUDITORS