ESMA Updates its Guidelines on Internal Controls for Credit Rating Agencies

Since January 2019, the European Securities and Markets Authority (ESMA) has been conducting a public consultation on the issue of internal controls within credit rating agencies operating within the jurisdiction. Based on observations between 2017 and 2018 that identified a number of shortcomings in this area of the CRAs practices, ESMA has been working at providing clear guidelines to help the industry move forward. Today, that report was released.

 

Based on the CRA Regulation (CRAR), ESMA are required to ensure that regulations are developed and implemented relating to the internal control systems of the CRAs, which they must have in place ‘in order to prevent or mitigate any possible conflicts of interest and ensure the integrity of its credit rating activities’. As we know, this is a common, but no less important objective of rating agency regulators, and it is interesting to note that, more than a decade after the Financial Crisis, regulators are still attempting to provide some sort of standard within CRAs. However, ESMA makes clear that the common consensus is that many of the CRAs are already implementing many of the standards that the report advances, and then some. The amendments made by the report will be applied from the 1^st July 2021, owing to disruption from the COVID-19 pandemic (it was originally planned for October 2020). There are number of key elements, and what follows is a collection of stand-out elements from the public consultation and subsequent amendments by ESMA.

 

Initially, the report starts by making clear that there were concerns raised regarding how prescriptive the originally planned guideline amendments were. This is to be expected, of course, and is why ESMA has a public consultation process. Also, predictably, smaller CRAs have been requested more clarity on how the guidelines affect their practices, owing to the lesser capability they have to conform (maybe owing to resources, or just a different operating structure from the larger CRAs). One of the largest issues raised was clarification that was needed regarding the understanding of the Board and Management within a CRA. Respondents worried that the two were not made clear enough by ESMA, and clear separation was needed within the wording. ESMA duly responded, declaring that, under the new wording, ‘it is the role of the CRA’s management to develop and implement the internal control framework, while it is the role of the board to approve the components of the framework and oversee their implementation’. Moving forward to how the CRAs should manage the risks that could affect their ability to meet the obligations under CRAR, ESMA have ‘removed reference to the requirement for it to take into account international standards and industry-leading practices as this could indirectly introduce standards or practices not approved by ESMA into the Guidelines’. ESMA declares later in the report that the inclusion of international standards in the field of elements like internal audits can also cause issues, and has subsequently removed any reference to a standard; the regulator will continue to monitor the appropriateness of such activities via its inspections and overarching supervision.

 

One of the most important aspects of post-Crisis regulation in the credit rating sector has been enforcing and maintaining the separation between analysts and commercial employees, and also separation between those tasked with developing methodologies, and those who are tasked with approving them. To that end, ESMA declares that ‘the goal of ESMA has been to ensure that staff members who conduct the analytical work of a credit rating should not be solely responsible for the approval of that credit rating. Likewise, staff members who conduct the development of methodologies, models or criteria should not be solely responsible for the approval of those methodologies, and staff members who conduct the validation or review of a credit rating methodology should not be solely responsible for the approval of that validation or review’. This is particularly clear and should, in theory, be easy to identify when breaches occur just by analysing the documentation that must be kept during said processes. In line with this, ESMA had originally pushed for the ‘real time monitoring’ of credit rating activities, which was argued against by respondents who suggested it is more efficient to conduct such monitoring on an ex-post basis. Whilst maintaining that compliance should have a role in the monitoring of credit rating activities, ESMA have relented and declared that ‘ESMA has removed reference to the real-time element of the monitoring requirement. The revised wording now that states that CRAs should instead build ongoing evaluations into their processes, which can include, for example, the timely monitoring of e-mail interactions between analysts and issuers. This could also be done on an ex-post basis’. Similar calls to enforce the ‘participation’ of compliance officers in rating committees were watered down to now emphasising ‘attendance rather than participation’. With further regard to the compliance function, clarification was sought by respondents concerning who could fulfil such roles (in the event that others outside of the compliance function were better suited). On this, ESMA maintained its course and clarified that compliance officers must be involved, although they can (and should) work with others to aid them with the delivery of their role.

 

Enforcing the separation between analysts and the development of methodologies is of key regulatory concern. To that end, ESMA stated that ‘the revised wording states that while analytical staff may participate in the approval of methodologies by the review function, they should not participate in the approval of methodologies developed themselves’. Furthermore, staff who participate in the review of a methodology cannot alone be involved in the approval process and/or be responsible for the final decision.

 

The amended guidelines are, for the most part, appropriate. There are elements of retreat since the public consultation but, for better or worse, that is part of the regulatory process. What remains to be seen is whether the updated guidelines have any effect. Many CRAs already meet these standards and go much further. For the smaller CRAs, there will need to be consideration. However, they do allow for ESMA to be clear in their regulatory actions moving forward, because there is plenty of clarity contained in this update; fall foul of clear instruction and the subsequent penalty (should be) awarded. Overall however, it is so interesting to note that such developments are still being undertaken, so long after the Financial Crisis. It is potentially remarkable that, elements such as those who develop methodologies cannot alone be responsible for their authorisation, are still needing to be clarified; it should be clear immediately that layers of responsibility are fundamentally required. Time will tell how these amendments fare.

 

Keywords – ESMA, Internal controls, business, @finregmatters