ESG Ratings Regulation (EU) 2024/3005: Who Must Act and How

The activity of ESG rating providers operating in the European Union. Until now, sustainability ratings were produced without a specific framework for access or organization; the Regulation changes that on three levels:

• Access: authorization or registration with ESMA.
• Organization: separation of activities to avoid conflicts of interest.
• Transparency: publication of information on the methodologies used.

The underlying goal is for an ESG score to stop being a black box and become a traceable opinion, produced by someone who is identified and supervised.

The Regulation applies from July 2, 2026. Unlike other European files still under negotiation, there is no calendar uncertainty here: the date is set and it is upon us.

For providers already operating, transitional regimes are provided that allow them to regularize their status without interrupting their activity, always within the deadlines that apply to each situation. The strategic decision (which regime, with what structure) should be made before the date, not after.

As a general rule, anyone who produces and distributes ESG ratings on a professional basis in the EU. The specific route (authorization, registration or another mechanism provided for) depends on each provider’s situation under the terms of the Regulation: a house established in the Union is not the same as a provider from outside that wants to serve European clients.

The first step is always the scope analysis: determining whether what you produce is an ESG rating within the meaning of the Regulation or falls outside it (raw data, bespoke research, one-off opinions). Everything else depends on that determination.

The Regulation provides for transitional regimes so that existing providers can adapt without ceasing their activity: windows in which to report their situation and process their definitive status with ESMA within the deadlines that apply to each case.

The important nuance: transitional does not mean an extension in which to do nothing. Separation of activities, documented methodologies and internal governance take months of work; anyone who starts when the window is closing will arrive with a weak file. Our practical advice is to determine the applicable regime as soon as possible and work backward from its deadlines.

It is the organizational pillar of the Regulation: anyone who produces ESG ratings must isolate that activity from others that could compromise its independence, so that the rating is not tainted by commercial interests in the rated entities.

In practice it means reviewing the corporate and operational perimeter: which services the group provides, to whom, with what information barriers and under what conflicts policy. For small providers, the challenge is to build a proportionate separation that is credible to ESMA without duplicating the entire structure.

Providers must make public information on the methodologies they use to produce their ratings, so that users and the market can understand what each rating measures, from which sources and with what limits.

This turns the methodology into a regulatory document, not a sales argument: it must be written down, versioned and consistent with what the analysis team actually does. For users it is good news: at last they will be able to compare what lies behind two conflicting ESG scores for the same issuer.

You are not the direct addressee of the authorization requirement, but you are of its effects. Three concrete tasks:

• Verify the ESMA status of each provider whose ratings you use.
• Review ESG data contracts: regulatory status, notices of methodology changes, remedies if the provider loses its status.
• Review disclosures: the SFDR information, prospectuses and marketing that cite ratings must rely on providers whose situation you can defend.

It is the same move you have already made with other critical providers: due diligence, contract and evidence.

They are links in the same chain. The SFDR Regulation (EU) 2019/2088, currently under review, requires sustainability disclosures that in many cases are built on ESG data and ratings. And since ESMA’s 2023 guidelines, clients’ sustainability preferences are integrated into the suitability test.

The ratings Regulation strengthens the weakest link: the quality and traceability of the source data. For a firm, the combined reading is clear: what you disclose, what you recommend and the data you rely on must tell the same story.