Authorization as an ESG ratings provider in the EU: key requirements to operate legally

Key data

Companies that issue sustainability ratings—the so-called ESG or ASG ratings—can no longer operate in the EU without express authorization from ESMA (European Securities and Markets Authority). Delegated Regulation (EU) 2026/1119, published on 1 September 2026, specifies precisely what information must be included in the authorization application, thus developing Regulation (EU) 2024/3005 which created the regulatory framework for this sector.

This regulation has direct consequences for sustainable investment funds, banks and large corporations that use these ratings to make decisions: if their ESG ratings provider is not authorized, the data they receive lacks regulatory support in the EU.

What does this regulation establish?

Delegated Regulation 2026/1119 specifies the exact content that must be included in every authorization application submitted to ESMA. This is a regulatory technical standard (RTS) that converts what Regulation (EU) 2024/3005 established in general terms into concrete and verifiable requirements.

The information blocks that every ASG ratings provider must demonstrate to ESMA are as follows:

Additionally, the regulation governs the recognition of third-country providers wishing to operate in the European market. These must submit a recognition application with equivalent requirements, demonstrating that their home country regulatory framework offers guarantees comparable to those required in the EU.

Economic and operational impact

The impact of this regulation is not merely bureaucratic: it directly affects the viability of any ESG ratings provider business in Europe.

• Without ESMA authorization, the activity cannot be exercised. Non-compliance does not generate a fine: it directly prevents operating in the European market.
• Cost of preparing the application: Documenting methodologies, conflict of interest policies, human and technical resources, and governance models involves a significant internal audit process, with associated legal and consulting costs.
• Impact on the value chain: Funds, banks and large companies using ratings from unauthorized providers are exposed to regulatory risk. This will pressure buyers of these services to verify the authorization status of their providers.
• International providers: ESG rating agencies based outside the EU (USA, UK, Asia) that want to maintain European clients will need to obtain formal recognition from ESMA, which may involve operational restructuring or opening subsidiaries in the EU.

Who does it affect?

• ESG/ASG rating agencies established in the EU that issue sustainability ratings to European clients.
• ESG ratings providers from third countries (outside the EU) that operate or wish to operate in the European market.
• Sustainable investment funds that contract ESG rating services: they must verify that their providers are authorized.
• Banks and financial entities that use ASG ratings in their risk analysis or sustainable finance compliance processes.
• Large and listed companies that use ESG ratings for their sustainability reports or to access green financing.
• Sustainability advisors and consultants that offer rating services as part of their activity.

Practical example

An ESG rating agency based in London that currently provides services to Spanish and German fund managers needs, following the entry into force of this regulation, to obtain formal recognition from ESMA as a third-country provider.

To do so, it will need to prepare and submit to ESMA a file that includes: its complete organizational structure, a detailed description of its ASG rating methodologies, its conflict of interest management policies, the qualifications of its analyst team, the technical infrastructure employed and its internal governance models. If it does not obtain that recognition, its European clients—funds, banks, companies—will not be able to legally use its ratings in the EU regulatory context, which in practice means the loss of those contracts.

Similarly, a Spanish startup that has developed an ESG scoring tool for SMEs and wants to commercialize it in the European market will need to request authorization from ESMA before issuing ratings with regulatory effects, demonstrating all the requirement blocks described in Regulation 2026/1119.

What should companies do now?

1. Identify if your activity requires authorization: If you issue, publish or commercialize sustainability ratings (ESG/ASG) aimed at clients in the EU, you need ESMA authorization or recognition.
2. Review Regulation (EU) 2024/3005: This is the base regulation that creates the authorization regime. Delegated Regulation 2026/1119 develops it with the specific technical requirements of the application.
3. Audit your internal documentation: Verify that you have documented your rating methodologies, conflict of interest policies, organizational structure, human and technical resources, and governance models. These are the six required blocks.
4. Prepare the application file for ESMA: Gather all required documentation following the technical requirements of Regulation 2026/1119. Consider support from legal specialists in European financial regulation.
5. If you are a buyer of ESG ratings: Verify that your current providers have initiated the authorization or recognition process with ESMA. An unauthorized provider exposes you to regulatory risk.
6. Third-country providers: Evaluate whether it is necessary to establish an entity in the EU or if the regulatory framework of the country of origin can be covered by the equivalent recognition procedure.

Official source

Consult complete regulation in official source (EUR-Lex, CELEX:32026R1119)

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026R1119