New rules require ESG rating providers to separate their rating activities from other business lines through tiered organisational safeguards.
Commission Delegated Regulation (EU) 2026/872 of 21 April 2026 (the "Delegated Regulation") sets out regulatory technical standards ("RTS") specifying the measures and safeguards that ESG rating providers must implement to separate their ESG rating activities from other activities under Regulation (EU) 2024/3005 (the "ESG Ratings Regulation"). The Delegated Regulation was published in the Official Journal of the European Union on 28 July 2026.
The Delegated Regulation entered into force on 17 August 2026 and applies from 2 July 2026, in line with the application date of the ESG Ratings Regulation. It is binding in its entirety and directly applicable in all Member States.
The Delegated Regulation applies to all ESG rating providers that carry on, by way of derogation under Article 16(2) of the ESG Ratings Regulation, one or more of the activities referred to in Article 16(1), points (d) or (f), alongside their ESG rating activities. Its three substantive articles set out a tiered framework of separation measures:
Separation of rating staff
All ESG rating providers relying on the derogation must establish separate organisational structures with specific reporting lines and specific allocations of functions and responsibilities to ensure that employees directly involved in assessing a rated item are not involved in any of the listed activities. Providers must implement physical separation measures and require those employees to submit an annual self-declaration confirming their non-involvement.
Additional controls for investment, credit and insurance activities
Providers engaged in investment services and activities, credit institution activities, or insurance or reinsurance activities must implement additional safeguards. These include role-based digital access controls, information barriers with watermarking methods and data classification, policies for managing confidential information, regular training, contractual compliance obligations and compliance monitoring. The adequacy of these measures must be assessed at least once every 24 months.
Specific safeguards for benchmark providers
Providers authorised to provide benchmarks (article 16 (3) of the ESG Ratings Regulation) must, in addition to the above mentioned measures, ensure that compensation arrangements for rating staff are not affected by conflicts of interest linked to benchmark activities, that ESG ratings are produced independently of benchmark outputs, and that any actual or potential conflicts of interest are documented before the provider enters into a client contract.
The Delegated Regulation is the latest in a series of regulatory developments under the ESG Ratings Regulation that we have been closely tracking. For a comprehensive overview of all five delegated regulations adopted by the Commission - including their scope, key compliance deadlines and the transitional regime.
See our earlier article "ESG | Commission adopted final delegated RTS regulation within its broader ESG Rating regulation package".
For further background on the transposition of the ESG Ratings Regulation and the European Single Access Point (ESAP) into Luxembourg law through Draft Law No. 8567, see our article "ESAP & rating ESG | What are the implications of Draft Law 8567".
Share on
