FCA ESG Ratings Regime: What PS26/22 Means for Rating Providers

From 29 June 2028, firms providing ESG ratings in the UK will need Financial Conduct Authority (FCA) authorisation unless an exclusion applies. The FCA confirmed the final FCA ESG ratings regime in Policy Statement PS26/22, published on 3 November 2026. The authorisation gateway opens on 24 June 2027, and larger providers must apply within its first month. After go-live, carrying on ESG ratings activity without authorisation will breach the general prohibition under the Financial Services and Markets Act 2000 (FSMA) and will be a criminal offence.

PS26/22 follows HM Treasury legislation bringing ESG ratings into the regulatory perimeter and the FCA's consultation in CP25/34, published in December 2025, which received 90 responses. The FCA has kept most of its proposals, making its main changes to the transparency and stakeholder engagement requirements to improve clarity and proportionality. The regime matters most to ESG rating providers, many of which will be regulated for the first time, but it is also relevant to asset managers, asset owners and other firms that use ESG ratings, and to the companies being rated.

Who Needs FCA Authorisation for ESG Ratings?

The new regulated activity is set out in the Financial Services and Markets Act 2000 (Regulated Activities) (ESG Ratings) Order 2025. Alongside the final rules, the FCA has revised its Perimeter Guidance (PERG) to help firms decide whether their products are in scope. PERG sets out the FCA's view of the legislation and is not legally binding, but it should be the starting point for any scoping exercise.

The revised guidance adds examples on when a provider could "reasonably expect" a rating to be "likely to influence" an investment decision, how to distinguish in-scope ESG ratings from ESG data products, and how certain exclusions apply, including those for private use and for ratings produced in the course of another regulated activity. That second exclusion does not apply where the rating is provided as a standalone product or service. The FCA accepts that the guidance cannot address every scenario and has said that firms can discuss their particular circumstances during the pre-application process.

Key Requirements Under the Final Rules

The final regime combines existing FCA Handbook standards with tailored rules in chapter 6 of the ESG sourcebook (ESG 6). The FCA describes its approach as principles-based and supportive of methodological diversity: it does not prescribe how providers should assess ESG factors. The requirements fall into seven areas:

1. baseline FCA standards;

2. transparency and disclosure;

3. governance, UK presence and outsourcing;

4. systems, controls and record keeping;

5. conflicts of interest and personal transactions;

6. stakeholder engagement and complaints; and

7. the Senior Managers and Certification Regime (SM&CR).

   
   

Baseline FCA Standards, Without the Consumer Duty

Providers will be subject to the Threshold Conditions, the Principles for Businesses (PRIN), relevant parts of SYSC, the General Provisions (GEN) and the financial crime provisions in SYSC 6 and the Financial Crime Guide. The outsourcing requirement in SYSC 8.1.1R applies as a rule rather than guidance, and providers will not be able to treat clients as eligible counterparties for PRIN purposes. There are no bespoke prudential requirements.

The Consumer Duty will not apply, which the FCA considers proportionate given the wholesale nature of the market. Disclosures must nonetheless be clear and easy to understand for their intended audience, which may include firms in the distribution chain that are themselves subject to the Duty. Complaints about ESG ratings will not fall within the Financial Ombudsman Service's jurisdiction, and there will be no Financial Services Compensation Scheme (FSCS) cover.

Transparency and Disclosure

The FCA has confirmed a tiered framework. Public disclosures cover matters such as methodology, objectives, coverage, data approach, limitations and engagement approach. Direct users receive more detailed product-level information, and individual rating-level detail where applicable. Rated entities that are not users can obtain the same detailed disclosures on request rather than by default, and providers must make clear how to request them.

Several changes since consultation reduce the operational burden. Rating-level information can be given at product level where it applies across a whole product, and does not need a separate document if it already sits within reports, scorecards, data feeds or platforms. Only data that materially influences a rating needs to be disclosed, not all underlying data. The FCA has also added public disclosures on data quality and verification, the use of estimates, review frequency, methodology versioning and the factors used to judge whether a methodology change is material.

Providers will not have to publish precise weightings or training data, and the trade secrets exemption has been retained. Firms no longer need to explain why information is a trade secret, but must make clear what has been withheld on that basis.

Governance, UK Presence and Outsourcing

The authorised firm must retain responsibility for the ESG ratings it provides in the UK and must be able to require changes to any part of the ratings process, including where functions sit elsewhere in a group. The FCA has confirmed that a "UK presence" does not mean locating every function or senior individual in the UK.

Firms need sufficient senior management presence, oversight capability and access to information, proportionate to their size and complexity.

For overseas providers, the FCA will assess structures in line with its Approach to International Firms. It has said that many overseas firms are likely to find a UK-incorporated subsidiary the clearest way to demonstrate accountability, particularly where differences between regulatory regimes limit the suitability of a branch. Outsourcing, including to providers outside the group, remains possible, subject to SYSC 8 and the specific limits in ESG 6 on what cannot be outsourced.

Systems, Controls and Record Keeping

Methodologies must be applied consistently within a product line, although this does not stop AI-driven models from being updated frequently. Providers must take reasonable steps to use accurate and up-to-date information. The FCA accepts the use of proxy data where a robust, documented approach is followed, and has confirmed that real-time updating is not required.

The record-keeping rule has been narrowed. Providers must keep records that allow them to explain and evidence how a rating was produced and how the outcome was determined, rather than records sufficient to reproduce it. No fixed retention period has been set, but firms should consider the SYSC 9 guidance and the three-year complaints window. Users must receive advance notice of material methodology changes; rated entities need not, although public notice is required where a rating is freely accessible.

Conflicts of Interest and Personal Transactions

Providers must identify, prevent and manage conflicts of interest, with public disclosure as a last resort where they cannot be reasonably confident that the risk to a rating's integrity or independence has been prevented. The FCA has published good and poor practice examples covering providers that also offer consultancy services, subsidiaries of larger groups and issuer-pays models. These are illustrative and are not a checklist.

On personal transactions, the FCA has moved away from applying COBS 11.7. Instead, providers need a policy and arrangements to prevent certain personal transactions. Active monitoring of employee trading is not mandatory, but firms are expected to assess whether it is an appropriate control for their business.

Stakeholder Engagement and Complaints

Providers must notify reasonably identifiable rated entities before a rating is made available for the first time, with a minimum notice period of two business days. The FCA has said it does not expect two days to be enough in every case. Publication does not need to wait for the rated entity's feedback, and the rule does not apply retrospectively to ratings already available before go-live.

Rated entities can request the data underlying their rating at any time and offer corrections of factual errors. Complaints can come from any stakeholder and can be raised within three years, but the FCA is clear that the complaints process is not a right of appeal against methodologies or analytical judgements.

SM&CR for ESG Rating Providers

Providers will be Core firms under the SM&CR, subject to the Senior Managers Regime (excluding SMF17), the Conduct Rules, fitness and propriety requirements and, where relevant, the Certification Regime. The FCA expects few, if any, staff to perform Certification Functions. It has declined to delay implementation pending its wider SM&CR review and expects providers to comply from go-live, with further information to follow as those reforms progress.

How Does the ESG Ratings Authorisation Gateway Work?

Applications are staggered according to expected UK revenue from ESG ratings activity. A "larger firm" is one that reasonably expects to generate £500,000 or more in annual UK ESG ratings revenue in the 12 months after submitting its application. The key dates are:

• February 2027: the FCA's Pre-Application Support Service (PASS) becomes available;

• 24 June 2027: the authorisation gateway opens;

• end of July 2027: deadline for larger firms to apply;

• end of August 2027: deadline for all other firms to apply; and

• 29 June 2028: the regime goes live.

The timing has real consequences. Under the legislation, firms that do not apply within their window, withdraw their application or are refused will not be able to take on new business once the regime goes live and will need to wind down. Firms that apply on time but have not received a decision by 29 June 2028 can continue as normal, including taking on new business, until the FCA determines their application.

During the gateway, firms below the £500,000 threshold will pay the Category 4 application fee (currently £2,820) and larger firms the Category 6 fee (currently £11,260). The threshold was raised from £250,000 following consultation. Annual fees will be covered in the FCA's forthcoming fees and levies consultation. Once authorised, providers will be supervised under SUP and will receive mandatory regulatory information requests from go-live, ahead of formal Handbook reporting rules. The FCA's Enforcement Guide and the Decision Procedure and Penalties manual (DEPP) will also apply.

What the Regime Means for Firms Already Regulated by the FCA

ESG ratings produced in the course of another regulated activity generally fall outside the new regime, but the FCA has not closed the door. It plans a targeted desk-based review of asset managers' practices when producing proprietary ESG ratings for use in fund marketing materials. It is also engaging with designated professional bodies about investment consultants that provide ESG ratings, will monitor investment research for emerging harms, and is taking no further action on benchmark administrators while HM Treasury's benchmarks reform continues.

Firms that use ESG ratings should benefit from better information on methodologies, limitations and conflicts. The FCA has been clear, however, that this makes due diligence on third-party ratings more efficient rather than unnecessary.

Key Themes

Three messages run through the policy statement. First, proportionality is built into the rules rather than offered as an exemption: smaller and specialist providers will not be expected to replicate the arrangements of global firms, but every applicant must meet the Threshold Conditions. Second, accountability must be visible in the UK, whatever the group structure. Third, the FCA recognises that many providers are new to regulation and will offer support through PASS and webinars, but has said that serious failings will be met with the same enforcement approach applied to other firms.

The regime has also been designed to align with the IOSCO recommendations and the EU framework, including the two-day notification minimum. Providers already preparing for the EU regime should be able to reuse some of that work, although the FCA's rules on UK accountability, SM&CR and complaints will need separate attention.

What Should Firms Do Now

The gateway is about seven months away and the first application window closes just over five weeks after it opens. The right starting point depends on whether a firm is a provider, a user or an already-regulated firm that produces its own ratings.

For ESG rating providers, sensible next steps include:

• assessing each product against PERG and documenting the conclusion, particularly for data products and tools close to the boundary;

• forecasting UK ESG ratings revenue to establish which application window applies;

• conducting a gap analysis against the final rules, focusing on disclosures, methodology governance, record keeping and conflicts;

• deciding on the UK legal and governance structure and how the UK entity will oversee group or outsourced functions;

• identifying Senior Managers and preparing Statements of Responsibilities and fitness and propriety assessments;

• drafting or updating policies on conflicts, personal transactions, rated entity notification and complaints; and

• planning engagement with PASS from February 2027 and registering for the FCA's webinars on 7 December 2026 and 26 January 2027.

For many providers, the most demanding parts of the application are likely to be demonstrating genuine UK oversight of group functions and evidencing a complete conflicts framework, rather than the disclosure requirements themselves.

Asset managers that produce proprietary ESG ratings for fund marketing materials should check that the basis for those ratings is documented and that marketing materials describe them fairly and clearly, ahead of the FCA's desk-based review. A proportionate review of existing arrangements will usually be sufficient.

Frequently Asked Questions

When does the FCA ESG ratings regime come into force?

The regime goes live on 29 June 2028. From that date, firms providing ESG ratings in the UK need FCA authorisation unless an exclusion applies. The FCA's authorisation gateway opens on 24 June 2027.

Who must apply for authorisation, and by when?

ESG rating providers within scope of the ESG Ratings Order must apply during the gateway. Firms expecting £500,000 or more in UK ESG ratings revenue in the 12 months after applying must apply by the end of July 2027; all other firms must apply by the end of August 2027.

Does the Consumer Duty apply to ESG rating providers?

No. The FCA has decided not to apply the Consumer Duty because the ESG ratings market is predominantly wholesale. Providers must still make disclosures clear and easy to understand for their intended audience.

Can an overseas ESG rating provider operate through a UK branch?

Possibly. The FCA will assess each structure under its Approach to International Firms, but it has said that many overseas firms are likely to find a UK-incorporated subsidiary the clearest way to demonstrate accountability and support effective supervision.

What happens if a provider misses its application window?

Under the legislation, a provider that does not apply within its window, withdraws its application or is refused cannot take on new business once the regime goes live and will need to wind down its ESG ratings business.

How Compliance Angle Can Help

Compliance Angle supports firms seeking FCA authorisation and firms adapting to new regulatory requirements. For ESG rating providers and investment firms affected by PS26/22, our support includes:

• FCA authorisation and application support including scoping, business plans and preparation for PASS meetings;

• regulatory gap analyses against the final ESG ratings rules;

• governance and SM&CR support, including Statements of Responsibilities and UK oversight arrangements;

• conflicts of interest, personal transactions and complaints policies and procedures;

• compliance monitoring frameworks and ongoing compliance support for newly authorised firms; and

• reviews of fund marketing materials that refer to proprietary ESG ratings.

Our support is practical and proportionate, tailored to each firm's business model, permissions, size and regulatory risk. Our earlier article on improving FCA applications for authorisation sets out common weaknesses in applications. If you would like to discuss how the regime applies to your firm, please contact us at info@complianceangle.co.uk.

Source: Financial Conduct Authority, PS26/22: ESG (Environmental, Social, Governance) ratings: Final regime, published 3 November 2026.