ABSTRACT
Credit rating agencies (CRAs) sit at the centre of modern capital markets, standing between issuers and investors and closing the information gap that would otherwise make debt pricing guesswork. The 2008 financial crisis showed what happens when that gatekeeping function goes unchecked: flawed rating methodologies, an “issuer-pays” model riddled with conflicts of interest, and regulators who had largely left CRAs to police themselves. This was followed by a spate of legislative reforms in every important market. This article discusses such reforms and examines the regulations through the lenses of the United States’ Dodd-Frank Wall Street Reform and Consumer Protection Act, 2010 and the EU’s CRA Regulation. The article considers the norms related to registration, disclosure requirements, conflict of interest and the recently created ESG Rating Provider framework in India. The article discusses the place of CRAs in the larger scheme of market intermediaries, including merchant bankers, debenture trustees, registrars to an issue, that SEBI licenses and regulates separately. The article concludes by highlighting the areas that have not been addressed by the reforms.
Keywords: Credit Rating Agencies; SEBI Regulations; Market Intermediaries; NRSRO; Dodd-Frank Act; IOSCO; Conflict of Interest; ESG Rating Providers
Introduction
Capital markets run on the assumption that investors have reliable, timely, comparable information to price risk. Credit rating agencies exist to supply it: by issuing independent opinions on the creditworthiness of issuers and debt instruments, they let investors who can’t run their own credit analysis make informed decisions anyway. Ratings do more than inform, though. Prudential norms for banks, insurers, and pension funds routinely peg capital adequacy and investment eligibility to rating categories, so a CRA’s opinion doubles as a regulatory trigger. That dual role, private information source and de facto gatekeeper, is exactly why CRA regulation matters. The 2008 crisis made the stakes concrete: structured finance products carrying top ratings suffered mass downgrades and defaults, and it became clear that leaving CRAs to police themselves had not worked. The statutory reform that followed is still unfolding, most recently through the extension of oversight to newer intermediaries such as ESG rating providers.
Credit Rating Agencies within the Market Intermediary Framework
CRAs are a particular sub-set of a bigger genus. The term ‘market intermediaries’ in India also includes merchant bankers, underwriters, debenture trustees, registrars and share transfer agents, portfolio managers, and stock brokers – all registered separately and regulated individually by SEBI under their own set of regulations formulated under the Securities and Exchange Board of India Act, 1992. The distinct characteristic of a CRA is the product that it sells – an opinion, which has nothing to do with a trade or even a custodial function; it is an opinion that drives the market and carries regulatory implications just like any other trade or custodial function. Regulation has recognized the speciality of CRAs. There are net worth criteria for CRAs, but the more important criteria have been structural independence, analytical expertise, and transparency. There are seven CRAs currently registered with SEBI – CRISIL, ICRA, CARE, India Ratings and Research, Brickwork Ratings, Acuéité Ratings, and Infomerics Valuation and Rating, which is quite a small number reflective of the oligopoly in the industry internationally.
International Standards: The IOSCO Code of Conduct
The majority of the international standards applicable to CRAs have been developed by the International Organization of Securities Commissions (IOSCO), as contained in its Code of Conduct Fundamentals for Credit Rating Agencies, which was first published in 2004 and amended thereafter, especially after 2008. The code is guided by the following four main principles: integrity of the rating process, independence of the CRAs, disclosure and transparency, and confidentiality of the non-public information. Although the Code is not mandatory, it is mandatory for CRAs registered with Indian SEBI, US SEC, and European ESMA to follow the Codes of Conduct which are in line with this Code.
The United States: From the 2006 Reform Act to Dodd-Frank
To be recognized by the regulators in the United States, CRAs have to register with the SEC as Nationally Recognized Statistical Rating Organizations (NRSROs) under Section 15E of the Securities Exchange Act of 1934 through the Credit Rating Agency Reform Act of 2006. The act embodied a philosophy of “registration, not regulation,” under which the SEC would govern governance, record-keeping and conflict-of-interest rules but not methodology. It became obvious how ineffective such hands-off approach was during the crisis, prompting Congress to enact Subtitle C of Title IX of the Dodd-Frank Wall Street Reform and Consumer Protection Act, 2010. Under Dodd-Frank, an Office of Credit Ratings would be established within the SEC; internal control procedures would be tightened, rating performance statistics and rating assumptions would be required to be disclosed, look-back requirements instituted if the analyst subsequently joined the rated entity, and issuers/underwriters of asset-backed securities would have to disclose third-party due diligence reports. In August 2014, the SEC completed implementation of Dodd-Frank by issuing regulations in response to fourteen Dodd-Frank provisions – including internal controls, conflicts of interest and analyst training standards – calling it a way to prevent another crisis.
The European Union: The CRA Regulation and ESMA Oversight
The European Union charted its own course in this regard, through Regulation (EC) No 1060/2009 on Credit Rating Agencies, further enhanced by CRA II (2011) and CRA III (2013). ESMA directly oversees CRAs in the Union, marking a departure from the earlier approach of relying on an ad hoc collection of national regulators. There are three main differences between the US and Indian approaches and those adopted by the EU. First, there is mandatory rotation of CRAs in respect of certain structured finance products. Second, the shareholders of a CRA may not sit on the board of directors of any entity rated by that CRA. Third, and most importantly, the Regulation provides for direct civil liability.
India: The SEBI (Credit Rating Agencies) Regulations, 1999
The credit rating agencies of India are governed by the SEBI (Credit Rating Agencies) Regulations, 1999 which have been formulated under the SEBI Act, 1992 and are currently applicable from July 2024. A CRA refers to any body corporate engaged in the process of rating securities that are already listed or are intended to be listed in a recognized stock exchange. The registration procedure is not an automatic process. The entity must be incorporated as per the provisions of the Companies Act, 2013; must meet the “fit and proper person” test as set out by SEBI; must possess a net worth of not less than 25 crores; and has appropriate infrastructure and staffing. All of this is underlain by the Code of Conduct, which mandates independent professional judgement, diligence and disclosure of conflicts of interest. Other changes included in the 2018 amendment were that net worth should increase progressively, promoters should maintain a minimum twenty-six per cent interest for three years post-registration, change of control will require prior SEBI approval, and CRA can seek to withdraw its registration. With respect to disclosures, SEBI has mandated that all press releases include standard “rating sensitivity factors,” while CRAs have to disclose probability-of-default benchmarks for one, two, and three years cumulative default rate so that an investor can compare the past performance of a CRA in comparison to their own criteria. In case an issuer is unwilling to cooperate with the CRA in the process of reviewing an existing rating, the said rating will be denoted as “ISSUER NOT COOPERATING” – which is a simple system, but it prevents dissemination of obsolete ratings. The most recent expansion of the scope of regulations happened in 2023, wherein SEBI has included ESG Rating Providers (ERPs) in the regulatory framework of registration, where net worth, infrastructure, and conflict of interest criteria are mostly based on CRA framework.
Other Market Intermediaries under SEBI’s Regulatory Umbrella
The regulation of CRA is just one part of a larger SEBI framework. The merchant banker manages the public issue and is liable for conducting due diligence in the offer document. The debenture trustee protects the debenture holder and oversees the security cover. The registrar and share transfer agent maintains the records of allotment and transfer. Though each has its own capital adequacy requirement, code of conduct, and inspection framework, the common goal of all remains the same as that of CRA regulation, which is to reduce the informational asymmetry.
Persisting Challenges and the Way Forward
Two decades of reform have not resolved everything. The issuer-pays model is still standard, and it still gives CRAs a built-in incentive to go easy on the entities paying them — regulators have chosen to manage that through disclosure rather than remove it. Rating shopping is harder still: an issuer quietly solicits preliminary views from several CRAs and engages only the one offering the best number, and there is no reliable way to catch this after the fact. The industry’s concentrated structure, in India and abroad, keeps entry barriers high and competition thin. Bringing ESG rating providers under SEBI’s wing shows regulators are watching for new categories of influence over capital flows, but international standards for ESG ratings are still being worked out, and SEBI, the SEC, and ESMA don’t yet move in step on methodology disclosure or cross-border recognition. Closing that gap is the more obvious next step
Conclusion
CRAs and market intermediaries do a job capital markets cannot do without, and the regulatory histories traced above amount to the same conclusion reached independently in Washington, Brussels, and Mumbai: that job cannot be left to unsupervised private ordering. SEBI’s 1999 Regulations, now extended to ESG rating providers, show a regime that has grown up; closer to international practice, but still shaped by India’s own market. What’s left is less about writing new rules than enforcing the ones already on the books, and watching for the next category of intermediary whose opinion turns out to matter more than anyone planned.
“PRIME LEGAL is a National Award-winning law firm with over two decades of experience across diverse legal sectors. We are dedicated to setting the standard for legal excellence in civil, criminal, and family law.”
WRITTEN BY: KHWAISH SACHDEVA
