From 29 June 2028, firms that provide ESG ratings in the UK need authorisation from the Financial Conduct Authority. The FCA published its final rules in PS26/22 on 3 November 2026. Applications open on 24 June 2027, in two windows set by each firm's projected ESG ratings revenue.
This is a new licence, not a change to an existing one. Most ESG ratings providers have never been regulated by the FCA, so the work starts with the basics: confirming the firm is in scope, choosing the legal entity that will apply, and building the governance and controls the FCA expects of any authorised firm.
The dates
| Date | What happens |
|---|---|
| 3 November 2026 | FCA publishes final rules and perimeter guidance in PS26/22 |
| 7 December 2026 | FCA webinar on the policy statement and the new regime |
| 26 January 2027 | FCA webinar on the authorisation process and pre-application support |
| February 2027 | Pre-application meetings available through the Pre-Application Support Service |
| 24 June to 29 July 2027 | First application window: firms projecting £500,000 or more of ESG ratings revenue |
| 30 July to 31 August 2027 | Second application window: all other firms |
| 29 June 2028 | The regime takes effect; providing ESG ratings without permission becomes a breach of the general prohibition |
The revenue test looks forward. The FCA asks for projected revenue from providing ESG ratings for the 12 months after the firm submits its application, not last year's figures.
What counts as an ESG rating
The Explanatory Memorandum to the ESG Ratings Order 2025 describes an ESG rating as an assessment of one or more environmental, social or governance factors, prepared using an established methodology and expressed in a defined system of rating categories, such as scores, letters or colours.
The regulated activity is providing such a rating where it is likely to influence a decision to make a specified investment, carried on by way of business. A firm provides a rating when it both produces it and makes it available. A firm that only distributes ratings produced by someone else is not intended to be caught.
The test is whether the rating is likely to be used in an investment decision, not whether the provider knows how each customer uses it. A rating sold to asset managers, asset owners or benchmark administrators will almost always meet it.
Who is in scope
| Provider | In scope? |
|---|---|
| UK provider, paid ratings to UK or overseas clients | Yes |
| UK provider, ratings given free of charge | Yes |
| Overseas provider, paid ratings reaching UK customers directly or indirectly | Yes |
| Overseas provider, ratings given free of charge to a UK customer | No |
| Firm that only redistributes another provider's ratings | Not intended to be caught |
Overseas providers need particular care. A rating that reaches a UK user through a data platform or a distributor can still bring the overseas provider into scope. Overseas groups will usually need to decide whether to apply from an existing UK entity, set up a new one, or stop offering ratings to UK customers.
The exclusions
The Order excludes ratings that are already covered elsewhere or that are not meant to influence investment decisions. In summary:
- ratings provided as part of an activity the FCA already regulates, or under another approval or recognised scheme;
- ratings that are also benchmarks under the UK Benchmarks Regulation;
- ratings used to produce, or incorporated into, a credit rating under the Credit Rating Agencies Regulation;
- ratings provided within proxy advisory services;
- ratings passed between members of the same group and not made available outside it;
- occasional or unpaid provision by charities, academics and journalists;
- accreditation and certification schemes whose purpose is not to influence investment decisions; and
- ratings produced only to meet a legal or regulatory requirement the producer is subject to.
Each exclusion has conditions. A firm relying on one should record its reasoning, product by product, against the Order and the FCA's perimeter guidance in PS26/22.
What the FCA will expect
The regime applies the FCA's baseline rules for authorised firms, plus rules written for ESG ratings providers. The approach draws on the IOSCO recommendations for ESG ratings and data providers and the ICMA Code of Conduct, which many providers already follow voluntarily.
The FCA's preparation guidance asks applicants to assess the changes they need in five areas:
| Area | What an applicant should be ready to show |
|---|---|
| Transparency | Published methodologies, the data sources used and how ratings are reviewed |
| Governance | A board and senior management structure that oversees methodology and quality |
| Systems and controls | Documented processes for producing, checking and changing ratings |
| Conflicts of interest | How the firm identifies and manages conflicts, including where it sells other services to rated companies |
| Stakeholder engagement and complaints | How rated companies can raise concerns and how complaints are handled |
Applicants must also meet the Threshold Conditions, the minimum standards every authorised firm meets on location, resources, suitability and business model. Senior managers will be approved under the Senior Managers and Certification Regime. The FCA's consultation CP26/37 on the next phase of that regime is relevant to which senior management functions an ESG ratings provider will need.
How to prepare
The FCA's own checklist for firms that are not yet authorised is a good working plan:
- Confirm whether each product is in scope, and whether any exclusion applies.
- Read the final rules in PS26/22 and carry out a gap analysis against current practice.
- Choose the legal entity that will apply.
- Assess the people, systems and costs needed for authorisation and for ongoing compliance.
- Review the Threshold Conditions and the FCA's expectations of applicants.
- Map senior management responsibilities under the Senior Managers and Certification Regime.
- Book a pre-application meeting from February 2027 if the business model raises questions of scope.
Firms that are already authorised for other activities do not make a fresh application in the same way, but they need to consider how ESG ratings affect their permissions, business model, governance, and systems and controls, and apply to vary their permission where needed.
Applications that fail usually do so for familiar reasons: incomplete business plans, policies that do not describe how the firm actually works, and senior managers who cannot explain their responsibilities. Our guide to why FCA authorisation applications fail sets these out.
What happens if a firm misses its window
The FCA states that submitting an application does not guarantee authorisation, and that a firm applying late may not receive a decision before the regime starts. The Order includes transitional arrangements: a firm that applies within its window and is still awaiting a decision on 29 June 2028 is treated as outside the regime until the FCA decides. A firm without that protection whose application is refused or withdrawn falls into a transitional regime under which it must stop new ESG ratings business once notified, with limited relief for existing contracts.
The practical message is simple. The window is the route to keep operating without interruption, and the first window closes on 29 July 2027.
How we can help
We advise ESG ratings and data providers on whether their products are in scope, prepare FCA applications and the supporting business plan, governance and controls, and support firms through pre-application meetings and the FCA's questions. For firms already authorised, we advise on permission changes. Our wider work for investment firms is set out on the investment firm authorisation page, and the wider FCA agenda for wholesale firms is in our wholesale banking compliance guide.