Credit rating agencies multi-firm review: Insights into surveillance, methodologies and internal controls

Multi-firm reviews Published: 15/05/2026 Last updated: 15/05/2026

This multi-firm review focuses on the surveillance processes, credit rating methodologies and internal controls for UK-registered credit rating agencies (CRAs).

1. Summary

Surveillance of existing ratings is a key regulatory priority for CRAs. In line with our 2024 portfolio letter and 2026 Regulatory Priorities report, we expect CRAs to ensure the quality of credit ratings on an ongoing basis through an effective surveillance process.

Any weaknesses or biases in methodologies or their application may impair the ratings’ integrity, making them less reliable as independent indicators of creditworthiness.

Our findings are based on a sample of firms and involved:

  • analysis of scoped information provided by CRAs including rating and control review files 
  • analysis of internal procedures of CRAs
  • engagement with analytical and control functions of CRAs
  • review of regulatory notifications, and  
  • ongoing supervisory work

Our aim is to reinforce existing regulatory expectations rather than introduce new ones, highlighting good practices and areas for improvement. 

2. Who this applies to

These findings apply to UK-registered CRAs. They may also be relevant to those who use credit ratings or engage with CRAs such as issuers, investors, intermediaries, trade associations and regulatory bodies.

3. What firms need to do

UK-registered CRAs should review these findings, evaluate their processes and controls under Board oversight, and consider if gap analysis and remediation are necessary. 

4. Why we did this work

Assigning a rating is only the starting point. CRAs must demonstrate sustained analytical quality and oversight after the initial rating assignment. Weaknesses in surveillance, methodologies or internal controls increase the risk that ratings may not reflect credit conditions in a timely manner, leading to incorrect or unexpected rating actions, undermining market confidence.

Through this review, we aimed to understand how CRAs maintain robust arrangements for ratings surveillance, consistent application and ongoing review of methodologies, and effective internal controls under the UK Credit Rating Agencies Regulation (UK CRAR).

Specifically:

  • Article 8(5) requires ongoing monitoring of ratings, including the impact of changes in macroeconomic and financial market conditions, with annual reviews representing the minimum regulatory standard when there are no earlier indications of material changes that could have an impact on a credit rating.
  • Article 8(3) requires methodologies to be rigorous, systematic, continuous and subject to validation based on historical experience, including back-testing. 
  • Article 6(4) and Annex I require governance, documentation, resourcing and three lines of defence controls to ensure ratings remain high quality and independent throughout their lifecycle.

We expect CRAs to maintain comprehensive internal records and disclose adequate rationales for rating actions, including environmental, social, and governance (ESG) factors. 

This review also touches on considerations relating to transparency and disclosure of ESG factors in methodologies, covered in the annex at the end.

Given technological developments in CRAs, the use of AI and models can enhance surveillance through earlier risk detection and improved consistency, if accompanied by effective governance to manage risks, biases and ensure analytical challenge. 

5. Surveillance: What we found

Surveillance consists of ongoing monitoring and an annual review of the rating. CRAs have a continuous obligation to maintain the quality and independence of ratings over time, and the annual review is the minimum regulatory requirement. To ensure that the annual review is a robust and meaningful component of the surveillance process, the governance, resourcing and controls for the annual review are expected to be at least equivalent to those for new ratings.

5.1. Purpose: Governance of surveillance process

Surveillance ensures that ratings reflect all available and relevant information, including changes in macroeconomic and financial conditions. Therefore, CRAs must ensure effective governance of the ongoing monitoring and annual review of all ratings (six-monthly for sovereigns).

5.2. People: Capability, capacity and roles of people responsible for surveillance

Surveillance analysts and approvers involved in the annual review are expected to have the equivalent seniority and experience as those responsible for the initial rating. All staff participating in the ongoing monitoring process are expected to be subject to robust independence safeguards to prevent conflicts of interest. The surveillance analyst should engage appropriately with rated entities, to ensure any material developments are considered.

5.3. Process: How the surveillance process works

The surveillance process must include ongoing monitoring with a well-documented annual review and transparent disclosure of rating actions. Annual reviews are expected to consider all relevant and available information, changes in assumptions, and the application of all aspects required by the methodology, including models and criteria. Controls for annual reviews of ratings are expected to be as strong as those used for initial ratings, and documented adequately to ensure quality and independent ratings.

CRAs must promptly notify us when they identify any error in a rating methodology or its application, regardless of a rating change. CRAs should have robust and transparent error identification processes, conduct root cause analysis with remediation plans, and ensure that Board oversight of the scope of errors is not limited.

6. Credit rating methodologies and their application: What we found 

Methodologies are fundamental to the assignment of credit ratings. Methodologies are inclusive of all their components such as models, key rating assumptions and criteria. Given the inherent risk of conflicts of interest in the CRA business model, good governance of methodology development, review and approval is critical. 

CRAs should mitigate the risk of commercial influence through effective conflicts of interest controls. There should be clear separation between commercial and analytical functions, independent oversight, and defined accountability in the methodology process. Further, methodologies must be applied consistently to both initial ratings and subsequent rating actions.

6.1. Purpose: Governance of methodology process and application

Methodologies provide a structured framework within which analytical judgement is applied, with sufficient detail to support consistent rating outcomes across analysts and rating committees. 

Analysts are expected to apply methodologies systematically, clearly justifying, documenting and disclosing any exceptions or divergences. 

To ensure methodologies remain independent and reflective of current and evolving risk factors, they should be subject to ongoing monitoring and reviewed annually by the independent review function (IRF). Firms should regularly report review findings and outcomes to their Board.

6.2. People: Capability, capacity and roles of people involved in methodologies process and application

INEDs are expected to independently monitor the development of credit rating methodologies, the effective management of conflicts of interest and the operation of the review function. Development and review functions are expected to be staffed with appropriately skilled personnel, including expertise in required areas (such as modelling, back-testing) and clearly segregated from commercial activities to prevent conflicts of interest.

6.3. Process: How the methodology process and application controls work

The IRF should independently validate and review credit rating methodologies, models and key rating assumptions, and play a central role in their approval. The development and review processes should reinforce independence and effective challenge. Methodologies need to be applied systematically and any objective reasons to vary from them should be appropriately documented and reviewed. 

7. Internal controls and oversight of the rating committee, surveillance process and methodologies: What we found

Second and third line controls should independently evaluate the adequacy and effectiveness of first line controls and processes to provide assurance on transparency and quality of ratings as well as effective mitigation of any conflicts of interest. Further, given that each CRA’s business differs in nature, scale and complexity, we expect internal controls to be proportionate and effectively resourced to independently deliver robust oversight and quality assurance.

7.1. Compliance

In the context of this MFW, the compliance function is responsible for independently monitoring adherence to regulatory obligations relating to the ratings and surveillance process, and methodologies and models.

It should identify and assess risks of non-compliance and provide guidance to analytical staff. Compliance should be independent, sufficiently resourced and skilled, with the ability to escalate issues to the Board. Compliance should ensure that errors and breaches for all ratings relevant to the UK (issued and endorsed) are notified to us.

7.2. Review

The second line review function or IRF is expected to operate as an independent, technically proficient control layer. It validates and reviews all credit rating methodologies, models and key rating assumptions on an ongoing basis and at least annually. IRF needs to be fully separate from the firm’s analytical and commercial activities, with independent reporting from the first line.

7.3. Risk management

Risk management should identify, assess and monitor risks relevant to the obligations under the UK CRAR, including those affecting the quality, continuity, and independence of rating and surveillance activities. Risk management should ensure that such risks are properly reported by the relevant functions. Risk management should escalate emerging risks to the Board, including those that could impair quality and independence of new and existing ratings.

7.4. Internal audit

Internal audit should provide independent and objective assurance on the effective operations and controls for the rating process and methodologies. 

We expect the audit function to issue recommendations to management and formally track remediation for any deficiencies in rating committee processes, annual review, and first and second line controls. Audit should provide regular reports to the INEDs or audit committee of the Board.

8. Next steps

Firms should reflect on how these findings apply to their business and consider adopting relevant examples of good practice as well as addressing any areas for improvement. 

We will continue to engage with the firms and may undertake spot checks which may include targeted reviews of rating actions, methodologies, or internal control outputs.


9. Annex: ESG factors in credit rating methodologies and surveillance

We expect CRAs to be transparent in how they consider ESG factors and disclose them in their methodologies and rating actions. 

  • Transparency of methodologies: We observed variations in how firms considered ESG factors in their published methodologies. Firms should be clear in the purpose of their published materials and articulate whether a methodology addresses ESG factors as analytical inputs or explanatory outputs. This would support transparency for users and align with firms’ disclosure obligations.
  • Consistency of ESG factors: From reviewing files and discussing with firms, we identified inconsistency in how they were classifying and documenting ESG factors. For some CRAs, governance factors were sometimes treated as ESG factors, and at other times considered within broader credit risk analysis. Such inconsistency could reduce clarity for users of credit ratings when reviewing published rating action rationales.
  • Application of ESG factors: Firms differed in how they were applying ESG factors during surveillance. A small number of firms’ methodologies included criteria for when to treat ESG factors as credit relevant, but others told us they relied more heavily on analytical judgement. To ensure consistent application, firms should consider how ESG factors are incorporated in their frameworks. 
  • Consideration of ESG factors: Most firms could describe at what stage ESG factors were considered within their surveillance process, for example before or during a rating committee. For some CRAs, we observed that internal documentation lacked clarity on the impact and materiality of environmental and social factors in determining a rating action. This may limit transparency for users in rating action rationales, where a specific ESG factor may be credit relevant.
  • Ongoing monitoring of ESG risks: Our review of files and discussions indicated that firms had varying approaches to surveillance of ESG risks (such as near-term or long-term, materiality, impact). Where ESG risks are assessed to be potentially credit material but may emerge over longer time horizons, firms should consider the ability of their surveillance including people and processes, to effectively monitor such risks.