ESG ratings enter FCA perimeter: what boards and asset owners must do before June 2027

The FCA has closed a long-standing gap in the UK's sustainable finance architecture. On 3 November, it published PS26/22, the final regime bringing ESG rating providers under its authorisation for the first time, following government legislation in October 2025 that extended the regulator's remit (FCA). Providers must apply for authorisation from 24 June 2027, with the framework taking full effect on 29 June 2028 (FCA).

A market that priced itself in without rules

ESG ratings have become infrastructure. The FCA describes them as inputs used by "asset managers, lenders, benchmark administrators and others to inform capital allocation decisions and manage risk" (FCA). Until now, that infrastructure has operated without a conduct regime, which is why 95% of respondents to the preceding consultation CP25/34 supported bringing it inside the perimeter (FCA). The regime is informed by IOSCO recommendations and existing international standards, meaning UK-authorised providers will sit closer to the emerging global baseline than firms operating under purely voluntary codes.

Laura Dawes, director of authorisations and sustainable finance at the FCA, framed the purpose plainly: "Trusted information is essential for well-functioning markets. These rules will help improve transparency and raise standards across the ESG ratings market while supporting competition, innovation and growth" (FCA). The subtext matters. The FCA is signalling that competition and growth objectives sit alongside, not behind, the integrity agenda, which is consistent with its secondary competitiveness objective and should temper fears of a heavy regime for smaller providers.

What changes for rating users

The more consequential shift is for the buy side. Once providers are authorised, rating users acquire counterparties they can hold to a regulated standard on methodology disclosure, conflicts management and engagement with rated entities. That has three practical consequences. Contract renegotiation becomes available: representations and warranties that were previously best-efforts can be anchored to FCA rules. Due diligence files need to distinguish between in-scope and out-of-scope vendors, because the FCA has published guidance to help firms identify whether they are captured (FCA). And internal governance, particularly at investment committees and risk committees, will need to document how ratings are used, challenged and overridden.

There is also a sequencing risk. Providers that fail to secure authorisation, or that withdraw from the UK market rather than apply, will leave gaps in coverage. Firms that rely on a single rating source for a specific asset class or geography should map that concentration now, while substitution is still orderly. The FCA is staggering application windows and encouraging early filing (FCA), which means the identity of likely survivors will be visible well before the 2028 cliff edge.

For senior leaders, the question is not whether to prepare but whose problem this is. Procurement, sustainability, risk and investment functions all have claims. The firms that assign a single accountable owner before mid-2027 will find the transition cheaper than those that discover their vendor is unauthorised the week it matters.