SEBI's rules for ESG rating providers

ESG ratings influence where money goes, but for years nobody supervised the firms that produced them. Methods were often opaque, the same firm could sell ratings and consulting to a company, and companies had little chance to correct errors.

SEBI decided to regulate ESG rating providers (ERPs) in the same way it regulates credit rating agencies. Since July 2023, no one may provide ESG ratings on Indian securities to Indian users without SEBI registration. The rules aim for three things: transparent methods, managed conflicts of interest, and ratings that reflect Indian conditions and assured data.

Timeline

Registration requirement

• Anyone providing ESG ratings or scores on Indian assets to users in India. SEBI's FAQs say this includes "all types of rating and scoring products", including rule-based and algorithmic scores.
• Overseas providers covering Indian assets for Indian clients must set up a locally incorporated entity.
• Not covered: overseas providers rating global assets for users outside India, and foreign firms that only run back-office work in India.

Category I and Category II

Other conditions include: an ERP may offer only ESG rating services, not advisory or index services; it cannot rate entities linked to its own promoter; and no entity holding 10% or more of one domestic ERP may hold 10% or more of another.

Rating products and scale

• Six products at a minimum: ESG Rating, Transition or Parivartan Score, Combined Score, and the Core version of each, built only on assured data such as BRSR Core.
• Scores are given on a 0 to 100 scale with a matching category.
• Methods are disclosed at summary level. SEBI does not prescribe methods or weights.

India-specific parameters

SEBI's March 2023 decision set a minimum list of 14 India-specific parameters for ERPs to consider, including:

• Environment: compliance with energy efficiency schemes, zero liquid discharge, extended producer responsibility, and operations near ecologically sensitive areas. Intensity ratios should use revenue adjusted for purchasing power parity.
• Social: job creation in small towns, sourcing from MSMEs and aspirational districts, gender wage gaps, and jobs and facilities for people with disabilities.
• CSR: CSR spending compared with the legal requirement.
• Governance: systems for monitoring compliance, votes by non-promoter shareholders against independent director appointments and against related-party transactions, royalty payments, and the share of related-party transactions.

Two business models

• Issuer-pays: the rated company pays under a written contract. Ratings can be shared widely, but the conflict of interest is obvious.
• Subscriber-pays: investors and other subscribers pay. Conflicts are lower, but access is limited. These ratings rely on publicly available information.
• An ERP must choose one model; hybrid models are not allowed.
• Under the April 2025 circular, a rated company can send comments in a standard format. The ERP must acknowledge them within 3 working days and respond within 10 working days.

Withdrawal of ratings

• Issuer-pays, securities: only after at least 3 years or half the security's life, whichever is longer, plus a no-objection from holders of 75% of the bonds by value.
• Issuer-pays, companies: only after at least 3 years of continuous rating.
• Subscriber-pays: only if no subscribers remain and the rating is not part of an active package, such as ratings for all Nifty 50 companies.

Disclosure

• Final ratings must be published on the ERP's website, and score updates disclosed within 10 days.
• Under subscriber-pays, the full rationale can be limited to subscribers, but basic details (company, sector, rating, date and the BRSR used) must be public.
• Stock exchanges display ESG ratings on each listed company's page and each listed bond's page, showing the ERP's name and business model.

Governance of ERPs

• An ESG ratings sub-committee and a nomination and remuneration committee.
• A yearly internal audit. Category II ERPs got a two-year deferral for the audit and the committees.

Registered providers (October 2026)

SEBI's register lists 19 ERPs: 5 in Category I and 14 in Category II.

• Category I: CRISIL ESG Ratings & Analytics, ESG Risk Assessments & Insights, ICRA ESG Ratings, CARE ESG Ratings, and NSE Sustainability Ratings & Analytics.
• Category II includes SES ESG Research, IIAS Sustainability Solutions and a range of smaller firms; the most recent was registered in March 2026.

India compared with other markets

• IOSCO (the global body of securities regulators) recommended oversight of ESG raters in 2021.
• EU: the ESG Ratings Regulation (Regulation (EU) 2024/3005) has applied since 2 July 2026, with ESMA as supervisor. By 10 September 2026, ESMA had registered 34 providers under a lighter temporary regime for small firms. Other providers had until 2 November 2026 to apply.
• UK: ESG ratings become a regulated activity under FCA authorisation from 29 June 2028.