ESG rating penalties

On 25 April 2026, the European Commission adopted a delegated regulation setting out the procedural rules for fines and periodic penalty payments that the European Securities and Markets Authority (ESMA) may impose on ESG rating providers under Regulation (EU) 2024/3005. The delegated act fills one of the final gaps in the EU’s ESG ratings supervisory framework ahead of its application date of 2 July 2026 — answering a question that has been open since the parent regulation was published in December 2024: precisely how will ESMA exercise its enforcement powers, and what safeguards will apply to providers subject to investigation?

This article breaks down the delegated regulation, maps the enforcement process, and explains what it means for ESG rating providers, asset managers, and compliance teams preparing for the new regime.

Why this delegated regulation matters

Regulation (EU) 2024/3005 established ESMA as the direct supervisor of ESG rating providers operating within the EU. It granted ESMA the authority to request information, conduct investigations and inspections, and — where infringements are found — impose fines of up to 10% of the provider’s total annual net turnover, as well as periodic penalty payments to compel compliance. However, Article 39(9) of the parent regulation required the Commission to adopt a separate delegated act specifying the procedural rules for how these enforcement powers would be exercised. Without those rules, ESMA’s ability to pursue infringement proceedings would have lacked a defined procedural framework — leaving providers uncertain about how investigations would be conducted and how their right to be heard would be protected.

The delegated regulation addresses all of these points. It defines the steps in infringement proceedings, codifies the rights of defence available to providers under investigation, sets limitation periods for both the imposition and enforcement of penalties, and establishes rules for the collection and transfer of fines to the EU general budget.

Enforcement process: from investigation to fine

The delegated regulation establishes a structured, multi-stage enforcement process. Each stage includes specific procedural safeguards designed to ensure that any provider subject to investigation has adequate opportunity to present its defence before a penalty is imposed.

Rights of defence under the new regime

A central feature of the delegated regulation is the codification of procedural safeguards for providers subject to investigation. These protections mirror established principles in EU securities supervision — drawing on ESMA’s existing experience with entities such as credit rating agencies and trade repositories — but are adapted specifically for ESG rating providers.

Providers have the right to receive a detailed written statement of findings before any penalty is imposed. At both the investigation stage and the Board decision stage, they may submit written responses within a set time limit, attach evidence, propose witnesses, and request oral hearings. Legal counsel may assist at every stage. Crucially, the Board is required to consider any written submissions received — including those submitted after the deadline — before adopting a final decision.

Access to the investigation file is also guaranteed. Once a statement of findings has been issued, the provider may request access to all documents in the file. However, documents obtained through file access may only be used for judicial or administrative proceedings related to the ESG Rating Regulation — a restriction designed to prevent information leakage into commercial disputes.

Limitation periods explained

The delegated regulation introduces two distinct five-year limitation periods, aligned with the approach used in other ESMA-supervised regimes. These periods define the outer boundaries within which ESMA must act.

The limitation period for imposing penalties is suspended for the duration of any appeal proceedings before the ESMA Board of Appeal or the Court of Justice of the EU. The enforcement limitation period is also suspended where time to pay has been allowed or where enforcement is paused pending an appeal decision. In practical terms, these provisions mean that a provider cannot avoid a fine simply by exhausting procedural timelines through repeated appeals — the clock stops while the matter is before a tribunal.

Key dates for ESG rating providers

What this means for the market

The enforcement framework has several practical implications for ESG rating providers, the asset managers that rely on their ratings, and the broader sustainable finance ecosystem.

For ESG rating providers

Providers that have not yet begun preparing for authorisation face an increasingly compressed timeline. The delegated regulation confirms that ESMA’s enforcement powers will be fully operational from the application date, and the procedural framework now exists to exercise them. Providers operating without authorisation after 2 November 2026 must cease their EU activities — and any continued provision of ratings without authorisation would itself constitute an infringement subject to the penalty regime now codified.

Compliance functions within rating providers should take particular note of the investigative cooperation requirements. Periodic penalty payments are specifically triggered by a provider’s refusal to submit to an investigation or to supply requested information. The daily penalty accrues until compliance is achieved, creating a powerful incentive for prompt cooperation with ESMA requests.

For asset managers and financial institutions

The enforcement regime adds a layer of credibility to ESG ratings used in SFDR product disclosures and investment decision-making. Financial market participants relying on ESG ratings should verify that their rating providers are pursuing authorisation within the specified timelines. Ratings sourced from providers that are not authorised or in the application process after 2 November 2026 may carry regulatory risk for downstream users, particularly in the context of greenwashing scrutiny under SFDR and the evolving EU Green Bond Standard.

Broader regulatory integration

The ESG Rating Regulation does not operate in isolation. It amends the SFDR to require financial market participants that produce in-house ESG ratings to disclose them on the same basis as those sourced from external providers. It also feeds into the European single access point (ESAP), through which ESG rating information will be made publicly accessible alongside corporate sustainability reports under the CSRD and ESRS framework.

For organisations managing complex, multi-framework regulatory obligations, the new enforcement regime underscores the importance of robust ESG data management infrastructure — both for rating providers that must demonstrate methodology transparency and for financial institutions that must substantiate their use of ESG ratings in product-level and entity-level disclosures.

Scrutiny and next steps

The delegated regulation now enters the scrutiny phase. Both the European Parliament and the Council of the EU have the right to object within a defined period. If neither institution raises an objection, the regulation will be published in the Official Journal and enter into force on the twentieth day following publication. Given the tight timeline before the 2 July 2026 application date, expedited scrutiny is expected.

ESG rating providers that have not yet engaged with the authorisation process should treat this delegated act as a signal that the supervisory architecture is now substantially complete. ESMA has already published a self-assessment tool to help entities determine whether they fall within the scope of the regulation, and a registration guide for the application process is available.

At Generation Impact Global, we help financial institutions and ESG professionals navigate the operational and data management challenges created by evolving EU sustainability regulation — from ESG strategy across jurisdictions to framework-specific reporting workflows.