The FCA says any ESG rating provider still operating without approval after 2028 commits a criminal offence. Apply on time, though, and a firm can keep trading, unassessed, indefinitely.
Estimated reading time: 7 minutes
.jpg){kind=link}
In short. On 3 November 2026 the FCA published PS26/22, the UK's first authorisation regime for ESG rating providers. Its own rules say that from 29 June 2028, any provider still operating without authorisation "will be in breach of the general prohibition under Financial Services and Markets Act 2000 (FSMA) and will be committing a criminal offence" [2], page 5. Two paragraphs later, the same document says a firm that applied on time but has not yet been assessed "will be able to continue business as normal, until we determine their application. This can include taking on new business" [[2]], page 46. And the market-scale claim that opens the FCA's own case for the regime, that "global spending on ESG ratings and data is estimated to have more than doubled between 2021 and 2025," carries its own parenthetical label: "(paywalled)" [[2]], page 4. Three documented mistakes: four stars.
ESG ratings tell asset managers, lenders and benchmark administrators how a company stacks up on environmental, social and governance criteria, and firms use them to decide where capital goes [1]. Until now, nobody has had to be authorised to sell one in the UK. PS26/22 changes that. Laura Dawes, the FCA's director of authorisations and sustainable finance, called the regime a way to "help improve transparency and raise standards across the ESG ratings market while supporting competition, innovation and growth" [[1]]. The rules themselves, and the case the FCA makes for them in its own 146-page policy statement, are less tidy than the press release.
What the regime actually requires, and by when
The timeline is specific. The authorisation gateway opens 24 June 2027. Firms the FCA classes as "larger," those expecting to earn 500,000 pounds or more a year from UK ESG ratings activity, must apply within the gateway's first month, by the end of July 2027; everyone else has until the end of August 2027 [[2]], page 46. The regime "goes live" on 29 June 2028. The consequence for ignoring it is not vague: paragraph 1.13 states plainly that beyond that date, "firms that carry on ESG ratings activity without the required authorisation will be in breach of the general prohibition under Financial Services and Markets Act 2000 (FSMA) and will be committing a criminal offence" [[2]], page 5.
Scope is wide. The rules catch not just UK-based raters but overseas providers too, if they are paid and their ratings reach anyone located in the UK, including when they are routed through an overseas intermediary who then passes them on [[2]], page 64. The FCA considered, and rejected, carving out smaller providers: "we do not consider that exempting smaller providers would be appropriate," on the basis that some smaller firms themselves said an exemption would make users see them as less reliable [[2]], page 55.
A hard deadline with a soft edge, two paragraphs apart
The 29 June 2028 cut-off reads as absolute in paragraph 1.13. It is not, for one specific group of firms, and the policy statement says so itself three sections later. Paragraph 9.10 confirms the strict version: a firm that misses the application window, withdraws, or gets refused "will not be able to take on new business once the regime goes live and will need to wind their business down" [[2]], page 46. Paragraph 9.11, directly underneath it, describes a different outcome for a firm that did everything asked of it: one that "applies within the stated timeframe, but where we have not determined their application by 29 June 2028, will be able to continue business as normal, until we determine their application. This can include taking on new business" [[2]], page 46.
The practical effect is that the regime's actual start date, for any firm that applies on time, is not 29 June 2028 at all. It is whenever the FCA finishes assessing that firm's application, a date the FCA controls and the policy statement does not estimate. An applicant who files correctly in July 2027 and is still waiting for a decision in 2029 is, on the FCA's own reading of its own legislation, trading entirely lawfully, taking new clients, a full year after the date the FCA told the public, in the same document, was the one that makes trading without authorisation a crime. The policy statement does not flag this as a risk to the credibility of its own deadline. It is simply stated once at paragraph 9.10 and left uncontradicted-looking at paragraph 9.11, three lines later.
The number the whole regime rests on is marked unverifiable, by the regulator itself
Chapter 1 opens the case for the regime with a single, load-bearing statistic. Paragraph 1.1: "ESG ratings play a significant role in decision-making for many institutional investors. Global spending on ESG ratings and data is estimated to have more than doubled between 2021 and 2025 (paywalled)" [[2]], page 4. That bracketed word is the FCA's own, not an editorial insertion. It is the regulator telling its own readers, in the document that creates a new criminal offence, that the figure behind its opening justification cannot be checked without paying someone else for it.
It gets thinner from there. The only harm figure the FCA generated itself, rather than cited from an outside source, does not appear in Chapter 1's case for the regime at all. It is in Annex 3, "Measuring success," sixty-five pages later: "Our survey carried out in 2024... found that 48% of users faced transparency-related challenges and 55% of users considered there were shortcomings in the systems and controls of ESG rating providers" [[2]], page 69. That is a real, specific, FCA-run data point about the actual problem this regime is meant to fix. It sits in the annex that explains how the FCA will know if the rules worked, not in the chapter that explains why the rules are needed.
The press release compounds the gap rather than closing it. It leads with two numbers: "95% of respondents to the government's consultation supported the move," and the FCA's own Financial Lives Survey 2024 finding that "72% of adults with investments or a defined contribution pension wanted their investments to do some good as well as provide a financial return" [[1]]. Neither measures a problem with ESG ratings. The 95 percent figure describes support for a 2025 legislative step putting ESG ratings inside the FCA's remit in principle, a different and earlier consultation from the FCA's own technical rulebook consultation, CP25/34, which opened in December 2025 and closed in March 2026 [[2]], page 4. The 72 percent figure describes general investor appetite for ethical investing, not dissatisfaction with how ratings are produced. The one number that actually says something is wrong with the ratings market today, the 48 and 55 percent findings, appears in neither the press release nor the chapter making the case for the rules. It is filed under measuring success.
Credit where due
Some of this policy statement responds to its own consultation properly. The FCA raised its "larger firm" revenue threshold from the proposed 250,000 pounds to 500,000 pounds after respondents said the lower figure would sweep in "most ESG rating providers," creating a barrier to entry the FCA had not intended [[2]], page 47. It narrowed a notification duty so firms tell ESG ratings users about changes rather than rated companies, a real proportionality concession [[2]], page 62. And the criminal offence itself is not left vague or symbolic: it names the exact statutory mechanism, the FSMA general prohibition, rather than a generic promise to "take action."
The claims, tested
| The document's own words | What the same document says elsewhere | Verdict |
|---|---|---|
| "From 29 June 2028, all ESG rating providers in scope will need to be FCA-authorised... firms that carry on ESG ratings activity without the required authorisation will be in breach of the general prohibition under [FSMA] and will be committing a criminal offence" [[2]], page 5 | A firm that applied on time but has not yet been assessed by 29 June 2028 "will be able to continue business as normal, until we determine their application. This can include taking on new business" [[2]], page 46 | The deadline is absolute only for firms that missed it; for compliant applicants, the real start date is whenever the FCA finishes its own assessment |
| "Global spending on ESG ratings and data is estimated to have more than doubled between 2021 and 2025 (paywalled)" [[2]], page 4, is the opening justification for the regime | The only FCA-generated harm figure, "48% of users faced transparency-related challenges and 55%... considered there were shortcomings in the systems and controls of ESG rating providers," sits in Annex 3, "Measuring success," not the Chapter 1 case for the rules [[2]], page 69 | The regime's stated justification leans on an unverifiable market-size figure; the one checkable FCA data point about actual market problems is filed as a success metric, not a reason |
| Press release: "95% of respondents to the government's consultation supported the move" and "72% of adults... wanted their investments to do some good as well as provide a financial return" [[1]] | The 95% figure concerns the 2025 legislation bringing ESG ratings into the FCA's remit in principle, not the FCA's own CP25/34 rulebook consultation (December 2025 to March 2026) [[2]], page 4; the 72% figure measures general investor sentiment, not ratings-market harm | The public-facing statistics measure appetite for ESG investing and support for regulating in principle, not evidence that these specific rules fix a demonstrated problem |
The mistakes, counted
A criminal-offence deadline that is not actually a deadline for firms who comply (1). Paragraph 1.13 states that operating without authorisation after 29 June 2028 is a criminal offence. Paragraph 9.11 confirms that a firm which applied on time but has not yet been assessed can keep trading, including taking new business, until the FCA gets round to deciding its case, with no estimate given for how long that might take [[2]], pages 5 and 46.
The regime's own justification rests on a figure its authors mark unverifiable (2). The "doubled between 2021 and 2025" market-spending claim that opens the case for the regime in Chapter 1 carries the parenthetical "(paywalled)" in the FCA's own text, while the regulator's own 2024 survey data on actual market problems is held back for the measuring-success annex rather than used to justify the rules up front [[2]], pages 4 and 69.
Public-facing statistics describe the wrong consultation and the wrong problem (3). The press release's headline support figures, 95 percent backing and 72 percent wanting ethical returns, concern a different, earlier consultation and general investor sentiment, not evidence of harm from unregulated ESG ratings specifically [[1]] [[2]], page 4.
Verdict
Four stars, three documented mistakes. The FCA has built a real authorisation gateway, with a real criminal offence attached, for a market that has operated without one until now. What it has not done is make its own deadline mean what it says for every firm, or made the public case for the regime with the one number it actually generated itself. A regulator creating a criminal offence for the first time ought to be able to say what problem it is solving without footnoting the market size as paywalled and burying the harm data in an annex about success.
The star score counts three documented mistakes. First, paragraph 1.13 of PS26/22 states that operating without authorisation after 29 June 2028 is a criminal offence, but paragraph 9.11 confirms a firm that applied on time and has not yet been assessed can keep trading, including taking new business, indefinitely past that date. Second, the regime's Chapter 1 justification rests on a market-spending figure the FCA's own text marks "(paywalled)," while the FCA's own 2024 survey data on actual ESG-ratings market problems, the only harm figure it generated itself, appears only in the Annex 3 measuring-success section. Third, the press release's headline statistics (95% support, 72% investor sentiment) describe a different, earlier consultation and general investor sentiment rather than evidence of harm in the ESG ratings market specifically. Three falls in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding about the conduct of any named individual; it tests the policy statement's own stated deadline and evidence base against its own other paragraphs, not the judgement of anyone who drafted them. All sources below were fetched directly on 7 November 2026 and returned HTTP 200; PS26/22 was checked with a full-text extraction of all 146 pages.
Sources
- New FCA rules bring ESG rating providers into UK regulation for the first time, FCA press release, published 3 November 2026
- PS26/22: ESG ratings: final regime, FCA policy statement, published 3 November 2026