Last week, the SEC adopted (in response to 14 mandated provisions under the Dodd-Frank Wall Street Reform and Consumer Protection Act) a final rule¹ that affects nationally recognized statistical rating organizations (NRSROs). Topics addressed in the final rule include internal controls; conflicts of interest; disclosures about statistics related to credit rating performance; an NRSRO’s policies and procedures for establishing and changing its rating methods; and standards to ensure the training, experience, and competence of credit analysts.²

Internal Controls

Structure

NRSROs will be required to “establish, maintain, enforce, and document an effective internal control structure” related to their process for establishing credit ratings. Specifically, NRSROs must include reasonably designed controls over (1) credit rating determination methods, (2) solicitation of periodic public feedback about such methods, and (3) performance of periodic reviews or internal audits of rating files to ensure adherence to the NRSRO’s established policies and procedures.

To maintain the internal control structure, NRSROs must also ensure that:

• Resources are sufficient “to implement and operate the . . . internal control structure as designed.”
• Controls are periodically monitored for effectiveness and necessary updates are made.
• Deficiencies “are assessed and addressed on a timely basis.”

Report on Effectiveness of Internal Control Structure

The final rule requires NRSROs to file with the SEC an annual report about their internal control structure along with an attestation by the NRSRO’s CEO or equivalent. The report must include:

• A description of management’s responsibility with respect to internal control.
• Any material weaknesses³ that have been identified and how they have been addressed.
• Whether “the internal control structure was effective as of the end of the fiscal year.”

Conflicts of Interest

The final rule prohibits NRSROs that develop, monitor, and analyze credit ratings from participating in sales and marketing activities.

Standards of Training, Experience, and Competence

NRSROs must establish, maintain, enforce, and document standards of training, experience, and competence and must reasonably design these standards to produce accurate ratings.

Other Changes Affecting NRSROs

Look-Back Reviews

The final rule requires NRSROs to institute policies and procedures for performing look-back reviews to determine whether, in establishing a credit rating, they may have been influenced by “the prospect of future employment by an issuer or underwriter.”

Disclosure of NRSRO Credit Rating Performance Statistics and Credit Rating Histories

The final rule requires NRSROs to “publicly disclose information about their initial credit ratings and subsequent changes to” these ratings and to provide enhanced disclosures about the methods they use to compute transition⁴ and default rates. NRSROs must also provide expanded disclosures about their credit rating histories as well as about “additional data elements . . . for a particular credit rating.” 

Credit Rating Methods

An NRSRO will be required to establish policies and procedures that are reasonably designed to ensure that:

• Its board of directors approves credit rating procedures and methods.
• It develops and modifies these procedures and methods in a manner consistent with its policies and procedures.
• Material changes to procedures and methods for determining credit ratings are applied consistently to current and future ratings and are published “on an easily accessible portion” of the NRSRO’s Web site.

Form and Certifications

When publishing a credit rating, NRSROs must provide “a form containing certain quantitative and qualitative information” and must disclose “any certifications from providers of third-party due diligence services with respect to [asset-backed securities].”

Universal NRSRO Rating Symbols

NRSROs must “establish, maintain, and enforce [policies related to] the use of rating symbols” and must clearly define each number, symbol, and score as well as the rating scales used. In addition, NRSROs must consistently apply such rating measures.