There are new requirements applicable to NRSROs pursuant to which
they must avoid certain conflicts of interest and have policies and
procedures to take certain actions to address credit ratings that are
influenced by a conflict of interest.\114\ These requirements may
facilitate the alignment of incentives at both the NRSRO and individual
NRSRO employee level to ultimately promote the production of unbiased
credit ratings. At the NRSRO level, for example, sales and marketing
considerations may influence the NRSRO's production of credit ratings.
Consequently, there is a new requirement that prohibits an NRSRO from
issuing or maintaining a credit rating where a person within the NRSRO
who participates in determining or monitoring the credit rating, or
developing or approving procedures or methodologies used for
determining the credit rating, including qualitative and quantitative
models, also: (1) Participates in sales or marketing of a product or
service of the NRSRO or a product or service of an affiliate of the
NRSRO; or (2) is influenced by sales or marketing considerations.\115\
This absolute prohibition should result in internal policies,
procedures, and organizational solutions that isolate the analytical
function from sales and marketing considerations within the NRSRO. To
the extent that the absolute prohibition prevents credit analysts that
participate in the determination of

credit ratings from being influenced by sales and marketing
considerations, this should curb potential conflicts of interest
related to ``rating catering'' practices that have been suggested by
anecdotal evidence \116\ and academic literature.\117\ Isolating the
production of credit ratings and the development of procedures and
methodologies for determining credit ratings from sales and marketing
considerations should promote the integrity and quality of credit
ratings to the benefit of their users.
---------------------------------------------------------------------------

    \114\ These requirements are discussed below in sections II.B.
and II.C. of this release.
    \115\ This requirement is discussed below in section II.B.1. of
this release.
    \116\ See Coffee Testimony I, pp. 2-3.
    \117\ See John M. Griffin, Jordan Nickerson, Dragon Yongjun
Tang, Rating Shopping or Catering? An Examination of the Response to
Competitive Pressure for CDO Credit Ratings, Rev. Fin. St. 2270-2310
(2013). The authors draw a distinction between rating shopping and
rating catering. ``Rating shopping'' refers to a situation in which
issuers solicit ratings from multiple credit rating agencies and
then hire the credit rating agencies that will issue the most
favorable credit ratings (Skreta and Veldkamp, 2009). Even though
rating agencies adhere to their rating procedures and methodologies
and issue unbiased ratings, credit rating inflation is a natural
consequence of the rating shopping process and is not driven by the
rating agencies. ``Rating catering'' refers to a situation in which
issuers solicit credit ratings from multiple credit rating agencies
and the credit rating agencies may not strictly adhere to their
procedures and methodologies for determining credit ratings in order
to issue more favorable credit ratings. The authors argue that under
pressure from investment banks, the credit rating agency with a more
stringent procedure or methodology for determining credit ratings
stretches the procedure or methodology to match more lenient
competitors (Bolton, Freixas, and Shapiro, 2012).
---------------------------------------------------------------------------

    At the individual level, an analyst's incentives may be distorted
by the prospect of future employment at an issuer or underwriter, which
could influence the analyst in determining a credit rating for that
issuer or underwriter. Consequently, there is a new requirement that an
NRSRO must have policies and procedures that address instances in which
this conflict of interest influenced a credit rating that are
reasonably designed to ensure that the NRSRO promptly determines
whether the current credit rating must be revised so that it no longer
is influenced by a conflict of interest and is solely a product of the
documented procedures and methodologies the NRSRO uses to determine
credit ratings and to promptly publish a revised credit rating, an
affirmation of the credit rating, or potentially place the credit
rating on watch or review and in each case include certain disclosures
about the existence of the conflict.\118\ This provision is designed to
require the NRSRO to promptly address a conflicted credit rating, and
it will likely limit the potential risk that users of credit ratings
may make investment decisions using biased or inaccurate information.
The disclosures also should provide information to investors and other
users of credit ratings that they can use to scrutinize an NRSRO,
thereby promoting accountability to the market for failing to
appropriately manage this conflict of interest.
---------------------------------------------------------------------------

    \118\ This requirement is discussed below in section II.C.1. of
this release.
---------------------------------------------------------------------------

    In terms of accountability, the Commission is finalizing a rule
amendment pursuant to which an NRSRO could have its registration
suspended or revoked for violating a rule governing conflicts of
interest.\119\ In addition, the Commission is amending Form NRSRO to
provide notice to an NRSRO or a credit rating agency applying for
registration as an NRSRO that an NRSRO is subject to applicable fines,
penalties, and other sanctions under the Exchange Act.\120\ This may
serve as a reminder to the NRSRO or applicant of the potential
consequences of failing to comply with federal laws and regulations.
Taken together, these accountability measures may have incremental
effects on the integrity of an NRSRO's activities and credit ratings by
promoting compliance with the Commission's rules.
---------------------------------------------------------------------------

    \119\ This requirement is discussed below in section II.B.3. of
this release.
    \120\ This requirement is discussed below in section II.D.1. of
this release.
---------------------------------------------------------------------------

    There are new requirements applicable to NRSROs pursuant to which
they must establish, maintain, enforce, and document policies and
procedures that are reasonably designed to ensure that: (1) The
procedures and methodologies, including qualitative and quantitative
data and models, the NRSRO uses to determine credit ratings are
developed and modified in accordance with the policies and procedures
of the NRSRO; and (2) material changes to the procedures and
methodologies, including changes to qualitative and quantitative data
and models, that the NRSRO uses to determine credit ratings are applied
consistently to all current and future credit ratings to which the
changed procedures or methodologies apply and, to the extent that the
changes are to surveillance or monitoring procedures and methodologies,
applied to current credit ratings to which the changed procedures or
methodologies apply within a reasonable period of time, taking into
consideration the number of credit ratings impacted, the complexity of
the procedures and methodologies used to determine the credit ratings,
and the type of obligor, security, or money market instrument being
rated.\121\ To the extent that these policies and procedures are
effectively implemented and enforced, their application may enhance the
integrity of how NRSROs determine credit ratings.
---------------------------------------------------------------------------

    \121\ This requirement is discussed below in section II.F.1. of
this release.
---------------------------------------------------------------------------

    There are new requirements applicable to NRSROs pursuant to which
they must establish, maintain, enforce, and document standards of
training, experience, and competence for the individuals they employ to
participate in the determination of credit ratings that are reasonably
designed to achieve the objective that the NRSRO produces accurate
credit ratings in the classes of credit ratings for which the NRSRO is
registered. At a minimum, these standards must include: (1) A
requirement for periodic testing of the individuals employed by the
NRSRO to participate in the determination of credit ratings on their
knowledge of the procedures and methodologies used by the NRSRO to
determine credit ratings in the classes and subclasses of credit
ratings for which the individual participates in determining credit
ratings; and (2) a requirement that at least one individual with an
appropriate level of experience in performing credit analysis, but not
less than three years, participates in the determination of a credit
rating.\122\ These requirements may increase the level of competence
and experience of the credit analysts employed by the NRSRO to
participate in the production of credit ratings with possible positive
effects on the integrity and quality of credit ratings.\123\
---------------------------------------------------------------------------

    \122\ See section II.I.1. of this release (providing a more
detailed discussion of the requirements of this paragraph).
    \123\ See Cesare Fracassi, Stefan Petry, and Geoffrey Tate, Are
Credit Ratings Subjective? The Role of Credit Analysts in
Determining Ratings (2014), available at http://papers.ssrn.com/
sol3/papers.cfm?abstractid=2230915. The authors find that
the identity of the credit analysts covering a firm significantly
affects the firm's credit rating, comparing credit ratings for the
same firm at the same time across credit rating agencies. Analyst
effects account for 30% of the variation within credit ratings. In
addition, the quality of credit ratings varies with observable
analyst characteristics.
---------------------------------------------------------------------------

    There are new requirements applicable to NRSROs pursuant to which
they must have reasonably designed policies and procedures relating to:
(1) Assessing the probability that an issuer of a security or money
market instrument will default, fail to make timely payments, or
otherwise not make payments in accordance with the terms of the
security or money market instrument; (2) clearly defining each symbol,
number, or score in the rating scale used by the NRSRO and including
the definitions in Exhibit 1 to Form NRSRO; and (3) applying any
symbol,

number, or score in the rating scale used by the NRSRO in a manner that
is consistent for all types of obligors, securities, and money market
instruments for which the symbol, number, or score is used.\124\
Compliance with these policies and procedures may increase the
likelihood that NRSROs apply rating symbols, numbers, or scores
consistently across classes of credit ratings to the benefit of the
users of credit ratings and obligors and issuers that are subject to
credit ratings.
---------------------------------------------------------------------------

    \124\ These requirements are discussed below in section II.J. of
this release.
---------------------------------------------------------------------------

    Finally, there are new requirements applicable to NRSROs pursuant
to which they must retain records of certain internal controls,
policies, procedures and standards they are required to document.\125\
These record retention requirements should facilitate Commission
oversight of NRSROs to the benefit of users of credit ratings.
Similarly, the Exchange Act requires an annual report of the NRSRO's
designated compliance officer to be filed on a confidential basis with
the Commission.\126\ The new requirement should facilitate Commission
oversight as well.
---------------------------------------------------------------------------

    \125\ These requirements are discussed below in sections
II.A.2., II.C.2., II.F.2., II.I.2., and II.J.2. of this release.
    \126\ This requirement is discussed below in section II.K. of
this release.
---------------------------------------------------------------------------

    There will be costs associated with the amendments and new rules
being adopted today related to governance of NRSROs.\127\ These costs
will be primarily incurred by NRSROs.\128\ Initial and ongoing direct
costs, including compliance costs, may vary among the NRSROs depending
on the size and complexity of their business activities (for example,
number of credit ratings outstanding, number of analysts, or number of
classes of credit ratings). Among other costs, NRSROs also may incur
training costs in order to make their personnel aware of the changes in
internal controls, policies, and procedures required by the amendments
and new rules. These costs are difficult to quantify because they
depend significantly on how the required changes differ from the
internal policies and procedures currently in place within each NRSRO.
In addition, they depend on factors such as the NRSRO's size and
business complexity. For example, an NRSRO may need to train its credit
analysts and sales and marketing staff in the updated policies and
procedures related to the sales and marketing conflict requirements.
Among other factors, this cost will likely vary significantly with the
degree of the existing separation between the functions of analytical
staff and sales and marketing personnel.\129\
---------------------------------------------------------------------------

    \127\ A detailed analysis of the economic costs, including
compliance costs that can potentially result from each amendment
and/or rule is presented in the focused economic analyses in section
II of this release. See sections II.A.4., II.B.4., II.C.3., II.D.2.,
II.E.4., II.F.3., II.G.6., II.H.4., II.I.3., II.J.3., II.K.2.,
II.L.2., and II.M.5. of this release.
    \128\ NRSROs may be able to pass some of the incremental costs
to their clients.
    \129\ This requirement is discussed below in section II.B.4. of
this release.
---------------------------------------------------------------------------

    Keeping all other factors constant, the costs associated with
establishing, maintaining, enforcing, and documenting internal policies
and procedures may be higher for structured finance products because
the inherent conflict of interest that credit rating agencies face in
rating these products is more acute than it is with respect to rating
other types of securities.\130\ In addition, keeping all other factors
constant, NRSROs operating under a business model that combines the
issuer-pay and subscriber-pay models may face greater direct costs,
given that the two models may entail different internal policies and
procedures to prevent different sources of potential conflicts of
interest. A component of these costs may also be fixed, which may have
a disproportionate impact on smaller NRSROs that may find it more
difficult to bear the costs. If NRSROs are not able to readily pass the
overall additional costs to clients, there may be adverse effects,
particularly on smaller NRSROs.
---------------------------------------------------------------------------

    \130\ See Amendments to Rules for Nationally Recognized
Statistical Rating Organizations, 74 FR at 63844. (``In the case of
structured finance products, the Commission believes this `issuer/
underwriter-pay' conflict is particularly acute because certain
arrangers of structured finance products repeatedly bring ratings
business to the NRSROs. As sources of frequent, repeated deal-based
revenue, some arrangers have the potential to exert greater undue
influence on an NRSRO than, for example, a corporate issuer that may
bring far less ratings business to the NRSRO.'') (footnotes
omitted).
---------------------------------------------------------------------------

    As a result of the amendments and new rules being adopted today,
the number of credit rating agencies registered with the Commission as
NRSROs may decline if current registrants believe that the cost of
being registered and being subject to these new requirements outweighs
the benefit of registration. The barriers to entry for credit rating
agencies to register as NRSROs may rise, discouraging credit rating
agencies from registering as NRSROs. Further, historically, successful
new entrants have established themselves by first specializing in a
particular industry, creating a track record in a particular rating
class, and building the necessary reputational capital to achieve
marketplace acceptance of their credit ratings.\131\ Compliance costs
may reduce the incentive for an NRSRO to expand its rating business
into new classes of credit ratings, with adverse effects on competition
in certain market segments. Also, if compliance costs significantly
erode profit margins for NRSROs, the barriers to exit from being
registered as an NRSRO in certain or all classes of credit ratings may
lower. The risk for deregistration may likely be higher for smaller
NRSROs. As mentioned earlier, these costs also should depend on the
complexity of operations within the NRSRO. Further, given that the
conflict of interest in rating structured finance products is more
acute, the competitive effects could be greater within the markets for
rating these products. These potential consequences could reduce
competition among NRSROs.
---------------------------------------------------------------------------

    \131\ See Commission, Report on the Role and Function of Credit
Rating Agencies in the Operation of the Securities Markets (Jan.
2003), p. 24.
---------------------------------------------------------------------------

    An amendment being adopted today provides a mechanism for a small
NRSRO to seek an exemption from the sales and marketing
prohibition.\132\ The exemption based on size may decrease the burden
on small NRSROs. However, this amendment could create adverse effects
on competition as exempted NRSROs may be able to draw business through
rating catering. In particular, exempted NRSROs may be able to more
readily produce conflicted and inflated ratings \133\ or generate a
greater stream of revenue from selling rating and ancillary services
than non-exempted NRSROs. Reputation, which is an important
disciplinary mechanism in this industry, may mitigate this risk to a
certain extent.\134\
---------------------------------------------------------------------------

    \132\ This provision is discussed below in section II.B.3. of
this release.
    \133\ See Griffin, Nickerson, and Tang, Rating Shopping or
Catering? An Examination of the Response to Competitive Pressure for
CDO Credit Ratings.
    \134\ See Jerome Mathis, James McAndrews, and Jean-Charles
Rochet, Rating the Raters: Are Reputation Concerns Powerful Enough
to Discipline Rating Agencies?, J. of Monetary Economics 657-674
(July 2009).
---------------------------------------------------------------------------

    A number of credit rating agencies located in the United States
have not registered as NRSROs.\135\ As U.S. regulatory agencies
continue to remove references to NRSRO credit ratings from the
regulations they administer, market

participants subject to these regulations may choose to use
unregistered credit rating agencies thereby diminishing the incentive
to register as an NRSRO.\136\ On the other hand, users of credit
ratings may choose to use NRSROs over unregistered credit rating
agencies because of the NRSRO registration and oversight program, which
is being enhanced by the amendments and new rules being adopted today.
---------------------------------------------------------------------------

    \135\ See, e.g., James H. Gellert, Chairman and CEO, Rapid
Ratings International, Inc., Testimony Concerning: Oversight of the
Credit Rating Agencies Post Dodd-Frank (July 27, 2011) (testimony
before the U.S. House of Representatives, Committee on Financial
Services, Subcommittee on Oversight and Investigations), available
at http://www.rapidratings.com/images/custom/
gellerttestimonytohousecfs
oversightandinvestigationsjuly27
2011finalwbio.pdf.
    \136\ See Public Law 111-203, 939A.
---------------------------------------------------------------------------

    To the extent that these amendments and new rules improve the
quality of credit-related information, they may have effects related to
allocative efficiency and capital formation. As a result of these
amendments and new rules, users of credit ratings could make more
efficient investment decisions based on higher-quality information.
Market efficiency also may improve if credit ratings become more
informative and the additional information is reflected in asset
prices. To the extent that the amendments and rules will be effective
in enhancing the integrity and quality of NRSRO credit ratings, users
of these credit ratings may benefit from an enhanced confidence in the
quality of the creditworthiness assessments reflected in the credit
ratings, which may have positive effects on the willingness of
investors to participate in the securities markets and thereby enhance
capital formation, as capital efficiently flows to more productive
uses. The benefits in terms of efficiency and capital formation arising
from the rules enhancing governance and the integrity of credit ratings
are likely to be greater for asset-backed securities, where the
inherent conflict of interest in the issuer-pay model is more acute,
and, as a result of the amendments and new rules, investors may become
less reluctant to invest in asset-backed securities.
b. Amendments and Rules Enhancing Disclosure and Transparency of Credit
Ratings
    The requirements in the amendments and new rules being adopted
today that are primarily designed to enhance disclosure should have
economic benefits, relative to the baseline that existed before the
amendments and rules were adopted, in terms of promoting the
transparency of credit ratings and NRSRO activities and, therefore,
NRSRO accountability. This should benefit users of credit ratings,
including investors. The amendments and rules also should enhance
disclosure requirements with respect to asset-backed securities for the
benefit of users of credit ratings, including investors in these
securities.
    The amendments significantly enhance the existing requirements for
NRSROs to produce and disclose performance statistics to make the
disclosures more comparable across NRSROs and easier for users of
credit ratings and others to understand.\137\ Similarly, the existing
requirements for NRSROs to disclose rating histories are being enhanced
to make the histories more complete in terms of the scope of credit
ratings that must be included in the histories and more robust in terms
of the information that must be disclosed with each rating action.\138\
To the extent that the new disclosures facilitate the evaluation of the
performance of an NRSRO's credit ratings and the comparison of rating
performance across all NRSROs--including direct comparisons of the
rating history of the same obligor or instrument across two or more
NRSROs--the rules may benefit users of credit ratings, including
investors. In particular, the enhanced disclosure may allow them to
better assess the reliability of credit ratings from different NRSROs
and, in the case of issuer-paid credit ratings or subscriber-paid
credit ratings, make more informed decisions regarding whether to hire,
or subscribe to the credit ratings of, a particular NRSRO.
---------------------------------------------------------------------------

    \137\ These amendments are discussed below in section II.E.1. of
this release.
    \138\ These amendments are discussed below in section II.E.3. of
this release.
---------------------------------------------------------------------------

    There are new requirements applicable to NRSROs pursuant to which
they must publish on their Internet Web sites: (1) Material changes to
the procedures and methodologies, including to qualitative models or
quantitative inputs, the NRSRO uses to determine credit ratings, the
reason for the changes, and the likelihood the changes will result in
changes to any current credit ratings; and (2) notice of the existence
of a significant error identified in a procedure or methodology,
including a qualitative or quantitative model, the NRSRO uses to
determine credit ratings that may result in a change to current credit
ratings.\139\ These requirements may benefit users of NRSRO credit
ratings in terms of their ability to evaluate the procedures and
methodologies used by an NRSRO to determine credit ratings. In this
way, they also may promote the NRSROs' accountability to the market and
the issuance of quality credit ratings.
---------------------------------------------------------------------------

    \139\ These amendments are discussed below in section II.F.1. of
this release.
---------------------------------------------------------------------------

    There are new requirements applicable to NRSROs pursuant to which
they must publish two items when taking a rating action: (1) A form
containing certain quantitative and qualitative information about the
credit rating that is the result or subject of the rating action; and
(2) any certification of a third-party due diligence provider relating
to the credit rating.\140\ The required disclosures may be used by
investors and other users of credit ratings to better understand credit
ratings issued by NRSROs. Specifically, the forms and certifications
will provide incremental information about how a credit rating was
produced (for example, disclosure about assumptions, limitations,
information relied on, version of the procedure or methodology used,
potential conflicts of interest) and the information content of the
credit rating. The information disclosed in the form, including
information about the limitations of the credit rating and information
regarding due diligence, may discourage undue reliance on credit
ratings by investors and other users of credit ratings in making
investment and other credit-based decisions.
---------------------------------------------------------------------------

    \140\ These amendments are discussed below in section II.G. of
this release.
---------------------------------------------------------------------------

    There is a new requirement applicable to issuers and underwriters
of asset-backed securities pursuant to which they must disclose the
findings and conclusions of any third-party due diligence report they
obtain.\141\ The rule applies to both registered and unregistered
offerings of asset-backed securities. Additionally, there is a new
requirement applicable to providers of third-party due diligence
services with respect to asset-backed securities pursuant to which they
must provide a written certification to any NRSRO that is producing a
credit rating with respect to the asset-backed security.\142\ The
certification must disclose information about the due diligence
performed, including a summary of the findings and conclusions of the
third party, and identification of any relevant NRSRO due diligence
criteria that the third party intended to meet in performing the due
diligence.
---------------------------------------------------------------------------

    \141\ These amendments are discussed below in section II.H.1. of
this release.
    \142\ These amendments are discussed below in sections II.H.2.
and II.H.3. of this release.
---------------------------------------------------------------------------

    As discussed above, the amendments and new rules are intended to
reduce asymmetric information in the asset-backed security market.
NRSROs producing credit ratings for asset-backed securities may benefit
from receiving the information in the certification. The certification
also will be signed by an individual who is duly authorized by the
third-party due diligence provider to

make such a certification, promoting confidence in the accuracy of the
information disclosed. Importantly, issuers and underwriters can no
longer select what part of this information to provide to NRSROs,
reducing the possibility of less favorable information being withheld
from NRSROs and reducing the risk that the credit ratings will be based
on imperfect or incomplete information (to the extent the NRSROs use
information about due diligence in producing their credit ratings).
Further, making this information available to all NRSROs (rather than
just the NRSROs hired to rate the asset-backed security) could promote
the issuance of more credit ratings for a given asset-backed security,
including credit ratings that provide a more diverse range of views on
the creditworthiness of the security. Users of credit ratings,
including investors and other participants in the asset-backed
securities markets, may benefit both directly and indirectly from the
disclosures made by issuers, underwriters, and providers of third-party
due diligence services. To the extent that findings and conclusions of
all third-party due diligence reports were not previously disclosed to
these persons, the amendments and new rules should enhance information
available to the public.
    Finally, there are new requirements pursuant to which NRSROs must
use the Commission's Electronic Data Gathering, Analysis, and Retrieval
(``EDGAR'') system to electronically submit Form NRSRO and required
exhibits to the form to the Commission.\143\ Having all information
available in an electronic format in EDGAR will provide a centralized
location and should make the information and the history of that
information more easily accessible, comparable, and searchable to users
of credit ratings, including investors.
---------------------------------------------------------------------------

    \143\ See section II.L. of this release (providing a more
detailed discussion of the amendments).
---------------------------------------------------------------------------

    There will be costs associated with the amendments and new rules
being adopted today that are related to enhanced disclosure and
transparency.\144\ These costs will be primarily incurred by
NRSROs,\145\ issuers and underwriters of asset-backed securities, and
third-party due diligence providers. Initial and ongoing direct costs,
including compliance costs, may vary among the affected parties
depending on their size and the complexity of their business activities
(for example, number of credit ratings outstanding, number of analysts,
number of classes of credit ratings, number of years issuing credit
ratings, and number of historical credit ratings). Keeping all other
factors constant, NRSROs operating according to a subscriber-pay model
may face greater losses in revenue from the sale of access to
historical ratings data, as more of this data becomes publicly
available, since they are likely to be more dependent on this source of
revenue than NRSROs operating according to the issuer-pay model. A
component of these costs may also be fixed, affecting more
significantly smaller NRSROs that may find it more difficult to bear
the costs. If NRSROs are not able to readily pass the overall
additional costs to clients, there may be adverse effects, especially
on smaller NRSROs.
---------------------------------------------------------------------------

    \144\ A detailed analysis of the economic costs, including
compliance costs that can potentially result from each rule is
presented in the focused economic analyses in section II of this
release. See sections II.A.4., II.B.4., II.C.3., II.D.2., II.E.4.,
II.F.3., II.G.6., II.H.4., II.I.3., II.J.3., II.K.2., II.L.2., and
II.M.5. of this release.
    \145\ NRSROs may be able to pass some of the incremental costs
to their clients.
---------------------------------------------------------------------------

    Similar to the amendments and new rules relating to governance, the
amendments and new rules relating to disclosure and transparency could
reduce the number of credit rating agencies registered with the
Commission as NRSROs to the extent that current registrants believe the
cost of being registered and subject to these new requirements
outweighs the benefit of registration. In addition, the barriers to
entry for credit rating agencies to register as NRSROs may rise,
especially for smaller credit rating agencies. NRSROs may have a
reduced incentive to register for a new class of credit ratings with
adverse effects on competition in certain market segments. Barriers to
exit from registration as an NRSRO may lower due to the possible
erosion of profit margins, though an NRSRO's decision to deregister
from certain or all classes of credit ratings may depend on whether
users of credit ratings will favor NRSROs because of the NRSRO
registration and oversight program, which is being enhanced by the
amendments and new rules being adopted today. The risk for
deregistration will likely be higher for smaller NRSROs, given the
fixed component of some compliance costs and the greater difficulty to
pass the increase in costs to their clients.
    Also, the amendments and new rules may impact competition among
third-party due diligence providers. Although the Commission knows
little about the characteristics of the market for the services they
provide, the certification requirement may increase the liability risk
for these providers, particularly for those who do not already bear
expert liability under Rule 193.\146\ If third-party due diligence
providers are not able to charge more for performing the asset review
to account for the heightened risk of liability, some providers may
exit the market or some entities that otherwise would have entered the
market may decide against doing so.
---------------------------------------------------------------------------

    \146\ See 17 CFR 230.193; 17 CFR 229.1111. Under Rule 193 and
Item 1111 of Regulation AB, an issuer of a registered asset-backed
security is required to perform a review of the assets underlying
the asset-backed security and disclose the nature of the review. In
meeting this requirement, an issuer may engage a third party to
perform the required review of the underlying assets. If the third
party's findings and conclusions are to be attributed to it, the
third-party must consent to being named in the issuer's registration
statement as an ``expert,'' thus subjecting the third party to so-
called ``expert liability'' under the Securities Act. If third-party
diligence providers are not subject to legal liability as experts,
the issuer itself remains legally accountable for the accuracy of
the disclosures it makes to investors.
---------------------------------------------------------------------------

    The amendments and new rules also may have positive effects on
competition, efficiency and capital formation. The enhanced
standardization of the information content may facilitate comparing
performance statistics and rating histories across NRSROs. Clients of
NRSROs (for example, issuers, subscribers, and others) may use the
performance statistics to inform their hiring or subscribing decisions,
increasingly promoting competition among NRSROs on the basis of the
quality of their credit ratings and the procedures and methodologies
used to determine credit ratings. To the extent that the adopted rules
facilitate the external monitoring and comparative analysis of NRSROs,
they may allow users of credit ratings to develop more refined views of
NRSRO performance and thereby indirectly increase accountability and
encourage integrity in the production of credit ratings. This, in turn,
may facilitate the ability of NRSROs to establish and maintain
reputations for issuing quality credit ratings to remain competitive.
More comparable performance data may also help relatively smaller and
newer NRSROs, including subscriber-paid NRSROs, to attract attention to
their rating performance, enhancing their ability to develop a
reputation for producing quality credit ratings. This may allow them to
better compete with more established competitors. Also, the ability of
non-hired NRSROs to obtain the information disclosed in the third-party
due diligence certification may provide them with an advantage in
producing informative unsolicited credit ratings, relative to
unregistered

credit rating agencies that cannot obtain this information.
    The new disclosure requirements in the form and certifications that
accompany a rating action may reduce information asymmetries about how
a credit rating was determined by providing additional information
about the rating process, such as assumptions, limitations, version of
the procedures or methodologies used, and, in the case of an asset-
backed security, a description of the findings and conclusions of a
third-party due diligence provider, if such services were employed. To
the extent that the required disclosure does not diminish the content
and timeliness of the information conveyed with the rating actions, the
enhanced information may increase the ability of users of credit
ratings to accurately interpret the information, potentially resulting
in more efficient investment decisions and higher overall market
efficiency to the benefit of those investors that use credit ratings.
This, in turn, may increase investors' participation in the securities
markets with positive effects on capital formation. Because of the
higher degree of information asymmetry in the asset-backed security
market, the benefits in efficiency and capital formation resulting from
the enhanced disclosure and transparency of credit ratings are likely
to be greater for these securities, with the result that investors may
become more willing to participate in this market.

II. Final Rules and Rule Amendments

    As discussed in detail below, the Commission is adopting new rules
and amendments to existing rules to implement Title IX, Subtitle C of
the Dodd-Frank Act and to enhance the NRSRO registration and oversight
program administered by the Commission. In designing rules to implement
Title IX, Subtitle C of the Dodd-Frank Act, the Commission has taken
into account section 15E(c)(2) of the Exchange Act.\147\ This section
provides, in pertinent part, that neither the Commission nor any State
(or political subdivision thereof) may regulate the substance of credit
ratings or the procedures and methodologies by which any NRSRO
determines credit ratings.\148\ One way the Commission has sought to
reconcile the rulemaking mandated by the Exchange Act, as amended by
the Dodd-Frank Act, with the limitation in section 15E(c)(2) is to
model rule text closely on statutory text.
---------------------------------------------------------------------------

    \147\ 15 U.S.C. 78o-7(c)(2).
    \148\ See 15 U.S.C. 78o-7(c)(2).
---------------------------------------------------------------------------

A. Internal Control Structure

    Section 932(a)(2)(B) of the Dodd-Frank Act added paragraph (3) to
section 15E(c) of the Exchange Act.\149\ Section 15E(c)(3)(A) requires
an NRSRO to establish, maintain, enforce, and document an effective
internal control structure governing the implementation of and
adherence to policies, procedures, and methodologies for determining
credit ratings (``internal control structure''), taking into
consideration such factors as the Commission may prescribe, by
rule.\150\ While section 15E(c)(3)(A) provides that the Commission
``may'' prescribe factors an NRSRO would need to take into
consideration when establishing, maintaining, enforcing, and
documenting the internal control structure, the requirement that an
NRSRO ``establish, maintain, enforce, and document an effective
internal control structure'' is self-executing.\151\ Consequently, an
NRSRO must adhere to this provision irrespective of whether the
Commission prescribes factors pursuant to section 15E(c)(3)(A).
---------------------------------------------------------------------------

    \149\ See Public Law 111-203, 932(a)(2)(B); 15 U.S.C. 78o-
7(c)(3)(A).
    \150\ See 15 U.S.C. 78o-7(c)(3)(A).
    \151\ See id.
---------------------------------------------------------------------------

    Section 15E(c)(3)(B) of the Exchange Act provides that the
Commission ``shall prescribe'' rules requiring each NRSRO to submit an
annual internal controls report to the Commission, which shall contain:
(1) A description of the responsibility of the management of the NRSRO
in establishing and maintaining an effective internal control
structure; (2) an assessment of the effectiveness of the internal
control structure; and (3) the attestation of the chief executive
officer (``CEO''), or equivalent individual, of the NRSRO.\152\
---------------------------------------------------------------------------

    \152\ See 15 U.S.C. 78o-7(c)(3)(B)(i) through (iii).
---------------------------------------------------------------------------

    In the proposing release, the Commission: (1) Deferred prescribing
factors the NRSRO must take into consideration in establishing,
maintaining, enforcing, and documenting an effective internal control
structure; (2) proposed amending the NRSRO recordkeeping rule (Rule
17g-2) to require that the documentation of the internal control
structure be subject to the rule's record retention requirements; and
(3) proposed amending the NRSRO annual reporting rule (Rule 17g-3) to
require an NRSRO to file an unaudited annual internal controls report
with the Commission.\153\
---------------------------------------------------------------------------

    \153\ See Nationally Recognized Statistical Rating
Organizations, 76 FR at 33421-33425.
---------------------------------------------------------------------------

1. Prescribing Factors
    In the proposing release, the Commission stated that it was
deferring prescribing factors an NRSRO must take into consideration
when establishing, maintaining, enforcing, and documenting an effective
internal control structure to provide the Commission with an
opportunity--through the NRSRO examination process and the submission
of annual reports by the NRSROs on the effectiveness of their internal
control structures--to review how NRSROs have complied with the self-
executing requirement in section 15E(c)(3)(A) of the Exchange Act to
establish, maintain, enforce, and document an effective internal
control structure.\154\ However, the Commission sought comment on
whether it would be appropriate as part of this rulemaking to prescribe
factors and on potential factors the Commission could prescribe.\155\
In particular, the Commission identified factors relating to: (1) The
establishment of an internal control structure; (2) the maintenance of
an internal control structure; and (3) the enforcement of an internal
control structure.\156\
---------------------------------------------------------------------------

    \154\ Id. at 33421-33423.
    \155\ Id.
    \156\ Id. at 33422-33423.
---------------------------------------------------------------------------

    In terms of establishing an internal control structure, the
Commission requested comment on the following factors:
     Controls reasonably designed to ensure that a newly
developed methodology or proposed update to an in-use methodology for
determining credit ratings is subject to an appropriate review process
(for example, by persons who are independent from the persons that
developed the methodology or methodology update) and to management
approval prior to the new or updated methodology being employed by the
NRSRO to determine credit ratings; \157\
---------------------------------------------------------------------------

    \157\ Section 15E(t)(3)(A) of the Exchange Act contains a self-
executing provision requiring that the board of directors of the
NRSRO shall ``oversee'' the ``establishment, maintenance, and
enforcement of policies and procedures for determining credit
ratings.'' See 15 U.S.C. 78o-7(t)(3)(A). At the same time, section
15E(r) of the Exchange Act requires the Commission to adopt rules
``to ensure that credit ratings are determined using procedures and
methodologies, including qualitative and quantitative data and
models'' that are approved by the board of the NRSRO. See 15 U.S.C.
78o-7(r)(1)(A).
---------------------------------------------------------------------------

     Controls reasonably designed to ensure that a newly
developed methodology or update to an in-use methodology for
determining credit ratings is disclosed to the public for consultation
prior to the new or updated

methodology being employed by the NRSRO to determine credit ratings,
that the NRSRO makes comments received as part of the consultation
publicly available, and that the NRSRO considers the comments before
implementing the methodology;
     Controls reasonably designed to ensure that in-use
methodologies for determining credit ratings are periodically reviewed
(for example, by persons who are independent from the persons who
developed and/or use the methodology) in order to analyze whether the
methodology should be updated;
     Controls reasonably designed to ensure that market
participants have an opportunity to provide comment on whether in-use
methodologies for determining credit ratings should be updated, that
the NRSRO makes any such comments received publicly available, and that
the NRSRO considers the comments;
     Controls reasonably designed to ensure that newly
developed or updated quantitative models proposed to be incorporated
into a credit rating methodology are evaluated and validated prior to
being put into use;
     Controls reasonably designed to ensure that quantitative
models incorporated into in-use credit rating methodologies are
periodically reviewed and back-tested;
     Controls reasonably designed to ensure that an NRSRO
engages in analysis before commencing the rating of a class of
obligors, securities, or money market instruments the NRSRO has not
previously rated to determine whether the NRSRO has sufficient
competency, access to necessary information, and resources to rate the
type of obligor, security, or money market instrument;
     Controls reasonably designed to ensure that an NRSRO
engages in analysis before commencing the rating of an ``exotic'' or
``bespoke'' type of obligor, security, or money market instrument to
review the feasibility of determining a credit rating;
     Controls reasonably designed to ensure that measures (for
example, statistics) are used to evaluate the performance of credit
ratings as part of the review of in-use methodologies for determining
credit ratings to analyze whether the methodologies should be updated
or the work of the analysts employing the methodologies should be
reviewed;
     Controls reasonably designed to ensure that, with respect
to determining credit ratings, the work and conclusions of the lead
credit analyst developing an initial credit rating or conducting
surveillance on an existing credit rating is reviewed by other
analysts, supervisors, or senior managers before a rating action is
formally taken (for example, having the work reviewed through a rating
committee process);
     Controls reasonably designed to ensure that a credit
analyst documents the steps taken in developing an initial credit
rating or conducting surveillance on an existing credit rating with
sufficient detail to permit an after-the-fact review or internal audit
of the rating file to analyze whether the analyst adhered to the
NRSRO's procedures and methodologies for determining credit ratings;
and
     Controls reasonably designed to ensure that the NRSRO
conducts periodic reviews or internal audits of rating files to analyze
whether analysts adhere to the NRSRO's procedures and methodologies for
determining credit ratings.\158\
---------------------------------------------------------------------------

    \158\ See Nationally Recognized Statistical Rating
Organizations, 76 FR at 33422.
---------------------------------------------------------------------------

    In terms of maintaining an internal control structure, the
Commission requested comment on the following factors:
     Controls reasonably designed to ensure that the NRSRO
conducts periodic reviews of whether it has devoted sufficient
resources to implement and operate the documented internal control
structure as designed;
     Controls reasonably designed to ensure that the NRSRO
conducts periodic reviews or ongoing monitoring to evaluate the
effectiveness of the internal control structure and whether it should
be updated; and
     Controls designed to ensure that any identified
deficiencies in the internal control structure are assessed and
addressed on a timely basis.\159\
---------------------------------------------------------------------------

    \159\ Id.
---------------------------------------------------------------------------

    In terms of enforcing an internal control structure, the Commission
requested comment on the following factors:
     Controls designed to ensure that additional training is
provided or discipline taken with respect to employees who fail to
adhere to requirements imposed by the internal control structure; and
     Controls designed to ensure that a process is in place for
employees to report failures to adhere to the internal control
structure.\160\
---------------------------------------------------------------------------

    \160\ Id. at 33422-33423.
---------------------------------------------------------------------------

    In terms of documenting the internal control structure, the
Commission asked for comment on whether there should be a factor
relating to the level of written detail about the internal control
structure that should be documented.\161\
---------------------------------------------------------------------------

    \161\ Id.
---------------------------------------------------------------------------

    A number of commenters addressed whether the Commission should
prescribe factors as part of this rulemaking and, if so, the type of
factors the Commission should prescribe.\162\ NRSROs urged the
Commission to defer rulemaking and stated that the Commission should
not prescribe factors.\163\ For example, one NRSRO stated that the
Commission should defer rulemaking until it has the opportunity to
determine through the examination process and its review of the NRSROs'
annual reports the ``best practices utilized'' by NRSROs to comply with
the self-executing requirement in section 15E(c)(3)(A) and that the
Commission's ``examination feedback regarding best practices related to
internal controls will be an important element for the adequate design
and monitoring of internal controls.'' \164\ Another NRSRO stated that
it ``strongly agrees'' with the Commission's proposal to defer
rulemaking but that, if the Commission proceeds with rulemaking, it
should ``exercise caution'' because attempting to create a ``one-size
fits all'' rule in ``such a short timeframe could result in the
creation of an anti-competitive environment and the attendant
unintended consequences.'' \165\ A third NRSRO stated that ``NRSROs
should have the flexibility to implement whatever control structure
suits their size and particular business operations.'' \166\
---------------------------------------------------------------------------

    \162\ See AFSCME Letter; A.M. Best Letter; Better Markets
Letter; CFA/AFR Letter; CFA II Letter; COPERA Letter; DBRS Letter;
Kroll Letter; Levin Letter; Morningstar Letter; S&P Letter;
TradeMetrics Letter.
    \163\ See A.M. Best Letter; DBRS Letter; Kroll Letter;
Morningstar Letter; S&P Letter.
    \164\ See Morningstar Letter.
    \165\ See A.M. Best Letter (``prescribing specific factors
implies that all NRSROs are the same, which they are not. NRSROs
vary in size, ownership, business plans, and management. `Specific
factors' would undoubtedly be designed to apply to the largest
NRSROs--this scenario would create a disproportionate impact on
smaller NRSROs, whose internal control structure would be best
served by designing and implementing policies and procedures that
apply the law to the specific characteristics of the NRSRO.'').
    \166\ See DBRS Letter.
---------------------------------------------------------------------------

    In contrast, several other commenters stated that the Commission
should not defer rulemaking.\167\ For example, one commenter stated
that the Commission ``already has significant information about the
weak internal controls at the NRSROs and has already identified a
number of factors critical to an effective internal control system''
and that ``[p]ostponing the issuance of any standards will result in
the NRSROs developing different internal control

structures, making oversight and the implementation of minimum
standards more difficult, time consuming, and expensive down the
line.'' \168\ Another commenter stated that the proposed approach
``will be ineffective in reforming credit rating agency practices and
will leave the Commission with little if any ability to hold ratings
agencies accountable if they adopt weak and ineffective controls.''
\169\ These commenters and others recommended that the Commission
prescribe factors,\170\ and one of the commenters recommended that the
Commission re-propose the rule to prescribe factors.\171\
---------------------------------------------------------------------------

    \167\ See AFR II Letter; AFSCME Letter; Better Markets Letter;
CFA/AFR Letter; COPERA Letter; Levin Letter.
    \168\ See Levin Letter.
    \169\ See CFA/AFR Letter. See also CFA II Letter.
    \170\ See AFGI Letter; AFSCME Letter; Better Markets Letter;
CFA/AFR Letter; COPERA Letter; Harrington Letter; Levin Letter;
TradeMetrics Letter.
    \171\ See CFA II Letter
---------------------------------------------------------------------------

    One commenter discussed factors that the commenter believed should
be included in ``a set of mandatory minimum standards for an effective
internal control system for credit ratings.'' \172\ Another commenter
stated that ``the criteria on which the Commission seeks comment are
precisely the sort of controls that ought to be in place if the system
is operating effectively.'' \173\ A third commenter agreed that the
rule should ``incorporate all of these factors [as described in the
proposing release].'' \174\ Two commenters pointed to the internal
control framework developed by the Committee of Sponsoring
Organizations of the Treadway Commission in 1992 as a model.\175\ Two
commenters stated that the rule should require that the documentation
of the internal control structure include specific elements, such as
how the board of directors conducted its oversight of the internal
control structure.\176\
---------------------------------------------------------------------------

    \172\ See Levin Letter.
    \173\ See CFA/AFR Letter.
    \174\ See Better Markets Letter.
    \175\ See CFA/AFR Letter; AFSCME Letter.
    \176\ See AFSCME Letter (stating that the NRSRO should be
required to document: the control environment; risk assessment;
control activities; and information and communication within the
NRSRO); CFA/AFR Letter (stating that the NRSRO should be required to
document: The design of the system of internal controls; the
evidence obtained and conclusions reached during testing of the
effectiveness of the internal controls; material weaknesses
identified and how they were remediated; how the board of directors
conducted its oversight; significant matters that arose in the
design, operation, or monitoring of internal controls and how they
were resolved; and the basis for reports to the Commission on the
effectiveness of the internal control structure).
---------------------------------------------------------------------------

    The Commission believes it is critically important to investors and
other users of credit ratings that, as required by section 15E(c)(3)(A)
of the Exchange Act, NRSROs establish, maintain, enforce, and document
an effective internal control structure governing the implementation of
and adherence to their policies, procedures, and methodologies for
determining credit ratings.\177\ The Commission agrees that the
requirements established by the NRSROs to address the internal control
structure should ``provide the companies' management the ability to
effectively administer their internal compliance measures, and instill
confidence in their investors and the public that the companies in fact
are achieving the objectives of their internal control rules and, in so
doing, promoting ratings that are high-quality, objective, independent,
reliable, and free from influence by any conflicts of interest.'' \178\
This is one of the reasons that the Commission previously has expressed
concerns about--and has taken action to address--the integrity of
policies, procedures, and methodologies for determining credit ratings
used by certain NRSROs in light of the role these NRSROs played in
determining credit ratings for securities collateralized by or linked
to subprime residential mortgages.\179\
---------------------------------------------------------------------------

    \177\ See 15 U.S.C. 78o-7(c)(3)(A).
    \178\ See CFA II Letter.
    \179\ See, e.g., Proposed Rules for Nationally Recognized
Statistical Rating Organizations, 73 FR 36212; Amendments to Rules
for Nationally Recognized Statistical Rating Organizations, 74 FR
63832; 2008 Staff Inspection Report.
---------------------------------------------------------------------------

    Moreover, the Commission staff conducts annual examinations of each
NRSRO and publishes a report summarizing the essential findings of the
examinations, as required by section 15E(p)(3) of the Exchange
Act.\180\ The annual report attributes the essential findings, as
applicable, to the ``smaller'' NRSROs or ``larger'' NRSROs, and
describes for the public the nature and extent of the deficiencies
cited. The Commission staff, as part of the annual examination of each
NRSRO, reviews whether the internal control structure of the NRSRO is
effective as required by section 15E(c)(3)(A) of the Exchange Act.\181\
---------------------------------------------------------------------------

    \180\ See 15 U.S.C. 78o-7(p)(3).
    \181\ See 15 U.S.C. 78o-7(c)(3)(A). See also 15 U.S.C. 78o-
7(p)(3)(B) (requiring the Commission to review, among other things,
whether the NRSRO conducts business in accordance with the policies,
procedures, and rating methodologies of the NRSRO, the internal
supervisory controls of the NRSRO, and the governance of the NRSRO).
---------------------------------------------------------------------------

    For example, in the annual report published in December 2013, the
Commission staff noted that all NRSROs had ``added or improved internal
controls over the rating process'' since the examinations began in 2010
and generally improved adherence to their rating policies and
procedures, which ``appear[ed] to be attributable, in part, to
improvements in the internal control structure at NRSROs.'' \182\
However, in several instances the staff found that an NRSRO did not
follow its policies and procedures and the staff recommended that the
NRSRO improve its internal controls to ensure compliance with the
policies and procedures.\183\ In particular, the Commission staff cited
section 15E(c)(3)(A) of the Exchange Act in its report and stated that
many NRSROs relied on a testing or internal audit program as an
internal supervisory control.\184\ The staff then described certain
weaknesses it found in those controls, and recommended that those
NRSROs improve and better document their testing and audit
programs.\185\
---------------------------------------------------------------------------

    \182\ See 2013 Annual Staff Inspection Report, p. 8.
    \183\ See, e.g., 2013 Annual Staff Inspection Report, p. 10
(discussing Commission staff finding that an NRSRO did not
consistently follow its policies and procedures for rating criteria
development).
    \184\ See 2013 Annual Staff Inspection Report, p. 18.
    \185\ See id.
---------------------------------------------------------------------------

    Deficiencies in the internal control structure found by the
examination staff are brought to the attention of the NRSRO, and the
staff monitors whether and how those deficiencies are addressed. If
warranted, the examination staff also can refer an NRSRO to the
enforcement staff for potential violations of section 15E(c)(3)(A).
    Given the importance of the NRSROs' internal control structures,
the Commission believes that an NRSRO should be required to consider
the factors identified in the proposing release when establishing,
maintaining, enforcing, and documenting an effective internal control
structure. The exercise of considering these factors will provide the
NRSROs with an opportunity to critically evaluate the effectiveness of
their existing internal control structures and new registrants a
reference point for designing or modifying existing internal control
structures to comply with the statutory requirement. This should
improve the overall effectiveness of the internal control structures of
the NRSROs.
    Consequently, the Commission is adding paragraph (d) to new Rule
17g-8 to provide that an NRSRO must consider certain factors when
establishing, maintaining, enforcing, or documenting an effective
internal control structure governing the implementation of and
adherence to policies, procedures, and methodologies for determining
credit ratings pursuant to section 15E(c)(3)(A) of the Act.\186\ The
factors identified in this paragraph are

the same factors the Commission identified in the proposing
release.\187\ Paragraph (d)(1) identifies the factors relating to
establishing an effective internal control structure, paragraph (d)(2)
identifies the factors relating to maintaining an effective internal
control structure, and paragraph (d)(3) identifies the factors relating
to enforcing an effective internal control structure.\188\
---------------------------------------------------------------------------

    \186\ See paragraph (d) of Rule 17g-8.
    \187\ See id. See also Nationally Recognized Statistical Rating
Organizations, 76 FR at 33422-33423.
    \188\ See paragraphs (d)(1) through (3) of Rule 17g-8.
---------------------------------------------------------------------------

    In considering a given factor, an NRSRO should determine whether it
would be appropriate for the firm's internal control structure.
Moreover, paragraphs (d)(1), (d)(2), and (d)(3) contain a ``catchall''
provision that provides that the NRSRO must consider any other controls
necessary to establish, maintain, or enforce an effective internal
control structure taking into consideration the nature of the business
of the NRSRO, including its size, activities, organizational structure,
and business model. The Commission is including the catchall provisions
because the factors identified in paragraph (d) of Rule 17g-8 may not
be comprehensive or sufficient for the circumstances of a particular
NRSRO. An NRSRO should not treat them as a checklist or ``safe harbor''
that allows the firm to conclude that it has established, maintained,
enforced, and documented an effective internal control structure.
    Paragraph (d)(4) of Rule 17g-8 addresses the documentation of the
internal control structure.\189\ In the proposing release, the
Commission did not identify a factor relating to this provision of the
statute.\190\ Consequently, paragraph (d)(4) does not identify a
specific factor.\191\ Instead, the paragraph provides--consistent with
the catchall provisions in paragraphs (d)(1) through (d)(3)--that an
NRSRO must take into consideration any controls necessary to document
an effective internal control structure taking into consideration the
nature of the business of the nationally recognized statistical rating
organization, including its size, activities, organizational structure,
and business model.\192\
---------------------------------------------------------------------------

    \189\ See paragraph (d)(4) of Rule 17g-8.
    \190\ See Nationally Recognized Statistical Rating
Organizations, 76 FR at 33421-33423.
    \191\ See paragraph (d)(4) of Rule 17g-8.
    \192\ Id.
---------------------------------------------------------------------------

    Finally, in adopting the final rule, the Commission has taken into
account comments from NRSROs that it should not prescribe factors or
``exercise caution'' in doing so because ``NRSROs should have the
flexibility to implement whatever control structure suits their size
and particular business operations'' \193\ and attempting to create a
``one-size fits all'' rule in ``could result in the creation of an
anti-competitive environment and the attendant unintended
consequences.'' \194\ In particular, the Commission notes that, while
the Commission is prescribing factors an NRSRO must consider, it is not
mandating that a specific factor be implemented. Consequently, while
NRSROs must consider the factors identified by the Commission, they can
tailor their internal control structures to their particular
circumstances.
---------------------------------------------------------------------------

    \193\ See DBRS Letter.
    \194\ See A.M. Best Letter (``prescribing specific factors
implies that all NRSROs are the same, which they are not. NRSROs
vary in size, ownership, business plans, and management. `Specific
factors' would undoubtedly be designed to apply to the largest
NRSROs--this scenario would create a disproportionate impact on
smaller NRSROs, whose internal control structure would be best
served by designing and implementing policies and procedures that
apply the law to the specific characteristics of the NRSRO.'').
---------------------------------------------------------------------------

2. Amendment to Rule 17g-2
    Section 15E(c)(3)(A) of the Exchange Act contains a self-executing
provision that requires an NRSRO, among other things, to document its
internal control structure.\195\ However, the statute does not
prescribe how an NRSRO must maintain this record. For example, the
statute does not prescribe how long the record must be retained or the
manner in which it must be maintained. Consequently, the Commission
proposed adding paragraph (b)(12) to Rule 17g-2 to identify the
internal control structure an NRSRO must document pursuant to
15E(c)(3)(A) of the Exchange Act as a record that must be
retained.\196\ As a result, the various retention and production
requirements of paragraphs (c), (d), (e), and (f) of Rule 17g-2 would
apply to the record documenting the internal control structure.\197\
---------------------------------------------------------------------------

    \195\ See 15 U.S.C. 78o-7(c)(3)(A).
    \196\ See proposed paragraph (b)(12) of Rule 17g-2; Nationally
Recognized Statistical Rating Organizations, 76 FR at 33423, 33539.
    \197\ See 17 CFR 240.17g-2(c) through (f).
---------------------------------------------------------------------------

    Two commenters expressed support for the proposal,\198\ whereas
three other commenters raised concerns which are discussed below.\199\
The Commission is adding paragraph (b)(12) to Rule 17g-2 as
proposed.\200\ Retention of the record will provide a means for the
Commission to monitor the NRSROs' compliance with 15E(c)(3)(A) of the
Exchange Act.
---------------------------------------------------------------------------

    \198\ See DBRS Letter; S&P Letter.
    \199\ See AFSCME Letter; A.M.Best Letter; Lambert Letter.
    \200\ See paragraph (b)(12) of Rule 17g-2. Section 17(a)(1) of
the Exchange Act requires an NRSRO to make and keep such records,
and make and disseminate such reports, as the Commission prescribes
by rule as necessary or appropriate in the public interest, for the
protection of investors, or otherwise in furtherance of the Exchange
Act. 15 U.S.C. 78q(a)(1).
---------------------------------------------------------------------------

    In addition, the Commission is amending paragraph (c) of Rule 17g-
2. Prior to today's amendments, this paragraph provided that the
records required to be retained under paragraphs (a) and (b) of Rule
17g-2 must be retained for three years after the date the record is
made or received. The modification clarifies that the records
documenting the internal control structure, the policies and procedures
discussed in sections II.C., II.F., and II.J. of this release, and the
standards discussed in section II.I. of this release must all be
retained until three years after the record is replaced with an updated
record (that is, when a control, policy, procedure, or standard
documented in one of these records is replaced with a new control,
policy, procedure, or standard).\201\
---------------------------------------------------------------------------

    \201\ See paragraph (c) of Rule 17g-2 (providing that the
records required to be retained pursuant to paragraphs (a) and (b)
of the rule must be retained for three years after the date the
record is made or received, except that a record identified in
paragraph (a)(9), (b)(12), (b)(13), (b)(14), or (b)(15) of the rule
must be retained until three years after the date the record is
replaced with an updated record).
---------------------------------------------------------------------------

    The reason for this clarifying amendment is that the text of
paragraph (c) of Rule 17g-2 prior to today's amendment was intended to
address records that generally contain historical information. For
example, the rule requires the retention of records reflecting entries
to and balances in all general ledger accounts, records indicating the
identity of any credit analyst(s) that participated in determining a
credit rating, credit analysis reports, credit assessment reports, and
private credit rating reports.\202\ The intent of the three-year record
retention requirement is to preserve these records documenting
historical information for three years after the fact in order to allow
Commission examiners the opportunity to review the past activities of
the NRSRO as reflected in these records. It also provides the NRSRO
with records that can be used in connection with internal or third-
party audits and for tracking past activities.
---------------------------------------------------------------------------

    \202\ See, e.g., 17 CFR 240.17g-2(a)(1), (a)(2)(i), and (b)(3).
---------------------------------------------------------------------------

    The Commission intended the three-year record retention provision
in paragraph (c) of Rule 17g-2 as applied to the documentation of the
internal control structure, the policies and

procedures, and the standards to also preserve historical information
for three years after the fact to facilitate Commission examinations
and NRSRO internal or third party audits of past activities. However,
the record reflects current rather than historical information until
there is an update of the internal control structure, policies and
procedures, or standards documented in the record (that is, the record
reflects the internal controls, policies and procedures, or standards,
as applicable, that govern the NRSRO's conduct now and in the future).
Consequently, because paragraph (c) of Rule 17g-2--prior to today's
amendments--required a record ``to be retained for three years after
the date the record is made or received,'' this provision as applied to
the documentation of the internal control structure, policies and
procedures, and standards would be ambiguous as to whether the record
must be retained for three years after the information reflected in the
record is no longer current.
    For example, section 15E(c)(3)(A) of the Exchange Act requires an
NRSRO to document its internal control structure.\203\ This means that
at all times the NRSRO must document the internal control structure
that is in effect and, consequently, if a given version of an internal
control structure is in effect for more than three years, the NRSRO
must continue to maintain the record documenting the internal control
structure even though three years have elapsed since the record was
made. The clarifying text being added to paragraph (c) of Rule 17g-2
addresses an ambiguity in the rule text. This ambiguity could be read
to establish a three-year retention period that is largely meaningless
and is inconsistent with the Commission's intent that these records be
retained for three years after the information in the record is no
longer current.\204\ Specifically, without the clarifying amendment,
paragraph (c) of Rule 17g-2 could be read to provide that the three-
year retention period begins to run at the time the internal control
structure was first documented. Under this reading, the rule would be
redundant because it would prescribe a retention period that is already
addressed by the self-executing requirement in section 15E(c)(3)(A) of
the Exchange Act (that an NRSRO must document its internal control
structure). In other words, the statutory requirement to document the
internal control structure acts as a retention requirement for as long
as the current version of the internal control structure is in effect.
Further, under this reading of the rule, if an internal control
structure was in effect for three or more years, an NRSRO could discard
the record documenting the previous internal control structure as soon
as it is replaced with an updated record documenting the revised
internal control structure (as it would have retained the previous
record of the internal control structure for three or more years). This
could prevent the Commission from reviewing whether the NRSRO adhered
to its previous internal control structure, as examinations generally
review past activities. The appropriate and intended retention period
is until three years after the internal control structure is updated.
As a result, the documentation recording the current internal control
structure and the documentation recording any prior versions of the
internal control structure that were updated within three years will be
available to Commission examiners. This will create an audit trail
between prior versions of the internal control structure and the
existing internal control structure. For these reasons, the Commission
is amending paragraph (c) of Rule 17g-2 to make clear that the records
documenting the internal control structure, the policies and
procedures, and the standards must be retained until three years after
the date the record is replaced with an updated record.\205\
---------------------------------------------------------------------------

    \203\ See 15 U.S.C. 78o-7(c)(3)(A).
    \204\ See paragraph (c) of Rule 17g-2 (providing that the
records must be retained until three years after the date the record
is replaced with an updated record).
    \205\ See sections II.C.2., II.F.2., II.I.2., and II.J.2.
(discussion the amendments to Rule 17g-2 to establish record
retention requirements for the records documenting policies and
procedures or standards).
---------------------------------------------------------------------------

    One commenter stated that a three-year retention period is
``insufficient,'' since ``the effects of a credit rating decision may
not arise until after that retention period expires.'' \206\ The
Commission believes the three year retention period is sufficient.
First, as noted above, an NRSRO must maintain a record documenting its
existing internal control structure for as long as the internal control
structure is in effect and for an additional three years after the
record is replaced with an updated record documenting the internal
control structure. Second, the Commission staff performs an annual
examination of each NRSRO. Consequently, the record documenting an
internal control structure that is no longer in effect will be
available for several exam cycles.
---------------------------------------------------------------------------

    \206\ See Lambert Letter. This commenter also suggested that the
final amendments mandate record retention requirements of seven
years, ``similar to section 802 of the Sarbanes-Oxley Act.''
---------------------------------------------------------------------------

    Another commenter suggested requiring that documentation be made
available to the Commission ``regardless of where the credit rating is
produced.'' \207\ The Commission notes that under the rules, regardless
of where a credit rating is produced, an NRSRO must document its
internal control structure and produce to Commission staff the records
documenting both its current internal control structure and any prior
versions of the internal control structure that are within the three-
year retention period.\208\
---------------------------------------------------------------------------

    \207\ See AFSCME Letter.
    \208\ See 15 U.S.C. 78o-7(c)(3)(A). See also paragraph (d) of
Rule 17g-2, which requires, among other things, that an NRSRO
maintain each record identified in paragraphs (a) and (b) in a
manner that makes the original record or copy easily accessible to
the principal office of the NRSRO. 17 CFR 240.17g-2(d).
---------------------------------------------------------------------------

    A third commenter stated that the requirement to document internal
controls is burdensome, particularly for smaller NRSROs, and argued
that documenting policies and procedures ``naturally coincide with the
establishment of a properly functioning internal controls structure,''
which the NRSRO should be allowed to establish on its own, and the
commenter urged the Commission to exclude ``extensive or overly-
inclusive documentation requirements'' should it adopt new paragraph
(b)(12) of Rule 17g-2.\209\ In response, the Commission notes that
section 15E(c)(3)(A)--not Rule 17g-2--requires an NRSRO to document its
internal control structure.\210\ The amendment to Rule 17g-2
establishes retention requirements for this documentation.
---------------------------------------------------------------------------

    \209\ See A.M. Best Letter.
    \210\ See 15 U.S.C. 78o-7(c)(3)(A).
---------------------------------------------------------------------------

3. Amendments to Rule 17g-3
    Section 15E(c)(3)(B) of the Exchange Act provides that the
Commission shall prescribe rules requiring an NRSRO to submit an annual
internal controls report to the Commission, which must contain: (1) A
description of the responsibility of management in establishing and
maintaining an effective internal control structure; (2) an assessment
of the effectiveness of the internal control structure; and (3) the
attestation of the CEO or equivalent individual.\211\
---------------------------------------------------------------------------

    \211\ See 15 U.S.C. 78o-7(c)(3)(B)(i) through (iii).
---------------------------------------------------------------------------

    The Commission proposed amending Rule 17g-3 to implement the
rulemaking mandated by section 15E(c)(3)(B) of the Exchange Act.\212\

Rule 17g-3 requires an NRSRO to furnish annual reports to the
Commission.\213\ In particular, before today's amendments, paragraph
(a) of Rule 17g-3 required an NRSRO to furnish five or, in some cases,
six separate reports within ninety days after the end of the NRSRO's
fiscal year and identified the reports that must be furnished.\214\ The
first report containing the NRSRO's financial statements must be
audited; the remaining reports on revenues and other matters may be
unaudited.\215\ Before today's amendments, paragraph (b) of Rule 17g-3
provided that the NRSRO must attach to the reports a signed statement
by a duly authorized person that the person has responsibility for the
reports and, to the best knowledge of the person, the reports fairly
present, in all material respects, the information contained in the
reports.\216\
---------------------------------------------------------------------------

    \212\ See Nationally Recognized Statistical Rating
Organizations, 76 FR at 33423-33425; 15 U.S.C. 78o-7(c)(3)(B)(i)
through (iii). In addition, as a technical amendment, the Commission
proposed to amend the title of Rule 17g-3 to replace the words
``financial reports'' with the words ``financial and other
reports.'' Nationally Recognized Statistical Rating Organizations,
76 FR at 33424, n.25. The Commission stated that the report
identified in paragraph (a)(6) of Rule 17g-3, the proposed internal
control report that would be required under paragraph (a)(7), and
the compliance report that would be required under paragraph (a)(8)
(which is discussed below in section II.K. of this release) are not
financial in nature. Id. The Commission also proposed adding the
word ``filed'' in the title of Rule 17g-3 to conform to amendments
the Dodd-Frank Act made to section 15E of the Exchange Act. See
Public Law 111-203, 932(a).
    \213\ See 17 CFR 240.17g-3.
    \214\ See Nationally Recognized Statistical Rating
Organizations, 76 FR at 33423.
    \215\ See id.
    \216\ See id.
---------------------------------------------------------------------------

    The proposed amendments would add paragraph (a)(7) to Rule 17g-3 to
require an NRSRO to file an additional report--which would be
unaudited--with its annual submission of reports pursuant to Rule 17g-
3.\217\ The proposed rule text describing the report that would need to
be filed closely mirrored the statutory text.\218\ In particular,
proposed paragraph (a)(7) would have required that the internal
controls report contain: (1) A description of the responsibility of
management in establishing and maintaining an effective internal
control structure; and (2) an assessment by management of the
effectiveness of the internal control structure.\219\
---------------------------------------------------------------------------

    \217\ See paragraph (a)(7) of Rule 17g-3, as proposed;
Nationally Recognized Statistical Rating Organizations, 76 FR at
33539. As discussed below, while the report will not be audited, it
will be reviewed by Commission examination staff.
    \218\ Compare paragraph (a)(7) of Rule 17g-3, as proposed, with
15 U.S.C. 78o-7(c)(3)(B)(i) through (ii).
    \219\ See paragraph (a)(7) of Rule 17g-3, as proposed;
Nationally Recognized Statistical Rating Organizations, 76 FR at
33539.
---------------------------------------------------------------------------

    Section 15E(c)(3)(B)(iii) of the Exchange Act provides that the
annual internal controls report must contain an attestation of the
NRSRO's CEO or equivalent individual.\220\ Accordingly, the Commission
proposed amending paragraph (b) of Rule 17g-3 to require that the NRSRO
attach to the report a signed statement by the CEO or, if the firm does
not have a CEO, an individual performing similar functions.\221\
---------------------------------------------------------------------------

    \220\ See 15 U.S.C. 78o-7(c)(3)(B)(iii).
    \221\ See paragraph (b) of Rule 17g-3, as proposed; Nationally
Recognized Statistical Rating Organizations, 76 FR at 33539. In
particular, the Commission proposed re-organizing paragraph (b) of
Rule 17g-3 into paragraphs (b)(1) and (b)(2). As proposed, paragraph
(b)(1) would contain the current requirement that the NRSRO must
attach to each of the annual reports required pursuant to paragraphs
(a)(1) through (6) a signed statement by a duly authorized person
associated with the NRSRO stating that the person has responsibility
for the financial reports and, to the best knowledge of the person,
the reports fairly present, in all material respects, the
information required to be contained in the reports. As proposed,
paragraph (b)(2) of Rule 17g-3 would require that the NRSRO attach
to the report filed pursuant to paragraph (a)(7) a signed statement
by the CEO of the NRSRO or, if the NRSRO does not have a CEO, an
individual performing similar functions, stating that the CEO or
individual has responsibility for the report and, to the best
knowledge of the CEO or other individual, the report fairly
presents, in all material respects, a description of the
responsibility of management in establishing and maintaining an
effective internal control structure and an assessment of the
effectiveness of the internal control structure.
---------------------------------------------------------------------------

    The Commission is adding paragraphs (a)(7) and (b)(2) to Rule 17g-3
with modifications from the proposal in response to comments.\222\ As
discussed below, the modifications to the text of paragraph (a)(7) are
designed to provide more guidance to NRSROs on the information that
must be included in the report compared to the proposed rule text,
which--as noted above--closely mirrored the statutory text.
---------------------------------------------------------------------------

    \222\ See paragraph (a)(7) of Rule 17g-3. The amendments to Rule
17g-3 also replace the phrase ``financial reports'' with the phrase
``financial and other reports'' and replace the phrase ``to be
furnished'' with the phrase ``to be filed or furnished.'' These
amendments are being adopted as proposed.
---------------------------------------------------------------------------

    Paragraph (a)(7)--as proposed and adopted--requires an NRSRO to
include in the report a description of the responsibility of management
in establishing and maintaining an effective internal control
structure.\223\ This rule text largely mirrors the statutory text.\224\
A number of commenters addressed the level of management that should
have primary responsibility for establishing and maintaining an
effective internal control structure and for assessing its
effectiveness.\225\ An NRSRO stated that the CEO (or equivalent) and
other management, supervisory, and compliance personnel affiliated with
the NRSRO should be responsible for designing the structure, and that
the board of directors should oversee the structure.\226\ Two other
commenters stated that the board of directors should oversee the
structure.\227\ An NRSRO stated that the wording in the proposed rule
was reasonable, but that the Commission should refrain from specifying
which level of management should be responsible for establishing and
maintaining the system and that this determination ``is best left to
each NRSRO based upon its business needs and organization.'' \228\
Similarly, another NRSRO stated that management and board oversight of
the internal control structure will vary greatly between each NRSRO
and, therefore, such determinations should be left to each NRSRO.\229\
On the other hand, a commenter suggested that management should have no
part in the establishment or maintenance of an internal control
structure, and that a committee of analysts should assess the
effectiveness of the NRSRO's internal control structure.\230\
---------------------------------------------------------------------------

    \223\ See paragraph (a)(7)(i)(A) of Rule 17g-3.
    \224\ Compare paragraph (a)(7)(i)(A) of Rule 17g-3, with 15
U.S.C. 78o-7(c)(3)(B)(i).
    \225\ See AFSCME Letter; CFA/AFR Letter; Harrington Letter;
Kroll Letter; Morningstar Letter; S&P Letter.
    \226\ See Morningstar Letter.
    \227\ See AFSCME Letter; CFA/AFR Letter.
    \228\ See S&P Letter.
    \229\ See Kroll Letter.
    \230\ See Harrington Letter (suggesting the formation of a
``Committee Assessment Function'' that would be ``devoted solely to
evaluating the committee performance over the course of a year of
all members regardless of title'' and would ``bypass management
entirely and report directly to a board member tasked with sole
responsibility for this function'').
---------------------------------------------------------------------------

    In response to these comments, the Commission notes that section
15E(t)(3)(C) of the Exchange Act prescribes a self-executing
requirement that the board of directors of the NRSRO shall ``oversee''
the ``effectiveness of the internal control system with respect to the
policies and procedures for determining credit ratings. '' \231\
Moreover, as discussed above, the self-executing provision in section
15E(c)(3)(A) requires an NRSRO to establish, maintain, enforce, and
document an effective internal control structure.\232\ Further, section
15E(c)(3)(B) of the Exchange Act refers, in pertinent part, to ``a
description of the responsibility of the management of the [NRSRO] in
establishing and maintaining an effective internal control

structure.'' \233\ Moreover, this section of the statute also provides
that the annual internal controls report--which must include an
assessment of the effectiveness of the internal control structure--must
contain an attestation of the NRSRO's CEO or equivalent
individual.\234\ Consequently, a reasonable interpretation of these
statutory provisions is that they allocate responsibility to the
NRSRO's board to ``oversee'' the effectiveness of the internal control
structure and responsibility to the NRSRO's management to establish,
maintain, enforce, and document the internal control structure and to
report annually on its effectiveness. This interpretation also is
consistent with the Commission's understanding of how the
responsibilities of a firm's board and management generally are
allocated.
---------------------------------------------------------------------------

    \231\ See 15 U.S.C. 78o-7(t)(3)(A).
    \232\ See 15 U.S.C. 78o-7(c)(3)(A).
    \233\ See 15 U.S.C. 78o-7(c)(3)(B)(i).
    \234\ See 15 U.S.C. 78o-7(c)(3)(B)(ii) and (iii).
---------------------------------------------------------------------------

    While it is the responsibility of management to establish,
maintain, enforce, and document the internal control structure, in
carrying out this responsibility management could, as a matter of good
practice, consider the extent to which other persons within the NRSRO
should be involved.\235\ For example, management could seek input from
persons within the NRSRO that carry out the day-to-day functions
related to governing the implementation of and adherence to policies,
procedures, and methodologies for determining credit ratings. This
could include input from persons responsible for determining credit
ratings, developing rating methodologies, and reviewing and monitoring
the NRSRO's compliance with its policies, procedures, and
methodologies. In addition, establishing a mechanism for persons within
the NRSRO to report, on a confidential basis if they choose, directly
to the board of directors any material weaknesses in the NRSRO's
internal control structure could be a useful check on management's
annual assessment of the effectiveness of the internal control
structure and could assist the board in its responsibility to oversee
the effectiveness of the internal control structure. Finally, an NRSRO
could consider developing procedures to identify and address internal
conflicts of interest that potentially could prevent an independent,
impartial, and unbiased assessment of the effectiveness of the internal
control structure. This could promote more accurate reporting by the
NRSRO on the internal control structure.
---------------------------------------------------------------------------

    \235\ See Harrington Letter; Morningstar Letter.
---------------------------------------------------------------------------

    In addition to the description of the responsibility of management
in establishing and maintaining an effective internal control
structure, the proposal required that the internal controls report
include ``an assessment by management of the effectiveness of the
internal control structure.'' \236\ As discussed in more detail below,
several commenters stated that the Commission should strengthen the
reporting requirement in the rule relating to the assessment of the
effectiveness of the internal control structure.\237\
---------------------------------------------------------------------------

    \236\ See Nationally Recognized Statistical Rating
Organizations, 76 FR at 33539. This provision of the proposed
amendment largely mirrored the statutory text. See 15 U.S.C. 78o-
7(c)(3)(B)(ii).
    \237\ See AFSCME Letter; CFA/AFR Letter. These two commenters
stated that the rule should require reporting on: (1) The period of
time to which management's assessment relates, which should be the
entire year; (2) the benchmark or framework used in assessing
internal controls, as well as the definition of internal control
used; (3) the statement that the board of directors is responsible
for overseeing the system of internal controls; (4) if a material
weakness was detected during the year, a description of that
material weakness and whether it has been remediated (and how) as of
the end of that year; and (5) non-compliance with applicable laws
and regulations that have been identified, consistent with the
Yellow Books standard of the General Accounting Office (``GAO'').
---------------------------------------------------------------------------

    The Commission is persuaded that the proposal should be modified to
provide more clarity on the information that must be reported in the
internal controls report. In particular, paragraph (a)(7) of Rule 17g-
3, as adopted, requires that the internal controls report include (in
addition to a description of the responsibility of management in
establishing and maintaining an effective internal control structure):
(1) A description of each material weakness in the internal control
structure identified during the fiscal year, if any, and a description,
if applicable, of how each identified material weakness was addressed;
and (2) a statement as to whether the internal control structure was
effective as of the end of the fiscal year.\238\ Consequently, the
final amendment provides more specificity as to the information that
must be included in the internal controls report in terms of assessing
the effectiveness of the NRSRO's internal control structure.\239\
---------------------------------------------------------------------------

    \238\ See paragraph (a)(7)(i) of Rule 17g-3.
    \239\ See paragraphs (a)(7)(i)(B) and (C) of Rule 17g-3. As
discussed above, the proposal would have required the report to
include an ``assessment by management of the effectiveness of the
internal control report.'' See Nationally Recognized Statistical
Rating Organizations, 76 FR at 33539. This more general description
of what must be contained in the internal controls report is being
moved to the prefatory text of paragraph (a)(7)(i) of Rule 17g-3.
---------------------------------------------------------------------------

    Further, in response to comments that the rule should specify that
the assessment covers the entire year, the Commission has made several
modifications to the proposal.\240\ Specifically, the prefatory text of
paragraph (a)(7)(i) of Rule 17g-3, as amended, provides that the
internal controls report must contain an assessment by management of
the effectiveness during the fiscal year of the internal control
structure.\241\ The amendment further requires that the report must
include a description of each material weakness in the internal control
structure identified during the fiscal year, if any, and a description,
if applicable, of how each identified material weakness was
addressed.\242\ Consequently, the reporting relating to material
weaknesses must cover the entire fiscal year. The amendment also
requires that the internal controls report contain a statement as to
whether the internal control structure was effective as of the end of
the fiscal year.\243\ Thus, this statement in the report relates to a
point in time: The fiscal year end. However, the assessment of whether
the internal control structure is effective as of the fiscal year end
will depend on how the NRSRO addressed any material weaknesses
identified during the fiscal year.\244\
---------------------------------------------------------------------------

    \240\ See AFSCME Letter; CFA/AFR Letter.
    \241\ See paragraph (a)(7)(i) of Rule 17g-3 (emphasis added).
    \242\ See paragraph (a)(7)(i)(B) of Rule 17g-3 (emphasis added).
The Commission expects the description to include the nature and the
duration of the material weakness.
    \243\ See paragraph (a)(7)(i)(C) of Rule 17g-3 (emphasis added).
    \244\ As discussed below, paragraph (a)(7)(ii) of Rule 17g-3
provides that management is not permitted to conclude that the
internal control structure was effective as of the end of the fiscal
year if there were one or more material weaknesses in the internal
control structure as of the end of the fiscal year.
---------------------------------------------------------------------------

    Commenters also addressed how to assess the internal control
structure. One commenter pointed to the internal control framework
developed by the Committee of Sponsoring Organizations (``COSO'') of
the Treadway Commission in 1992 as a model.\245\ Another commenter
stated that the Commission should establish a framework against which
the internal controls of an NRSRO can be measured that would identify
the objectives of the controls, set forth mandatory minimum components,
and specify how a material weakness would be handled.\246\ Some
commenters suggested that the Commission clarify how an NRSRO should
assess whether its internal

control structure is effective.\247\ One of these commenters suggested
the Commission lay out a basic definition of internal control and the
objectives the internal controls are designed to achieve but did not
provide a suggested definition.\248\ An NRSRO suggested that the
Commission clarify that ``an `effective' internal control structure is
one that is `reasonably designed' to achieve its purposes.'' \249\ In
contrast, another NRSRO stated that the proposed reporting requirement
is ``sufficiently explicit'' and that ``additional guidance is not
needed.''\250\ This commenter added that each NRSRO operates in its own
unique way and that prescribing more detailed rules ``may not be
appropriate for every NRSRO in every situation.''\251\
---------------------------------------------------------------------------

    \245\ See CFA/AFR Letter (stating that the Commission should use
the COSO framework as a basis for evaluating and inspecting the
assessment of internal controls and the control structure on which
management will report).
    \246\ See Levin Letter.
    \247\ See CFA/AFR Letter; DBRS Letter.
    \248\ See CFA/AFR Letter.
    \249\ See DBRS Letter.
    \250\ See S&P Letter.
    \251\ Id.
---------------------------------------------------------------------------

    The Commission agrees that providing more clarity as to when
management of the NRSRO is not permitted to conclude that its internal
control structure is effective would strengthen the requirement and
provide greater certainty to NRSROs in terms of how to assess the
effectiveness of the internal control structure.\252\ The Commission
therefore is modifying the proposal to add a provision specifying when
the NRSRO is not permitted to conclude that its internal control
structure is effective.\253\ In particular, the final amendment
provides that management of the NRSRO is not permitted to conclude that
the internal control structure of the NRSRO was effective as of the end
of the fiscal year if there were one or more material weaknesses in the
internal control structure as of the end of the fiscal year.\254\
---------------------------------------------------------------------------

    \252\ See, e.g., CFA/AFR Letter; DBRS Letter. The Commission
provided such guidance when it recently adopted a new reporting
requirement for broker-dealers pursuant to which certain types of
broker-dealers must file a compliance report that contains, among
other statements, a statement as to whether the broker-dealer's
internal control over compliance with certain rules was effective.
See Broker-Dealer Reports, Exchange Act Release No. 70073 (July 30,
2013), 78 FR 51910, 51916-51920 (Aug. 21, 2013). See also 17 CFR
240.17a-5(d)(3). The reporting requirement contains provisions
prescribing when a broker-dealer is not permitted to conclude that
its internal control over compliance with these rules was effective.
    \253\ See paragraph (a)(7)(ii) of Rule 17g-3.
    \254\ Id.
---------------------------------------------------------------------------

    Commenters suggested several definitions of the term material
weakness. For example, one commenter suggested that material weakness
be defined as a ``serious deficiency that would prevent or in fact did
prevent the internal controls from achieving their objective.'' \255\
Another commenter described a material weakness as ``a serious
deficiency in an internal control that would prevent it from achieving
its objective.'' \256\ Similarly, a third commenter stated that a
definition of material weakness should be one ``which clearly sets out
what would be a serious deficiency in internal controls that would
prevent the internal controls from achieving their objective.'' \257\
An NRSRO requested that the Commission provide guidance as to what
constitutes a material weakness and suggested that a material weakness
be defined as a ``deficiency, or combination of deficiencies, in
internal controls where it is more likely than not that the integrity
of the rating process will be compromised by the failure to follow the
NRSRO's policies, procedures, and methodologies.'' \258\ This commenter
also stated that it believed that one of the objectives of the internal
control structure is to ``provide reasonable assurance regarding the
prevention or timely detection of actions that could have a material
effect on the integrity of credit ratings.'' \259\ On the other hand,
another NRSRO stated that the Commission should allow NRSROs to define
material weakness and other terms.\260\
---------------------------------------------------------------------------

    \255\ See CFA/AFR Letter.
    \256\ See Levin Letter.
    \257\ See COPERA Letter.
    \258\ See Morningstar Letter (also stating that, ``[t]o the
extent the CEO's report requires a discussion of internal control
deficiencies, this discussion should be limited to material
deficiencies that prevent management from concluding its internal
structure is effective, which is consistent with the Commission's
requirement for reports related to internal controls over financial
reporting.'').
    \259\ See Morningstar Letter.
    \260\ See S&P Letter.
---------------------------------------------------------------------------

    The Commission is persuaded that including a description of a
material weakness in paragraph (a)(7) of Rule 17g-3 will strengthen the
reporting requirement and provide greater certainty to NRSROs in terms
of how to assess the effectiveness of the internal control structure.
Consequently, the paragraph, as adopted, includes a description of when
a material weakness exists.\261\ This description is based, in part, on
suggestions by commenters and on recent amendments to the broker-dealer
reporting rule.\262\ The description of material weakness in the rule
incorporates the concept of a deficiency in the internal control
structure of the NRSRO.\263\ Consequently, paragraph (a)(7) of Rule
17g-3 also includes a description of when a deficiency in the internal
control structure exists.\264\ Under the requirements of the paragraph,
the first step is to determine whether there are deficiencies in the
internal control structure. If so, the second step is to determine
whether a material weakness exists in light of the identified
deficiencies.
---------------------------------------------------------------------------

    \261\ See paragraph (a)(7)(iv) of Rule 17g-3.
    \262\ See Broker-Dealer Reports, 78 FR at 51916-51920; 17 CFR
240.17a-5(d)(3).
    \263\ See paragraph (a)(7)(iv) of Rule 17g-3.
    \264\ See paragraph (a)(7)(iii) of Rule 17g-3.
---------------------------------------------------------------------------

    The description in paragraph (a)(7) of Rule 17g-3 of when a
deficiency exists is based on the control objectives set forth in
section 15E(c)(3)(A) of the Exchange Act.\265\ This self-executing
provision specifies that the internal control structure must
effectively govern the implementation of and adherence to the NRSRO's
policies, procedures, and methodologies for determining credit ratings.
In other words, the controls must be designed to achieve the following
objectives: (1) That the NRSRO implements policies, procedures, and
methodologies for determining credit ratings in accordance with its
policies and procedures; and (2) that the NRSRO determines credit
ratings in accordance with its policies, procedures, and methodologies
for determining credit ratings. Given these control objectives, the
paragraph provides that a deficiency in the internal control structure
exists when the design or operation of a control does not allow
management or employees of the NRSRO, in the normal course of
performing their assigned functions, to prevent or detect a failure of
the NRSRO to: (1) Implement a policy, procedure, or methodology for
determining credit ratings in accordance with its policies and
procedures; or (2) adhere to an implemented policy, procedure, or
methodology for determining credit ratings.\266\
---------------------------------------------------------------------------

    \265\ See 15 U.S.C. 78-o7(c)(3)(A) (requiring that the internal
control structure govern the ``implementation of and adherence to
[the NRSRO's] policies, procedures, and methodologies for
determining credit ratings'').
    \266\ See paragraph (a)(7)(iii) of Rule 17g-3.
---------------------------------------------------------------------------

    The existence of a deficiency in the internal control structure,
however, does not necessarily mean that a material weakness exists.
Even a well-designed internal control structure cannot guarantee that a
deficiency will never occur. Therefore, paragraph (a)(7) of Rule 17g-3
provides that a material weakness exists if a deficiency, or a
combination of deficiencies, in the design or operation of the internal
control structure creates a reasonable possibility that a failure
identified in the description of deficiency (that is, a failure of the
NRSRO to implement a policy, procedure, or methodology for

determining credit ratings in accordance with its policies and
procedures or to adhere to a policy, procedure, or methodology for
determining credit ratings) that is material will not be prevented or
detected on a timely basis.\267\
---------------------------------------------------------------------------

    \267\ See paragraph (a)(7)(iv) of Rule 17g-3.
---------------------------------------------------------------------------

    In the proposing release, the Commission asked whether the internal
controls report should be made public.\268\ One commenter stated that
the internal controls report should be made publicly available.\269\
The commenter stated that making the report public would enable users
of credit ratings ``to evaluate the effectiveness of [the] rating
agency's internal control structure and consider what impact, if any,
it may have on the quality of the credit ratings the NRSRO produces.''
\270\ On the other hand, three commenters--all NRSROs--stated that the
report should be kept confidential (as are the other reports submitted
to the Commission under Rule 17g-3).\271\ One NRSRO stated that
publicizing the reports could make them less informative and more
defensive in nature, limiting their effectiveness.\272\ A second NRSRO
stated that ``[m]anagement reports to the board (including an annual
report, which would also be filed with the Commission) are likely to be
key elements of the board's ability to oversee the effectiveness of the
internal control structure'' and ``[s]ince board oversight will be
promoted by open and free dialogue with management, the Commission
should not impede such communication when imposing requirements that
make some or all parts of such management reports publicly available.''
\273\ A third NRSRO stated that the reports may contain proprietary or
confidential information pertaining to the activities of the
NRSRO.\274\
---------------------------------------------------------------------------

    \268\ See Nationally Recognized Statistical Rating
Organizations, 76 FR at 33425.
    \269\ See CII Letter.
    \270\ Id.
    \271\ See DBRS Letter; Kroll Letter; S&P Letter.
    \272\ See DBRS Letter (also arguing that nothing in the Dodd-
Frank Act suggests the intent of Congress was to make the reports
public and that there is no precedent under federal securities laws
to force a private company to publicize information of this kind,
and that users of credit ratings already have access to much
information on NRSROs on which to make informed use of ratings,
including how they formulate credit opinions and the historical
performance of those opinions).
    \273\ See Kroll Letter.
    \274\ See S&P Letter.
---------------------------------------------------------------------------

    The Commission is adopting the amendment as proposed and,
therefore, is not requiring that the internal controls report be made
public. The final amendment is intended to assist the Commission in
examining and monitoring the effectiveness of the internal control
structures of NRSROs and how the structures evolve and improve over
time.\275\ Making the reports public--as suggested by one commenter--
could cause NRSROs to make them less detailed and candid.\276\ In
appropriate cases, if an NRSRO fails to establish, maintain, enforce,
and document an effective internal control structure, the Commission
could institute enforcement proceedings, at which point the allegations
related to the internal control structure would be a matter of public
record.
---------------------------------------------------------------------------

    \275\ See Nationally Recognized Statistical Rating
Organizations, 76 FR at 33513.
    \276\ See DBRS Letter.
---------------------------------------------------------------------------

    One commenter suggested the report be subjected to a third-party
audit attesting to the report's reliability.\277\ As stated above, the
final amendment does not require that the internal controls report be
made public. Consequently, the report is not a public document that
will be relied upon by investors and other users of credit ratings.
Rather, it is a non-public report that will be used by Commission
examiners as part of their monitoring of NRSROs' compliance with the
requirement in section 15E(c)(3)(A) of the Exchange Act to establish,
maintain, enforce, and document an effective internal control
structure. The Commission has taken these factors into consideration in
balancing the benefits of having the internal controls report audited
by a third party and the costs of such a requirement. The Commission
examines each of the ten NRSROs currently registered with the
Commission annually. At this time, the Commission believes that the
annual examinations by the Commission staff will provide a sufficient
means for reviewing the accuracy of the internal controls reports filed
by the NRSROs.
---------------------------------------------------------------------------

    \277\ See Levin Letter.
---------------------------------------------------------------------------

    In order to implement section 15E(c)(3)(B)(iii) of the Exchange
Act, the Commission is adopting the amendment to paragraph (b) of Rule
17g-3 with modifications to correspond to the modifications to
paragraph (a)(7) discussed above.\278\ Specifically, as proposed,
paragraph (b)(2) of Rule 17g-3 would require that the NRSRO attach to
the internal controls report filed pursuant to paragraph (a)(7) a
signed statement by the CEO of the NRSRO or, if the NRSRO does not have
a CEO, an individual performing similar functions, stating, in
pertinent part, that the report fairly presents, in all material
respects, a description of the responsibility of management in
establishing and maintaining an effective internal control structure
and an assessment of the effectiveness of the internal control
structure.\279\ As discussed above, under the final amendments,
paragraph (a)(7) of Rule 17g-3 provides that the report must contain a
description of each material weakness in the internal control structure
identified during the fiscal year, if any, and a description, if
applicable, of how each material weakness was addressed, and an
assessment by management of the effectiveness of the internal control
structure as of the end of the fiscal year.\280\ Consequently, under
the final amendments, paragraph (b)(2) of Rule 17g-3 provides that the
CEO or individual performing similar functions must state, in pertinent
part, that the internal controls report fairly presents, in all
material respects: An assessment by management of the effectiveness of
the internal control structure during the fiscal year that includes a
description of the responsibility of management in establishing and
maintaining an effective internal control structure; a description of
each material weakness in the internal control structure identified
during the fiscal year, if any; a description, if applicable, of how
each identified material weakness was addressed; and an assessment by
management of the effectiveness of the internal control structure as of
the end of the fiscal year.\281\
---------------------------------------------------------------------------

    \278\ See paragraph (b)(2) of Rule 17g-3. See also 15 U.S.C.
78o-7(c)(3)(B)(iii) (providing, in pertinent part, that the
Commission shall prescribe rules requiring each NRSRO to submit to
the Commission an internal controls report, which shall contain the
attestation of the CEO, or equivalent individual, of the NRSRO).
    \279\ See Nationally Recognized Statistical Rating
Organizations, 76 FR at 33539.
    \280\ See paragraph (a)(7)(i) of Rule 17g-3.
    \281\ See paragraph (b)(2) of Rule 17g-3.
---------------------------------------------------------------------------

4. Economic Analysis
    This section builds on the economic analysis in section I.B. of
this release by presenting a focused analysis of the potential economic
effects that may derive from the specific amendments relating to
reporting on internal control structures.\282\ The baseline that
existed before today's amendments was one in which NRSROs must
establish, maintain, enforce, and document an effective internal
control structure governing the implementation of and adherence to
their methodologies for determining credit ratings.\283\ In

addition, section 15E(t)(3)(C) of the Exchange Act requires the board
of directors of the NRSRO to ``oversee'' the ``effectiveness of the
internal control system with respect to policies and procedures for
determining credit ratings.'' \284\ However, before today's amendments,
there were no requirements addressing: (1) The factors an NRSRO must
consider when establishing, maintaining, enforcing, and documenting an
internal control structure; and (2) the retention of the records
documenting the NRSRO's internal control structure. In addition, there
were no requirements to file an annual internal controls report with
the Commission attested to by the NRSRO's CEO or equivalent individual
describing the responsibility of the management of the NRSRO in
establishing and maintaining an effective internal control structure
and containing an assessment of the effectiveness of the internal
control structure.
---------------------------------------------------------------------------

    \282\ The economic analysis in section I.B. of this release
discusses the primary economic impacts that may derive from the
amendments and new rules being adopted today.
    \283\ See 15 U.S.C. 78o-7(c)(3)(A).
    \284\ See 15 U.S.C. 78o-7(t)(3)(C).
---------------------------------------------------------------------------

    Relative to the baseline, paragraph (d) of Rule 17g-8 requiring an
NRSRO to consider certain factors when establishing, maintaining,
enforcing, and documenting an internal control should result in
benefits. As noted above, the exercise of considering these factors
will provide the NRSROs with an opportunity to critically evaluate the
effectiveness of their existing internal control structures and new
registrants a reference point for designing or modifying existing
internal control structures to comply with the statutory requirement to
establish, maintain, enforce, and document an effective internal
control structure governing the implementation of and adherence to
their methodologies for determining credit ratings.\285\ This should
improve the overall effectiveness of the internal control structures of
the NRSROs.
---------------------------------------------------------------------------

    \285\ See 15 U.S.C. 78o-7(c)(3)(A).
---------------------------------------------------------------------------

    Relative to this baseline, the amendments to Rule 17g-2 requiring
an NRSRO to retain a record documenting its internal control structure
should result in benefits. Recordkeeping rules such as Rule 17g-2 are
integral to the Commission's investor protection function because the
preserved records are the primary means of monitoring compliance with
applicable securities laws.\286\ Rule 17g-2 is designed to ensure that
an NRSRO makes and retains records that will assist the Commission's
staff in monitoring, through its examination program, whether an NRSRO
is complying with applicable securities laws, including the provisions
of section 15E of the Exchange Act and the rules adopted under section
15E. The amendments to Rule 17g-2 are designed to assist the Commission
staff in monitoring an NRSRO's compliance with the requirement in
section 15E(c)(3)(A) of the Exchange Act to establish, maintain,
enforce, and document an effective internal control structure governing
the implementation of and adherence to its policies, procedures, and
methodologies for determining credit ratings.
---------------------------------------------------------------------------

    \286\ See Oversight of Credit Rating Agencies Registered as
Nationally Recognized Statistical Rating Organizations, 72 FR at
33582.
---------------------------------------------------------------------------

    Relative to the baseline, the amendments to Rule 17g-3 requiring
NRSROs to file an internal controls report with the Commission should
result in benefits. First, the annual report will facilitate the
Commission's oversight of NRSROs by assisting the Commission in
monitoring an NRSRO's compliance with the requirement in section
15E(c)(3)(A) of the Exchange Act to establish, maintain, enforce, and
document an effective internal control structure governing the
implementation of and adherence to policies, procedures, and
methodologies for determining credit ratings. Compliance with the
requirement to file the internal controls report may enhance the
integrity of credit ratings by increasing the likelihood that NRSROs
will adhere to their procedures and methodologies for determining
credit ratings.
    Second, the requirement that an NRSRO describe in the report any
material weaknesses identified during the fiscal year and how any
identified material weakness was addressed may incentivize an NRSRO to
more closely monitor and make appropriate improvements to its internal
control structure, which could improve the integrity and quality of its
credit ratings. The requirements also could provide accountability for
effective governance by the NRSRO's board and management, which also
may improve the integrity of credit ratings.
    Third, the requirement that the CEO or a person performing similar
functions attest to the report should help to ensure that the report
fairly presents the assessment by management of the effectiveness of
the internal control structure. It also should promote greater focus
within an NRSRO on establishing, maintaining, enforcing, and
documenting an effective internal control structure, given the
involvement of senior level management in attesting to the reported
information. Further, because the person attesting to the report must
represent that the person has responsibility for the report, there will
be senior level accountability for the accuracy and completeness of the
report, which also should promote greater focus within an NRSRO on
establishing, maintaining, enforcing, and documenting an effective
internal control structure.
    Paragraph (d) of Rule 17g-8 and the amendments to Rules 17g-3 and
17g-2 should promote the objective of ensuring that NRSROs comply with
section 15E(c)(3)(A) of the Exchange Act (that is, establish, maintain,
enforce, and document an effective internal control structure).\287\
This should mitigate the risk that an NRSRO may use a rating
methodology that has not been implemented in accordance with its
policies and procedures or that it issues a credit rating that was not
determined in accordance with its policies, procedures, and
methodologies for determining credit ratings. Again, the integrity and
quality of credit ratings could increase as a result.
---------------------------------------------------------------------------

    \287\ See 15 U.S.C. 78o-7(c)(3)(A).
---------------------------------------------------------------------------

    With respect to prescribing factors, commenters stated, in response
to a question in the proposing release, that the Commission should not
prescribe factors for an internal control structure because this would
place a heavy burden on small NRSROs.\288\ The Commission believes the
manner in which it has prescribed factors will address these concerns
and, relative to the baseline, paragraph (d) of Rule 17g-8 should not
result in costs. NRSROs already are required to establish, maintain,
enforce, and document an effective internal control structure governing
the implementation of and adherence to their methodologies for
determining credit ratings.\289\ In doing so, an NRSRO already must
consider the types of controls that would be necessary to meet this
statutory requirement. Paragraph (d) of Rule 17g-8 provides reference
points for engaging in this exercise and may facilitate and focus the
process. Moreover, while the Commission is prescribing factors an NRSRO
must consider, it is not mandating that a specific factor be
implemented. Consequently, while NRSROs must consider the factors
identified by the Commission, they can tailor and scale their internal
control structures to their size and business activities.
---------------------------------------------------------------------------

    \288\ See A.M. Best Letter; Kroll Letter.
    \289\ See 15 U.S.C. 78o-7(c)(3)(A).
---------------------------------------------------------------------------

    Relative to the baseline, the amendments to Rule 17g-2 prescribing
retention requirements for the documentation of the internal control
structure will result in costs to NRSROs. NRSROs already have
recordkeeping systems in place to comply with the recordkeeping
requirements in Rule

17g-2 before today's amendments. Therefore, the recordkeeping costs of
this rule will be incremental to the costs associated with these
existing requirements. Specifically, the incremental costs will consist
largely of updating their record retention policies and procedures and
retaining and producing the additional record. Based on analysis for
purposes of the Paperwork Reduction Act (``PRA''),\290\ the Commission
estimates that paragraph (b)(12) of Rule 17g-2 and the amendment to
paragraph (c) of Rule 17g-2 will result in total industry-wide one-time
costs to NRSROs of approximately $12,000 and total industry-wide annual
costs to NRSROs of approximately $3,000.\291\
---------------------------------------------------------------------------

    \290\ 44 U.S.C. 3501 et seq.
    \291\ See section V.A. of this release (discussing
implementation and annual compliance considerations). The one-time
and annual costs are determined by monetizing internal hour burdens
and adding external costs identified in the PRA analysis in section
IV.D.3. of this release.
---------------------------------------------------------------------------

    Relative to the baseline, the amendments to Rule 17g-3 requiring
that NRSROs file an annual internal controls report with the Commission
will result in costs to NRSROs. An NRSRO will likely incur costs to
engage outside counsel to analyze the requirements for the report and
to assist in drafting and reviewing the report. These legal costs are
expected to be greater for the filing of the first report and are
expected to depend on the size and complexity of the operations of the
NRSRO. NRSROs also will need to establish and maintain internal
processes to gather and retain evidentiary information to support the
report. However, NRSROs already have processes and controls for
preparing and submitting the annual reports required by Rule 17g-3
before today's amendments. Therefore, the reporting costs of this rule
will be incremental to the costs associated with these existing
requirements. Based on analysis for purposes of the PRA, the Commission
estimates that paragraph (a)(7) of Rule 17g-3 and the amendment to
paragraph (b) of Rule 17g-3 will result in total industry-wide one-time
costs to NRSROs of approximately $400,000 and total industry-wide
annual costs to NRSROs of approximately $667,000.\292\