On 19 December 2024, the European Securities and Markets Authority (ESMA) issued a consultation paper on guidelines on internal controls for benchmark administrators (BAs), credit rating agencies (CRAs) and market transparency infrastructures.

ESMA directly supervises all EU CRAs, securitisation repositories and trade repositories as well as certain BAs and certain data reporting service providers in accordance with the relevant Regulations. These Regulations include certain requirements relating to the internal control system that supervised entities must have in place.

ESMA has already published guidelines on internal control for CRAs and these set out the components and characteristics of an effective internal control system within a CRA.

The consultation paper now published is intended to build on and replace the guidelines on internal control for CRAs and set out ESMA’s views for all entities it directly supervises (except for third-country central counterparties). It also revises ESMA’s expectations considering the growing impact of technology on supervised entities’ operations. This includes in terms of managing technology risk from external and internal sources, and the integration of new technologies into supervised entities’ internal controls.

Next steps

The deadline for comments on the consultation paper is 18 March 2025.

ESMA will consider the responses it receives and expects to publish a final report in Q4 2025.