The sector in brief
A credit rating agency assesses the creditworthiness of companies, governments and financial products, and publishes ratings that investors use. It does not take deposits or move client funds. For that reason, its direct exposure to money laundering is lower than that of a bank or a broker.
It is still within the regulated population. The Capital Markets Authority lists credit rating agencies among the firms it supervises, and the agency has relationships with clients, pays and receives fees and handles confidential information. A rating can also give credibility to an entity or product, which makes it valuable to someone who wants to appear legitimate.
Supervisors will expect a proportionate programme: know who the clients are, understand who controls them and pays the fees, and have a way to escalate concerns.
Where the risk sits
Clients with hidden ownership
A rated entity whose owners are not clear can use a rating to gain trust that it may not deserve.
Payments by third parties
Fees paid by someone other than the rated entity, or from unexpected countries, need an explanation.
Shell or newly formed issuers
Entities with little track record seeking a rating to launch products can be an early step in a laundering or fraud scheme.
Misuse of ratings
A rating can be used in marketing to persuade investors, and a flawed process can lend credit to a scheme.
Sanctions
Clients and payers must be screened to avoid doing business with sanctioned persons.
Who supervises you
Credit rating agencies are supervised by the Capital Markets Authority onshore, and by the free-zone regulator where they operate in a financial centre. Check the licence for the activities permitted and the regulator responsible.
The supervisor decides the detailed rules for your licence category, so always read its current guidance alongside this page.
What supervisors expect
- A named compliance officer with a proportionate programme, approved at senior level.
- A business risk assessment that sets out what exposure the agency has and why it is low or higher in particular areas.
- Client due diligence including owners and controllers, and understanding of who pays the fees.
- Sanctions and politically exposed person screening of clients and payers.
- Escalation of concerns about a client, including those raised by analysts during their work.
- Reporting through goAML where there is suspicion, training, record keeping and independent testing proportionate to the firm.
Red flags to watch
- A client that will not say who owns or controls it.
- Fees paid by a company unrelated to the rated entity.
- An urgent request for a rating with little supporting information.
- A client whose accounts or information do not match what analysts find.
- Pressure to give a rating that the analysis does not support.
- A rated entity that appears to exist only on paper.
A worked example
A fee paid by an unrelated company
A recently formed company asks for a rating of a new debt product. The fee is paid by a different company abroad that is not mentioned anywhere in the application. The agency asks why, and is told it is a group arrangement, but cannot find any record of the link. The compliance officer asks for documents, reviews who the owners are and, if the answers are not satisfactory, declines the engagement and considers whether to report.
How Adventant helps
Questions answered
Do rating agencies really need an AML programme?
They are among the firms the authority supervises, so they are expected to have a programme that suits the risk. It can be modest, but it must exist and work.
Where is the real risk for a rating agency?
In who the clients are and who pays them. A rating can give credibility to an entity, so knowing the owners and the source of the fees matters most.
Do we need transaction monitoring?
Probably only at a basic level, such as reviewing fee payments for unusual sources. The programme should be proportionate and explained in the risk assessment.
What should an analyst do if they see a red flag?
Raise it with the compliance officer without alerting the client. A route to escalate that is quick and safe is an important control.
How often should we review client files?
At least when the rating is renewed or something material changes. More often for higher-risk clients. The cycle should be in the policy.