What are your due diligence responsibilities when engaging ESG ratings and data products providers?

View PDF

Authored by: Joyce Li

While the appeal of environmental, social and governance (ESG) credentials may still be subject to debate, it is certain that ESG factors play an increasingly important role in financial markets (including in the asset management sector). The demand and need for reliable and high quality ESG ratings and data products have also increased, especially amidst increasing allegations of greenwashing.

Recognising the importance and growing demand from industry for guidance on baseline standards on how providers of ESG ratings and data conduct business, the Securities and Futures Commission (SFC) supported and sponsored the development of a voluntary code of conduct (VCoC) for ESG ratings and data products providers providing products and services in Hong Kong (ESG Service Providers).

Following the publication of the VCoC, the SFC in its recent guidance to asset managers on due diligence expectations for ESG Service Providers encourages asset managers to take into account adherence of the ESG Service Providers to the VCoC or any similar or higher standards.

We set out below a brief update of the VCoC and the SFC’guidance to asset managers regarding due diligence expectations for third-party ESG Service Providers (Guidance).

The voluntary code of conduct for ESG Service Providers

The VCoC, published in October 2024, was officaily launched on 29 November 2024. It aims to foster a trusted, efficient and transparent market by introducing clear standards for ESG Service Providers and focusing on achieving four key outcomes: good governance, management of conflicts of interest, transparency and strengthening systems and controls in the sector.

The VCoC was modelled on international best practices recommended by the International Organisation of Securities Commission ensuring that the VCoC is interoperable and consistent with the expectations introduced in other major financial jurisdictions. It is hosted and maintained by the International Capital Market Association (ICMA).

ESG Service Providers who signed up to the VCoC will make available publicly (on ICMA’s VCoC webpage) a self-attestation document explaining their approach and actions taken to adhere to the principles of the VCoC. Such self-attestation document not only promotes transparency but is also a critical bridge to the availability and consistency of information concerning the methodologies and operations of ESG Service Providers and the information and product they produce.

Expectations on asset managers using data and products provided by ESG Service Providers

Asset managers are expected to exercise due skill, care and diligence when engaging third-party service provides, and this will include ESG Service Providers if an asset manager uses ESG data in its performance of its business activities.

Understanding the products – To meet the SFC’s expectations, asset managers should conduct reasonable due diligence and ongoing assessments on third-party ESG Service Provides which would allow them to reasonably understand the ESG products provided, including:

• how such products are produced (for instance, the source and timeliness of the underlying information used, any use of estimates, methodologies applied, and the criteria and approach for assessing the covered entity);

• limitations and the purposes for which the product is being used.

Having clear understanding of the ESG products, and its underlying methodologies and data sources, is not only important in meeting regulatory obligations, it is also pertinent to ensuring that the ESG data and products are used appropriate and in a manner which supports an asset manager’s investment strategy and delivers an outcome that is aligned with how the investment product was described and what its investors are looking for.

ESG Service Provider’s adherence to VCoC – To facilitate asset managers in meeting its due diligence requirements, asset managers may take into account the principles and recommended actions of the VCoC during its initial due diligence and ongoing assessment of ESG Service Providers:

• where ESG Service Providers have signed up to the VCoC and completed the self-attestation document, asset managers may use such information for their due diligence and on-going assessment of its ESG Service Providers

• however, asset managers will still need to determine the level and extent of due diligence required in order to satisfactorily discharge its obligations

• the level of due diligence and ongoing assessments of the third-party ESG Service Providers and their products to be conducted should be proportionate to the impact that the products ultimately have on their investment and risk management processes.

Policy and procedures – Asset managers may leverage group resources and staff, and adopt group policies and procedures to satisfy SFC’s regulatory expectations provided that such policies and procedures are subject to similar or higher that the SFC’s expectations. Further, the local management will retain the responsibility to ensure the intermediaries comply with the SFC’s requirements.

Last but not least, asset managers should have written policies and procedures as well as written records to the due diligence and ongoing assessment conducted in order to demonstrate how they have adequately satisfied the SFC’s expectations.

Key Contacts

Joyce Li

Partner | Financial Services

Email or call +852 2825 9318