The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 ("the Act") begins sweeping reform for the U.S. financial system. It requires new and existing regulatory agencies to undertake more than 50 studies of the financial system and more than 250 instances of rulemaking. Duane Morris has issued further Alerts on many of the broad topics addressed by the Act, accessible at www.duanemorris.com/FinancialReform.

Among the many new regulations included in the Act is a set of regulations that address credit rating agencies. Generally, a credit rating agency researches and reviews the credit-worthiness of corporations, financial institutions, special-purpose entities and governments that issue certain types of financial obligations – including bonds, preferred stock and commercial paper – and then assigns the issuer a credit rating. The determination of credit-worthiness affects both the decision of investors on whether or not to invest in the issuer and the interest rate applied to the debt. In theory, the rating is initiated and paid for by the issuer of the obligation; although in practice, it is usually the investment bank managing the offering on behalf of the issuer that initiates the rating process.

In recent years and as the influence of credit ratings outpaced their reliability, investors have often relied too heavily on favorable ratings in lieu of performing their own independent research and analysis. Additionally, government regulators have become increasingly dependent on the ratings to set regulatory policies for the financial industry. Essentially, investors and government regulators have outsourced to the credit rating agencies their own obligation to perform due diligence into the credit-worthiness of a security or debt issuer.

Background on Credit Rating Agencies and Prior Regulations

Although government regulators have relied on credit rating agencies since the 1930s to manage the amount of risk held by regulated entities, the agencies themselves have largely been exempt from legal regulations that apply to more-traditional forms of investment advice. Instead, legislators have generally depended on the market, rather than the government, to regulate the industry. Additionally, for many years, rating agencies have avoided regulation by claiming status as "journalists" and maintaining that the First Amendment freedom of the press precludes government regulation of the methodologies and content of their rating opinions. This position was recently debated and generally discredited in a 2009 opinion of the U.S. District Court for the Southern District of New York, in Abu Dhabi Commercial Bank, et al. v. Morgan Stanley.¹

It was not until 1975 that the U.S. Securities and Exchange Commission (SEC) began to formally recognize credit rating agencies by establishing a process to designate qualifying agencies as nationally recognized statistical rating organizations (NRSRO). Designation as an NRSRO was desirable to the agencies because it allowed other SEC-regulated entities to rely on the ratings to satisfy some of their own regulatory requirements. Although NRSRO designation allowed for formal government recognition, the program continued to rely primarily on market forces to regulate the industry.

The government's first effort to impose meaningful regulation on the credit rating industry was in 2006 when, in response to several high-profile corporate scandals, but prior to the recent financial crisis, President Bush signed the Credit Rating Agency Reform Act (CRARA). CRARA, which was intended to improve the quality of ratings by increasing accountability, transparency and competition, gave exclusive authority to the SEC to draft and implement a set of rules that would govern registration, recordkeeping, reporting and oversight for credit rating agencies. With respect to registration, the rules require a credit rating agency seeking NRSRO status to comply with certain registration requirements, including a lengthy application process.

The rules allowed an agency to register separately as an NRSRO to rate five different classes of entities: (1) financial institutions, brokers and dealers; (2) insurance companies; (3) corporate issuers; (4) issuers of asset-backed securities; and (5) issuers of government securities, municipal securities or securities issued by a foreign government. There are currently 10 credit rating agencies that have applied for and been granted registration as an NRSRO: A.M. Best Company, Inc.; DBRS Ltd.; Fitch, Inc.; Japan Credit Rating Agency, Ltd.; Moody's Investor Services, Inc.; Rating and Investment Information, Inc.; Standard & Poor's Rating Services; Egan-Jones Rating Company; LACE Financial Corp.; and Realpoint LLC.

With respect to recordkeeping, reporting and oversight, the SEC adopted a set of rules that required each NRSRO-designated agency to comply with the following:

• Post specified nonconfidential portions of its registration form on its website within 10 days after being granted the NRSRO designation, including specific information regarding procedures and methodologies for determining ratings.
• Keep and maintain performance-measurement statistics, including downgrade and default rates for three years and disclose this information to the SEC and the public.
• Annually furnish certain financial reports to the SEC, including audited financial statements and an annual certification application.

Despite CRARA's progress in the regulation of credit rating agencies, its effectiveness was limited because CRARA expressly prohibited regulation of the fundamental basis for the agencies' work – their credit rating processes and methodologies.

When the asset-backed structured finance market began to expand in the years leading up to the recent financial crisis, the role of rating agencies in these complex investment instruments became even more influential. Because of the increasing complexity of these structured investments, investors began to rely more heavily on the credit rating agencies to understand the investment instruments and gauge their risk. Even the most complex and risky investments could be sold with a favorable rating from a recognized agency. Although in theory this system would provide sound and objective information for investors, in practice, it did not. Significant conflicts of interest arose because large Wall Street investment firms could direct substantial market share to the agencies that were most likely to issue favorable ratings. Thus, agencies began altering their methodologies and even skewing their assessments to retain the business of large firms that controlled such high volumes of work. As a result, the financial system took on far more risk than it knew or could handle.

When the housing market crashed and individuals began to default on the underlying assets, many of these investment instruments were downgraded, which only accelerated the crisis. As the Senate's Permanent Subcommittee on Investigations has recently exposed, hundreds of billions of dollars' worth of questionable subprime mortgage-backed securities, which had received triple-A ratings, turned out to be worthless and have since been downgraded to junk status. In 2009, following the collapse of the U.S. housing market and the financial crisis of 2008 and 2009, the SEC made a number of amendments to the implementing rules for CRARA. These amendments were designed to add regulations that required increased disclosure of performance statistics and rating methodologies, public disclosure of a sample of rating actions for each class of credit ratings, enhanced recordkeeping and annual reporting requirements, and additional restrictions that addressed potential and actual conflicts of interest.

Although the 2009 amendments were intended to address many gaps left by CRARA as originally enacted, Congress recently determined that these amendments did not go far enough. Congressional investigators concluded that credit rating agencies had become so influential in the current financial system – and increasingly subject to conflicts of interest – that rating agencies were of "national importance" and stronger government regulation was required. As a result, regulation of the credit rating agencies is a cornerstone of the new Act.

Key Provisions in the Act

As legislators attempted to address the causes of the recent financial crisis, the credit rating industry was specifically targeted for its role. The Act significantly increases the regulation of NRSROs in an attempt to avert further adverse consequences of the mortgage-backed securities crisis that led to the economic crisis and recognize the value of transparent and reliable ratings in the financial system. The major components of the regulation are (1) the creation of a new "Office of Credit Ratings" at the SEC to oversee NRSROs and enforce the rules and regulations concerning NRSROs, (2) the creation of new disclosure requirements that attempt to make ratings and the process of determining ratings more transparent to the public and users of the ratings, (3) provisions that require the implementation of internal controls in the formulation of ratings by NRSROs, (4) provisions that address conflicts of interest inherent in the current business model of NRSROs, and (5) provisions that make it easier for plaintiffs to sue credit rating agencies in certain circumstances. The following paragraphs summarize the key provisions and requirements of the Act relating to NRSROs.

New "Office of Credit Ratings" at the SEC to Oversee Credit Rating Regulations

Section 932(p)(1) of the Act creates an "Office of Credit Ratings" at the SEC that will focus on regulating NRSROs and enforcing the Act's provisions. The mission of the Office of Credit Ratings will be to protect the users of credit ratings, promote accuracy in credit ratings issued by NRSROs and ensure that such ratings are not unduly influenced by conflicts of interest. The Office of Credit Ratings will have its own director and a compliance staff composed of people with "knowledge of and expertise in corporate, municipal, and structured debt finance." The Office of Credit Ratings is required to examine NRSROs at least once a year and make key findings public. In connection with its annual examinations, the Office of Credit Ratings will review (1) whether the NRSRO is conducting business in accordance with the policies, procedures and rating methodologies of the NRSRO; (2) the management of conflicts by the NRSRO; (3) the implementation of ethics policies by the NRSRO; (4) the internal supervisory controls of the NRSRO; (5) the governance of the NRSRO; (6) the processing of complaints by the NRSRO; and (7) the policies of the NRSRO governing the post-employment activities of former staff of the NRSRO. The Office of Credit Ratings must issue a public report summarizing the essential findings of all its examinations, the responses by NRSROs to any material regulatory deficiencies identified by the SEC, and whether the NRSROs have appropriately addressed the recommendations of the SEC. The Office of Credit Ratings will have authority to establish rules necessary to enforce the new regulations and be able to establish fines and other penalties for violation of the regulations. The creation of the Office of Credit Ratings addresses the increased focus that the SEC will have on regulating rating agencies, and is intended to ensure that resources are devoted to ensuring compliance with the Act and related rules.

Disclosure and Internal Control Requirements

Section 932 of the Act creates new requirements for the development and maintenance of internal controls in NRSROs and increases the amount of disclosure required by NRSROs. These internal controls and disclosure requirements are designed to allow users of credit ratings to understand how the products they may be investing in are being rated. The internal controls and disclosures should also allow users of ratings to compare the performance of the NRSROs over time.

Internal Controls. Each NRSRO must establish, maintain, enforce and document an effective control structure governing the implementation of and adherence to policies, procedures and methodologies for determining credit ratings, taking into consideration such factors as the SEC may prescribe by rule. The chief executive officer of each NRSRO must make an annual attestation to the effectiveness of the NRSRO's internal controls. Each NRSRO must complete an annual internal control report that describes the responsibility of management in establishing and maintaining controls and assessing the effectiveness of the internal control structure of the NRSRO.

Disclosure of Credit Rating Methodology. The SEC will prescribe rules to ensure that ratings are produced in accordance with procedures and methodologies that have been approved by the NRSRO board or a body performing a function similar to that of a board. When there are material changes to credit rating procedures and methodologies – including changes to qualitative and quantitative data and models – the changes must be applied consistently to all credit ratings to which the changed procedures and methodologies apply. Additionally, the NRSRO must disclose the reasons for any material change in credit rating procedures and methodologies. Each NRSRO must notify the users of credit ratings of the following: (1) the methodology used with respect to a particular credit rating, (2) any material change made to a procedure or methodology, (3) any significant error that is identified in a procedure or methodology that may result in credit rating changes, and (4) the likelihood that a material change in procedure or methodology would result in a change in current credit ratings.

Form for Disclosure. The SEC will prescribe rules to require NRSROs to publish with each rating a form (in paper or electronic format) disclosing information about (1) the assumptions behind the rating, (2) the data relied upon, (3) whether servicer or remittance reports are used to monitor the rating, and (4) other information to allow investors and users of credit ratings to better understand the rating. The form must discuss (1) the main assumptions underlying the rating, (2) potential limitations of the rating, (3) information on the uncertainty of ratings, (4) whether and to what extent third-party due diligence reports have been used, (5) data about the issuer used in determining the rating, (6) the NRSRO's assessment of the quality of data available and considered, (7) information related to conflicts of interest and (8) other information that the SEC may require.

Transparency of Ratings' Performance. The SEC will prescribe rules that require each NRSRO to "publicly disclose information on the initial credit ratings determined by the [NRSRO] for each type of obligor, security, and money market instrument, and any subsequent changes to such credit ratings." This disclosure is likely to assist users of credit ratings in evaluating the accuracy of the ratings and comparing the performance of the ratings by different NRSROs.

Third-Party Due Diligence Services for Asset-Backed Securities. Issuers or underwriters of asset-backed securities must make public the findings and conclusions of any due diligence report obtained by the issuer or underwriter. Third-party due diligence services must certify (in a form and content to be established by the SEC) that they have conducted a thorough review of data, documentation and other relevant information necessary for the NRSRO to provide an accurate rating. NRSROs shall make such certifications public, in order to allow the public to determine the adequacy of third-party due diligence services.

Corporate Governance and Management of Conflicts of Interests

The Act also contains provisions that appear to influence the corporate governance of NRSROs to ensure that conflicts of interest are minimized when an NRSRO determines a rating for a product. These provisions include the requirement for independent directors on the board of each NRSRO, increased duties of directors to ensure that the provisions of the Act are followed, the requirement that the sales and marketing functions of an NRSRO are separated from the rating functions of the NRSRO and the requirement that NRSROs consider information in addition to what is received from the issuer.

Independent Directors and Duties of the Board. Each NRSRO must have a board of directors, and at least half the members of the board (but not fewer than two directors) must be independent. A portion of the independent directors must include users of NRSRO ratings. In order to be considered independent, a member of the board may not – other than in his or her capacity as a member of the board of directors – accept any consulting, advisory or other compensatory fee from the NRSRO, or be a person associated with the NRSRO or with any company affiliated with it. An independent director must also be disqualified from any deliberation involving a specific rating if the independent board member has a financial interest in the outcome of the rating. Independent directors may receive compensation, but such compensation cannot be linked to the business performance of the NRSRO. The term of the independent director is required to be for a fixed term not to exceed five years, and such term may not be renewable. In addition to their overall responsibilities, the board of directors is required to oversee (1) the establishment, maintenance and enforcement of policies and procedures for determining credit ratings; (2) the establishment, maintenance and enforcement of policies and procedures to address, manage and disclose conflicts of interest; (3) the effectiveness of the internal control system with respect to policies and procedures for determining credit ratings and (4) the compensation and promotion policies and practices of the NRSRO.

Conflicts of Interest. The SEC will prescribe rules to prevent the sales and marketing considerations of NRSROs from influencing the production of NRSRO ratings. Such rules will provide exceptions for small NRSROs. Any violation of such rules that affects a rating will be grounds for revocation or suspension of NRSRO registration. The Act also installs a new requirement for NRSROs to conduct a one-year look-back review when an NRSRO employee goes to work for an obligor or underwriter of a security or money market instrument subject to a rating by that NRSRO. The NRSRO is also required to report to the SEC when certain employees of the NRSRO go to work for an entity that the NRSRO has rated in the previous 12 months.

Independent Information. Section 935 of the Act provides that in producing a credit rating, an NRSRO must consider information from a source other than an issuer that the NRSRO finds credible and potentially significant to a rating decision.

Enforcement and Liability

The Act also contains several provisions that appear to allow for greater enforcement of violations by NRSROs. NRSROs will now face the same liability under the securities laws as faced by registered public-accounting firms or securities analysts. Additionally, the SEC has the right to revoke an NRSRO's status under certain circumstances.

Private Actions. Section 933 of the Act amends the Securities Exchange Act of 1934 to allow investors to bring private actions against rating agencies for a knowing or reckless failure (i) to conduct a reasonable investigation of the rated security with respect to factual elements relied upon by its own methodology for evaluating credit risk or (ii) to obtain reasonable verification of such factual elements from other sources that the credit rating agency considered to be competent and that were independent of the issuer and underwriter. Additionally, under section 939(g) of the Act, NRSROs will now be subject to "expert liability" through the nullification of Securities Act Rule 436(g), which previously provided an exemption for credit ratings provided by NRSROs from being considered a part of the registration statement. NRSROs will now face the same type of liability in private securities actions faced by registered public accounting firms or securities analysts under the securities laws.

Right to Deregister. Section 932 of the Act authorizes the SEC to revoke a credit rating agency's NRSRO status for a particular class of securities when an NRSRO has insufficient financial and managerial resources to consistently produce accurate ratings.

NRSROs Required to Refer Tips to Law-Enforcement or Regulatory Authorities. Section 934 of the Act provides that each NRSRO must refer to law-enforcement or regulatory authorities credible information that the NRSRO receives that alleges that an issuer of securities rated by the NRSRO has committed a material violation of law. The NRSRO is not required to verify the accuracy of such information.

Miscellaneous Provisions

Testing and Education. Section 936 of the Act directs the SEC to issue rules to ensure that any person employed by an NRSRO to perform credit ratings meets standards of training, experience and competence necessary to produce accurate ratings, and is tested for knowledge of the credit rating process.

Universal Rating Symbols. Section 938 of the Act requires NRSROs to clearly define any symbols used to denote a credit rating, and apply those symbols in a consistent manner to all types of securities and money market instruments. However, there is no restriction on NRSROs using distinct sets of symbols to denote credit ratings for different types of securities.

Timing of Regulations. Section 937 of the Act directs the SEC to issue final regulations required by the Act not later than one year after the date of enactment of the Act.

About Duane Morris

Duane Morris has an online Financial Services Reform Center – www.duanemorris.com/FinancialReform – which includes videos and the firm's comprehensive series of Alerts analyzing the provisions of the Dodd-Frank Act and emerging policies, as well as links to relevant government websites. Duane Morris' attorneys are monitoring the rules and regulations released under the Dodd-Frank Act, as well as the regulatory agencies' interpretive guidance. For additional Alerts on these and other topics, please revisit www.duanemorris.com/FinancialReform.

For Further Information

If you have any questions about the Act or any of the topics described in this Alert, including how they may affect your company or its executives, please contact A. Bruce Bowden, Neal A. Patel, John A. Loveman, any member of the Corporate Practice Group or the attorney in the firm with whom you are most regularly in contact.

As required by United States Treasury Regulations, you should be aware that this communication is not intended by the sender to be used, and it cannot be used, for the purpose of avoiding penalties under United States federal tax laws.

Note

1. Abu Dhabi Commer. Bank v. Morgan Stanley & Co., 2010 U.S. Dist. LEXIS 59339 (S.D.N.Y. June 15, 2010).

Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.