Credit Rating Agency Misconduct: When the Rating File Leaves Out the Decision

Credit rating agency misconduct can involve departures from published methodologies, commercial pressure on credit analysis and failures to preserve required records. An analyst may know which model actually produced a rating. A compliance employee may know which messages never reached the retention system. We connect what you saw inside the credit rating agency to the decision, the published rating and the records meant to explain it.

This page follows credit rating agencies through their methodologies, conflicts and recordkeeping obligations. Our neighboring page on auditors and other securities fraud gatekeepers follows the audit work behind a company’s financial statements.

What Did the SEC Find in the Credit Rating Agency Recordkeeping Action?

The Securities and Exchange Commission’s September 3, 2024 action concerned failures by six credit rating agencies and their personnel to maintain and preserve electronic communications. The firms admitted the facts in their respective SEC orders and acknowledged violating federal securities recordkeeping provisions. The SEC announced combined civil penalties of more than $49 million for those failures.

The firms were nationally recognized statistical rating organizations, commonly called NRSROs. Moody’s Investors Service and S&P Global Ratings each agreed to a $20 million civil penalty. Fitch Ratings agreed to $8 million, A.M. Best Rating Services to $1 million, HR Ratings de México to $250,000 and Demotech to $100,000. The SEC also ordered each firm to stop violating the recordkeeping rules.

The SEC’s New York Regional Office conducted the investigations, with assistance from the Office of Credit Ratings. The SEC explained the consequence of missing records: they can hinder its ability to test compliance and hold firms accountable, often at investors’ expense.

The admissions matter when reading the SEC’s account of an enforcement action. Here, the firms acknowledged recordkeeping violations, and the settlements addressed retention policies and employee compliance.

Which Records Explain a Credit Rating Decision?

Credit rating records connect the published result to the analysis, the people who approved it and the communications behind it. The Securities and Exchange Commission staff’s December 2014 examination report described required records covering internal work papers, participants in rating decisions and communications about initiating, monitoring, changing or withdrawing a rating. That range matters to someone who saw a problem after the initial rating was published.

The staff found incomplete or inaccurate rating committee memoranda and missing documents at one smaller credit rating agency. It also found weaknesses in email retention and delays in producing requested emails and rating materials. At other credit rating agencies, files lacked complete and accurate documentation of committee presentations or the methodologies, criteria and models applied.

For someone who attended the committee, the useful comparison is the discussion against the memorandum that survived. For someone responsible for retention, it is the business communication against the copy available for review. We use those connections to build the evidence behind a securities fraud concern, including who understood the missing information and what happened when it was raised.

When the Credit Rating Methodology and the Work Part Company

A published methodology gives credit rating analysts a concrete comparison with the work performed inside the firm. The 2014 SEC staff report described several departures from agencies’ own policies, models and rating definitions.

At one smaller credit rating agency, the staff found that certain mortgage-backed securities had experienced temporary interest shortfalls without the downgrades that appeared to follow from the published methodology and rating definitions. The firm also failed to update some surveillance ratings monthly as its methodology required. An employee following those securities could connect the payment information, the scheduled review and the rating left in place.

The report gave an especially pointed example from a larger credit rating agency:

If you worked on model validation or the resulting rating, the committee’s decision and the model actually used are the comparison we want to understand. We see the absurdity in the staff’s account: the model failed its review and still got the job.

The staff also found that a larger credit rating agency did not require independent verification of outside models or testing of their providers’ quality controls. Errors in those models led to changes in a substantial number of outstanding ratings. If you worked with those models, the checks performed before use belong beside the errors that later changed the ratings.

How Commercial Pressure Can Reach Credit Rating Criteria

The issuer-pay business model creates a potential conflict because the company seeking a credit rating pays for it. The Securities and Exchange Commission staff’s 2014 annual report on credit rating organizations described the incentive to give more favorable ratings to retain clients. In structured finance, it identified particularly acute potential conflicts where a concentrated group of sponsors, underwriters and managers generated lucrative rating fees.

The same report explained that subscriber-pay businesses face their own pressures. An influential investor paying for access to ratings might benefit from an upgrade or downgrade because of an existing position. An upgrade could also bring a security within the subscriber’s investment guidelines. Knowing who wanted the change helps identify the commercial interest behind it.

The examination report showed how that pressure could appear in the correspondence. After extensive email review at one larger credit rating agency, the staff said the evidence suggested that business and market-share concerns influenced revisions to rating criteria. Business personnel pressed concerns raised by a trade association. The criteria changed in a way that addressed those concerns and benefited the trade group, while supporting documentation was lacking.

The staff recommended separating the analytical process from commercial influence and retaining the analytical justification for the criteria. If you saw those drafts change, your explanation can connect the correspondence to the final criteria. We see the trade group’s objection getting an answer while the analytical file came up short.

What Did the SEC Require the Credit Rating Agencies to Change?

Under the 2024 settlements, four firms had to retain compliance consultants and agreed to comprehensive reviews of their personal-device communications policies and procedures. Those reviews also covered how the firms addressed employee noncompliance. The remedy reached both the retention system and what management did when people failed to use it.

A.M. Best and Demotech were excused from the consultant requirement. The SEC credited significant early efforts to comply after registration and cooperation with its investigations. At the time of the announcement, the six firms had begun improving their compliance policies and procedures.

For an employee in compliance or records management, those are concrete subjects: what the policy required, where business communications went, how failures were identified and how the firm responded. We examine that sequence with you because a written policy and its operation can tell different stories.

What Evidence Is Needed for Whistleblowing?

For a credit rating agency concern, useful evidence connects the internal decision to the methodology, communications and published rating. Your firsthand knowledge can explain why a change occurred or why a file is incomplete.

The complaint record deserves attention of its own. In the 2014 examinations, SEC staff found that one larger credit rating agency’s written complaint procedures omitted employee complaints and lacked a prompt timeframe for logging complaints. At one smaller credit rating agency, employees in an office did not know the complaint procedures and failed to report communications that might have constituted complaints. If you raised an issue, what you said and how the company treated it can supply part of the missing history.

A broader study helps explain why that firsthand account matters. The Significance of Whistleblowing as an Anti-Fraud Measure, published in the Journal of Forensic & Investigative Accounting in 2018, examined occupational-fraud survey data from the Association of Certified Fraud Examiners. In its sample of 4,943 frauds, whistleblowing detected 35.9%, compared with 21.4% detected through internal controls. In that sample, whistleblowing found more frauds than internal controls did.

SEC whistleblowers can share 10% to 30% of qualifying sanctions collected. We assess the SEC whistleblower award question with the evidence. A separate False Claims Act case would require information that also concerns false claims for government payment. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Identifying the program that fits your information is part of our work with you.

You Know What the Credit Rating File Leaves Out

If you know which model was used, whose commercial objection changed the criteria or which messages disappeared from the retained record, speak to our whistleblower experts about what happened inside the credit rating agency. We work beside you to connect the technical decisions to the evidence and build a whistleblower case around what the credit rating file left out. We bring in securities fraud whistleblower lawyers who understand credit rating practices and stay with you through the process.