Is ESMA Becoming a Rating Agency? Steffen Kern Places Risk Monitoring in the Broader Role of Financial Supervision

The presentation of risks by the European Securities and Markets Authority (ESMA) can easily invite a comparison with the work of a rating agency. Liquidity, market, credit, contagion, operational and environmental risks are assessed and communicated using a colour-coded system ranging from lower to very high risk. Combined with an outlook indicating whether risks are rising, stable or declining, the presentation has some of the characteristics of a rating system.

This raises an interesting question: Is ESMA gradually developing into a rating agency itself, and could its risk assessments eventually become publicly available as regularly updated ratings?

According to Steffen Kern of ESMA, the comparison has its limits. His response places ESMA’s assessment of financial-market risks in the much broader context of the general responsibilities of supervisory institutions. Monitoring markets, identifying emerging vulnerabilities and assessing the potential consequences of risks are fundamental elements of modern financial supervision. ESMA itself describes its role not only as that of a regulator and supervisor, but explicitly also as a market monitor that conducts stress tests and publishes reports and research on risks to investors and financial stability.

The distinction is important. A credit rating agency typically expresses an opinion on the creditworthiness of a particular issuer or financial instrument. ESMA’s risk monitoring, by contrast, is primarily concerned with the condition and vulnerabilities of markets as a whole. Its assessments cover developments that may affect investor protection, orderly markets and financial stability. ESMA therefore analyses not simply whether a particular borrower is likely to meet its financial obligations, but whether risks are building up within the financial system and how they may interact.

This broader perspective explains why the categories used by ESMA extend well beyond conventional credit risk. Market liquidity, price volatility, contagion between institutions and markets, operational disruptions, cyber threats and environmental risks can all become relevant to the stability and functioning of financial markets. The purpose of the assessment is therefore diagnostic rather than classificatory: it is intended to identify areas of vulnerability and support regulatory and supervisory action before risks develop into broader market disruptions.

The methodology nevertheless has some striking similarities with the language of ratings. ESMA has for years presented its assessments through colours indicating different levels of risk intensity. In one of its earlier Trends, Risks and Vulnerabilities reports, for example, the methodology explicitly defined green as potential risk, yellow as elevated risk, orange as high risk and red as very high risk. The assessment combined quantitative indicators with analyst judgement and was supplemented by an outlook for the expected development of each risk.

Yet Steffen Kern’s broader interpretation points to a fundamental difference in institutional purpose. Risk assessment is part of the information and analytical infrastructure of supervision. It does not turn the supervisor into a credit rating agency. Supervisory authorities need their own independent understanding of markets precisely because they cannot rely exclusively on the opinions of external rating agencies, market participants or individual institutions.

In fact, ESMA’s mandate explicitly includes market monitoring. EU legislation provides that ESMA shall monitor markets for financial instruments marketed, distributed or sold in the Union. This is therefore not an additional activity borrowed from the rating industry but a core component of the supervisory framework.

There is also an interesting institutional paradox. ESMA is itself the direct supervisor of credit rating agencies in the European Union. It monitors whether rating agencies are independent, objective and of high quality, including their governance, methodologies and management of conflicts of interest. The same authority therefore supervises the providers of credit ratings while independently assessing risks across the markets in which those ratings are used.

The question of public availability deserves separate attention. ESMA already publishes a substantial part of its market-risk analysis. Its Trends, Risks and Vulnerabilities reports are produced regularly and identify developments and vulnerabilities across EU financial markets. ESMA also publishes market reports and other analytical material. In this sense, the information is already public – but not in the form of issuer-specific ratings comparable to those issued by Moody’s, S&P Global Ratings, Fitch Ratings or European credit rating agencies.

The latest ESMA assessments underline the continuing importance of this function. ESMA’s risk monitoring has recently highlighted risks arising from geopolitical tensions, potentially disorderly market corrections, increasing interconnectedness, cyber and hybrid threats and operational dependencies. These are risks for which no traditional credit rating, however sophisticated, could provide a complete picture of market-wide vulnerability.

The more appropriate conclusion, therefore, is not that ESMA is moving towards becoming a rating agency. Rather, ESMA’s risk assessments illustrate how the analytical methods of financial-market supervision and the communication techniques familiar from the rating industry can increasingly overlap.

A rating agency reduces complex information about creditworthiness to an opinion expressed through a rating scale. A supervisory authority similarly needs to reduce a vast amount of market information to signals that can guide attention, analysis and action. A traffic-light system can perform precisely that function without becoming a credit rating.

Steffen Kern’s response therefore puts the issue into perspective. Market observation and risk assessment belong to the general toolkit of supervisory institutions. The fact that ESMA communicates these assessments through a structured, colour-coded system may make them look like ratings. Their purpose, however, is fundamentally different: they are instruments for understanding markets, identifying vulnerabilities and supporting the supervisory mission of protecting investors, maintaining orderly markets and contributing to financial stability.

The interesting question for the future may consequently be less whether ESMA will become a rating agency than whether supervisory risk assessments will become increasingly important as a distinct category of publicly available market information—situated somewhere between academic research, regulatory analysis and the ratings traditionally supplied by specialised credit rating agencies.