Circular to Intermediaries Guidance to asset managers regarding due diligence expectations for third-party ESG ratings and data products providers

1. The Securities and Futures Commission’s (SFC) observed from its previous fact-finding exercise¹ that asset managers generally engage ESG ratings and data products providers (ESG service providers) and use the products of these providers to facilitate their investment decision-making and risk management processes. The exercise also highlighted common concerns raised by asset managers regarding ESG service providers’ data quality, transparency and conflicts of interest management.

2. Pursuant to General Principles 2 and 3 of the Code of Conduct², asset managers are generally expected to exercise due skill, care and diligence when engaging third-party service providers and ensure that such resources are adequate and effective for the proper performance of their business activities. To meet such regulatory expectations, asset managers should conduct reasonable due diligence and ongoing assessments on third-party ESG service providers.

3. To address the common concerns discussed in Paragraph 1, the due diligence and ongoing assessments should allow asset managers to reasonably understand the ESG products provided by the third-party ESG service providers. These include how such products are produced (eg, the source and timeliness of the underlying information used, any use of estimates, methodologies applied, and the criteria and approach for assessing the covered entity), limitations and the purposes for which the product is being used³.

4. Asset managers should ensure they can demonstrate how they have adequately fulfilled the above expectations regarding reasonable due diligence and ongoing assessments of third-party ESG service providers and their products.

   Referencing the voluntary code of conduct for ESG service providers

5. To meet the above regulatory expectations, asset managers may take into account the principles and recommended actions of the Hong Kong Code of Conduct for ESG Ratings and Data Products Providers (VCoC)⁴  during their due diligence and ongoing assessment process. The VCoC is formulated based on IOSCO-recommended global baseline standards for ESG service providers and covers principles relating to governance, transparency, systems and controls, and management of conflicts of interest. Apart from the VCoC, asset managers may make reference to other similar or higher standards for their due diligence and ongoing assessments if deemed necessary and appropriate.

6. Where ESG service providers have signed up to the VCoC and completed the self-attestation document, asset managers can utilise the information contained in the document (available on the VCoC website) to facilitate their due diligence and ongoing assessments of the ESG service providers and their products.

   Definitions and applicability

7. For the avoidance of doubt, this circular adopts the same definitions as in the VCoC, including ESG rating/score, ESG data product, ESG ratings/data products provider, and the negative scope.

8. The expectations stated under Paragraphs 2 to 4 above are applicable to asset managers who carry out Type 9 regulated activities, including those that are wholly incidental to their other regulated activities, and who have discretion over the investment management process of the fund or discretionary account under their management, regardless of whether the fund being managed is authorised by the SFC.

9. Asset managers should adopt a proportionate approach to fulfil the regulatory expectations, ie, the level of due diligence and ongoing assessments of the third-party ESG service providers and their products to be conducted should be proportionate to the impact that the products ultimately have on their investment and risk management processes.

10. Asset managers may leverage group resources and staff, and adopt group policies and procedures to satisfy the above expectations, provided that those group resources, staff, policies and procedures are subject to standards that are similar to or higher than our expectations. Nevertheless, we wish to remind asset managers that their local management retain the responsibility to ensure the intermediaries comply with the SFC’s requirements.

11. Should you have any queries regarding this circular, please contact your case officer.
    
    
    

Intermediaries Supervision Department               Investment Products Division
Intermediaries Division                                                    Securities and Futures Commission
Securities and Futures Commission

End

SFO/IS/038/2024

¹ Refer to the Report on the fact-finding exercises on ESG ratings and data products providers issued by the SFC dated October 2023.
² The Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission.
³ Consistent with Good Practice 5 recommended by the International Organization of Securities Commissions (IOSCO) in its Call for Action in 2022 to promote international good practices among asset managers.
⁴ Following the publication of the VCoC on 3 October 2024, ESG ratings providers and ESG data products providers will have respective implementation periods of six months and 12 months.