Master Circular for ESG Rating Providers Outsourcing Principles · SEBI/HO/DDHS/POD3/P/CIR/2024/45

What changed

This master circular establishes mandatory principles for ESG Rating Providers (ERPs) that outsource business activities. ERPs must maintain a comprehensive outsourcing policy approved by their Board or partners. The policy must address risk management, due diligence, and the selection of third-party service providers. ERPs remain fully liable for all outsourced activities and must ensure that outsourcing does not impede regulatory supervision or investor rights. All outsourcing arrangements require a legally binding written contract that defines performance levels, confidentiality, and audit rights. ERPs must also implement contingency plans, disaster recovery measures, and data security protocols to protect proprietary and customer information. These requirements apply to all third-party relationships, including those with group entities or associates.