What Is an NRSRO? Categories, Registration, and SEC Oversight

An NRSRO, or Nationally Recognized Statistical Rating Organization, is a credit rating agency registered with the U.S. Securities and Exchange Commission to issue opinions on how likely borrowers are to repay their debts. The designation matters because federal and state rules tie many investment decisions to ratings issued by these specific agencies. Eleven firms currently hold the status, and registration is governed by 15 U.S.C. § 78o-7.¹²

What an NRSRO Does and Why the SEC Label Matters

At its core, an NRSRO assigns letter-and-number credit ratings that express how likely a borrower is to make timely payments on debt. Scales typically run from AAA at the top down to D for default, with each agency defining its own symbols. The important dividing line falls between BBB- and BB+. Anything BBB- or higher is investment grade; anything below is speculative, sometimes called high yield.³

That line carries legal weight. Banks, pension funds, and other regulated institutions face restrictions on holding speculative-grade debt, and those restrictions historically referenced ratings issued by NRSROs. The SEC created the designation precisely to control which agencies produce ratings that count for regulatory purposes. Anyone can publish an opinion about a bond; only an NRSRO’s opinion carries this recognition.

The framework was formalized by the Credit Rating Agency Reform Act of 2006, which replaced an older system of informal SEC no-action letters with a statutory registration process, mandatory disclosures, and ongoing federal oversight.² After NRSROs assigned inflated ratings to mortgage-backed securities that later collapsed, Congress tightened the rules through the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, which added independence, disclosure, and compliance requirements and directed federal agencies to reduce automatic reliance on credit ratings in their regulations.⁴

The Five Categories an NRSRO Can Rate

An NRSRO does not receive blanket authority to rate everything. The statute defines five distinct classes of debt, and an agency must be registered in each class it wants to cover:²

Financial institutions, brokers, and dealers, including banks, savings associations, and securities firms.
Insurance companies and their ability to meet policyholder obligations.
Corporate issuers, meaning non-financial companies issuing debt securities.
Asset-backed securities, including instruments backed by pools of loans or receivables.
Government securities, covering municipalities, sovereign governments, and foreign political subdivisions.

An agency might register in just one category where it has deep expertise, or across all five. Its authorized output is limited to what the SEC has approved, and expanding into a new class requires additional certifications from institutional buyers who have relied on the agency’s ratings in that category.⁵

Who Currently Holds the Designation

Eleven credit rating agencies are registered with the SEC as NRSROs:¹

S&P Global Ratings
Moody’s Investors Service
Fitch Ratings
DBRS, Inc.
A.M. Best Rating Services
Kroll Bond Rating Agency
Egan-Jones Ratings Co.
Japan Credit Rating Agency, Ltd.
HR Ratings LLC
Demotech, Inc.
Clasificadora de Riesgo Pacific Credit Rating S.A.C.

S&P, Moody’s, and Fitch dominate the market and are the names most investors encounter. The remaining eight tend to specialize by asset class or geography. A.M. Best focuses heavily on insurance company ratings; Demotech concentrates on property and casualty insurers. Not every registered NRSRO covers all five rating categories, and the SEC’s website lists the specific classes each agency is approved to rate.

How an Agency Becomes an NRSRO

Registration begins with the submission of Form NRSRO to the SEC, along with two paper copies of all exhibits and supporting documentation.⁶ The threshold showing is that the agency is already established and trusted in the market. The statute requires written certifications from at least ten qualified institutional buyers, none of them affiliated with the applicant, confirming they have relied on the agency’s ratings for at least the three years immediately preceding the certification. For each category of debt the agency wants to rate, at least two of those certifications must specifically address that category, and each must be notarized.⁵

The application also demands extensive operational transparency. The agency must submit performance statistics showing how accurately past ratings predicted defaults across short-term, mid-term, and long-term horizons; a full description of the qualitative and quantitative methodologies it uses; details on its organizational structure and largest issuers and subscribers (submitted confidentially); disclosure of any conflicts of interest and the procedures managing them; a code of ethics or an explanation of why one is not maintained; and policies preventing misuse of nonpublic information obtained during the rating process.²

The application identifies a designated compliance officer by name and address. That officer’s role is deliberately narrow. Under Dodd-Frank, the compliance officer cannot participate in determining ratings, developing methodologies, performing sales or marketing, or setting compensation outside the compliance function.⁴ Once the SEC has a completed application, it has 90 days to grant registration or begin a proceeding to deny it. Approval is issued by SEC order.²

What Ongoing Status Requires

Registration is not a one-time event. Every NRSRO must file an updated annual certification on Form NRSRO within 90 days of the end of the calendar year. Separately, within 90 days of its fiscal year end, the agency files audited financial statements (or its parent’s audited consolidated statements if the NRSRO is a division) along with a management assessment of internal controls over the rating process. Missing these filings is itself grounds for revocation.⁶

The SEC’s Office of Credit Ratings is required by statute to examine every NRSRO at least once a year, reviewing everything from methodology application to conflict management and recordkeeping. The office publishes an annual staff report summarizing its findings.⁷

NRSROs also have to make their track records public. Complete credit rating histories are published in a machine-readable XBRL format on a publicly accessible platform, updated at least monthly. Each disclosure identifies the agency, the date of every rating action, the rated entity or security, whether the action was an initial rating, upgrade, downgrade, or withdrawal, and the rating symbol assigned.⁶ Investors and researchers can evaluate agency performance independently rather than rely on the agency’s own marketing.

Conflict Rules That Shape How NRSROs Operate

The most persistent structural tension is the issuer-pays business model. Before the 1970s, investors paid to access ratings. The industry then shifted so that the entities seeking ratings pay for them, creating an incentive to keep paying clients happy with favorable opinions.⁸ Federal regulations do not ban the model, but SEC Rule 17g-5 prohibits an NRSRO from issuing or maintaining a rating when certain conflicts exist:⁹

A single client accounts for 10% or more of the agency’s total net revenue.
An analyst who participated in the rating, or the person who approved it, owns securities of the rated entity.
The agency or someone associated with it advised the rated entity on its corporate structure, assets, or liabilities.
Anyone involved in determining ratings or developing methodologies negotiated the fee for the rating.
An analyst or approver received gifts from the rated entity worth more than $25 in total, beyond what is normal in routine business meetings.
Anyone who participates in determining ratings also participates in sales or marketing, or is influenced by sales considerations.

A separate safeguard targets the revolving door. When a former NRSRO employee joins an entity the agency rated while that person was on staff, the NRSRO must conduct a look-back review covering the one-year period before departure, determine whether any conflict influenced the affected ratings, and revise them if warranted.²

What Happens When the SEC Finds Violations

The SEC can censure an NRSRO, impose operational restrictions, suspend registration for up to 12 months, or revoke NRSRO status entirely. Individuals can be barred from association with any NRSRO for up to a year or permanently. Any of these actions requires a hearing on the record and a finding that the action protects investors and serves the public interest. Grounds include criminal convictions within the preceding ten years, failure to file required annual certifications, inadequate financial or managerial resources, and failure to supervise employees who violate securities laws. The SEC can also suspend or revoke registration for a single rating category when problems are specific to that class.²

Enforcement is real. In 2024, the SEC charged six NRSROs with recordkeeping violations tied to staff use of personal devices for business communications. Moody’s and S&P Global each paid $20 million, Fitch paid $8 million, and three smaller agencies paid between $100,000 and $1 million. Each agency was censured and ordered to cease the violations, and four of the six had to retain independent compliance consultants to overhaul their communications policies.¹⁰

1
U.S. Securities and Exchange Commission. Current NRSROs
2
Office of the Law Revision Counsel. 15 USC 78o-7 – Registration of Nationally Recognized Statistical Rating Organizations
3
U.S. Securities and Exchange Commission. Updated Investor Bulletin – The ABCs of Credit Ratings
4
Congress.gov. HR 4173 – 111th Congress (2009-2010) Dodd-Frank Wall Street Reform and Consumer Protection Act
5
U.S. Securities and Exchange Commission. Form NRSRO – Application for Registration as a Nationally Recognized Statistical Rating Organization
6
eCFR. 17 CFR Part 240 Subpart A – Nationally Recognized Statistical Rating Organizations
7
U.S. Securities and Exchange Commission. Staff Report on Nationally Recognized Statistical Rating Organizations
8
U.S. Securities and Exchange Commission. Statement on the Removal of References to Credit Ratings from Regulations
9
Securities and Exchange Commission. 17 CFR 240.17g-5 – Conflicts of Interest
10
U.S. Securities and Exchange Commission. SEC Charges Six Credit Rating Agencies with Significant Recordkeeping Failures