An internal credit rating system is how an asset manager assigns and maintains its own credit rating on each issuer it holds: a rating scale, a methodology with factors, weights and adjustment limits, the financial spreads the methodology reads, a review cycle with event triggers, and named people who propose, challenge and approve, all kept in a file an examiner can follow. It is hard because the work is heavy and the accountability is narrow: hundreds of issuers, each re-spread and re-scored at least yearly, while the rules hold specific people responsible for every determination. Botminds' Internal Credit Rating splits the two. Seven AI agents do the reading, spreading, scoring and drafting, every value cited to its page; the analyst, an independent reviewer and the committee chair make and sign the decisions.
The worked examples use the solution's sample data on fictional firms: Quillfield Capital's credit research team, 912 issuers on a 12-month cycle, and the annual review of Orrin Freight Lines, a truckload carrier whose bonds sit in six of its portfolios. The rules are quoted from their own texts.
Where the agents stop in Internal Credit Rating: one annual review, step by step
Agent
Intake and Spreading agentsOpen annual and event reviews with a due date and the event cited; spread 10-Ks, 10-Qs and annual reports into the house template, in the issuer's own language, tie every total out and cite each value to its page.
Never: changes a rating, closes a review or fills a missing value; anything below 0.90 confidence goes to the analyst
Agent
Scorecard and Peer agentsApply the approved methodology version to score each factor and compute the implied rating; place the issuer among peers and flag where it is the outlier.
Never: changes a weight, notches, or sets a rating
Agent
Divergence and Challenge agentsCompare the proposal with the three agencies and their median, stop the file at two notches and draft a cited reason; draft the reviewer's questions.
Never: writes the final reason, sends a challenge, or accepts one
A person decides
Credit analystNotches for what the scorecard misses, edits and approves the reason, proposes the rating.
A person decides
Independent reviewer, then the committee and its chairThe reviewer challenges and accepts or rejects with a reason code; the committee votes; the chair signs with an attestation.
What is an internal credit rating system?
It is the whole apparatus behind a single letter grade. Banks using the Basel internal ratings-based approach have it spelled out: at least seven grades for borrowers that have not defaulted, and grade descriptions and criteria that "must be sufficiently detailed to allow those charged with assigning ratings to consistently assign the same grade to borrowers or facilities posing similar risk" (Basel Framework, CRE36.19 and CRE36.25). Asset managers have no single equivalent rule, but two fund regimes come close.
A US money market fund may hold only securities its board, or the adviser it delegates to, has determined present minimal credit risks, after an analysis of four factors about the issuer (17 CFR 270.2a-7(a)(11)). An EU money market fund's manager must run "a prudent internal credit quality assessment procedure", "based on prudent, systematic and continuous assessment methodologies" validated against "historical experience and empirical evidence, including back testing" (Regulation (EU) 2017/1131, Article 19). Everyone else, from insurance mandates to high-yield funds, builds to the same pattern by choice.
What an internal credit rating system includes, and where the rules speak to each part
| Component | What the rules say | What to check in your own system |
|---|---|---|
| A rating scale | Basel banks: at least seven non-default grades, each defined (CRE36.19–20). | Your grades map to the agencies' scale, so a split can be counted in notches. |
| A methodology | EU money market funds: systematic, continuous, validated with back testing (Art. 19(3)). | Factors, weights, sector tables and adjustment limits are written down, versioned and approved. |
| Data and spreads | Information "of sufficient quality, up-to-date and from reliable sources" (Art. 19(2)). | Every input in a spread can be traced to the page it came from. |
| A review cycle and triggers | US: ongoing review of minimal credit risk (2a-7(g)(3)). EU: at least yearly, and on a material change (Art. 19(4)). | Annual and event reviews open themselves, with a due date and the event cited. |
| Named people and approvals | EU: the person or persons responsible are documented (Art. 21(1)(f)); the procedure is approved by senior management (Art. 23(1)). | Who proposed, challenged and approved each rating is in the file, and no one did two of those on one file. |
| Documentation | US: three years from the latest review (2a-7(h)(3)). EU: three complete annual accounting periods (Art. 21(2)). | A rating file can be exported for one issuer, or for every holding of one fund, on demand. |
How do asset managers rate issuers internally?
In six moves, whatever the software: open the review, spread the statements, score under the methodology, place the issuer among peers, adjust for what the scorecard misses, and take the result through challenge and committee. The order matters, because each step depends on the one before it being right, and a mistake in the spread travels all the way to the signature.
The sample review of Orrin Freight Lines shows the shape. The Spreading agent reports 96 values, 94 of them above 0.90 confidence, totals tied out. The Scorecard agent applies Corporate Methodology v4.2 for transportation, scoring eight factors to a weighted 11.60, which maps to BB. The Peer agent places Orrin among nine transportation peers, where its 38% customer concentration is the highest (the peer median is 14%). The analyst, Maya Lindqvist, takes one notch for that concentration and leaves an owned-fleet notch unapplied because it is already in the liquidity score: BB−. All three agencies sit at BBB−, so the proposal is three notches below them, and the Divergence agent stops the file until a reason is written.
Six agents on one annual review, each step stated before the file reaches a person
Can AI assign a credit rating?
AI can compute a scorecard and draft every document around a rating; under the rules that govern internal ratings, it cannot be the one who determines it. Rule 2a-7 lets a money market fund's board delegate the minimal credit risk determination "to the fund's investment adviser or officers", under written guidelines the board establishes and reviews (2a-7(j)). The EU rules go further: an override of a methodology's output must name "the person who is responsible for the decision" and the objective reason (Delegated Regulation (EU) 2018/990, Article 7). A determination needs someone who can be asked why.
The supervisors' own frameworks have not caught up with generative tools either. SR 26-2, the banking agencies' model risk guidance of 17 April 2026 that superseded SR 11-7, carves generative and agentic AI models out of its scope and leaves them to banks' wider risk management (SR 26-2 attachment, note 3; how banks are handling the gap is covered in SR 26-2 and AI: what to ask an agent that reads loan files). Rating agencies are at the same stage. Asked about it by the SEC's examiners, "NRSROs discussed the integration of AI and DeFi in the credit rating process and identified some potential risks, including data security and privacy issues, technical compatibility, and regulatory and legal risks" (SEC Office of Credit Ratings, 2025 Staff Report).
The practical answer is to draw the line explicitly and write it into the system, so it does not depend on habit. In Internal Credit Rating each agent's limits are part of its definition: the Scorecard agent applies only approved methodology versions and cannot change a weight or notch; the Divergence agent refuses a reason that cites no source and never writes the final one; the File agent never sends anything outside the firm. A regulator reading the file sees which steps an agent took and which a named person approved.
Who is responsible for an internal credit rating?
The people the procedure names, and in a fund the board that approved the procedure. For an EU money market fund the documentation must include "the person or persons responsible for the internal credit quality assessment procedure", and the procedure is approved by senior management and the governing body, which must have "a good understanding" of it (Articles 21 and 23). For a US money market fund the board stays responsible for oversight of whatever it delegates.
Inside the credit team, responsibility is divided by question. The analyst is responsible for the evidence and the proposal, the independent reviewer for the challenge, the committee and its chair for the decision, and the chief risk officer for the methodology and for what leaves the firm. What each of those signatures attests is worked through in its own guide.
The rating ladder: the scorecard, the proposal and the agencies on one scale
Internal rating system vs agency ratings: why a fund needs both
An agency rating is an outside opinion the fund may use; an internal rating is the fund's own determination it must defend. US law keeps the regulator out of the first: neither the SEC nor any state "may regulate the substance of credit ratings or the procedures and methodologies" by which a registered agency determines them (Exchange Act §15E(c)(2), 15 U.S.C. 78o-7). That makes judging the agency's rating the user's job, and the internal rating is where the judgment is recorded.
An agency rating and an internal rating answer different questions
Agency rating: A registered agency's, under methodologies the SEC may not regulate in substance.
Internal rating: The firm's own, under a methodology it approved and must be able to explain.
Agency rating: With each rating action: the methodology version used, the data relied on and the rating's sensitivity to assumptions (Rule 17g-7(a)).
Internal rating: Every value, notch and reason, cited to its page, plus the challenge and the vote.
Agency rating: On the agency's schedule, with outlooks and watches along the way.
Internal rating: On the firm's cycle and its own event triggers; an agency action is one input among several.
Agency rating: Consider it. A US money market fund may not rest eligibility on it; EU managers may not rely on it solely or mechanistically.
Internal rating: Rest an eligibility, limit or client decision on it, because someone named signed it.
The two meet in the split. When an internal rating sits two or more notches from the agency median, the reason has to exist before the committee meets, or the file looks like a mistake rather than a view. Why internal and agency ratings split, and how to write the reason has its own guide.
What to check before you buy an internal credit rating system
Test a system on files you have already rated, not on a vendor's demo issuer, and judge it on the steps where your own process breaks today. Seven checks separate a governed rating system from a faster spreadsheet.
Seven checks for any internal credit rating system, run on your own past files
- It runs your methodology, not its own
Load your factors, weights, sector tables and adjustment limits. The implied rating on ten past files should match what your spreadsheet produced, or the difference should be explained.
- Every number opens on its page
Pick twenty spread values at random. Each should show the document, page and passage, and the confidence of the reading.
- It refuses to guess
Give it a filing with a missing note. A sound system leaves the value empty and asks; a weak one fills it.
- The people are enforced, not suggested
Try to propose and approve the same file as one user. The system should refuse, and record the attempt.
- Splits stop the file
Set the split threshold to two notches and replay a file you know diverged. It should not reach review without a cited reason.
- Methodology changes are versioned and re-run
Propose a weight change. You should see which issuers move before anyone approves it, and the old version should stay attached to the old ratings.
- An examiner's request can be answered from the file
Ask for every money market holding's credit file with its four factors. Count how long it takes and how many files are incomplete.
Where Internal Credit Rating fits as a rating system, and its limits
Internal Credit Rating fits a buy-side credit team that already has a methodology and a committee and wants the work around them governed: spreads cited to their pages, scorecards applied only under approved versions, splits explained before committee, challenges and votes in the file, and exam requests answered from it. In the sample, the SEC's request for the credit file behind every money market holding is mapped to 174 files, 171 of them complete, with the three gaps shown first and their owners named.
It does not supply a methodology, though it will run yours as versioned settings; keeping your credit rating methodology and running it as settings explains how. It does not replace a licensed agency ratings feed; it reads the one you have. It does not validate your model for you: a methodology change is re-run on the book, validated by your model risk team and approved by the CRO, never by the person who proposed it. And it does not take a decision the rules give to a person.
Every step by people and agents, in one audit trail
Questions people ask
How often must internal ratings be reviewed?
EU money market funds must review every internal credit quality assessment at least once a year and reassess when a material change could affect it. US money market funds must review minimal credit risk on an ongoing basis; the SEC declined to set a frequency in 2015. Basel banks refresh ratings at least annually and higher-risk names more often.
What is a minimal credit risk determination?
It is a US money market fund's finding that a security presents minimal credit risks, which makes it eligible to hold. It must rest on an analysis of the issuer's or guarantor's capacity to meet its obligations, considering, to the extent appropriate, financial condition, sources of liquidity, ability to react to future events and the strength of its industry. Rule 2a-7 in plain words covers it in full.
Can we use a vendor's rating model instead of our own methodology?
You can use one as an input, but the determination is still yours, and an EU money market fund must validate whatever methodology it uses with back testing. A vendor score you cannot explain factor by factor is hard to defend when the examiner asks why one name was eligible and its peer was not.
What does setting up an internal credit rating system involve?
In Internal Credit Rating, five steps: connect the systems the file draws on, import the issuers, map your rating scale to the agencies', choose the approved methodology versions, and assign analysts and reviewers. The set-up then goes to the CRO for approval. The inputs are your methodology, scale, coverage book and a sample of last cycle's rating files.
Does an internal rating have to agree with the agencies?
No. It has to be explained when it differs. Agencies disagree with each other too: in a 1996 Federal Reserve Bank of New York study, Moody's and S&P gave different ratings to 21 of the 49 sovereigns both rated. What an examiner looks for is a reason written before the decision, not agreement.