The NRSRO list is the SEC's list of nationally recognized statistical rating organizations: credit rating agencies registered with the Commission under Section 15E of the Securities Exchange Act. As of October 2026 it has eleven names, from A.M. Best to S&P Global Ratings, after the SEC registered Clasificadora de Riesgo Pacific Credit Rating on January 5, 2026. For an investor the list answers a narrow question, whether an agency is registered and examined, and not the one that matters, whether its ratings are good. The SEC says so itself, and its annual exams show what can go wrong inside a rating file. Botminds' Internal Credit Rating is built for the other side of that relationship: the buy-side credit team that must judge the agencies' ratings and keep its own, and that can test its own files against the faults the SEC's examiners found.
The list and findings are quoted from the SEC's own pages and its Staff Report on NRSROs of April 2026. Examples of internal files are the solution's sample data on fictional firms.
The registered rating agencies, in four numbers
11
credit rating agencies registered as NRSROs on the SEC's list, October 2026
93.4%
of all NRSRO ratings outstanding at the end of 2024 came from the three largest agencies
76.1%
of outstanding ratings were in the government securities category, which includes municipal issuers
9 of 10
agencies examined in 2025 had at least one essential finding
What is an NRSRO?
An NRSRO is a credit rating agency that has registered with the SEC and issues ratings, certified by qualified institutional buyers, in one or more of five classes: financial institutions, brokers or dealers; insurance companies; corporate issuers; issuers of asset-backed securities; and issuers of government, municipal or foreign government securities. Registration is voluntary, so "not all credit ratings are credit ratings of an NRSRO", and it is unlawful for an agency that is not registered to say it is one (SEC Office of Credit Ratings, 2025 Staff Report).
The term mattered most when regulations referred to NRSRO ratings directly. Since Dodd-Frank, many of those references are gone, the money market fund rule among them, but the label persists in contracts, investment guidelines and insurance regulation: the SEC's staff note that the NAIC's process for recognising rating agencies for insurers' capital "includes no criteria other than registration with the SEC as an NRSRO" (2025 Staff Report), which the NAIC's draft due diligence framework would change (draft of 25 September 2026).
Which credit rating agencies are registered with the SEC in 2026?
Eleven, listed below with the date of the SEC order granting each registration. The SEC's 2025 report grouped the ten agencies registered during 2025 by revenue as large, medium and small; the eleventh was registered after the period the report covers.
The NRSRO list, October 2026
| Agency | Registered | Group in the SEC's 2025 report |
|---|---|---|
| A.M. Best Rating Services, Inc. | September 24, 2007 | Medium |
| Clasificadora de Riesgo Pacific Credit Rating S.A.C. | January 5, 2026 | Registered after the report period |
| DBRS, Inc. | September 24, 2007 | Medium |
| Demotech, Inc. | July 11, 2022 | Small |
| Egan-Jones Ratings Co. | December 21, 2007 | Small |
| Fitch Ratings, Inc. | September 24, 2007 | Large |
| HR Ratings LLC | November 5, 2012 | Small |
| Japan Credit Rating Agency, Ltd. | September 24, 2007 | Small |
| Kroll Bond Rating Agency, LLC | February 11, 2008 | Medium |
| Moody's Investors Service, Inc. | September 24, 2007 | Large |
| S&P Global Ratings | September 24, 2007 | Large |
How many NRSROs are there, and how did the count change?
Ten at the end of 2025 and eleven since January 5, 2026, when the SEC granted Pacific Credit Rating's registration in the financial institutions, corporate issuers and government securities classes. In the same period one applicant, Transparency Analytics, withdrew its application before a decision, and Egan-Jones applied to re-register in the asset-backed and government classes; on March 23, 2026 the Commission instituted proceedings "to determine whether such registration should be denied", noting questions about the adequacy of its resources "to consistently produce credit ratings with integrity" (2025 Staff Report). Egan-Jones remains registered in its other classes.
Counting agencies says little about concentration. The three large agencies accounted for 93.38% of all ratings outstanding at the end of 2024, down from 98.8% in 2007, and 98.6% of government securities ratings; outside government securities the medium agencies hold meaningful shares, especially in asset-backed securities. Ratings of the loans inside CLOs, often private credit estimates, are a case of their own, discussed in where the ratings in WARF come from.
What does NRSRO registration mean?
That the agency meets the registration requirements and is examined every year, not that its ratings are right. The SEC's staff are explicit: because the Commission may not regulate the substance of ratings, its examiners do not assess "the quality, reliability, or credibility of an NRSRO's methodologies, models, or ratings", and registration "is not a Commission 'seal of approval'" (2025 Staff Report).
It is up to users of credit ratings to assess for themselves the quality, credibility, and reliability of an NRSRO's credit ratings.
SEC Office of Credit Ratings, 2025 Staff Report
That sentence is the case for an internal credit rating. A fund that holds a bond because an NRSRO rates it investment grade has delegated a judgment the regulator says belongs to the user. The internal rating is where that judgment is made and written down, and a split from the agencies is where it shows.
Who regulates credit rating agencies?
In the US, the SEC, through its Office of Credit Ratings; in the EU, the European Securities and Markets Authority; and for the largest agencies, both together. Section 15E(p)(3) requires the SEC's staff to examine every NRSRO at least once a year, covering eight areas set in the statute, from adherence to methodologies and conflicts of interest to governance, the compliance officer, complaints and former employees. The largest agencies also have supervisory colleges of regulators: the SEC chairs S&P's, ESMA chairs Fitch's and the UK's Financial Conduct Authority chairs Moody's (2025 Staff Report).
Can the SEC change a credit rating?
No. The Exchange Act forbids it: "neither the Commission nor any State ... may regulate the substance of credit ratings or the procedures and methodologies by which any nationally recognized statistical rating organization determines credit ratings" (15 U.S.C. 78o-7(c)(2)). The SEC can examine whether an agency follows its own methodologies and the rules on conflicts, records and disclosure, refer findings to enforcement, and act on registration. It cannot tell an agency that a BBB should be a BB.
That gap is why other users built their own checks. The NAIC, which cannot rely on the SEC to judge ratings either, now has a process to challenge individual filing exempt designations and a draft framework to test rating providers; NAIC filing exempt and the end of blind reliance explains both.
What did the SEC find in its 2025 NRSRO exams?
Findings at nine of the ten agencies, three of them material regulatory deficiencies, and a pattern that applies to any rating file. The staff stress that essential findings "are not findings or conclusions of the Commission and have not been subject to adjudication". Read as a checklist, they describe the controls a buy-side rating desk needs as much as an agency does.
SEC exam findings at rating agencies, and the same fault on a buy-side rating desk
Medium agencyAn analyst voted in a rating committee while owning the obligor's securities; compliance had caught the same analyst before. Material regulatory deficiency.
The same fault on a buy-side deskA committee member holds the bond personally, or their team arranged the deal, and votes.
The controlRecusals recorded on the agenda with the reason; members recuse from issuers their team arranged.
Small agencyA qualitative adjustment applied without first producing the model-implied rating the methodology required; nobody in the process questioned it. Material regulatory deficiency.
The same fault on a buy-side deskA notch taken from a scorecard nobody ran, or from last year's.
The controlThe scorecard rating sits on the ladder beside the proposal; every notch is drawn from it, with its reason.
Small agencyA revised methodology let ratings ignore timely payment although the scale's definitions require it. Material regulatory deficiency; the agency disputed it.
The same fault on a buy-side deskA sector table changed without checking it still matches what each grade means.
The controlMethodology changes replayed on the book and validated before the CRO approves.
Large agencyAnalytical files without all the relevant emails, weakening any after-the-fact review.
The same fault on a buy-side deskThe challenge and the answers live in a mailbox, not the rating file.
The controlChallenge, answers and reasons recorded in the file itself.
Small agencyDocumentation showing a qualitative assessment's outcome but not the rationale behind it.
The same fault on a buy-side deskA reason code with no reason, or a reason with no source.
The controlA cited rationale on every decision; a reason that cites nothing is refused.
Small agencyRatings no longer maintained still shown as current; rating histories incomplete after a coding error.
The same fault on a buy-side deskA stale internal rating still feeding limits and the order management system.
The controlReviews carry due dates and escalate when late; signed ratings go to risk, holdings and order management.
The other findings concerned reporting rather than rating: incomplete financial reports to the Commission, a confidentiality control switched off without a replacement, followed by "a marked increase in unauthorized external disclosures", transition data left out of performance statistics, no effective way to complain anonymously, and incomplete disclosure forms. The rule behind the ownership finding is old and plain. A registered agency may not issue or maintain a rating where an analyst who took part, or the person approving it, "directly owns securities of, or has any other direct ownership interest in" the rated person (17 CFR 240.17g-5(c)(2)).
The finding about incentives, and why it matters to a buy-side desk
One finding from earlier exams is still open and speaks directly to how credit teams are measured. In 2023 the staff found that a small agency's "performance measurement system used by the NRSRO to evaluate credit analysts established incentives to produce ratings as quickly as possible, without regard to rating quality". The agency dropped the system, but in the staff's view its remediation had still not appropriately addressed the recommendation to resource and enforce its controls (2025 Staff Report).
A buy-side desk that measures analysts on reviews closed per week has the same exposure. Speed is worth measuring, and five measures of a rating process include hours per review, but always next to the quality measures: splits explained before committee, files complete when asked, values traceable to their page. A faster process that drops those is the 2023 finding in another building.
What is Form NRSRO, and what can an investor learn from it?
Form NRSRO is the registration form, updated by an annual certification each agency files within 90 days of the year end. It is public on EDGAR and must be free on the agency's own website. Its exhibits are where an investor can check an agency rather than trust it: Exhibit 1 carries standardised performance statistics, including rating transitions; Exhibit 2 a general description of the procedures and methodologies; Exhibit 8 the numbers of credit analysts and supervisors. Agencies must also publish free rating histories under Rule 17g-7(b), and the version of the methodology used with each rating action.
The 2025 exams found that one medium agency excluded some ratings it considered non-final from its Exhibit 1 statistics, so "users of credit ratings were provided with incomplete information for assessing the NRSRO's ratings performance". A team that uses Exhibit 1 to judge an agency's record should read the definitions before the numbers.
An internal rating file built for an after-the-fact review
Using the exam findings to test your own rating desk
Pull ten closed rating files and ask of each the questions the examiners asked: did anyone who voted hold the securities or have a business tie to the issuer; was the scorecard run before any notch; did the methodology version match the scale's definitions; are the challenge and the answers in the file; does every decision carry a reason with a source; and is any rating still feeding limits after its review date passed? The answers are the cheapest audit a credit team can run, and they show whether the problem is the analysis or the file.
A memo whose every sentence an after-the-fact reviewer can open
Internal Credit Rating and the agencies' ratings it reads
The solution does not rate on behalf of an agency or judge one; it reads the ratings from your licensed feed, three agencies in the sample, and puts them beside your own on one scale. It applies to the internal file the controls the SEC's findings point to: three different people on every file, recusals with reasons, the scorecard before any notch, cited reasons, the challenge in the file and an append-only trail. What each signature on an internal rating attests takes the committee side of that further.
Questions people ask
Is S&P an NRSRO?
Yes. S&P Global Ratings has been registered since September 24, 2007, as have Moody's Investors Service, Fitch Ratings, DBRS, A.M. Best Rating Services and Japan Credit Rating Agency. The SEC's 2025 report grouped S&P, Moody's and Fitch as the large agencies.
Is there an EU equivalent of the NRSRO list?
Yes. Rating agencies operating in the EU register with the European Securities and Markets Authority under the Credit Rating Agencies Regulation, which also requires EU firms not to rely solely or mechanistically on ratings.
What is a material regulatory deficiency?
In the SEC staff's reports, it is an essential finding involving conduct that could undermine the quality of a rating or impair the objectivity of the rating process, among other things. The agency's response to each one is summarised in the annual report. Three of the 2025 findings were classed that way.
Are private ratings from NRSROs examined too?
Yes, and they were a focus in 2025. The staff reviewed ratings in private credit markets because "the lack of transparency with respect to these unpublished ratings has the potential to heighten the risk of them being affected by conflicts of interest", and noted competitive pressures are "more acute in the context of private ratings".
Where can I see an NRSRO's ratings performance?
In Exhibit 1 to its annual Form NRSRO certification, on EDGAR and on the agency's website, and in the rating histories each agency must publish free under Rule 17g-7(b). Read the definitions first: the SEC found one agency leaving some ratings out of its statistics.