MOODYS CORP /DE/

MIS, certain of the Company's credit rating affiliates, and many of the issuers and/or securities that MIS and the affiliates rate, are subject to extensive regulation in the U.S. (including by state and local authorities), EU, U.K. and in other countries. In addition, some of the services offered by MA and its affiliates are subject to regulation in a number of countries. MA also derives a significant amount of its sales from banks, insurers and other financial services providers who are subject to regulatory oversight and who are required to conduct due diligence and pass through certain regulatory requirements to key suppliers such as MA by contract. Existing and proposed laws and regulations can impact the Company’s operations, products and the markets in which the Company operates. Additional laws and regulations have been proposed or are being considered. Each of the existing, adopted, proposed and potential laws and regulations can increase the costs and legal risk associated with the Company’s operations, including the issuance of credit ratings, and may negatively impact the Company’s profitability and ability to compete, or result in changes in the demand for the Company's products and services, in the manner in which the Company's products and services are utilized, and in the manner in which the Company operates.

In the U.S., CRAs are subject to extensive regulation primarily pursuant to Section 15E of the Exchange Act and rules thereunder. MIS is registered with the SEC as an NRSRO and is subject to the SEC's oversight and examination authority.

In the EU, the CRA industry is registered and supervised through a pan-EU regulatory framework. ESMA has direct supervisory responsibility for registered CRAs throughout the EU. MIS’s EU CRA subsidiaries are registered with ESMA and are subject to its ongoing supervision. EU CRAs are also subject to DORA, which imposes a range of requirements in relation to the management of ICT risk, regulatory reporting, testing and the management of risks related to ICT services provided by third-parties. DORA also establishes an EU-wide oversight framework for ICT service providers who are designated by the EU supervisory authorities as CTPPs. MIS is not an ICT service provider. MA is an ICT service provider but has not been designated as a CTPP.

In November 2024, the EU published in the EU Official Journal a new Regulation on ESG Rating Activities. This new regulation will become applicable in July 2026 and will subject ESG rating and/or score providers to a number of substantive and procedural requirements and formal supervision by ESMA. Certain products currently offered by MIS may fall in scope of the Regulation and we continue to assess and prepare for the implications. We do not currently expect MA products to fall into scope.

The EU AI Act was published in the EU Official Journal in July 2024, though elements of the Act have different implementation periods and further grace periods have been proposed. The impact of the Regulation remains uncertain as it is currently being reviewed by the EU Institutions; however, it could increase the Company's costs and expose it to the risk of penalties over time.

In the U.K., MIS U.K. is registered with and regulated by the FCA.

The U.K. Parliament has now passed legislation to authorize the FCA to regulate ESG ratings. Certain products currently offered by MIS may fall into scope of the legislation. The FCA has begun consulting on rules for the U.K. ESG ratings framework. We continue to assess the implications for the Company.