The ESG Rating Regulation's legal representative is a compliance role, not an address
TL;DR
- Regulation (EU) 2024/3005 has applied since 2 July 2026. A third-country provider that is not covered by an equivalence decision and cannot use endorsement must obtain ESMA recognition under Article 12, and recognition requires a legal representative that is a legal person established in the Union.
- The representative must be able to demonstrate the provider's ongoing compliance and is accountable to ESMA for it; ESMA's recognition file asks for the representative's own adequacy assessment and monitoring description.
- ESMA's application window runs to 2 November 2026. Its list of Article 51 notifications includes third-country firms, most of them UK, Swiss, US and Asian data providers below the turnover cap; no legal representative has yet been recorded in the public register.
The representative regimes most firms know — Article 27 GDPR, Article 13 DSA — are built around receipt and forwarding. Article 12 of the ESG Rating Regulation is built differently. The legal representative is not a mailbox for ESMA's letters; it is the person ESMA holds to account for whether a provider in Hong Kong, Zurich or London is complying with a European regulation it may have read for the first time this year.
Law, regulator practice, market practice
Black-letter law. Article 12(1) opens recognition to third-country providers whose net turnover has stayed below the Accounting Directive's small-undertaking ceiling for each of the last three years; larger providers must establish in the Union or endorse through an EU group entity. Article 12(3) requires a legal representative that is a legal person established in the Union, expressly appointed to act on the provider's behalf, which must be able to demonstrate to ESMA, on an ongoing basis, that the provider complies with the Regulation and "shall be accountable to ESMA in that respect". Article 12(7) ties recognition to ESMA's supervisory and fining powers, and Article 36's fining provision is framed to reach the provider or, where applicable, its legal representative. Natural persons are excluded; so, in substance, is any representative that cannot evidence what it signs.
Regulator practice. ESMA's final report on the recognition technical standards (October 2025) spells out what the application must contain about the representative: its identity and status, the mandate, a contact person, and — the operative items — the representative's assessment of the adequacy of the provider's compliance measures and its description of the ongoing monitoring it will perform. ESMA has set the application deadline at 2 November 2026 and asks for an informal heads-up two weeks before filing. It has also stated publicly that ratings may continue to be distributed by providers that notified in time while their application is pending. What ESMA has not done is publish any guidance on how deep the representative's assessment must go; the first recognition decisions will set that bar.
Market practice. There is no incumbent. ESMA's register listed 34 EU small providers under the temporary regime and no recognised third-country provider as of September 2026; no legal representative appears in it. The firms that could take the role fall into two groups: law practices with an ESMA or CSSF focus, which price the application phase on hourly rates and are cautious about an exposure that reaches the representative; and the representative providers in Brussels, Dublin and Vienna that sell GDPR, DSA and AI Act mandates at volume — intake and forwarding, with no monitoring content — and are not positioned to sign an adequacy assessment. The Benchmark Regulation's Article 32 legal representative is the closest precedent, and that market never became visible either.
Who this affects
Three groups. First, mid-size and small third-country ESG rating and data providers that notified ESMA between 2 July and 2 August 2026 and now need to file a recognition application by 2 November — their choice of representative is on the critical path. Second, the Luxembourg and other EU fund managers that consume those ratings in SFDR and benchmark data chains: a provider that fails to obtain recognition cannot distribute ratings in the Union, and the manager's data lineage breaks with it. Third, the counsel advising both: the representative's adequacy assessment is a document the application depends on, and it has to be written by someone who has actually examined the provider's organisational and transparency arrangements under Articles 15 to 27.
Operational implications
For a provider, the sequence is: confirm scope and the turnover test against the last three years' accounts; decide between recognition and an EU entity; appoint the representative early enough for it to complete an adequacy assessment before 2 November, with findings the provider can remediate or explain in the file; and settle, before signature, whether home-country law allows the representative to obtain the records ESMA may demand — for some Asian jurisdictions this is the gating question. For a representative, the role is only viable as a monitored product: a Luxembourg-held evidence repository, a quarterly review, an intake address for ESMA correspondence, information and inspection rights in the mandate, and a resignation right where compliance can no longer be demonstrated.
VieKey takes Article 12 mandates through its Luxembourg company and runs them on that basis; the same architecture covers AI Act, DSA and GDPR representation for non-EU firms. See EU representative for non-EU firms, or write to [email protected].