240.17g-2—Records to be made and retained by nationally recognized statistical rating organizations.

(a) Records required to be made and retained. A nationally recognized statistical rating organization must make and retain the following books and records, which must be complete and current:
(1) Records of original entry into the accounting system of the nationally recognized statistical rating organization and records reflecting entries to and balances in all general ledger accounts of the nationally recognized statistical rating organization for each fiscal year.
(2) Records with respect to each current credit rating of the nationally recognized statistical rating organization indicating (as applicable):
(i) The identity of any credit analyst(s) that participated in determining the credit rating;
(ii) The identity of the person(s) that approved the credit rating before it was issued;
(iii) If a quantitative model was a substantial component in the process of determining the credit rating of a security or money market instrument issued by an asset pool or as part of any asset-backed or mortgage-backed securities transaction, a record of the rationale for any material difference between the credit rating implied by the model and the final credit rating issued; and
(iv) Whether the credit rating was solicited or unsolicited.
(3) An account record for each person (for example, an obligor, issuer, underwriter, or other user) that has paid the nationally recognized statistical rating organization for the issuance or maintenance of a credit rating indicating:
(i) The identity and address of the person; and
(ii) The credit rating(s) determined or maintained for the person.
(4) An account record for each subscriber to the credit ratings and/or credit analysis reports of the nationally recognized statistical rating organization indicating the identity and address of the subscriber.
(5) A record listing the general types of services and products offered by the nationally recognized statistical rating organization.
(6) A record documenting the established procedures and methodologies used by the nationally recognized statistical rating organization to determine credit ratings.
(7) A record that lists each security and money market instrument and its corresponding credit rating issued by an asset pool or as part of any asset-backed or mortgage-backed securities transaction where the nationally recognized statistical rating organization, in determining the credit rating for the security or money market instrument, treats assets within such pool or as a part of such transaction that are not subject to a credit rating of the nationally recognized statistical rating organization by any or a combination of the following methods:
(i) Determining credit ratings for the unrated assets;
(ii) Performing credit assessments or determining private credit ratings for the unrated assets;
(iii) Determining credit ratings or private credit ratings, or performing credit assessments for the unrated assets by taking into consideration the internal credit analysis of another person; or
(iv) Determining credit ratings or private credit ratings, or performing credit assessments for the unrated assets by taking into consideration (but not necessarily adopting) the credit ratings of another nationally recognized statistical rating organization.
(8) For each outstanding credit rating, a record showing all rating actions and the date of such actions from the initial credit rating to the current credit rating identified by the name of the rated security or obligor and, if applicable, the CUSIP of the rated security or the Central Index Key (CIK) number of the rated obligor.
(b) Records required to be retained. A nationally recognized statistical rating organization must retain the following books and records (excluding drafts of documents) that relate to its business as a credit rating agency:
(1) Significant records (for example, bank statements, invoices, and trial balances) underlying the information included in the annual financial reports furnished by the nationally recognized statistical rating organization to the Commission pursuant to § 240.17g-3.
(2) Internal records, including nonpublic information and work papers, used to form the basis of a credit rating issued by the nationally recognized statistical rating organization.
(3) Credit analysis reports, credit assessment reports, and private credit rating reports of the nationally recognized statistical rating organization and internal records, including nonpublic information and work papers, used to form the basis for the opinions expressed in these reports.
(4) Compliance reports and compliance exception reports.
(5) Internal audit plans, internal audit reports, documents relating to internal audit follow-up measures, and all records identified by the internal auditors of the nationally recognized statistical rating organization as necessary to perform the audit of an activity that relates to its business as a credit rating agency.
(6) Marketing materials of the nationally recognized statistical rating organization that are published or otherwise made available to persons that are not associated with the nationally recognized statistical rating organization.
(7) External and internal communications, including electronic communications, received and sent by the nationally recognized statistical rating organization and its employees that relate to initiating, determining, maintaining, monitoring, changing,, or withdrawing a credit rating.
(8) Any written communications received from persons not associated with the nationally recognized statistical rating organization that contain complaints about the performance of a credit analyst in initiating, determining, maintaining, monitoring, changing, or withdrawing a credit rating.
(9) Internal documents that contain information, analysis, or statistics that were used to develop a procedure or methodology to treat the credit ratings of another nationally recognized statistical rating organization for the purpose of determining a credit rating for a security or money market instrument issued by an asset pool or part of any asset-backed or mortgage-backed securities transaction.
(10) For each security or money market instrument identified in the record required to be made and retained under paragraph (a)(7) of this section, any document that contains a description of how assets within such pool or as a part of such transaction not rated by the nationally recognized statistical rating organization but rated by another nationally recognized statistical rating organization were treated for the purpose of determining the credit rating of the security or money market instrument.
(11) Form NRSROs (including Exhibits and accompanying information and documents) submitted to the Commission by the nationally recognized statistical rating organization.
(c) Record retention periods. The records required to be retained pursuant to paragraphs (a) and (b) of this section must be retained for three years after the date the record is made or received.
(d) (1) Manner of retention. An original, or a true and complete copy of the original, of each record required to be retained pursuant to paragraphs (a) and (b) of this section must be maintained in a manner that, for the applicable retention period specified in paragraph (c) of this section, makes the original record or copy easily accessible to the principal office of the nationally recognized statistical rating organization and to any other office that conducted activities causing the record to be made or received.
(2) A nationally recognized statistical rating organization must make and keep publicly available on its corporate Internet Web site in an XBRL (eXtensible Business Reporting Language) format the ratings action information for ten percent of the outstanding credit ratings required to be retained pursuant to paragraph (a)(8) of this section, selected on a random basis, for each class of credit rating for which it is registered and for which it has issued 500 or more outstanding credit ratings paid for by the obligor being rated or by the issuer, underwriter, or sponsor of the security being rated. Any ratings action required to be disclosed pursuant to this paragraph (d)(2) need not be made public less than six months from the date such ratings action is taken. If a credit rating made public pursuant to this paragraph is withdrawn or the instrument rated matures, the nationally recognized statistical rating organization must randomly select a new outstanding credit rating from that class of credit ratings in order to maintain the 10 percent disclosure threshold. In making the information available on its corporate Internet Web site, the nationally recognized statistical rating organization shall use the List of XBRL Tags for NRSROs as specified on the Commission's Internet Web site.
(3) (i) A nationally recognized statistical rating organization must make publicly available on its corporate Internet Web site in an interactive data file that uses a machine-readable format the ratings action information required to be retained pursuant to paragraph (a)(8) of this section for any credit rating initially determined by the nationally recognized statistical rating organization on or after June 26, 2007.
(B) Any ratings action information required to be made and kept publicly available on a nationally recognized statistical rating organization's corporate Internet Web site pursuant to paragraph (d)(3)(i)(A) of this section with respect to credit ratings paid for by the obligor being rated or by the issuer, underwriter, or sponsor of the security being rated need not be made public less than twelve months from the date such ratings action is taken.
(C) Any ratings action information required to be made and kept publicly available on a nationally recognized statistical rating organization's corporate Internet Web site pursuant to paragraph (d)(3)(i)(A) of this section with respect to credit ratings other than those ratings described in paragraph (d)(3)(i)(B) of this section need not be made public less than twenty-four months from the date such ratings action is taken.
(ii) In making the information required under paragraph (d)(3)(i) of this section available in an interactive data file on its corporate Internet Web site, the nationally recognized statistical rating organization shall use any machine-readable format, including but not limited to XBRL format, until 60 days after the date on which the Commission publishes a List of XBRL Tags for NRSROs on its Internet Web site, at which point the nationally recognized statistical rating organization shall make this information available in an interactive data file on its corporate Internet Web site in XBRL format using the List of XBRL Tags for NRSROs as published by the Commission on its Internet Web site.
(e) Third-party record custodian. The records required to be retained pursuant to paragraphs (a) and (b) of this section may be made or retained by a third-party record custodian, provided the nationally recognized statistical rating organization furnishes the Commission at its principal office in Washington, DC with a written undertaking of the custodian executed by a duly authorized person. The undertaking must be in substantially the following form:
The undersigned acknowledges that books and records it has made or is retaining for [the nationally recognized statistical rating organization] are the exclusive property of [the nationally recognized statistical rating organization]. The undersigned undertakes that upon the request of [the nationally recognized statistical rating organization] it will promptly provide the books and records to [the nationally recognized statistical rating organization] or the U.S. Securities and Exchange Commission (“Commission”) or its representatives and that upon the request of the Commission it will promptly permit examination by the Commission or its representatives of the records at any time or from time to time during business hours and promptly furnish to the Commission or its representatives a true and complete copy of any or all or any part of such books and records.
A nationally recognized statistical rating organization that engages a third-party record custodian remains responsible for complying with every provision of this section.
(f) A nationally recognized statistical rating organization must promptly furnish the Commission or its representatives with legible, complete, and current copies, and, if specifically requested, English translations of those records of the nationally recognized statistical rating organization required to be retained pursuant to paragraphs (a) and (b) this section, or any other records of the nationally recognized statistical rating organization subject to examination under section 17(b) of the Act (15 U.S.C. 78q(b)) that are requested by the Commission or its representatives.

Code of Federal Regulations

[72 FR 33620, June 18, 2007, as amended at 74 FR 6482, Feb. 9, 2009; 74 FR 63863, Dec. 4, 2009]