(a) Records required to be made and retained. A nationally recognized statistical rating organization must make and retain the following books and records, which must be complete and current:

(1) Records of original entry into the accounting system of the nationally recognized statistical rating organization and records reflecting entries to and balances in all general ledger accounts of the nationally recognized statistical rating organization for each fiscal year.

(2) Records with respect to each current credit rating of the nationally recognized statistical rating organization indicating (as applicable):

(i) The identity of any credit analyst(s) that participated in determining the credit rating;

(ii) The identity of the person(s) that approved the credit rating before it was issued;

(iii) If a quantitative model was a substantial component in the process of determining the credit rating of a security or money market instrument issued by an asset pool or as part of any asset-backed securities transaction, a record of the rationale for any material difference between the credit rating implied by the model and the final credit rating issued; and

(iv) Whether the credit rating was solicited or unsolicited.

(3) An account record for each person (for example, an obligor, issuer, underwriter, or other user) that has paid the nationally recognized statistical rating organization for the issuance or maintenance of a credit rating indicating:

(i) The identity and address of the person; and

(ii) The credit rating(s) determined or maintained for the person.

(4) An account record for each subscriber to the credit ratings and/or credit analysis reports of the nationally recognized statistical rating organization indicating the identity and address of the subscriber.

(5) A record listing the general types of services and products offered by the nationally recognized statistical rating organization.

(6) A record documenting the established procedures and methodologies used by the nationally recognized statistical rating organization to determine credit ratings.

(7) A record that lists each security and money market instrument and its corresponding credit rating issued by an asset pool or as part of any asset-backed securities transaction where the nationally recognized statistical rating organization, in determining the credit rating for the security or money market instrument, treats assets within such pool or as a part of such transaction that are not subject to a credit rating of the nationally recognized statistical rating organization by any or a combination of the following methods:

(i) Determining credit ratings for the unrated assets;

(ii) Performing credit assessments or determining private credit ratings for the unrated assets;

(iii) Determining credit ratings or private credit ratings, or performing credit assessments for the unrated assets by taking into consideration the internal credit analysis of another person; or

(iv) Determining credit ratings or private credit ratings, or performing credit assessments for the unrated assets by taking into consideration (but not necessarily adopting) the credit ratings of another nationally recognized statistical rating organization.

(8) For each outstanding credit rating, a record showing all rating actions and the date of such actions from the initial credit rating to the current credit rating identified by the name of the rated security or obligor and, if applicable, the CUSIP of the rated security or the Central Index Key (CIK) number of the rated obligor.

(9) A record documenting the policies and procedures the nationally recognized statistical rating organization is required to establish, maintain, and enforce pursuant to section 15E(h)(4)(A) of the Act (15 U.S.C. 78o-7(h)(4)(A)) and §240.17g-8(c).

(b) Records required to be retained. A nationally recognized statistical rating organization must retain the following books and records (excluding drafts of documents) that relate to its business as a credit rating agency:

(1) Significant records (for example, bank statements, invoices, and trial balances) underlying the information included in the annual financial reports the nationally recognized statistical rating organization filed with or furnished to, as applicable, the Commission pursuant to §240.17g-3.

(2) Internal records, including nonpublic information and work papers, used to form the basis of a credit rating issued by the nationally recognized statistical rating organization.

(3) Credit analysis reports, credit assessment reports, and private credit rating reports of the nationally recognized statistical rating organization and internal records, including nonpublic information and work papers, used to form the basis for the opinions expressed in these reports.

(4) Compliance reports and compliance exception reports.

(5) Internal audit plans, internal audit reports, documents relating to internal audit follow-up measures, and all records identified by the internal auditors of the nationally recognized statistical rating organization as necessary to perform the audit of an activity that relates to its business as a credit rating agency.

(6) Marketing materials of the nationally recognized statistical rating organization that are published or otherwise made available to persons that are not associated with the nationally recognized statistical rating organization.

(7) External and internal communications, including electronic communications, received and sent by the nationally recognized statistical rating organization and its employees that relate to initiating, determining, maintaining, monitoring, changing,, or withdrawing a credit rating.

(8) Any written communications received from persons not associated with the nationally recognized statistical rating organization that contain complaints about the performance of a credit analyst in initiating, determining, maintaining, monitoring, changing, or withdrawing a credit rating.

(9) Internal documents that contain information, analysis, or statistics that were used to develop a procedure or methodology to treat the credit ratings of another nationally recognized statistical rating organization for the purpose of determining a credit rating for a security or money market instrument issued by an asset pool or part of any asset-backed securities transaction.

(10) For each security or money market instrument identified in the record required to be made and retained under paragraph (a)(7) of this section, any document that contains a description of how assets within such pool or as a part of such transaction not rated by the nationally recognized statistical rating organization but rated by another nationally recognized statistical rating organization were treated for the purpose of determining the credit rating of the security or money market instrument.

(11) Forms NRSRO (including Exhibits and accompanying information and documents) the nationally recognized statistical rating organization filed with or furnished to, as applicable, the Commission.

(12) The internal control structure the nationally recognized statistical rating organization is required to establish, maintain, enforce, and document pursuant to section 15E(c)(3)(A) of the Act (15 U.S.C. 78o-7(c)(3)(A)).

(13) The policies and procedures the nationally recognized statistical rating organization is required to establish, maintain, enforce, and document pursuant to §240.17g-8(a).

(14) The policies and procedures the nationally recognized statistical rating organization is required to establish, maintain, enforce, and document pursuant to §240.17g-8(b).

(15) The standards of training, experience, and competence for credit analysts the nationally recognized statistical rating organization is required to establish, maintain, enforce, and document pursuant to §240.17g-9.

(c) Record retention periods. The records required to be retained pursuant to paragraphs (a) and (b) of this section must be retained for three years after the date the record is made or received, except that a record identified in paragraph (a)(9), (b)(12), (b)(13), (b)(14), or (b)(15) of this section must be retained until three years after the date the record is replaced with an updated record.

(d) Manner of retention. An original, or a true and complete copy of the original, of each record required to be retained pursuant to paragraphs (a) and (b) of this section must be maintained in a manner that, for the applicable retention period specified in paragraph (c) of this section, makes the original record or copy easily accessible to the principal office of the nationally recognized statistical rating organization and to any other office that conducted activities causing the record to be made or received.

(e) Third-party record custodian. The records required to be retained pursuant to paragraphs (a) and (b) of this section may be made or retained by a third-party record custodian, provided the nationally recognized statistical rating organization furnishes the Commission at its principal office in Washington, DC with a written undertaking of the custodian executed by a duly authorized person. The undertaking must be in substantially the following form:

A nationally recognized statistical rating organization that engages a third-party record custodian remains responsible for complying with every provision of this section.

(f) A nationally recognized statistical rating organization must promptly furnish the Commission or its representatives with legible, complete, and current copies, and, if specifically requested, English translations of those records of the nationally recognized statistical rating organization required to be retained pursuant to paragraphs (a) and (b) this section, or any other records of the nationally recognized statistical rating organization subject to examination under section 17(b) of the Act (15 U.S.C. 78q(b)) that are requested by the Commission or its representatives.

[72 FR 33620, June 18, 2007, as amended at 74 FR 6482, Feb. 9, 2009; 74 FR 63863, Dec. 4, 2009; 79 FR 55263, Nov. 14, 2014]