Unsolicited ESG Ratings and Your Regulation 30 Disclosure Duty

Between 1 and 18 September 2026, at least six large listed entities filed stock exchange intimations about an unsolicited ESG rating they never commissioned, including Tata Steel, which told the exchanges on 18 September 2026 that SES ESG Research had, the previous day, voluntarily assigned it an "ESG score (Adjusted) of 68.3 (Grade B)". These are Regulation 30 disclosure events, and they have landed in the middle of AGM season. If a SEBI-registered ESG Rating Provider (ERP) scores your company tomorrow, the compliance clock starts running on a document you didn't ask for and never saw in draft, and can't correct.

An unsolicited ESG rating is a score assigned to a listed entity by an ESG Rating Provider that the entity has not engaged, paid or supplied data to. An ESG Rating Provider (ERP) is an intermediary registered with the Securities and Exchange Board of India (SEBI) under the SEBI (Credit Rating Agencies) Regulations, 1999, as amended with effect from 4 July 2023, to issue ESG ratings on Indian securities and issuers.

The September 2026 filings

Read the September cluster as filings rather than as scores. The language is remarkably consistent across issuers, and that consistency is itself the practice signal.

Tata Steel's letter (Ref: SEC/1061/2026-27, 18 September 2026) states that SES ESG Research Private Limited, "a SEBI Registered ESG Rating provider", had on 17 September 2026 voluntarily assigned the company an ESG score (Adjusted) of 68.3 (Grade B) in the Metals and Mining Sector for 2026; that the company "has not engaged SES ESG to provide ESG rating services"; and that the report was prepared "voluntarily and independently, based on publicly available data pertaining to FY2025-26". The disclosure is expressly made "in terms of Regulation 30 and Regulation 51 read with Schedule III" of the LODR Regulations (BSE).

This is now an annual event for Tata Steel. The company filed materially the same letter on 12 August 2025 (Ref: SEC/710/2025-26) for the 2025 SES ESG score, again recording non-engagement and reliance on FY2024-25 data (BSE).

IRCTC's letter of 16 September 2026 (No. 2019/IRCTC/CS/ST.EX/356) discloses a Crisil ESG rating of "63" with the category "Strong", and goes one clause further than Tata Steel: the company "has neither engaged Crisil ESG Ratings for the aforesaid rating nor participated in the preparation of the ESG rating report" (BSE).

NTPC, Asian Paints, HPCL and Aegis Logistics are reported to have filed comparable intimations in the same window; we haven't been able to extract and verify the text of the HPCL and Asian Paints PDFs, so their scores are not reproduced here.

Does Regulation 30 require disclosure of an unsolicited ESG rating?

The filings themselves don't point to a named sub-clause.

Tata Steel cites "Regulation 30 and Regulation 51 read with Schedule III" generically. Most of the others cite Regulation 30 read with the SEBI Master Circular bearing reference HO/49/14/14(7)2025-CFD-POD2/I/3762/2026 dated 30 January 2026, the consolidated Master Circular for compliance with the LODR Regulations, which consolidates circulars in force up to 30 December 2025 (TaxGuru summary). No filing in this cluster asserts that an ESG rating is a deemed-material event.

What has happened is a convergence of practice. Large issuers have decided that a third-party score circulating in the market, attributed to a SEBI-registered intermediary, is information a reasonable investor would want, and that filing it is cheaper than defending a decision not to. Defensible, certainly. But it's a judgement, and a judgement under Regulation 30 needs to be written down.

Start with the materiality policy. Regulation 30 requires a board-approved policy for determining materiality, and if yours is silent on third-party ESG ratings you are improvising under a same-day clock. Add a line: unsolicited ESG ratings from SEBI-registered ERPs are disclosed as a matter of policy, without admission that each is individually material.

The clock then runs from receipt, well before publication. The filings show companies working to a next-day standard: Tata Steel's event date is 17 September 2026 and its filing is dated 18 September 2026; one intimation records a Crisil email received at 8:58 p.m. on 2 September 2026 and is dated 3 September 2026; Aadhar Housing Finance's letter records "Date and time of occurrence of event/information: May, 7 2026 and 02:55 P.M." on a same-day filing. The ERP's email is the trigger, so the timestamp sitting in somebody's inbox is the fact that matters.

Check whether Regulation 51 bites as well. Tata Steel's dual citation of Regulations 30 and 51 read with Schedule III reflects an entity with listed non-convertible securities, and Aadhar Housing Finance separately hosts the intimation on its website in the section for disclosures under Regulation 62. With listed debt, you are looking at a two-regulation, two-channel filing rather than a single exchange intimation. This is the part most secretarial teams miss on a first pass.

Why subscriber-pays lets an ERP score you without asking

ERPs are regulated under the SEBI (Credit Rating Agencies) Regulations, 1999, as amended with effect from 4 July 2023, with procedural and disclosure obligations set out in the Master Circular for ESG Rating Providers, currently Master Circular No. SEBI/HO/DDHS/DDHS-POD-2/P/CIR/2025/100 dated 11 July 2025 (TaxGuru). Under that framework, an ERP follows either an issuer-pays or a subscriber-pays business model (SEBI board memorandum, December 2024).

The subscriber-pays model is one in which investors, rather than the rated company, pay the ERP for the rating and the rationale. In an issuer-pays engagement you are the client: you get a draft, a fact-check window and an appeal. In a subscriber-pays model the investor is the client, and the rated company is the subject, not the customer, so nothing in the commercial relationship requires your consent, your data or your sign-off. The inputs are your BRSR and annual report, plus whatever else happens to be sitting on your website.

The inputs are your BRSR and annual report, plus whatever else happens to be sitting on your website.

SEBI has been tightening the edges of this. In its November 2024 consultation the regulator proposed that subscriber-pays ERPs share rating reports with subscribers and the rated issuer simultaneously, that this policy be publicly disclosed, and that rated entities and their group companies not be permitted to subscribe to their own ratings; where an ERP disagrees with the issuer's representation, it may respond by way of remarks or an addendum (Business Standard). Those measures were carried through in April 2025 (Business Standard).

The sources aren't aligned on one point. The November 2024 consultation floated exempting subscriber-pays ERPs from disclosing ratings to the exchanges; a summary of the 29 April 2025 circular records that subscriber-pays ERPs must publicly disclose assigned ratings in a specified format while restricting the rationale to subscribers, and that exchanges must display ESG ratings in a designated section (TaxGuru). Read the operative circular text before you assume the ERP has filed anything. If it hasn't, your Regulation 30 intimation is the only exchange record of that score, which makes your drafting the market's primary source.

What "ESG score (Adjusted)" and "Category: Strong" mean

The three ERPs in this cluster use scales that don't map onto each other. SES reports a number with a letter grade and an "(Adjusted)" suffix (68.3 / Grade B; 65.7 (Adjusted) in an August 2026 filing). Crisil reports a number with a word category (63 / "Strong"; 58). NSE Sustainability reports a bare number (33). One July 2026 filing shows a score of 59.04 in the category "Adequate" on FY2025-26 disclosures against 59.66 on FY2024-25 disclosures, a 0.62-point move that a careless headline turns into "ESG score falls".

The "(Adjusted)" label is the ERP's own construct; none of the filings defines it. What the filings do tell you is the input: the 6 August 2026 intimation states that SES prepared its report from the company's BRSR for FY25-26 plus other public data.

So reconcile. BRSR Core is the subset of BRSR attributes that must be independently assured or assessed. Your BRSR Core attributes are the assured or assessed subset under the BRSR Core framework circular (SEBI/HO/CFD/CFD-SEC-2/P/CIR/2023/122, 12 July 2023), as modified by the March 2025 ease-of-doing-business circular (SEBI/HO/CFD/CFD-PoD-1/P/CIR/2025/42, 28 March 2025), which recast the requirement as assurance or assessment, addressed value chain disclosures and introduced voluntary green credit disclosure. Check the current text for the applicability and glide-path years that apply to you, because they have moved more than once.

Build a two-column map: every input the ERP appears to have used, against whether that number sits inside your assured or assessed BRSR Core table or outside it. Where the ERP has scored you on unassured narrative, you have a factual basis for a representation. Where it has scored you on assured data and still marked you down, you are arguing about methodology weighting, and that is an argument you will lose in a press statement and shouldn't start.

Solicited versus unsolicited ESG ratings at a glance

Drafting the intimation letter

Nine elements, in this order; the September 2026 filings supply most of the wording.

1. Subject line naming the regulation and the event: "Disclosure under Regulation 30 [and 51] — ESG Rating".
2. Name the ERP in full and state its SEBI registration, and where known its category, as in the "SEBI registered ESG Rating Provider under Category-II" formulation.
3. Date and time of receipt of the communication.
4. The score reproduced verbatim, including scale, grade, category, sector and year: "ESG score (Adjusted) of 68.3 (Grade B) in Metals and Mining Sector for 2026", not "68.3 out of 100".
5. Non-engagement: "the Company has not engaged [ERP] to provide ESG rating services".
6. Non-participation: "nor participated in the preparation of the ESG rating report". That is IRCTC's addition, and the stronger clause. Adopt it.
7. Data basis and period: publicly available data pertaining to FY2025-26.
8. Neutrality. Do not thank, welcome, celebrate or contest the score in the intimation. The moment you say "we are pleased", you have endorsed a methodology you have not reviewed.
9. Website posting under Regulation 46, and Regulation 62 where applicable.

Keep the letter to one page; commentary belongs in the sustainability report.

How do you handle AGM questions when the score contradicts your BRSR narrative?

Boards are being asked, from the floor, why an independent SEBI-registered provider rates the company "Adequate" when the integrated report says "leadership". Have three answers ready.

On scale: scores from SES, Crisil and NSE Sustainability are not on a common scale and are not intended to be. A 63 from one provider and a 58 from another are not a ranking.

On inputs: state plainly which ERP used which financial year. A score built on FY2024-25 public data will not reflect FY2025-26 performance. Aadhar Housing Finance made exactly this point on the record, noting it was in the process of publishing its first BRSR for FY25-26.

On engagement: the company did not commission, fund or supply data for the rating, and has no contractual right to review it before publication. That is how the subscriber-pays model works, and it isn't a failure of disclosure.

What CFOs, company secretaries and IR teams should do now

• Amend the materiality policy at the next board meeting. One clause covering unsolicited third-party ESG ratings, with a "disclose without admission of individual materiality" formulation.
• Give ERPs a named recipient. Their emails arrive at generic investor-relations addresses at 8:58 p.m. Route them to the company secretary and a deputy, with an escalation SLA measured in hours.
• Pre-approve the template, so that the intimation is a fill-in-the-blanks document needing one signature rather than a drafting exercise at 9 p.m.
• Maintain an ERP register. SEBI publishes the list of registered ESG Rating Providers. Know which of them cover your sector and roughly when they refresh.
• Run an annual self-score. If your BRSR is the input, read it the way an ERP will: mechanically, without the design, without the CEO letter.
• Brief the chair before the AGM, not during it. Three paragraphs, one page.
• Don't litigate the methodology in public. Use the representation and addendum route the ERP framework provides.

Bottom line

An unsolicited ESG rating isn't a reputational event you can manage in your own time. It's a disclosure event with a same-day clock, and the six September 2026 filings show the market has already settled the "do we file?" question in favour of filing. What remains is preparatory work: a written materiality position, a one-page house template built on the Tata Steel and IRCTC language, a reconciliation of the ERP's inputs to your assured BRSR Core data, and a board briefing that explains why a number you did not commission sits on the exchange under your company's name. Do that once, properly, and the next unsolicited score is a twenty-minute filing rather than an AGM ambush.