In addition to the CRR, the question relies, inter alia, on the following regulations: 

• Regulation (EC) No. 1060/2009 ("CRAR");
• Commission Implementing Regulation (EU) 2016/1799 and Commission Implementing Regulation (EU) 2024/1872;
• EBA's Decision confirming that unsolicited credit assessments of certain ECAIs do not differ in quality from their solicited credit assessments under art 138 CRR (EBA/DC/2021/397);
• ESMA Guidelines on the Scope of CRAR (ESMA80-196-6345) ("Guidelines").

The current legal framework and ratio of CRR and CRAR are interpretable as allowing the use of ECAIs' private ratings. Namely, based on the: 

• lack of an explicit negative indication in the CRR; 

  The CRR does not expressly prohibit the use of private ratings for CRR purposes.  

• lack of a contrary positive indication in the CRR; 

  The CRR does not include among the general constraints and requirements relating to the use of external ratings (e.g., art. 113, 135, 136, 138) any explicit indications regarding the necessary "public" nature of the ratings, while instead explicitly recalling such element only in specific contexts (e.g. art. 137(1) CRR – on export credit agencies – or art. 270c CRR – on securitizations). Even when required, moreover, the publication is based on specific features and disclosure mechanisms not necessarily consistent with the CRAR ones. 

• reading of CRR and CRAR wording; 

  The CRR merely specifies (art. 135 CRR) that ratings may be used to determine weighting factors if issued by ECAIs registered under the CRAR, leveraging on the quality of the assessment arising from the author of the same rather than on the transparency or publicity of such report. 

  Moreover, the notion of "ECAI", autonomously defined by the CRR, comprises also entities exempt from the application of CRAR, allowing institutions to avail, in this sense, of all ECAIs (including the non-CRAR ones, when capable of issuing ratings based on harmonized standards of quality and reliability). This notwithstanding art. 4(1) CRAR, which apparently – but subject in any case to the specialty principle – limits credit ratings to be used for regulatory purposes to EU-registered CRAs.

  The CRAR does not prohibit the issuance of private ratings by ECAIs. While determining authorization and governance requirements aimed at outlining harmonized standards of quality and reliability for agencies that also want to issue public ratings, clarifying the scope and limits of such ratings, the CRAR does not however have an impact on, or expressly preclude, the issuance of private ratings by registered/certified ECAIs or the use of private / unpublished ratings by an institution under the CRR (See also the Guidelines, recital 43 of the CRAR, and art. 2(2)(a), 4(1), 3(1)(g), CRAR).

• reading of the Authorities' positions; 

  In line with the CRR, the ESMA Guidelines and further positions refer only to the presence of ECAIs, without also explicitly referring to the public nature of the ratings. ESMA indeed merely states that "only a rating provider who is an ESMA-registered CRA and complies with the rules on organization and conduct of business set forth in CRAR, can issue credit ratings for regulatory purposes in the EU", consistently with the provisions of the CRR which – for its own regulatory purposes – effectively requires the use of a registered/certified ECAI, without however mentioning (rectius, specifying only in certain different provisions) the need for publication of the rating.

An additional element that should be considered is the initial goal set by the Committee on Banking Supervision as reported in CRE "Calculation of RWA for credit risk CRE21 Standardised approach: use of external ratings". The following should be mentioned: "21.2(3) International access/transparency: The individual ratings, the key elements underlining the ratings assessments and whether the issuer participated in the rating process should be publicly available on a non-selective basis, unless they are private ratings, which should be at least available to both domestic and foreign institutions with legitimate interest and on equivalent terms. In addition, the ECAI’s general procedures, methodologies and assumptions for arriving at ratings should be publicly available." The point indicates that the use of a private rating was expected for RWA computation, provided that this rating was available to other institutions on equivalent terms and that the methodology was public and consistent with the public ratings. 

• policy goals;

  The combined aim of the CRR and CRAR's requirements at stake is to ensure a general enhancement of the quality of the sensitivity, as well as the prudential soundness, of credit risk assessments used to determine the risk weighting of institutions' exposures and ratings: (i) issued by mapped and equivalent ECAIs; (ii) based on the same methodologies and information of public ratings; (iii) shared with each requesting institution on fully equivalent terms;  despite formally private, should be considered as meeting the policy goals underlying the relevant provisions. 

• use of the information and methodologies of public ratings;  

  Different kinds of private ratings exist, and ratings issued by ECAIs that follow exactly the same methodologies and are based on the same information as public ratings, shall be distinguished from private credit ratings provided by other financial market participants (not qualifying as recognized ECAIs) 

• possibility of providing the rating to third parties upon request;

  The rating, although private, is not subject to any contractual restrictions preventing the ECAI from issuing the same rating to third parties or, where applicable, on publication or distribution; namely, the ECAI , ceteris paribus, can issue the same rating to any other credit institutions upon request, ensuring that the output is made available to all requesting entities on an equal basis. This shall distinguish the rating from those not destined to be made available to others – namely the general public or other parties interested in the purchase of the information. Moreover, this aligns with the concept of "subscription", which shall refer to any arrangement whereby a service – such as the provision of one or more credit ratings – is received in exchange for payment, including instances where the rating is issued upon request by a single party but can also be made available to others on fully equivalent terms and conditions. In such cases, although the rating is not formally public, it is not exclusive and may be accessed on equivalent basis and under the same conditions by other paying parties. 

• the lack of impacts arising from the classification of the rating as unsolicited; 

  Pursuant to art. 138 CRR "credit ratings that have been requested" ("solicited") or, alternatively, "credit ratings that have not been requested" ("unsolicited") can be alternatively used for "the determination of risk weights to be assigned to assets and off-balance sheet items", provided that, in the latter case, "EBA has confirmed that the unsolicited credit assessments of an ECAI do not differ in quality from the solicited credit assessments of that ECAI", without any explicit or implicit indication of the necessary "public" nature of the rating issued by the nominated agency. 

The conclusive interpretation shall be that the unsolicited and private rating issued by the ECAI, in the case under consideration, can be used by the credit institution under the CRR for attributing risk weights in the standardized approach.