ESG ratings governance: providers must follow a code, disclose methodologies and segregate ESG activities to prevent conflicts. Regulation requires providers of ESG Ratings and ESG Data Products ('ERDPP') to operate only within authorised services unless approved, to comply or explain adherence to a Code of Conduct covering governance, quality controls, conflicts of interest, transparency, confidentiality and engagement, and to adopt written policies ensuring independence and protection of non public information. ERDPPs must disclose their Code compliance, publish rating methodologies and all ESG Ratings on their websites, and segregate ESG activities from other business to prevent conflicts of interest.