In re DBRS

 UNITED STATES OF AMERICA 
 Before the 
 SECURITIES AND EXCHANGE COMMISSION 
 
SECURITIES EXCHANGE ACT OF 1934 
Release No. 98638 / September 29, 2023 
 
ADMINISTRATIVE PROCEEDING 
File No. 3-21773 
 
 
In the Matter of 
 
DBRS, Inc. 
 
Respondent. 
 
ORDER INSTITUTING ADMINISTRATIVE 
AND CEASE-AND-DESIST PROCEEDINGS, 
PURSUANT TO SECTIONS 15E(d) AND 21C 
OF THE SECURITIES EXCHANGE ACT OF 
1934, MAKING FINDINGS, AND IMPOSING 
REMEDIAL SANCTIONS AND A CEASE-
AND-DESIST ORDER 
   
 
 
The Securities and Exchange Commission (“Commission”) deems it appropriate, in the 
public interest and for the protection of investors that public administrative and cease-and-desist 
proceedings be, and hereby are, instituted pursuant to Sections 15E(d) and 21C of the Securities 
Exchange Act of 1934 (“Exchange Act”) against DBRS, Inc. (“DBRS” or “Respondent”).   
 
In anticipation of the institution of these proceedings, Respondent has submitted an Offer 
of Settlement (“Offer”) that the Commission has determined to accept. Respondent admits the facts 
set forth in Section III below, acknowledges that its conduct violated the federal securities laws, 
admits the Commission’s jurisdiction over it and the subject matter of these proceedings, and 
consents to the entry of this Order Instituting Administrative and Cease-and-Desist Proceedings, 
Pursuant to Sections 15E(d) and 21C of the Securities Exchange Act of 1934, Making Findings, 
and Imposing Remedial Sanctions and a Cease-and-Desist Order (“Order”), as set forth below. 
 
 
 

2 
 
On the basis of this Order and Respondent’s Offer, the Commission finds
1
 that: 
Summary 
1. Nationally recognized statistical rating organizations (“NRSROs”) and the credit 
ratings they issue play a unique and important role in our financial markets. The federal securities 
laws impose recordkeeping requirements on NRSROs  to  establish a framework of oversight to 
ensure that NRSROs responsibly discharge their role. The Commission has long said that 
recordkeeping requirements have proven integral to the Commission’s investor protection function 
because preserved records are the primary means of monitoring compliance with applicable federal 
securities laws.  
2. These proceedings arise out of the longstanding failure by DBRS, an NRSRO, to 
adhere to NRSRO recordkeeping requirements. DBRS employees, including those at senior levels, 
have communicated internally by text messages since at least July 2019.  The text messages 
occurred both on personal and DBRS-issued cell phones, and they included discussions of 
initiating or determining credit ratings.  
3. DBRS failed to retain these messages as required by NRSRO recordkeeping rules. 
In fact, at the direction of DBRS, with approval from its compliance department, at least nineteen 
DBRS analytical employees “wiped” their DBRS-issued phones in 2022 during a company rollout 
of new devices, such that the phones’ contents cannot be retrieved or analyzed to determine 
whether they contained any communications subject to recordkeeping requirements.  
4. As a result of this conduct, DBRS violated Section 17(a)(1) of the Exchange Act 
and Rule 17g-2(b)(7) thereunder. 
Respondent 
5. Respondent is  a Delaware corporation headquartered in New York, New York. 
DBRS has been registered with the Commission as an NRSRO since 2007. On July 2, 2019, DBRS 
was acquired by Morningstar, Inc., the parent of Morningstar Credit Ratings, LLC (“MCR”), after 
which DBRS and MCR integrated their businesses.  
NRSRO Recordkeeping Requirements 
6. Section 17(a)(1) of the Exchange Act requires NRSROs and other regulated entities 
to make and keep for prescribed periods such records, and furnish copies thereof, as required by 
Commission rules.  
 
1
  The findings herein are made pursuant to Respondent’s Offer of Settlement and are not 
binding on any other person or entity in this or any other proceeding.  
 

3 
7. Pursuant to this provision, the Commission adopted recordkeeping requirements 
specific to NRSROs. Those requirements include, among other provisions, Exchange Act Rule 
17g-2(b)(7), which requires an NRSRO, for a period of three years, to retain internal and external 
communications, including electronic communications, received and sent by the NRSRO and its 
employees that relate to initiating, determining, maintaining, monitoring, changing, or withdrawing 
a credit rating. 
8. In adopting Rule 17g-2, the Commission emphasized the importance of analogous 
recordkeeping requirements, stating, “the retention of written communications has played an 
important role in assisting the Commission in identifying legal violations and compliance issues 
with respect to other regulated entities.” Final Rule, Oversight of Credit Rating Agencies 
Registered as Nationally Recognized Statistical Rating Organizations, 72 Fed. Reg. 33564, 33588 
(June 18, 2007). The Commission also specifically emphasized the evidentiary relevance of 
internal NRSRO records, stating that “internal communications will play an important role in 
assisting the Commission in identifying legal violations and compliance issues in its oversight of 
NRSROs.” Id. 
DBRS’s Electronic Communications Policies and Procedures 
9. Since at least July 2019, DBRS has had an Electronic Communications Global 
Policy stipulating that DBRS work email was the only method of electronic communication that its 
employees may use for business purposes. The policy further prohibits the use for business 
purposes of other types of electronic communications, including text messaging, instant messaging 
applications, and personal email accounts.  
10. Prior to 2022, DBRS issued cell phones to certain employees, but permitted 
employees to use their personal cell phones for work purposes, including phone calls and accessing 
DBRS work email. In 2022, DBRS began requiring all employees to use DBRS-issued cell phones 
for business purposes. To implement this policy, DBRS issued new iPhones to all employees, 
including those to whom DBRS had previously issued cell phones. 
DBRS’s Recordkeeping Failures 
11. DBRS employees involved in determining credit ratings for commercial mortgage-
backed securities (“CMBS”) transactions, including those at senior levels, have communicated 
internally for business purposes using text messages since at least July 2019, in violation of 
DBRS’s Electronic Communications Global Policy. 
12. In November 2022, the Commission staff subpoenaed text messages for eight 
DBRS employees involved in initiating or determining CMBS ratings. In response, DBRS 
produced text messages that included discussions of initiating or determining credit ratings, and 
other topics related to DBRS’s business as an NRSRO.  
13. For example, CMBS employees, including senior CMBS personnel, exchanged 
hundreds of text messages with other CMBS colleagues concerning transactions for which DBRS 
had been engaged to issue credit ratings. Some of these messages included discussion of 

4 
adjustments to results of the quantitative predictive model that DBRS used to rate multi-borrower 
CMBS transactions. 
14. The text messages revealed that all eight employees who were named in the 
subpoena exchanged numerous business-related text messages over a multi-year period, and that 
other DBRS employees exchanged business-related text messages as well. 
15. Many of the text messages were exchanged on employees’ personal cell phones, 
with some containing snapshots of internal DBRS documents and communications, such as DBRS 
ratings files and emails. Other text messages were exchanged on DBRS-issued cell phones. 
16. DBRS failed to retain its employees’ text messages, including those related to credit 
ratings. In responding to the November 2022 subpoena, DBRS undertook to collect personal and 
work-issued cell phones and image their records, having not previously collected or retained them. 
17. In doing so, DBRS discovered that in 2022, at least nineteen analytical employees 
to  whom DBRS had previously issued cell phones permanently “wiped” those phones, such that 
their contents can no longer be retrieved or analyzed to determine whether they contained any 
communications subject to recordkeeping requirements. Employees took this action at the direction 
of DBRS, with approval from its compliance department, in connection with DBRS’s issuance of 
new cell phones to all employees. Before giving this directive to employees, DBRS did not first 
seek to preserve NRSRO records that were required to be retained.  
Violations 
18. As a result of the conduct described above, DBRS willfully
2
 violated Section 
17(a)(1) of the Exchange Act and Rule 17g-2(b)(7) thereunder, which requires each NRSRO, for a 
period of three years, to retain internal and external communications, including electronic 
communications, received and sent by the NRSRO and its employees that relate to initiating, 
determining, maintaining, monitoring, changing, or withdrawing a credit rating.  
Undertakings 
19. Prior to this action, DBRS enhanced its training on approved business 
communications methods, made significant changes to technology available to employees, and 
began implementing technologies to facilitate compliance with NRSRO recordkeeping 
 
2
 “Willfully,” for purposes of imposing relief under Section 15E(d) of the Exchange Act, 
“‘means no more than that the person charged with the duty knows what he is doing.’” Wonsover 
v. SEC, 205 F.3d 408, 414 (D.C. Cir. 2000) (quoting Hughes v. SEC, 174 F.2d 969, 977 (D.C. 
Cir. 1949)). There is no requirement that the actor “also be aware that he is violating one of the 
Rules or Acts.” Tager v. SEC, 344 F.2d 5, 8 (2d Cir. 1965). The decision in The Robare Group, 
Ltd. v. SEC, which construed the term “willfully” for purposes of a differently structured 
statutory provision, does not alter that standard. 922 F.3d 468, 478-79 (D.C. Cir. 2019) (setting 
forth the showing required to establish that a person has “willfully omit[ted]” material 
information from a required disclosure in violation of Section 207 of the Investment Advisers 
Act of 1940). 

5 
requirements. To ensure the effectiveness of these measures and address the involvement of 
DBRS’s compliance department in its recordkeeping failures, DBRS has undertaken to: 
20. Compliance Consultant. 
a. DBRS shall retain, within thirty (30) days of the entry of this Order, the 
services of a compliance consultant (“Compliance Consultant”) that is not unacceptable to 
the Commission staff. The Compliance Consultant’s compensation and expenses shall be 
borne exclusively by DBRS. 
b. DBRS will oversee the work of the Compliance Consultant.  
c. DBRS shall provide to the Commission staff, within sixty (60) days of the 
entry of this Order, a copy of the engagement letter detailing the Compliance Consultant’s 
responsibilities, which shall include a comprehensive compliance review as described 
below. DBRS shall require that, within ninety (90) days of the date of the engagement 
letter, the Compliance Consultant conduct: 
i. A comprehensive review of DBRS’s supervisory, compliance, and other 
policies and procedures designed to ensure that internal and external 
communications, including electronic communications, received and 
sent by DBRS and its employees that relate to initiating, determining, 
maintaining, monitoring, changing, or withdrawing a credit rating 
(“Rule 17g-2(b)(7) Communications”) are preserved in accordance with 
the requirements of the federal securities laws and NRSRO regulations 
and an assessment of DBRS’s framework for addressing instances of 
non-compliance among its employees. 
ii. A comprehensive review of training conducted by DBRS to ensure 
personnel are complying with the requirements regarding the 
preservation of Rule 17g-2(b)(7) Communications, including those 
found on personal devices, in accordance with the federal securities 
laws and NRSRO regulations. 
iii. An assessment of any surveillance measures implemented by DBRS to 
ensure compliance, on an ongoing basis, with the requirements 
regarding the preservation of Rule 17g-2(b)(7) Communications, 
including those found on personal devices, in accordance with the 
federal securities laws and NRSRO regulations. 
iv. An assessment of the technological solutions that DBRS has begun 
implementing to facilitate compliance with the requirements regarding 
the preservation of Rule 17g-2(b)(7) Communications in accordance 
with the federal securities laws and NRSRO regulations, including an 
assessment of the likelihood that DBRS personnel will use the 
technological solutions going forward and a review of the measures 

6 
employed by DBRS to track employee usage of new technological 
solutions. 
v. An assessment of the measures used by DBRS to prevent the use of 
unauthorized communications methods for Rule 17g-2(b)(7) 
Communications by employees. This assessment should include, but not 
be limited to, a review of the firm’s policies and procedures to ascertain 
if they provide for any significant technology and/or behavioral 
restrictions that help prevent the risk of the use of unapproved 
communications methods on personal devices to send or receive Rule 
17g-2(b)(7) Communications in contravention of the requirements of 
the federal securities laws and NRSRO regulations. 
vi. A review of DBRS’s electronic communications surveillance routines to 
ensure the preservation of electronic Rule 17g-2(b)(7) Communications, 
including those found on personal devices,  in accordance with the 
federal securities laws and NRSRO regulations, are incorporated into 
DBRS’s overall communications surveillance program. 
vii. A comprehensive review of the framework adopted by DBRS to address 
instances of non-compliance by DBRS personnel with DBRS’s policies 
and procedures concerning the use of approved communications 
methods, including on personal devices, for Rule 17g-2(b)(7) 
Communications in accordance with the federal securities laws and 
NRSRO regulations in the past.  This review shall include a survey of 
how DBRS determined which employees failed to comply with DBRS 
policies and procedures, the corrective action carried out, an evaluation 
of who violated policies and why, what penalties were imposed, and 
whether penalties were handed out consistently across business lines 
and seniority levels. 
d. DBRS shall require that, within forty-five (45) days after completion of the 
review set forth in sub-paragraphs c.i through c.vii above, the Compliance Consultant shall 
submit a detailed written report of its findings to DBRS and to the Commission staff (the 
“Report”). DBRS shall require that the Report include a description of the review 
performed, the names of the individuals who performed the review, the conclusions 
reached, the Compliance Consultant’s recommendations for changes in or improvements to 
DBRS’s policies and procedures, and a summary of the plan for implementing the 
recommended changes in or improvements to DBRS’s policies and procedures. 
e. DBRS shall adopt all recommendations contained in the Report within 
ninety (90) days of the date of the Report; provided, however, that within forty-five (45) 
days after the date of the Report, DBRS shall advise the Compliance Consultant and the 
Commission staff in writing of any recommendations that DBRS considers to be unduly 
burdensome, impractical, or inappropriate. With respect to any recommendation that DBRS 
considers unduly burdensome, impractical, or inappropriate, DBRS need not adopt such 

7 
recommendation at that time, but shall propose in writing an alternative policy, procedure, 
or disclosure designed to achieve the same objective or purpose.  
f. As to any recommendation concerning DBRS’s policies or procedures on 
which DBRS and the Compliance Consultant do not agree, DBRS and the Compliance 
Consultant shall attempt in good faith to reach an agreement within sixty (60) days after 
the date of the Report. Within fifteen (15) days after the conclusion of the discussion and 
evaluation by DBRS and the Compliance Consultant, DBRS shall require that the 
Compliance Consultant inform DBRS and the Commission staff in writing of the 
Compliance Consultant’s final determination concerning any recommendation that DBRS 
considers to be unduly burdensome, impractical, or inappropriate. DBRS shall abide by 
the determinations of the Compliance Consultant and, within sixty (60) days after final 
agreement between DBRS and the Compliance Consultant or final determination by the 
Compliance Consultant, whichever occurs first, DBRS shall adopt and implement all of 
the recommendations that the Compliance Consultant deems appropriate. 
g. DBRS shall cooperate fully with the Compliance Consultant and shall 
provide the Compliance Consultant with access to such of DBRS’s files, books, records, 
and personnel as are reasonably requested by the Compliance Consultant for review.  
h. DBRS shall not have the authority to terminate the Compliance Consultant 
or substitute another compliance consultant for the initial Compliance Consultant, 
without the prior written approval of the Commission staff. DBRS shall compensate the 
Compliance Consultant and persons engaged to assist the Compliance Consultant for 
services rendered under this Order at their reasonable and customary rates. 
i. DBRS shall require the Compliance Consultant to enter into an agreement 
that provides that for the period of engagement and for a period of two years from 
completion of the engagement, the Compliance Consultant shall not enter into any 
employment, consultant, attorney-client, auditing, or other professional relationship with 
DBRS, or any of its present or former affiliates, directors, officers, employees, or agents 
acting in their capacity. The agreement shall also provide that the Compliance Consultant 
will require that any firm with which he/she is affiliated or of which he/she is a member, 
and any person engaged to assist the Compliance Consultant in the performance of 
his/her duties under this Order shall not, without prior written consent of the Commission 
staff, enter into any employment, consultant, attorney-client, auditing, or other 
professional relationship with DBRS, or any of its present or former affiliates, directors, 
officers, employees, or agents acting in their capacity as such for the period of the 
engagement and for a period of two years after the engagement.  
j.  The Report and related written communications of the Compliance 
Consultant will likely include confidential financial, proprietary, competitive business or 
commercial information. Public disclosure of the Report could discourage cooperation, 
impede pending or potential government investigations or undermine the objectives of 
the reporting requirement. For these reasons, among others, the Report and the contents 
thereof are intended to remain and shall remain non-public, except (1) pursuant to court 

8 
order, (2) as agreed to by the parties in writing, (3) to the extent that the Commission 
determines in its sole discretion that disclosure would be in furtherance of the 
Commission’s discharge of its duties and responsibilities, or (4) is otherwise required by 
law. 
21. One-Year Evaluation. DBRS shall require the Compliance Consultant to assess 
DBRS’s program for the preservation, as required under the federal securities laws and NRSRO 
regulations, of Rule 17g-2(b)(7) Communications, including those found on personal devices, 
commencing one year after submitting the Report required by Paragraph 20.d above. DBRS shall 
require this review to evaluate DBRS’s progress in the areas described in Paragraphs 20.c.i-vii 
above. After this review, DBRS shall require the Compliance Consultant to submit a report (the 
“One Year Report”) to DBRS and the Commission staff and shall ensure that the One Year 
Report includes an updated assessment of DBRS’s policies and procedures with regard to the 
preservation of Rule 17g-2(b)(7) Communications (including those found on personal devices), 
training, surveillance programs, and technological solutions implemented in the prior year 
period. 
22. R
eporting Discipline Imposed.  For two years following the entry of this Order, 
DBRS shall notify the Commission staff as follows upon the imposition of any discipline imposed 
by DBRS, including, but not limited to, written warnings, loss of any pay, bonus, or incentive 
compensation, or the termination of employment, with respect to any employee found to have 
violated DBRS’s policies and procedures concerning the preservation of Rule 17g-2(b)(7) 
Communications, including those found on personal devices:  within thirty (30) days of the 
imposition of such discipline. 
23. I
nternal Audit.  In addition to the Compliance Consultant’s review and issuance of 
a One Year Report, DBRS will also have its Internal Audit function conduct a separate audit(s) 
to assess DBRS’s progress in the areas described in Paragraphs 20.c.i-vii above. After 
completion of this audit(s), DBRS shall ensure that Internal Audit submits a report to DBRS and 
the Commission staff. 
24. R
ecordkeeping.  DBRS shall preserve, for a period of not less than six (6) years 
from the end of the fiscal year last used, the first two (2) years in an easily accessible place, any 
record of compliance with these undertakings. 
25. D
eadlines.  For good cause shown, the Commission staff may extend any of the 
procedural dates related to the undertakings. Deadlines for procedural dates shall be counted in 
calendar days, except that if the last day falls on a weekend or federal holiday, the next business 
day shall be considered to be the last day. 
26. Certification. DBRS shall certify, in writing, compliance with the undertakings set 
forth above. The certification shall identify the undertakings, provide written evidence of 
compliance in the form of a narrative, and be supported by exhibits sufficient to demonstrate 
compliance. The Commission staff may make reasonable requests for further evidence of 
compliance, and Respondent agrees to provide such evidence.  The certification and supporting 
material shall be submitted to Osman Nawaz, Chief, Complex Financial Instruments Unit, Division 

9 
of Enforcement, Securities and Exchange Commission, 100 Pearl Street, Suite 20-100, New York, 
New York 10004-2616, with a copy to the Office of Chief Counsel of the Enforcement Division, 
no later than sixty (60) days from the date of the completion of the undertakings.   
 
 In view of the foregoing, the Commission deems it appropriate, in the public interest  and 
for the protection of investors to impose the sanctions agreed to in Respondent DBRS’s Offer. 
 
 Accordingly, pursuant to Sections 15E(d) and 21C of the Exchange Act, it is hereby 
ORDERED that: 
 
A. Respondent DBRS cease and desist from committing or causing any violations and 
any future violations of Section 17(a)(1) of the Exchange Act and Rule 17g-2(b)(7) thereunder.   
B. Respondent DBRS is censured.   
C. Respondent DBRS shall comply with the undertakings enumerated in Paragraphs 
19 to 26 above. 
D. Respondent DBRS shall, within 30 days of the entry of this Order, pay a civil 
money penalty in the amount of $6,000,000 to the Securities and Exchange Commission for 
transfer to the general fund of the United States Treasury, subject to Exchange Act Section 
21F(g)(3). If timely payment is not made, additional interest shall accrue pursuant to 31 U.S.C. 
§   3717. 
Payment must be made in one of the following ways:   
(1) Respondent may transmit payment electronically to the Commission, which 
will provide detailed ACH transfer/Fedwire instructions upon request;  
(2) Respondent may make direct payment from a bank account via Pay.gov 
through the SEC website at http://www.sec.gov/about/offices/ofm.htm
; or  
(3) Respondent may pay by certified check, bank cashier’s check, or United 
States postal money order, made payable to the Securities and Exchange 
Commission and hand-delivered or mailed to:  
Enterprise Services Center 
Accounts Receivable Branch 
HQ Bldg., Room 181, AMZ-341 
6500 South MacArthur Boulevard 
Oklahoma City, OK 73169 
 
Payments by check or money order must be accompanied by a cover letter identifying 
DBRS as a Respondent in these proceedings, and the file number of these proceedings; a copy of 
the cover letter and check or money order must be sent to Osman Nawaz, Chief, Complex 

10 
Financial Instruments Unit, Division of Enforcement, Securities and Exchange Commission, 100 
Pearl Street, Suite 20-100, New York, New York 10004-2626.  
E. Amounts ordered to be paid as civil money penalties pursuant to this Order shall be 
treated as penalties paid to the government for all purposes, including all tax purposes. To preserve 
the deterrent effect of the civil penalty, Respondent agrees that in any Related Investor Action, it 
shall not argue that it is entitled to, nor shall it benefit by, offset or reduction of any award of 
compensatory damages by the amount of any part of Respondent’s payment of a civil penalty in 
this action (“Penalty Offset”). If the court in any Related Investor Action grants such a Penalty 
Offset, Respondent agrees that it shall, within 30 days after entry of a final order granting the 
Penalty Offset, notify the Commission’s counsel in this action and pay the amount of the Penalty 
Offset to the Securities and Exchange Commission. Such a payment shall not be deemed an 
additional civil penalty and shall not be deemed to change the amount of the civil penalty imposed 
in this proceeding. For purposes of this paragraph, a “Related Investor Action” means a private 
damages action brought against Respondent by or on behalf of one or more investors based on 
substantially the same facts as alleged in the Order instituted by the Commission in this 
proceeding. 
 
 By the Commission. 
 
 
 
 Vanessa A. Countryman 
        Secretary 

UNITED STATES OF AMERICA 
 Before the 
 SECURITIES AND EXCHANGE COMMISSION 
 
SECURITIES EXCHANGE ACT OF 1934 
Release No. 98638 / September 29, 2023 
 
ADMINISTRATIVE PROCEEDING 
File No. 3-21773 
 
 
In the Matter of 
 

DBRS, Inc. 
 
Respondent. 
 

ORDER INSTITUTING ADMINISTRATIVE 
AND CEASE-AND-DESIST PROCEEDINGS, 
PURSUANT TO SECTIONS 15E(d) AND 21C 
OF THE SECURITIES EXCHANGE ACT OF 
1934, MAKING FINDINGS, AND IMPOSING 
REMEDIAL SANCTIONS AND A CEASE-
AND-DESIST ORDER 

   
 

 

The Securities and Exchange Commission (“Commission”) deems it appropriate, in the 
public interest and for the protection of investors that public administrative and cease-and-desist 
proceedings be, and hereby are, instituted pursuant to Sections 15E(d) and 21C of the Securities 
Exchange Act of 1934 (“Exchange Act”) against DBRS, Inc. (“DBRS” or “Respondent”).   

 

In anticipation of the institution of these proceedings, Respondent has submitted an Offer 
of Settlement (“Offer”) that the Commission has determined to accept. Respondent admits the facts 
set forth in Section III below, acknowledges that its conduct violated the federal securities laws, 
admits the Commission’s jurisdiction over it and the subject matter of these proceedings, and 
consents to the entry of this Order Instituting Administrative and Cease-and-Desist Proceedings, 
Pursuant to Sections 15E(d) and 21C of the Securities Exchange Act of 1934, Making Findings, 
and Imposing Remedial Sanctions and a Cease-and-Desist Order (“Order”), as set forth below. 

 

 

 



2 

 

On the basis of this Order and Respondent’s Offer, the Commission finds1 that: 

Summary 

1. Nationally recognized statistical rating organizations (“NRSROs”) and the credit 
ratings they issue play a unique and important role in our financial markets. The federal securities 
laws impose recordkeeping requirements on NRSROs to establish a framework of oversight to 
ensure that NRSROs responsibly discharge their role. The Commission has long said that 
recordkeeping requirements have proven integral to the Commission’s investor protection function 
because preserved records are the primary means of monitoring compliance with applicable federal 
securities laws.  

2. These proceedings arise out of the longstanding failure by DBRS, an NRSRO, to 
adhere to NRSRO recordkeeping requirements. DBRS employees, including those at senior levels, 
have communicated internally by text messages since at least July 2019. The text messages 
occurred both on personal and DBRS-issued cell phones, and they included discussions of 
initiating or determining credit ratings.  

3. DBRS failed to retain these messages as required by NRSRO recordkeeping rules. 
In fact, at the direction of DBRS, with approval from its compliance department, at least nineteen 
DBRS analytical employees “wiped” their DBRS-issued phones in 2022 during a company rollout 
of new devices, such that the phones’ contents cannot be retrieved or analyzed to determine 
whether they contained any communications subject to recordkeeping requirements.  

4. As a result of this conduct, DBRS violated Section 17(a)(1) of the Exchange Act 
and Rule 17g-2(b)(7) thereunder. 

Respondent 

5. Respondent is a Delaware corporation headquartered in New York, New York. 
DBRS has been registered with the Commission as an NRSRO since 2007. On July 2, 2019, DBRS 
was acquired by Morningstar, Inc., the parent of Morningstar Credit Ratings, LLC (“MCR”), after 
which DBRS and MCR integrated their businesses.  

NRSRO Recordkeeping Requirements 

6. Section 17(a)(1) of the Exchange Act requires NRSROs and other regulated entities 
to make and keep for prescribed periods such records, and furnish copies thereof, as required by 
Commission rules.  

 
1  The findings herein are made pursuant to Respondent’s Offer of Settlement and are not 

binding on any other person or entity in this or any other proceeding.  
 



3 

7. Pursuant to this provision, the Commission adopted recordkeeping requirements 
specific to NRSROs. Those requirements include, among other provisions, Exchange Act Rule 
17g-2(b)(7), which requires an NRSRO, for a period of three years, to retain internal and external 
communications, including electronic communications, received and sent by the NRSRO and its 
employees that relate to initiating, determining, maintaining, monitoring, changing, or withdrawing 
a credit rating. 

8. In adopting Rule 17g-2, the Commission emphasized the importance of analogous 
recordkeeping requirements, stating, “the retention of written communications has played an 
important role in assisting the Commission in identifying legal violations and compliance issues 
with respect to other regulated entities.” Final Rule, Oversight of Credit Rating Agencies 
Registered as Nationally Recognized Statistical Rating Organizations, 72 Fed. Reg. 33564, 33588 
(June 18, 2007). The Commission also specifically emphasized the evidentiary relevance of 
internal NRSRO records, stating that “internal communications will play an important role in 
assisting the Commission in identifying legal violations and compliance issues in its oversight of 
NRSROs.” Id. 

DBRS’s Electronic Communications Policies and Procedures 

9. Since at least July 2019, DBRS has had an Electronic Communications Global 
Policy stipulating that DBRS work email was the only method of electronic communication that its 
employees may use for business purposes. The policy further prohibits the use for business 
purposes of other types of electronic communications, including text messaging, instant messaging 
applications, and personal email accounts.  

10. Prior to 2022, DBRS issued cell phones to certain employees, but permitted 
employees to use their personal cell phones for work purposes, including phone calls and accessing 
DBRS work email. In 2022, DBRS began requiring all employees to use DBRS-issued cell phones 
for business purposes. To implement this policy, DBRS issued new iPhones to all employees, 
including those to whom DBRS had previously issued cell phones. 

DBRS’s Recordkeeping Failures 

11. DBRS employees involved in determining credit ratings for commercial mortgage-
backed securities (“CMBS”) transactions, including those at senior levels, have communicated 
internally for business purposes using text messages since at least July 2019, in violation of 
DBRS’s Electronic Communications Global Policy. 

12. In November 2022, the Commission staff subpoenaed text messages for eight 
DBRS employees involved in initiating or determining CMBS ratings. In response, DBRS 
produced text messages that included discussions of initiating or determining credit ratings, and 
other topics related to DBRS’s business as an NRSRO.  

13. For example, CMBS employees, including senior CMBS personnel, exchanged 
hundreds of text messages with other CMBS colleagues concerning transactions for which DBRS 
had been engaged to issue credit ratings. Some of these messages included discussion of 



4 

adjustments to results of the quantitative predictive model that DBRS used to rate multi-borrower 
CMBS transactions. 

14. The text messages revealed that all eight employees who were named in the 
subpoena exchanged numerous business-related text messages over a multi-year period, and that 
other DBRS employees exchanged business-related text messages as well. 

15. Many of the text messages were exchanged on employees’ personal cell phones, 
with some containing snapshots of internal DBRS documents and communications, such as DBRS 
ratings files and emails. Other text messages were exchanged on DBRS-issued cell phones. 

16. DBRS failed to retain its employees’ text messages, including those related to credit 
ratings. In responding to the November 2022 subpoena, DBRS undertook to collect personal and 
work-issued cell phones and image their records, having not previously collected or retained them. 

17. In doing so, DBRS discovered that in 2022, at least nineteen analytical employees 
to whom DBRS had previously issued cell phones permanently “wiped” those phones, such that 
their contents can no longer be retrieved or analyzed to determine whether they contained any 
communications subject to recordkeeping requirements. Employees took this action at the direction 
of DBRS, with approval from its compliance department, in connection with DBRS’s issuance of 
new cell phones to all employees. Before giving this directive to employees, DBRS did not first 
seek to preserve NRSRO records that were required to be retained.  

Violations 

18. As a result of the conduct described above, DBRS willfully2 violated Section 
17(a)(1) of the Exchange Act and Rule 17g-2(b)(7) thereunder, which requires each NRSRO, for a 
period of three years, to retain internal and external communications, including electronic 
communications, received and sent by the NRSRO and its employees that relate to initiating, 
determining, maintaining, monitoring, changing, or withdrawing a credit rating.  

Undertakings 

19. Prior to this action, DBRS enhanced its training on approved business 
communications methods, made significant changes to technology available to employees, and 
began implementing technologies to facilitate compliance with NRSRO recordkeeping 

 
2 “Willfully,” for purposes of imposing relief under Section 15E(d) of the Exchange Act, 
“‘means no more than that the person charged with the duty knows what he is doing.’” Wonsover 
v. SEC, 205 F.3d 408, 414 (D.C. Cir. 2000) (quoting Hughes v. SEC, 174 F.2d 969, 977 (D.C. 
Cir. 1949)). There is no requirement that the actor “also be aware that he is violating one of the 
Rules or Acts.” Tager v. SEC, 344 F.2d 5, 8 (2d Cir. 1965). The decision in The Robare Group, 
Ltd. v. SEC, which construed the term “willfully” for purposes of a differently structured 
statutory provision, does not alter that standard. 922 F.3d 468, 478-79 (D.C. Cir. 2019) (setting 
forth the showing required to establish that a person has “willfully omit[ted]” material 
information from a required disclosure in violation of Section 207 of the Investment Advisers 
Act of 1940). 



5 

requirements. To ensure the effectiveness of these measures and address the involvement of 
DBRS’s compliance department in its recordkeeping failures, DBRS has undertaken to: 

20. Compliance Consultant. 

a. DBRS shall retain, within thirty (30) days of the entry of this Order, the 
services of a compliance consultant (“Compliance Consultant”) that is not unacceptable to 
the Commission staff. The Compliance Consultant’s compensation and expenses shall be 
borne exclusively by DBRS. 

b. DBRS will oversee the work of the Compliance Consultant.  

c. DBRS shall provide to the Commission staff, within sixty (60) days of the 
entry of this Order, a copy of the engagement letter detailing the Compliance Consultant’s 
responsibilities, which shall include a comprehensive compliance review as described 
below. DBRS shall require that, within ninety (90) days of the date of the engagement 
letter, the Compliance Consultant conduct: 

i. A comprehensive review of DBRS’s supervisory, compliance, and other 
policies and procedures designed to ensure that internal and external 
communications, including electronic communications, received and 
sent by DBRS and its employees that relate to initiating, determining, 
maintaining, monitoring, changing, or withdrawing a credit rating 
(“Rule 17g-2(b)(7) Communications”) are preserved in accordance with 
the requirements of the federal securities laws and NRSRO regulations 
and an assessment of DBRS’s framework for addressing instances of 
non-compliance among its employees. 

ii. A comprehensive review of training conducted by DBRS to ensure 
personnel are complying with the requirements regarding the 
preservation of Rule 17g-2(b)(7) Communications, including those 
found on personal devices, in accordance with the federal securities 
laws and NRSRO regulations. 

iii. An assessment of any surveillance measures implemented by DBRS to 
ensure compliance, on an ongoing basis, with the requirements 
regarding the preservation of Rule 17g-2(b)(7) Communications, 
including those found on personal devices, in accordance with the 
federal securities laws and NRSRO regulations. 

iv. An assessment of the technological solutions that DBRS has begun 
implementing to facilitate compliance with the requirements regarding 
the preservation of Rule 17g-2(b)(7) Communications in accordance 
with the federal securities laws and NRSRO regulations, including an 
assessment of the likelihood that DBRS personnel will use the 
technological solutions going forward and a review of the measures 



6 

employed by DBRS to track employee usage of new technological 
solutions. 

v. An assessment of the measures used by DBRS to prevent the use of 
unauthorized communications methods for Rule 17g-2(b)(7) 
Communications by employees. This assessment should include, but not 
be limited to, a review of the firm’s policies and procedures to ascertain 
if they provide for any significant technology and/or behavioral 
restrictions that help prevent the risk of the use of unapproved 
communications methods on personal devices to send or receive Rule 
17g-2(b)(7) Communications in contravention of the requirements of 
the federal securities laws and NRSRO regulations. 

vi. A review of DBRS’s electronic communications surveillance routines to 
ensure the preservation of electronic Rule 17g-2(b)(7) Communications, 
including those found on personal devices, in accordance with the 
federal securities laws and NRSRO regulations, are incorporated into 
DBRS’s overall communications surveillance program. 

vii. A comprehensive review of the framework adopted by DBRS to address 
instances of non-compliance by DBRS personnel with DBRS’s policies 
and procedures concerning the use of approved communications 
methods, including on personal devices, for Rule 17g-2(b)(7) 
Communications in accordance with the federal securities laws and 
NRSRO regulations in the past.  This review shall include a survey of 
how DBRS determined which employees failed to comply with DBRS 
policies and procedures, the corrective action carried out, an evaluation 
of who violated policies and why, what penalties were imposed, and 
whether penalties were handed out consistently across business lines 
and seniority levels. 

d. DBRS shall require that, within forty-five (45) days after completion of the 
review set forth in sub-paragraphs c.i through c.vii above, the Compliance Consultant shall 
submit a detailed written report of its findings to DBRS and to the Commission staff (the 
“Report”). DBRS shall require that the Report include a description of the review 
performed, the names of the individuals who performed the review, the conclusions 
reached, the Compliance Consultant’s recommendations for changes in or improvements to 
DBRS’s policies and procedures, and a summary of the plan for implementing the 
recommended changes in or improvements to DBRS’s policies and procedures. 

e. DBRS shall adopt all recommendations contained in the Report within 
ninety (90) days of the date of the Report; provided, however, that within forty-five (45) 
days after the date of the Report, DBRS shall advise the Compliance Consultant and the 
Commission staff in writing of any recommendations that DBRS considers to be unduly 
burdensome, impractical, or inappropriate. With respect to any recommendation that DBRS 
considers unduly burdensome, impractical, or inappropriate, DBRS need not adopt such 



7 

recommendation at that time, but shall propose in writing an alternative policy, procedure, 
or disclosure designed to achieve the same objective or purpose.  

f. As to any recommendation concerning DBRS’s policies or procedures on 
which DBRS and the Compliance Consultant do not agree, DBRS and the Compliance 
Consultant shall attempt in good faith to reach an agreement within sixty (60) days after 
the date of the Report. Within fifteen (15) days after the conclusion of the discussion and 
evaluation by DBRS and the Compliance Consultant, DBRS shall require that the 
Compliance Consultant inform DBRS and the Commission staff in writing of the 
Compliance Consultant’s final determination concerning any recommendation that DBRS 
considers to be unduly burdensome, impractical, or inappropriate. DBRS shall abide by 
the determinations of the Compliance Consultant and, within sixty (60) days after final 
agreement between DBRS and the Compliance Consultant or final determination by the 
Compliance Consultant, whichever occurs first, DBRS shall adopt and implement all of 
the recommendations that the Compliance Consultant deems appropriate. 

g. DBRS shall cooperate fully with the Compliance Consultant and shall 
provide the Compliance Consultant with access to such of DBRS’s files, books, records, 
and personnel as are reasonably requested by the Compliance Consultant for review.  

h. DBRS shall not have the authority to terminate the Compliance Consultant 
or substitute another compliance consultant for the initial Compliance Consultant, 
without the prior written approval of the Commission staff. DBRS shall compensate the 
Compliance Consultant and persons engaged to assist the Compliance Consultant for 
services rendered under this Order at their reasonable and customary rates. 

i. DBRS shall require the Compliance Consultant to enter into an agreement 
that provides that for the period of engagement and for a period of two years from 
completion of the engagement, the Compliance Consultant shall not enter into any 
employment, consultant, attorney-client, auditing, or other professional relationship with 
DBRS, or any of its present or former affiliates, directors, officers, employees, or agents 
acting in their capacity. The agreement shall also provide that the Compliance Consultant 
will require that any firm with which he/she is affiliated or of which he/she is a member, 
and any person engaged to assist the Compliance Consultant in the performance of 
his/her duties under this Order shall not, without prior written consent of the Commission 
staff, enter into any employment, consultant, attorney-client, auditing, or other 
professional relationship with DBRS, or any of its present or former affiliates, directors, 
officers, employees, or agents acting in their capacity as such for the period of the 
engagement and for a period of two years after the engagement.  

j.  The Report and related written communications of the Compliance 
Consultant will likely include confidential financial, proprietary, competitive business or 
commercial information. Public disclosure of the Report could discourage cooperation, 
impede pending or potential government investigations or undermine the objectives of 
the reporting requirement. For these reasons, among others, the Report and the contents 
thereof are intended to remain and shall remain non-public, except (1) pursuant to court 



8 

order, (2) as agreed to by the parties in writing, (3) to the extent that the Commission 
determines in its sole discretion that disclosure would be in furtherance of the 
Commission’s discharge of its duties and responsibilities, or (4) is otherwise required by 
law. 

21. One-Year Evaluation. DBRS shall require the Compliance Consultant to assess 
DBRS’s program for the preservation, as required under the federal securities laws and NRSRO 
regulations, of Rule 17g-2(b)(7) Communications, including those found on personal devices, 
commencing one year after submitting the Report required by Paragraph 20.d above. DBRS shall 
require this review to evaluate DBRS’s progress in the areas described in Paragraphs 20.c.i-vii 
above. After this review, DBRS shall require the Compliance Consultant to submit a report (the 
“One Year Report”) to DBRS and the Commission staff and shall ensure that the One Year 
Report includes an updated assessment of DBRS’s policies and procedures with regard to the 
preservation of Rule 17g-2(b)(7) Communications (including those found on personal devices), 
training, surveillance programs, and technological solutions implemented in the prior year 
period. 

22. Reporting Discipline Imposed.  For two years following the entry of this Order, 
DBRS shall notify the Commission staff as follows upon the imposition of any discipline imposed 
by DBRS, including, but not limited to, written warnings, loss of any pay, bonus, or incentive 
compensation, or the termination of employment, with respect to any employee found to have 
violated DBRS’s policies and procedures concerning the preservation of Rule 17g-2(b)(7) 
Communications, including those found on personal devices: within thirty (30) days of the 
imposition of such discipline. 

23. Internal Audit.  In addition to the Compliance Consultant’s review and issuance of 
a One Year Report, DBRS will also have its Internal Audit function conduct a separate audit(s) 
to assess DBRS’s progress in the areas described in Paragraphs 20.c.i-vii above. After 
completion of this audit(s), DBRS shall ensure that Internal Audit submits a report to DBRS and 
the Commission staff. 

24. Recordkeeping.  DBRS shall preserve, for a period of not less than six (6) years 
from the end of the fiscal year last used, the first two (2) years in an easily accessible place, any 
record of compliance with these undertakings. 

25. Deadlines.  For good cause shown, the Commission staff may extend any of the 
procedural dates related to the undertakings. Deadlines for procedural dates shall be counted in 
calendar days, except that if the last day falls on a weekend or federal holiday, the next business 
day shall be considered to be the last day. 

26. Certification. DBRS shall certify, in writing, compliance with the undertakings set 
forth above. The certification shall identify the undertakings, provide written evidence of 
compliance in the form of a narrative, and be supported by exhibits sufficient to demonstrate 
compliance. The Commission staff may make reasonable requests for further evidence of 
compliance, and Respondent agrees to provide such evidence.  The certification and supporting 
material shall be submitted to Osman Nawaz, Chief, Complex Financial Instruments Unit, Division 



9 

of Enforcement, Securities and Exchange Commission, 100 Pearl Street, Suite 20-100, New York, 
New York 10004-2616, with a copy to the Office of Chief Counsel of the Enforcement Division, 
no later than sixty (60) days from the date of the completion of the undertakings.   

 

 In view of the foregoing, the Commission deems it appropriate, in the public interest  and 
for the protection of investors to impose the sanctions agreed to in Respondent DBRS’s Offer. 
 
 Accordingly, pursuant to Sections 15E(d) and 21C of the Exchange Act, it is hereby 
ORDERED that: 
 

A. Respondent DBRS cease and desist from committing or causing any violations and 
any future violations of Section 17(a)(1) of the Exchange Act and Rule 17g-2(b)(7) thereunder.   

B. Respondent DBRS is censured.   

C. Respondent DBRS shall comply with the undertakings enumerated in Paragraphs 
19 to 26 above. 

D. Respondent DBRS shall, within 30 days of the entry of this Order, pay a civil 
money penalty in the amount of $6,000,000 to the Securities and Exchange Commission for 
transfer to the general fund of the United States Treasury, subject to Exchange Act Section 
21F(g)(3). If timely payment is not made, additional interest shall accrue pursuant to 31 U.S.C. 
§ 3717. 

Payment must be made in one of the following ways:   

(1) Respondent may transmit payment electronically to the Commission, which 
will provide detailed ACH transfer/Fedwire instructions upon request;  

(2) Respondent may make direct payment from a bank account via Pay.gov 
through the SEC website at http://www.sec.gov/about/offices/ofm.htm; or  

(3) Respondent may pay by certified check, bank cashier’s check, or United 
States postal money order, made payable to the Securities and Exchange 
Commission and hand-delivered or mailed to:  

Enterprise Services Center 
Accounts Receivable Branch 
HQ Bldg., Room 181, AMZ-341 
6500 South MacArthur Boulevard 
Oklahoma City, OK 73169 

 
Payments by check or money order must be accompanied by a cover letter identifying 

DBRS as a Respondent in these proceedings, and the file number of these proceedings; a copy of 
the cover letter and check or money order must be sent to Osman Nawaz, Chief, Complex 

http://www.sec.gov/about/offices/ofm.htm


10 

Financial Instruments Unit, Division of Enforcement, Securities and Exchange Commission, 100 
Pearl Street, Suite 20-100, New York, New York 10004-2626.  

E. Amounts ordered to be paid as civil money penalties pursuant to this Order shall be 
treated as penalties paid to the government for all purposes, including all tax purposes. To preserve 
the deterrent effect of the civil penalty, Respondent agrees that in any Related Investor Action, it 
shall not argue that it is entitled to, nor shall it benefit by, offset or reduction of any award of 
compensatory damages by the amount of any part of Respondent’s payment of a civil penalty in 
this action (“Penalty Offset”). If the court in any Related Investor Action grants such a Penalty 
Offset, Respondent agrees that it shall, within 30 days after entry of a final order granting the 
Penalty Offset, notify the Commission’s counsel in this action and pay the amount of the Penalty 
Offset to the Securities and Exchange Commission. Such a payment shall not be deemed an 
additional civil penalty and shall not be deemed to change the amount of the civil penalty imposed 
in this proceeding. For purposes of this paragraph, a “Related Investor Action” means a private 
damages action brought against Respondent by or on behalf of one or more investors based on 
substantially the same facts as alleged in the Order instituted by the Commission in this 
proceeding. 

 
 By the Commission. 
 
 
 

 Vanessa A. Countryman 
        Secretary 


	UNITED STATES OF AMERICA
	In the Matter of
	DBRS, Inc.
	Respondent.