There's a revealing scene in the film version of MichaelLewis's The Big Short. It's 2007; the subprime mortgage crisis hasyet to unfold. Two hedge fund managers visit a Standard &Poor's executive in her office on Water Street in Manhattan. Oneasks the exec to name a time in the past year when the companydidn't give a bank the AAA rating it was seeking. She demurs. “Ifwe don't work with them,” she says, “they will go to ourcompetitors. It's not our fault. It's simply the way the worldworks.”

That was the way the world worked then—and, 10 years later, it'snot entirely clear how much has changed.

Before the crisis, Standard & Poor's Global Ratings (nowS&P), Moody's Investors Service and Fitch Ratings—the BigThree—showered investment banks with a bounty of AAA blessings,giving them the regulatory license to gobble up mortgage-backedsecurities. When the subprime market crashed, these complex debtinstruments infected the balance sheets of banks worldwide, wipingout an estimated $11 trillion of household wealth in the U.S.alone.

Of all the securities classed as investment-grade by Moody's(Baa3 or higher) in 2007, for example, 89% were subsequentlydowngraded to junk. “This crisis could not have happened withoutthe rating agencies,” the Financial Crisis Inquiry Commissionconcluded in 2011.

You might have expected the credit rating companies, like thebanks, to have taken a massive regulatory hit, savaging theirbusiness models and earnings prospects. They didn't. In fact, theymanaged what amounts to the great escape of the post-crisis era.Ten years later, the Big Three's grip on business is stronger thanever. “I, like everyone else, thought S&P, Moody's, and Fitchwould fail to exist as companies, as they would blow up in a stormof litigation and no one in the markets would use them again,” saysDaniel Davies, research adviser at London-based Frontline Analysts,a risk and credit analytics firm. “Yet, they seem stronger thanever before.”

Towering over a cluster of much smaller rivals, the Big Threecontrol about 96% of the global market. Their way of doingbusiness—the issuer-pays model that's been around since the early1970s—endures. Now that model could face its first serious testsince the crisis as the Federal Reserve hikes interest rates fromthe low levels that have spurred record corporate-bondissuance.

The post-crisis swing in the regulatory pendulum changed WallStreet forever, but it's not clear how much life changed for theumpires of credit, despite a few regulatory tweaks such as newSecurities and Exchange Commission rules to reduce conflicts ofinterest. Investors, analysts, and lawmakers say rating companiescontinue to weaken standards to win business, with regulators againasleep at the wheel.

“The bottom line is that the same risks that devastated oureconomy will continue unless we take action,” said Senator AlFranken, a longtime campaigner for credit rating reform. (In 2010the Minnesota Democrat won passage of a legislative amendment thatwould have changed the way the companies do business, but it wasstripped from the final bill.) Franken says stronger measures areneeded to protect Main Street from “Wall Street'srecklessness.”

In their defense, the Big Three say they welcome competition andembrace good governance. Spokespersons for Moody's and Fitch citedreports that detail their compliance with post-crisis regulations,including SEC-imposed firewalls between credit analysis and salesand marketing designed to reduce potential conflicts of interest.“Our primary focus,” says S&P President John Berisford, “is tobe deeply aware of the potential conflicts within thebusiness.”

Judging from the evidence of recent years, new regulationsclearly didn't banish the demons of the crisis forever. In January2015, S&P paid $58 million to settle claims it had loosened itsstandards to win business in commercial-mortgage bonds three yearsearlier; the SEC ordered S&P to suspend significant portions ofthat market for one year.

Today, as that slap-down suggests, a new cloud looms over theindustry. As delinquencies in the $505 billion U.S.commercial-­mortgage bond market rose this year, Bloomberg Newsreported that smaller rating companies such as DBRS Inc. and KrollBond Rating Agency Inc. were abruptly downgrading bonds tied toproperties like shopping malls and office towers just a few yearsafter lavishing top grades on them. While the rating companies inquestion contend the downgrades reflect a shifting economiclandscape, some investors charge that the companies, in their zealfor market share, were too lenient in the first place.

And there's the rub. The issuer-pays model remains an incentivefor raters to go easy on clients, says Marcus Stanley, policydirector at Americans for Financial Reform in Washington, anactivist group. “As long as ratings agencies are both central tosecurities markets and face incentives to inflate ratings andmislead investors, they pose a risk to the financial system,” hesays.

An SEC report last December read like something right out of thecrisis. Without naming specific companies, it exposed basic errorsand conflicts of interest in the rating of asset-backed securities(bonds backed by collateral such as car loans or mortgages). Itpointed to continuing breaches of internal firewalls betweenvarious parts of the ratings business. These echoes of crisis-eralapses suggest that two big problems haven't gone away: thedeep-rooted practice of issuers shopping around for ratings and thesystemic risk posed by the dominance of the Big Three.

Seven years after the Dodd-Frank Act sought to reregulate WallStreet, the regulators haven't pushed ahead with many of thereforms envisaged in the legislation, which aimed to boostaccountability and lighten the financial system's reliance onrating companies. The Department of Labor, for example, continuesto promote the use of credit ratings in rules that apply to pensionfunds, while the SEC has yet to propose legal liability rules forrating companies. The SEC has also failed to endorse an alternativebusiness model such as the Dodd-Frank proposal for rating companiesto receive rating assignments at random to curb issuer influence onbusiness decisions.

Now, with President Trump happy to clip the wings of financialreformers, the prospects of spoiling the ratings industry's greatescape at this point look unlikely.

Frank Partnoy, a professor of law and finance at the Universityof San Diego who once worked as a derivatives structurer at MorganStanley, argues for a back-to-basics approach he says should havebeen adopted in the wake of the crisis: setting aside traditionalratings in favor of alternative indicators of creditworthiness orthe lack of it, such as credit default swaps and proprietary riskmodels.

“We just canned an opportunity of a lifetime to enact meaningfulreforms,” Partnoy said. “A lot of the finger-pointing fromregulators continues to be aimed at banks, while rating agencieshave fallen off the radar.”

The Big Three's viselike grip on the market amounts to atriopoly. The U.S. industry is run by just 2.65 companies,according to the SEC, citing a popular measure of sectorconcentration known as the Herfindahl-Hirschman Index. It's asimilar story in Europe, where they have a commanding 93% marketshare, based on industry revenue. Although the three are frequentlylumped together, Fitch is considerably smaller than the others. Itsmarket share, as a proportion of all the rated debt outstanding,stood at 13% at the end of 2015, compared with S&P's 49% andMoody's 34%.

Deven Sharma, who as S&P president from August 2007 toSeptember 2011 steered the world's largest credit rating companythrough the crisis, says concentration isn't necessarily a badthing. He compares the ratings universe to the world of accounting,where four firms hold sway.

“Critics may label this as incumbency bias or a monopoly,” hesays. “But just like Google, you get the network effect: Everyonein the marketplace can trade on this information. Ratings helpmarket participants to understand credit risk through a commonvocabulary, providing a benchmark for investors and regulators tocompare credit risk.”

In the aftermath of the crisis, regulators in the U.S. andEurope tried to put a dent in the ratings companies' dominance bybringing in a formal supervisory regime. Dodd-Frank banned banksfrom relying on ratings for regulatory capital purposes, andregulators imposed fines for crisis-era lapses.

But market faith in the Big Three persists thanks to incumbencybias, which raises barriers to entry for challengers, and to theoverwhelming complexity of disentangling ratings from the globalfinancial infrastructure. Credit ratings are, in effect, hardwiredin regulations and private financial contracts governing bankingand insurance standards around the world.

Conservative investment practices are to blame, too. In manycases, guidelines at large pension and insurance funds mandate thatsecurities be rated by the Big Three exclusively as a preconditionfor investment. Breaking this rule is “one of the unfinishedbusiness items of post-crisis reforms that has frustratedregulators,” says Jim Nadler, head of Kroll Bond Rating.

Meanwhile, the credit raters keep on carrying on. This is trueeven as occasional warning lights flash over the post-crisis boomin corporate bond issuance that's improved rating companies'balance sheets and offset vanishing revenues from the rating ofmortgage bonds.

We won't know for certain how well the raters have surfed thetrillion-dollar corporate credit wave until the tide goes out. Butif the Big Three could survive the 2008 crisis, they can probablysurvive anything.

Bloomberg News

Copyright 2018 Bloomberg. All rightsreserved. This material may not be published, broadcast, rewritten,or redistributed.