The credit rating agencies (Moody’s, Fitch etc) have been accused of inflating the ratings of companies after their ratings underestimated the default risk during the 2008 financial crisis. First, it is strange to accept ratings expressed as letters (AAA, AAB etc) when the market participants care about the default risk and the letter codes are based (or so the rating agencies say) on the default risk. Remove the coarse letter codes and require the rating to equal the estimated probability of default over the next n years. The probability should have enough significant digits and should report standard errors. It should not vaguely claim that the default probability is somewhere between x and y. The potential for rating inflation and later justification of wrong ratings is reduced by transparency.
A good punishment for the rating agencies that also increases transparency is to repeal any regulation requiring the use of their ratings. Currently, banks are only allowed to invest in “investment grade” bonds, where the grade is determined by the credit rating (agencies). The purpose of the regulation should be to prevent banks from taking too much risk, so the variable of interest is the default probability, not the rating. Replace the requirement of “investment grade” rating with a requirement that the predicted default probability over the next n years must be below x. The obvious question is who predicts this probability.
The restriction to investing only in bonds predicted to be unlikely to default is similar to the vague requirement of due diligence. The investing bank must be able to justify its decision later if the investment turns out badly. The bank must use all available sources of info (maybe even rating agencies) and state of the art methods to predict default probabilities for bonds it intends to invest in. To prevent the bank from manufacturing a justification ex post to excuse its bad decision, the methodology it uses to predict must be provably unchanged from the time of investing. This can be achieved by sharing the methodology with the regulator.
There is a concern that business secrets leak from the regulator to competitors. This can be eliminated by encrypting the info that the bank gives the regulator, with the bank keeping the key. The encrypted info can even be publicly posted on the web. If concerns arise, the bank can later be ordered to give the key to the regulator (or even to the public), who can then verify the info received in the past. If the bank claims to have lost the key, the punishment should be the same as for the lawbreaking that the key is intended to verify.