BlueOnion

B with the tension stated, and the contrast with the two ESG vendors already holding A in this index is the cleanest way to see it. MioTech and SESAMM earned A because the removal test leaves an empty database: their natural language processing creates sustainability signals that do not exist in reported form, extracted from unstructured sources across hundreds of thousands of companies. BlueOnion works the other way round.

Its coverage is extended through a licensing collaboration with Morningstar Sustainalytics, and the platform aggregates, scores, standardises and visualises data that largely already exists. Strip the AI and a substantial product remains: an ESG data platform with proprietary scoring, regulatory report generation and a gatekeeper workflow system, which is close to what several established data vendors sell.

The AI layer is real and shipped, described as predictive analytics, anomaly detection and explainable insights, but it sits on top of the asset rather than being the asset. In ESG the useful distinction is whether the models manufacture the data or interpret it.

Structurally low autonomy by design, in the same shape that earned bondIT a B. The system screens, scores, simulates and reports, and a portfolio manager or gatekeeper acts on the output, with the workflow product explicitly routing through human approval and document signing steps. Explainability is presented as a product property rather than an afterthought, which supports a reviewer's ability to interrogate an output before relying on it.

Short of A because nothing describes what happens with the one genuinely automated judgement in the product, the anomaly detection, including what threshold raises a flag, who reviews it and what follows when the model disagrees with an analyst.

The AI components carry no published validation. Predictive analytics and anomaly detection are offered to reveal risks and opportunities before they emerge, which is a forecasting claim, and no accuracy, precision, false alarm rate, lead time or backtest appears, in the pattern recorded against Blue Fire AI.

The proprietary sustainability scores are the other half: methodology may be described in the Code self assessment, but a described methodology is not a validated one, and nothing tests whether the scores predict the outcomes they imply, such as controversy incidence or transition risk materialising. For a product whose purpose is helping institutions avoid greenwashing accusations, the reliability of its own assessments is the load bearing property.

No named client and no quantified outcome. The company describes helping banks in Hong Kong tackle greenwashing without naming one, and refers to itself as award winning without the award being identified in the material found. The strongest external signal is the Morningstar Sustainalytics collaboration announced in May 2025, which is a genuine commercial relationship with a major independent research and ratings firm and comes with a quote from that firm, but the direction matters: Sustainalytics supplies data into this platform rather than adopting the platform, so it validates the distribution channel rather than the product's results. That is the opposite direction from the Liquidnet integration that helped earn bondIT an A. One named bank stating what changed would move this axis.

The platform occupies a position between two sides of a market and nothing describes how it is managed. Fund gatekeepers at distributors use it to screen, shortlist and reject products, while asset managers who make those products are also clients, so the system sees which funds are being examined, which fail sustainability screening and which are onboarded, at the same time as serving the firms whose funds are being judged.

That is commercially valuable information about selection outcomes flowing across a boundary, and no statement addresses whether screening activity, rejections or watchlist composition inform anything served to another client. Client portfolio holdings sit in the same platform and carry the ordinary confidentiality question on top.

No privacy posture published, and the personal data exposure is genuinely low for this product because the subject matter is companies, funds and portfolios rather than individuals. The residual exposure sits in the workflow product, which handles gatekeeper due diligence, requests for proposal and document signing, so it holds named individuals at asset management firms and their approval decisions, and in client portfolio holdings, which are confidential to the institution rather than personal. This is one of the few builds where the C reflects a small question left unanswered rather than a large one.

No SOC 2, ISO 27001, penetration testing programme or trust centre found. The material held is confidential rather than personal, principally client portfolio holdings and the fund selection decisions of distribution gatekeepers, and the latter is commercially sensitive to several parties at once. Banks of the size implied by the target market run vendor security assessments as standard, so evidence likely exists privately while nothing is published for a prospective buyer.

The standout axis and rare in this index. BlueOnion has published a self assessment document setting out its conformance with the Hong Kong Securities and Futures Commission's voluntary Code of Conduct for providers of ESG ratings and data products, covering its proprietary scores and related data products, referencing its own policies and frameworks and noting alignment with comparable regimes in other jurisdictions.

Almost no vendor in this index engages with a supervisory framework governing its own category, let alone publishes a conformance document against one, and this is the correct response to a regulator that chose a voluntary code over licensing. Short of A because a self assessment is self attested, with no independent assurance over the claims and no supervisory registration, and voluntary conformance carries no consequence for departing from it.

Governance disclosure is real and published, which is what lifts this above the C most vendors sit at. The SFC Code self assessment is a documented governance artefact addressing methodology and the handling of conflicts around proprietary ESG scores, and the platform is built on explainability rather than opaque scoring. What is not addressed is the bias question specific to this product class, and it is a well documented one.

ESG ratings diverge sharply between providers assessing the same issuer, which means a score is a methodological position rather than a measurement, and the scores systematically favour large capitalisation issuers in developed markets who have the resources to produce extensive disclosure. Smaller companies and issuers in emerging markets score worse for reporting less rather than for behaving worse, and capital is then allocated on that difference. That is the same coverage tilt recorded against bondIT's rated issuer universe, and nothing published describes how coverage gaps or non reporting are handled.

No warranty, service level, accuracy commitment or remedy published, and the consequence is regulatory rather than financial in the first instance. The product exists because supervisors are scrutinising how sustainable investment products are sold, and a bank that classifies, screens or reports on a product using these analytics and gets it wrong faces the supervisory consequence itself, since responsibility for the classification stays with the regulated firm.

Nothing states what the institution is owed if a score, a principal adverse impact report or an SFDR classification proves wrong. There is a second party in the pattern recorded for Blue Fire AI: the issuer or fund assessed unfavourably, which has no relationship with the vendor, no notice and no route to contest an assessment that may exclude it from portfolios.

Better than most, and earned on the data side rather than the model side. The principal third party dependency is named, quantified and announced: Morningstar Sustainalytics supplies research and ratings data into the platform, with the resulting coverage stated at 300,000 mutual funds and ETFs and 93,000 bond funds.

Naming the upstream provider matters more here than for most vendors, because a client relying on these analytics is inheriting another firm's rating methodology and a buyer can only assess what it is actually getting if the source is identified.

Short of A because the AI side is undisclosed: no model, provider or version is named for the predictive analytics, anomaly detection or explainability layer, and the boundary between licensed data, proprietary scoring and model generated inference is not drawn anywhere.

Little integration detail. The product is a cloud terminal reached directly, with reports generated on demand, and the one substantial data integration described flows inward from Morningstar Sustainalytics rather than outward into client systems.

No portfolio management system, order management system, fund administration platform or client reporting tool is named, and for a workflow product covering screening through RFP to document signing, the connections to the systems where those records must ultimately live are the load bearing ones and are undescribed.

Described as cloud based with no hosting arrangement, region, provider, tenancy model or residency commitment published. Data residency is a live consideration for the buyer set, since Hong Kong institutions handling client portfolio data operate under their own regulatory expectations about where records are held, and clients pursuing EU SFDR reporting have European obligations of their own.

No pricing, model, unit or tier published, with a demonstration booking as the only route in. The product spans two quite different commercial shapes, a data and analytics terminal on one side and a workflow system for fund onboarding on the other, and nothing indicates whether these are licensed together, separately, per seat or by assets under management.

Several buyer types, concentrated in one market. The company's own self assessment names institutional investors, asset managers, private equity firms and corporations, and its product pages add banks, wealth managers and the fund gatekeepers who run distribution due diligence, which is a distinct and often overlooked buyer.

Functional range is respectable, covering fund and company ESG scoring, business involvement screening, temperature alignment, PCAF carbon accounting and principal adverse impact reporting, with fund coverage stated at 300,000 mutual funds and ETFs plus 93,000 bond funds following the Sustainalytics collaboration.

Held at B rather than the A that MioTech and SESAMM hold because the evidenced footprint is Hong Kong centred, with EU SFDR alignment indicating a target market rather than a demonstrated one, whereas those two operate across several continents with named clients on multiple sides of the market.