The new EU banking package (CRR3/CRD6) amending the Capital Requirements Regulation and Directive (CRR/CRD) includes extensive provisions on the management, reporting, disclosure, governance and supervisory review of the environmental, social and governance (ESG) risks of EU banks, but no immediate requirement to apply a supporting or penalising factor to own funds requirements for exposures to take account of the impact of ESG factors.

CRR3 and CRD6 have now been published in the Official Journal and enter into force on 9 July 2024.

New definition of ESG risk

The amendments to CRR define 'ESG risk' as the risk of any negative financial impact on a bank stemming from the current or prospective impact of ESG factors on that bank's counterparties or invested assets. The definition states that ESG risks materialise through the traditional categories of financial risks and that they include risks from the physical effects of environmental factors and the risks from the current or prospective impact of the transition to an environmentally sustainable economy. CRR3 also introduces new related definitions of environmental risk, physical risk, transition risk, social risk and governance risk. Exposures will be regarded as subject to the impact of environmental or social factors where they hinder the EU's ambition to achieve its regulatory objectives relating to ESG factors in a way that could have a negative financial impact on banks in the EU.

New rules on the management, reporting and disclosure of ESG risks

CRR3 also makes changes to EU banks' management, reporting and disclosure of ESG risks. Most of these changes will apply from 1 January 2025.

Banks using the internal ratings-based (IRB) approach will be required to ensure that the scenarios used for their capital adequacy stress tests include ESG risk drivers, including physical risk and transition risk drivers stemming from climate change. The European Banking Authority (EBA) is tasked with issuing guidelines on the application of this requirement.

When applying the credit risk mitigation rules, banks will be required to ensure that ESG-related considerations prompt an assessment on whether there has been a significant decrease in the market value of eligible financial collateral and qualifying immovable property collateral. Under the IRB approach, banks will also be required to take into account the obsolescence of physical collateral resulting from ESG-related valuation considerations.

Banks will be subject to new requirements to report to supervisors on their exposures to ESG risks, including their existing and new exposures to fossil fuel sector entities and their exposures to physical risks and transition risks. The EBA will be required to submit draft implementing technical standards (ITS) on these requirements by 10 July 2025 (and to develop IT solutions for this reporting). This change applies from entry into force of CRR3, but any new reporting requirements set out in the ITS will not apply earlier than six months from the date of their entry into force.

CRR3 will now require all banks (not just those categorised as large institutions) to include information on ESG risks in their 'Pillar 3' disclosures, including the total amount of exposures to fossil fuel sector entities and how the bank integrates the identified ESG risks in its business strategy and processes, and governance and risk management. Banks categorised as large institutions that are G-SIIs or listed entities will have to disclose this information semi-annually, but other banks will only be required to disclose this information annually. This change applies from 1 January 2025, but the EBA will be tasked with drafting ITS specifying uniform formats for these disclosures by 10 July 2025 (and to develop IT solutions for banks other than small and non-complex institutions to report their disclosures via the EBA's planned new centralised web platform).

New governance and supervisory review requirements for ESG risks

CRD6 makes significant changes to the rules on the governance and supervisory review of the ESG risks of EU banks. Member States will be required to adopt national implementing measures for these rules by 10 January 2026 (18 months after entry into force of CRD6) and to apply those rules from 11 January 2026 (the day after the end of the transposition period).  

Banks will be required to ensure that their internal capital adequacy assessment process explicitly takes into account the short, medium and long term for the coverage of ESG risks (as defined by CRR3) and that their processes for identifying, managing, monitoring and reporting of risks include ESG risks in the short, medium and long term.

CRD6 amends the requirements for management bodies to approve and periodically review the strategies and policies for taking up, managing, monitoring and mitigating the risks to which banks are or might be exposed. CRD6 will specify that these strategies and policies must also cover the risks relating to ESG factors in the short, medium and long term and that the review must take place at least every two years. Management bodies will be required to develop and monitor the implementation of specific plans, quantifiable targets and processes to monitor and address the financial risks arising in the short, medium and long-term from ESG factors, including those arising from the process of adjustment and transition trends towards the relevant Member State, EU and, where relevant, non-EU regulatory objectives and legislation relating to ESG factors.

CRD6 will require that a bank's management body possesses adequate collective knowledge, skills and experience to be able to understand the impacts the bank creates in the short, medium and long term, taking into account ESG factors and training of members of the management body must include training on ESG risks and impacts.

Banks will be specifically required to ensure that their remuneration policies and practices take into account their risk appetite in terms of ESG risks. The risk committee will also be specifically required to examine whether incentives provided by the remuneration system take account of risks resulting from the impact of ESG factors.

Supervisors will be required to ensure that banks have, as part of their governance arrangements and risk management framework required, robust strategies, policies, processes and systems for the identification, measurement, management and monitoring of ESG risks over the short, medium and long term. These must be proportionate to the bank's business model and activities and must consider a short, medium and a long-term horizon of, where appropriate, at least ten years. Banks will be required to test their resilience to long-term negative impacts of ESG factors under a range of baseline and adverse scenarios. Supervisors will be required to assess and monitor banks' practices and the EBA will be required to issue guidelines on methodologies, planning, assessment criteria and scenario setting by 10 January 2026.

Supervisors carrying out their periodic supervisory review and evaluation of banks will be required to assess the bank's governance and risk management processes for dealing with ESG risks and the bank's exposures to ESG risks, taking into account their business models and their plans to monitor and address ESG risks. Supervisors will also be required to assess banks' ESG plans and targets as well as the progress made towards addressing the ESG risks arising from the process of adjustment towards climate neutrality by 2050 and whether banks have put in place appropriate policies and operational actions related to the targets and milestones defined in the plans.

Member States will be obliged to ensure that supervisors have powers to require banks to reduce the risks arising in the short, medium and long term from ESG factors, including those arising from the process of adjustment and transition trends towards the relevant Member State, EU or non-EU legal and regulatory objectives, through adjustments to their business strategies, governance and risk management.

Next steps

The EBA's 2023 report on the role of ESG risks in the prudential framework of banks and investment firms identified a range of short-term actions that the EBA proposes to take as part of the implementation of CRR3/CRD6. These include, in particular, including environmental risks in stress-testing programs under the internal ratings based and internal model approaches, including environmental and social factors as part of external credit assessments by credit rating agencies and in due diligence requirements, identifying whether environmental and social factors constitute triggers of operational risk losses and developing environment-related concentration risk metrics as part of supervisory reporting.

The report also identified possible medium- to longer-term revisions to the Pillar 1 framework, including the possible use of scenario analysis to enhance the forward-looking elements of the prudential framework, the role of transition plans to enhance the Pillar 1 framework, revising the IRB supervisory formula and the corresponding standardised approach for credit risk to better reflect environmental risk elements and the introduction of environment-related concentration risk metrics under the Pillar 1 framework.

The report did not recommend introducing a green supporting factor or brown supporting factor at that stage but CRR3 will require the EBA to re-assess whether there should be a dedicated treatment of assets and liabilities subject to the impact of environmental or social factors. The EBA will be required to report by end-2024 on the availability of reliable and consistent ESG data for different exposure classes and the feasibility of introducing a standardised methodology to identify and qualify exposures subject to the impact of these factors based on a common set of principles for ESG risk classification and by end-2025 on the effective riskiness of those exposures compared to other exposures and the impacts of an adjusted dedicated prudential treatment of those exposures on financial stability and bank lending.

In addition, CRR3 tasks the EBA with preparing a report for the Commission by 10 July 2025 on whether ESG risks are appropriately reflected in the credit risk rating methodologies by external credit assessment institutions.

The EBA reports may lead to further legislative proposals by the Commission.

Authors: Caroline Dawson, Hélène Kouyaté and Chris Bates.