Corporate Sustainability: EU to Expand ESG-Related Reporting Obligations

On November 28, 2022, the European Council gave its final approval to a new Corporate Sustainability Reporting Directive (CSRD). Once transposed into the laws of the EU members states, the new set of rules will replace the existing non-financial reporting obligations of the 2014 Non-Financial Reporting Directive (NFRD). The new rules will have an enormous impact on business and the way it is reported. The number and clusters of in-scope companies will increase dramatically not only within the European Union, as the CSRD will also significantly affect non-European companies.

The CSRD is part of a broad policy push by European lawmakers aimed at making corporates take responsibility for ESG-related impacts of their business activities and at helping ESG-minded investors and other stakeholders make educated decisions. According to the European parliament, the CSRD is meant to serve to end so-called greenwashing and lay the groundwork for sustainability reporting standards at a global level.

To highlight a few selected aspects:

• The CSRD will widen both scope and depth of sustainability reporting by prescribing a double materiality standard under which companies have to explain both how their business models are affected by sustainability matters and how it affects such matters itself.
• While previous policy efforts concentrated predominantly on large companies with stock market listings, the EU’s focus has been widened to also account for sustainability related effects of large companies without stock market listings, as well as listed small and medium sized companies. A company is treated as “large” if the undertaking meets at least two of the following criteria: (i) a balance sheet total of more than EUR 20 million; (ii) a net turnover of more than EUR 40 million; (iii) an average number of employees of more than 250.
• Non-EU companies will also be affected. Their EU subsidiaries will have to comply with the new sustainability reporting obligations as early as 2025 if they have large company status and a stock listing on an EU-regulated market, and from 2026 if they have large company status and no such stock listing. Moreover, certain non-EU companies’ own sustainability efforts can become subject to reporting obligations as of 2029.
• Non-compliance with CSRD reporting obligations may trigger civil and/or criminal enforcement action.

1. The New Sustainability Reporting Landscape Under the CSRD

In comparison with the NFRD, the scope of the non-financial reporting items remains virtually unchanged under the CSRD. Sustainability matters subject to reporting obligations encompass environmental, social and human rights, as well as governance factors including employee matters, anti‐corruption and anti‐bribery matters (Amendments to Directive 2013/34/EU No. 2 (b): new Article 2 point 17; “Sustainability Matters”).

However, the scope of application and the level of detail and focus of reporting change significantly.

a. Extended Scope of Application

First, all large undertakings that meet at least two of the following three criteria (Article 3 point 7 Directive 2013/34/EU; such companies “Large Companies”)  

• balance sheet total of more than EUR 20 million,
• net turnover of more than EUR 40 million,
• an average number of employees of more than 250,

have to comply with the new reporting obligations—regardless of a stock market listing on an EU‑regulated market.

Second, all smaller enterprises are encompassed by the new reporting obligations provided that their securities are admitted to trading on a regulated market in the European Union and that they are not considered micro enterprises, meaning that they meet at least two of the following criteria (Article 3 point 1 Directive 2013/34/EU; such companies “Listed SMEs”)

• a balance sheet total of more than EUR 350,000,
• net turnover of more than EUR 700,000,
• an average number of employees of more than 10.

Third, sustainability information concerning non-European companies, which have generated net turnover of at least EUR 150 million in the EU in the last two consecutive years, will have to be published by their EU subsidiaries, or if no EU subsidiary exists, by their EU branches provided that (Amendments to Directive 2013/34/EU No. 14: new Article 40a point 1)

• the subsidiary fulfills the criteria of either a Large Company or a Listed SME (“Third‑Country Subsidiary”) or
• the relevant branch has a net turnover of more than EUR 40 million (“Third-Country Branch”).

With regard to Third-Country Subsidiaries, this obligation relates to the sustainability information at the group level of the ultimate parent undertaking of the Third-Country Subsidiary (“Ultimate Parent Company”) (Amendments to Directive 2013/34/EU No. 14: new Article 40a point 1). Regarding Third-Country Branches, this obligation relates to either (1) the sustainability information at the individual level of the non-European owner of the Third-Country Branch or (2), if the owner is held by a non-European undertaking, to the relevant sustainability information at the group level (both entities a “Branch Owner”) (Amendments to Directive 2013/34/EU No. 14: new Article 40a point 1).

It is estimated that, as a result of the expansion of the scope of application, the number of companies subject to non-financial reporting obligations will increase from 11,700 to 49,000.

b. Detailed Reporting Requirements and Double Materiality

All Large Companies and Listed SMEs are required to report both on (1) how their business model impacts Sustainability Matters (“inside-out perspective”) and (2) how Sustainability Matters influence their undertaking’s development, performance and position (“outside-in perspective”; together double materiality) (Amendments to Directive 2013/34/EU No. 4: new Article 19a point 1).

This information must be presented in a dedicated section of the management report (Amendments to Directive 2013/34/EU No. 4: new Article 19a point 1) and must cover, among others, the following aspects with regards to both the company’s own operations and its value chains (Amendments to Directive 2013/34/EU No. 4: new Article 19a points 2 and 3):

• The plans of the company, including implementing actions and related financial and investment plans, to ensure that its business model and strategy are compatible with the transition to a sustainable economy and with the limiting of global warming to 1,5°C in line with the Paris Agreement and the objective of achieving climate neutrality by 2050.
• How the company’s business model and strategy take account of the interests of the undertaking’s stakeholders and of the impacts of the undertaking on Sustainability Matters.
• A description of the time-bound targets related to Sustainability Matters set by the company, including, where appropriate, absolute greenhouse gas emission reduction targets at least for 2030 and 2050, a description of the progress the undertaking has made towards achieving those targets, and a statement of whether the undertaking’s targets related to environmental factors are based on conclusive scientific evidence.
• A description of the due diligence process implemented by the company with regard to Sustainability Matters, and, where applicable, in line with requirements of the EU on undertakings to conduct a due diligence process.
• A description of the principal risks to the company related to Sustainability Matters, including a description of the company’s principal dependencies on those matters, and how the undertaking manages those risks.

If this information is not available for its value chain the effected company must explain the efforts made to obtain such information, the reasons why the necessary information could not be obtained and how it plans to obtain the relevant information in the future (Amendments to Directive 2013/34/EU No. 4: new Article 19a point 3).

The Directive allows Listed SMEs to choose to submit a less detailed sustainability report limited to more general information (Amendments to Directive 2013/34/EU No. 4: new Article 19a point 6) including

• the company’s policies in relation to Sustainability Matters,
• the principal actual or potential adverse impacts of its business on Sustainability Matters and any related identification, monitoring, prevention, mitigation and remediation measures, and
• the principal risks related to Sustainability Matters and how the company manages those risk.

In this case, the relevant small and medium-sized company has to report in accordance with sustainability reporting standards dedicated to small and medium-sized companies.

In addition, during a transitional period for the financial years before January 1, 2028, Listed SMEs can choose to opt-out of the new reporting obligations (Amendments to Directive 2013/34/EU No. 4: new Article 19a point 7). However, they must state in their management reports why the sustainability report was not provided.

With regards to non-European companies, the sustainability information to be included in sustainability reports of their Third-Country Subsidiaries and Third-Country Branches is less extensive than the sustainability information to be published by European companies. The CSRD specifies selected items to be covered in such reports (Amendments to Directive 2013/34/EU No. 14: new Article 40a point 1). Third-Country Subsidiaries and Third-Country Branches are responsible for requesting the relevant information from the Ultimate Parent Company, and Branch Owner, respectively. If they cannot obtain all relevant information their reporting has to include all information in their possession, as well as a statement that the non-European company did not make available the necessary information (Amendments to Directive 2013/34/EU No. 14: new Article 40a point 1). Sustainability reports relating to non-European companies must generally be accompanied by an assurance opinion by a firm authorized to do so under the national law of the relevant non-European company or under the law of a EU member state unless the Ultimate Parent Company or Branch Owner does not provide the necessary assurance opinion and the Third‑Country Subsidiary or Third-Country Branch discloses this in a statement (Amendments to Directive 2013/34/EU No. 14: new Article 40a point 3). The Commission will publish a list of non‑European companies that comply with the obligations under the new directive (Amendments to Directive 2013/34/EU No. 14: new Article 40a point 4). The CSRD makes Third-Country Branches and members of the administrative, management, and supervisory bodies of Third-Country Subsidiaries responsible for ensuring that, to the best of their knowledge and ability, the reporting on the Branch Owner, and the Ultimate Parent Company, respectively, is made in accordance with the provisions of the new directive (Amendments to Directive 2013/34/EU No. 14: new Article 40c).

Companies are exempted from the reporting obligations if they are part of a group and included in the consolidated management report of their parent undertaking, provided that the management report is drawn up in compliance with the CSRD (Amendments to Directive 2013/34/EU No. 7: new Article 29a no. 8). If the parent undertaking is a non-European company, this only applies if the consolidated management report is deemed to be equivalent to the sustainability reporting standards under the CSRD (Amendments to Directive 2013/34/EU No. 7: new Article 29a no. 8).

c. Uniform Standards

Under the CSRD, the European Commission will adopt delegated acts containing sustainability reporting standards, which will specify the information companies are required to report in accordance with the new reporting obligations. The first set of standards is due by June 30, 2023 with more detailed standards to follow by June 30, 2024 (Amendments to Directive 2013/34/EU No. 8: new Article 29b point 1).

When adopting such delegated acts, the Commission will take account and take consideration of the technical advice developed by the European Financial Reporting Advisory Group (EFRAG) and consult, on a yearly basis, the European Parliament and jointly the Member State Expert Group on Sustainable Finance (Amendments to Directive 2013/34/EU No. 8: new Article 29b point 1). EFRAG has already delivered its first set of draft European Sustainability Reporting Standards to the European Commission in November 2022. Once the European Commission has consulted with EU bodies and Member States it will adopt the final standards as delegated acts in June 2023, after which the European Parliament and Council will be granted a scrutiny period.

By June 30, 2024, the Commission will adopt dedicated sustainability reporting standards for both Listed SMEs (Amendments to Directive 2013/34/EU No. 8: new Article 29c point 1) and non‑European companies (Amendments to Directive 2013/34/EU No. 14: new Article 40b). Third‑Country Subsidiaries and Third-Country Branches may choose not to follow those standards when reporting on their Ultimate Parent Company or Branch Owner as long as they draw up their sustainability reports in accordance with either the reporting standards mandatory for Large Companies or reporting standards deemed to be equivalent to those standards as determined by implementing acts to be adopted by the EU Commission (Amendments to Directive 2013/34/EU No. 14: new Article 40a point 2).

d. Independent Audit

Companies will have to ensure adequate auditing of their sustainability reporting. The CSRD requires auditors to express an opinion based on a limited assurance engagement regarding compliance of individual sustainability reporting with the requirements of the CSRD, as well as regarding compliance with the sustainability reporting standards to be adopted by the Commission (Amendments to Directive 2013/34/EU No. 13: new point (aa) in Article 34 paragraph 1, subparagraph 2). The new directive does not require the auditor giving the aforementioned opinion to be identical with the auditor of the financial statements (Amendments to Directive 2013/34/EU No. 13: new paragraph 3 in Article 34). Rather, independent assurance services providers can be allowed to render this opinion (Amendments to Directive 2013/34/EU No. 13: new paragraph 4 in Article 34).

e. Enforcement and Penalties

Members states have to ensure that their laws contain effective, proportionate and dissuasive penalties for infringements of the obligations set out in the CSRD (Article 51 Directive 2013/34/EU).

It is to be expected that potential penalties will at least be as strict as those already applicable under the NFRD regime. For example, German law provides for criminal liability if members of the management board and/or supervisory board incorrectly render or obfuscate the circumstances of their company in the non-financial statement required by NFRD (section 331 paragraph 1 no. 1 and No. 2 German Commercial Code, HGB). In addition, members of these boards face liability under the German Act on Administrative Offense Proceedings, OWIG, if they act in contravention of the non-financial reporting obligations established by NFRD when drawing up the non-financial statement report (section 334 paragraph 1 no. 3 und 4 HGB).

f. Staggered Application

Once the CSRD is signed by the Presidents of the EU Parliament and Council, it will be published in the Official Journal of the European Union. 20 days later, it will officially come into effect, giving EU member states 18 months to implement the new rules.

Thereafter, the obligations imposed by the CSRD will take effect in four stages:

• Large Companies already subject to the non-financial reporting obligations under NFRD will have to comply with the new obligations imposed by the CSRD as soon as their 2025 reporting on the financial year 2024.
• Other Large Companies will have to follow the new CSRD rules in their 2026 reporting on the financial year 2025.
• Listed SMEs (and non-complex credit institutions and captive insurance undertakings) will have to adapt their 2027 reporting on the financial year 2026 to the CSRD framework.
• Third-Country Subsidiaries and Third-Country Branches will have to report sustainability information on their Ultimate Parent Undertaking, and Branch Owner, respectively, starting in 2029 for the financial year 2028.

2. Practical Implications for Companies and Their Boards

Scope and depth of the CSRD sustainability reporting obligations present companies, their executive and non-executive directors, and also legal departments, with a whole new set of ESG‑related risks. To address these challenges, the following should be ensured:

• Information serving as the basis of the non-financial reporting must be accurate, scientifically proven (if applicable), and well-documented. This may require, among others, updates of risk maps, adaptation of existing CMS organizations and structures, and generally raising awareness for Sustainability Matters within the company among employees and managers through training and guidelines.
• To the extent that Sustainability Matters relate to specific legal risks such as anti‑corruption and anti‐bribery issues, adequate compliance systems to support statements on relevant preventative and reactive measures should be in place.
• The company should have procedures to investigate cases of potential CSRD non‑compliance. This will enable management to anticipate and assess the likelihood of negative impacts on the company, resulting from, for example, private litigation or public enforcement, and more generally on its reputation.

It will be the board’s obligation not only to ensure CSRD-compliant reporting, but also to establish an adequate system capable of identifying, managing, and mitigating the aforementioned risks arising from the CSRD.