EU finalises landmark sustainability reporting directive

Companies required to meet a range of obligations as enhanced non-financial reporting standard goes live in January

Background

The Corporate Sustainability Reporting Directive (CSRD) was published today in the EU's Official Journal and will come into force in 20 days (on 5 January 2023). This is the final step on the legislative journey which began in December 2019 when the Commission announced its intention to review the Non-Financial Reporting Directive (NFRD) as part of the European Green Deal.

The Commission's review identified deficiencies in the NFRD. Users found that the non-financial information disclosed was insufficiently comparable, unreliable, and often irrelevant, while disclosing companies still faced additional disclosure requests from rating agencies, investors, and NGOs. The NFRD also had a limited scope and only applied to around 11,700 companies.

The CSRD was therefore developed to provide higher quality data across a wider range of companies (projected to be around 50,000 companies) by requiring detailed disclosures on sustainability matters, thus minimising the potential for greenwashing. Companies must report through the lens of double materiality and therefore disclose information about the sustainability risks and opportunities facing the business, as well as the impacts the business has on society and the environment.

In addition, and importantly, the CSRD will introduce an element of extraterritoriality, requiring in some circumstances reporting at full group level where non-EU entities have an EU subsidiary.

Undertakings captured by the CSRD:

The CSRD will apply to:

• Large undertakings (including EU subsidiaries of non-EU parent companies) that exceed at least two of the following three thresholds: (i) 250 employees on average during the financial year; (ii) net turnover of €40 million; and (iii) total assets of €20 million.
• Listed undertakings – ie, undertakings with securities listed on an EU regulated market (irrespective of whether the issuer is incorporated within or outside the EU). This includes small and medium-sized entities (SMEs) but excludes micro-undertakings which do not exceed two of the following three thresholds: (i) 10 employees on average during the financial year; (ii) net turnover of €700,000; and (iii) total assets of €350,000.
• Non-EU undertakings with substantial activity in the EU. Where net turnover generated within the EU exceeded €150 million (in each of the last two consecutive years), provided the non-EU undertaking has (i) an EU subsidiary that is listed or a large undertaking (ie within CSRD's scope as per the above two bullets); or (ii) an EU branch that generated net turnover of at least €40 million, the EU subsidiary or branch must report at the non-EU parent's group level.
• Parent undertakings of large groups, which are groups that satisfy, on a consolidated basis, the criteria set out in the first bullet.

Subject to the thresholds described above, where an in-scope EU company (or branch) has an ultimate parent incorporated outside the EU, CSRD's extraterritorial aspect drags the non-EU parent and its entire group within the CSRD reporting framework – ie the in-scope EU subsidiary must report at a consolidated level for the entire group. This group-level reporting will, however, be slightly less burdensome. Reporting for non-EU undertakings will also only be required from 2029, giving considerable preparation time.  

Exemptions:

There are various exemptions which permit in-scope undertakings not to report. A full exemption is available to in-scope subsidiaries if they are included in a consolidated sustainability report issued by their parent (whether an EU-parent or third country undertaking). There is a partial exemption in the first three years after CSRD comes into force where certain information about an undertaking's value chain is unavailable, and undertakings can explain efforts made to obtain the information and why it was unavailable or could not be reported.

CSRD disclosure requirements:

In-scope undertakings must disclose information on sustainability matters, including:

• Business model and strategy – comprising their resilience to risks from sustainability matters and opportunities arising from sustainability matters, and how their strategy accounts for the interests and impact upon other stakeholders.
• Transition plans – which are Paris-aligned, ie compatible with limiting global warming to 1.5°C and achieve net zero by 2050.
• Targets – where appropriate (and where set by the undertaking), absolute greenhouse gas emission reduction targets for 2030 and 2050, and a description of the progress made in achieving the targets.
• Governance – a description of the role, skills and expertise of the administrative, management and supervisory bodies, as well as any incentive schemes linked to sustainability matters.
• Policies – regarding sustainability matters.
• Due diligence process – with respect to sustainability matters.
• Principal adverse impacts – both actual and potential, connected to the undertaking's own operations as well as its value chain, and any actions taken to prevent, mitigate, remediate or end such impacts.

Further detail as to the sustainability reporting standards will be provided through delegated acts – a first set will be adopted by 30 June 2023 and others by 30 June 2024 – with responsibility for production delegated to the European Financial Reporting Advisory Group (EFRAG). On 22 November, EFRAG submitted the first set of draft European Sustainability Reporting Standards (ESRS) to the Commission for consideration.

In developing the ESRS, EFRAG worked closely with other standard setting bodies including the Global Reporting Initiative (GRI) and the International Sustainability Standards Board (ISSB). GRI notes that the ESRS are as closely aligned as possible with GRI, but there will be divergence as GRI provides for impact reporting (ie disclosing the company's sustainability impacts on stakeholders) whereas the CSRD also requires the ESRS to address financial materiality (ie sustainability impacts on the company).

EFRAG has released 12 draft standards: two cross-cutting standards that explain fundamental CSRD concepts, and provide for general requirements and disclosures; and ten topical standards which establish metrics and explain how to disclose targets across environment (eg, E1 climate change), social (eg, S2 workers in the value chain) and governance (G1 business conduct) topics.

Timeline:

CSRD reporting will gradually be required between 2025 and 2029 in four stages:

• Reporting in 2025 on the financial year 2024 for undertakings with more than 500 employees already subject to the NFRD.
• Reporting in 2026 on the financial year 2025 for large undertakings and parent undertakings of large groups that are not currently subject to the NFRD.
• Reporting in 2027 on the financial year 2026 for listed SMEs (except micro undertakings). Prior to financial years starting in 2028, SMEs may opt out and choose not to publish a sustainability report (provided that they state in their management report why a sustainability report has not been included).
• Reporting in 2029 on the financial year 2028 for group-level reporting of non-EU undertakings with in-scope EU subsidiaries (or branches).

When considering the CSRD's implications, the implementing rules of relevant member states (required within 18 months) should be reviewed to check for idiosyncrasies and minor alterations which may complicate the reporting landscape.

Key comparisons (CSRD v TCFD v SEC)

How to prepare?

1. Capacity build – where a company is not already producing a sustainability report using GRI (or going beyond TCFD) a significant volume of data must be collected, and other information collated, to disclose. Companies should ensure they have sufficient experienced personnel to supervise this process.
2. Get governance right – as noted above, CSRD requires disclosures on business model and strategy, and suitable governance structures must be put in place to coordinate such high-level considerations of risks, opportunities, and impacts. This is in addition to the specific disclosures regarding governance.
3. Consider your value chain – disclosures should contain information about a company's value chain, including its business relationships and supply chain, in addition to information about its own operations. It's therefore imperative to engage with suppliers and end-users both to collect data, and to understand any underlying methodologies.