Finalised EBA guidelines on ESG risk management

The Guidelines outline minimum standards and reference methodologies for the identification, measurement, management and monitoring of ESG risk by institutions.

The EBA recognises that, due to the cross-cutting nature of ESG risk, ESG risk will manifest through adverse impacts on other existing risk categories. The EBA expects institutions to understand what these adverse impacts might look like and what they must do to mitigate the outcome to ensure business resilience and the sustainability of the institution’s business model.  A key takeaway from the guidelines is that institutions must embed ESG risk in existing risk management systems and processes and integrate ESG factors in business and risk strategy development. ESG-related data sourcing is key to supporting this integration.

These guidelines will apply to all banking institutions starting 11 January 2026, except for minor and non-complex institutions, for which the guidelines will apply from 11 January 2027.

Institutions should assess their stand against these new Guidelines and determine what must be achieved before the application deadline. Most institutions will have already completed work to address the European Central Bank Guide on Climate-Related and Environmental Risks, November 2020. A key first step will be to complete a gap analysis against work completed to date to comply with the ECB Guide, compared to requirements set out in the Guidelines.

A key difference is that the Guidelines require institutions to consider ESG risk holistically. In contrast, the Guide focuses on climate-related and environmental risk, i.e. the ‘E’ of ESG (although there is more focus in the Guidelines on ‘E’ compared to ‘S’ and ‘G’). At a minimum, institutions must integrate social and governance risk across the risk management framework if they haven’t already done so. While the EBA recognise that work has progressed concerning climate-related risk measurement, the expectation is that broader environmental risks, such as the degradation of ecosystems and biodiversity loss, are fused into the analysis.

Integrating the Guidelines in the risk management framework and implementing related updates across the three lines of defence will take time. Institutions should begin their gap assessment without delay so that an action plan to close gaps can be developed and delivered before the January 2026 deadline. The EBA expects responsibility for action plans to be clearly allocated and documented. Securing organisational buy-in is a key first step to facilitate readiness before the deadline.  

How we can help

If you have any questions about compliance with the Guidelines or how to approach and structure a gap analysis as a first step, please contact Niamh Doyle in Forvis Mazars.