ESG risk management in banks

The European Banking Authority published its final guidelines on January 9, 2025, based on the amended Capital Requirements Directive. They apply to large institutions from January 11, 2026 and to small and non-complex institutions from January 11, 2027 at the latest. They set out how banks identify, measure, manage and monitor ESG risks, and they require plans that address the risks from the transition toward the EU's goal of climate neutrality by 2050, over the short, medium and long term.

According to KPMG's summary, the materiality assessment runs every year, or every two years for small and non-complex institutions. Banks combine exposure-based, portfolio-based and scenario-based methods, and their transition plans carry timelines, intermediate targets and milestones. A separate set of EBA guidelines covers environmental scenario analysis.

In Germany, section 25a of the German Banking Act names ESG risks among the risks a bank must manage over the short, medium and long term, and section 26c deals with them directly. The current MaRisk says it specifies section 26c and implements both EBA guidelines, on ESG risk management and on environmental scenario analysis.

MaRisk defines ESG risks as events or conditions from the environment, social or governance areas that act as drivers of the existing risk types. Banks assess their effects in the risk inventory, the internal control system, the strategy and the reports, on plausible scenarios that agree with scientific findings; data history alone is not enough. The ninth amendment dropped the duty to use several methods to identify them.

The significant banks follow the European Central Bank's guide on climate-related and environmental risks from 2020. KPMG notes that these banks were expected to meet its expectations by the end of 2024, that progress differs between institutions, and that the ECB keeps using enforcement measures against banks that fall short. The ECB also runs climate stress tests with horizons beyond three years.

The priority areas KPMG lists are physical risks from extreme weather and biodiversity loss, transition risks such as stranded commercial real estate, greenwashing and litigation, and ESG risks in supply chains. For a lender these turn into data questions: the energy rating of a building in the collateral file, the emissions of a corporate borrower, the flood zone of a property.

Risks that come from environmental, social or governance factors and show up in the bank's own risk types. A flood damages the collateral behind a mortgage, a carbon price makes a borrower's business less profitable, a governance scandal at a customer becomes a credit loss or a reputational problem. They are risk drivers, which is why MaRisk does not treat them as a separate risk type.

Risk management steers the bank: it decides which loans it grants, at which price, and how much capital it holds. Reporting discloses the result to the market, through the CSRD, the EU taxonomy and the bank's green asset ratio. The two use the same data, and ESG reporting in Germany covers the disclosure side.

All of them. KPMG's summary of the EBA guidelines lists credit, market, operational, liquidity and reputational risk, and the guidelines expect each of them to be assessed for ESG drivers over the short, medium and long term.