What Do Banks Actually Have to Do About ESG Risk in 2026?

In 2026 the United States withdrew its climate risk rules for large banks and the European Central Bank started fining banks for not having done the work. Both happened within four months. Here is what ESG risk management in banking actually requires now, and where.

Published by MASSIVUE, an enterprise transformation and capability building firm whose Academy delivers green finance, ESG risk and sustainable lending credentials. Last reviewed: August 2026.

The short answer

ESG in banking stopped being a policy commitment and became a supervised risk discipline. The change is narrow and specific: in the European Union, a bank is now examined on whether it can identify, measure and manage ESG risk inside its ordinary credit and risk processes, and it can be fined for failing to do so.

The European Banking Authority guidelines on the management of ESG risks began applying to all but small and non-complex institutions on 11 January 2026. Small and non-complex institutions follow by 11 January 2027 at the latest. These are not disclosure rules. They sit inside prudential supervision, alongside credit risk and liquidity, and they are assessed through the supervisory review process.

In the United States the direction reversed. The Federal Reserve, the FDIC and the OCC rescinded their joint climate risk principles for large financial institutions, effective 18 November 2025, on the reasoning that general safety and soundness standards already require institutions to manage material risk.

So the honest answer to what banks have to do about ESG in 2026 is that it depends entirely on who supervises them, and for the first time the answers are far apart.

Key takeaways

1. The EU rules are live and enforced with money. On 13 February 2026 the ECB imposed periodic penalty payments of 7,551,050 euros on Credit Agricole for failing to assess the materiality of its climate and environmental risks by a supervisory deadline. It was not the first such penalty.
2. ESG risk is treated as a driver, not a category. The EBA requires institutions to handle ESG factors as drivers of credit, market, operational, reputational, liquidity, business model and concentration risk, over a horizon of at least ten years.
3. Banks now have a defined data ask. For large corporate counterparties the guidelines list the specific data points a bank should consider obtaining, including asset locations and hazard exposure, scope 1, 2 and 3 emissions, fossil fuel dependency and any disclosed transition plan.
4. Missing data is not an exemption. Where data is unavailable, institutions must assess and document the gap, use sectoral or regional proxies, and reduce reliance on proxies as data improves.
5. Engagement comes before exit. Both the EBA and the Monetary Authority of Singapore expect banks to engage counterparties and adjust terms rather than withdraw financing indiscriminately.
6. The US rollback removed guidance, not risk. Rescinding the climate principles did not remove the underlying safety and soundness duty, and it does not travel with a bank into its EU, UK or Singapore operations.

The rules did not converge in 2026, they split

For most of the past decade the direction of travel in bank supervision was one way. That ended. A bank operating in more than one region is now supervised to materially different expectations on the same balance sheet.

The practical consequence is that a global bank cannot run one ESG risk policy and call that compliance. It can run one capability applied at different intensities. Those are different things, and the second is achievable.

What the EBA guidelines actually require

The guidelines are built around four obligations that now appear, in some form, in every serious supervisory regime operating today.

A materiality assessment you can evidence. Institutions must run regular and comprehensive assessments of which ESG risks are material to them, and be able to show the work. This is the most enforced item in the EU today, and the reason is that it is testable. A supervisor can set a date, ask for the assessment, and observe whether it exists.

A combination of measurement methods. One method is not enough. The guidelines require institutions to combine exposure-based, sector-based, portfolio-based and scenario-based approaches, together with portfolio alignment methods, so risks are visible across short, medium and long horizons. Exposure-based methods are specifically expected to deliver the short-term view of how ESG risks affect the risk profile and profitability.

Integration into the existing risk framework. ESG risks are to be handled as drivers of the traditional risk categories rather than as a parallel discipline. They belong in risk appetite, internal controls and the ICAAP, and the assessment horizon extends to at least ten years, which is longer than most banks plan for anything else.

A prudential transition plan. Under Article 76(2), the management body must produce a plan with quantifiable targets and milestones for monitoring and addressing the financial risks stemming from ESG factors. The EBA is explicit that this is a prudential document about risk to the institution, and that it should be reconciled with, rather than duplicated by, transition plans produced for sustainability reporting.

What a bank now has to know about a borrower

The most useful part of the EBA guidelines for anyone on either side of a credit conversation is the list of data points institutions should consider collecting for large corporate counterparties. It converts a vague obligation into a specific question set. For environmental risk the guidelines name:

• The geographical location of key assets such as production sites, their exposure to environmental hazards including temperature, wind, water and solid mass related hazards, and whether insurance is available.
• Current greenhouse gas emissions across scope 1, 2 and 3, in absolute terms and where relevant in intensity terms, plus targets where these exist.
• Dependency on fossil fuels, measured either through economic factor inputs or the revenue base.
• Energy and water demand or consumption, again through inputs or revenue.
• Energy efficiency for real estate exposures, assessed alongside the debt servicing capacity of the counterparty.
• The current and anticipated financial effects of environmental risks and opportunities on the counterparty financial position, performance and cash flows.
• Transition-related strategic plans, including any climate transition plan disclosed under the sustainability reporting directive.

For social and governance risk the list is shorter and turns on alignment with the OECD Guidelines for Multinational Enterprises, the UN Guiding Principles on Business and Human Rights and the ILO Declaration on Fundamental Principles and Rights at Work, together with material negative impacts on workers, communities and consumers, and the due diligence processes used to avoid and remediate them.

Two things about that list matter more than its contents. The first is that it is about the counterparty financial position, not the counterparty environmental virtue. Energy efficiency appears next to debt servicing capacity because the guidelines are asking whether an efficiency retrofit obligation will impair a borrower ability to repay. The second is that this is the question set corporate treasurers are already meeting at refinancing, which is the subject of our companion article on what companies still have to prove after the EU Omnibus. This article looks at the same conversation from the lender side of the table.

Engagement first, exit last

A persistent misreading of ESG rules in banking is that they push lenders to exit high-emitting sectors. The supervisory texts say close to the opposite.

The EBA sets out a sequence of risk management tools. Engagement comes first: determine which counterparties to engage with based on the materiality assessment, open a dialogue, and consider counterparty-specific actions such as adjusting the product offering or agreeing a remedial plan that supports the counterparty transition. Only where continuation is judged incompatible with the institution risk appetite is cessation of the relationship contemplated, and it is described as a last resort.

Between those two poles sit the levers that actually change deals. The guidelines specifically contemplate adjusting financial terms, including contractually agreed safeguards and corrective measures, adjusting conditions such as tenor, and adjusting pricing on ESG risk-relevant criteria. They also contemplate sectoral policies, exposure limits and portfolio diversification on ESG criteria.

MAS takes the same position more bluntly in its transition planning guidelines, telling financial institutions not to indiscriminately divest from or withdraw financing and insurance coverage from higher-risk exposures, and to prioritise engagement instead.

This is the practical shape of ESG in banking in 2026. It is not a sector ban. It is repricing, retenoring, covenanting and conversation, applied unevenly across a portfolio according to a materiality assessment. That is a credit skill, and it sits with relationship managers and credit officers rather than with a sustainability team.

The data gap the Omnibus left behind

There is an obvious problem with the data list above, and the EU created it itself.

Directive (EU) 2026/470, the Omnibus I directive, entered into force on 18 March 2026 and narrowed corporate sustainability reporting to undertakings exceeding both 1,000 employees and 450 million euros in net turnover. It also capped what in-scope companies can demand from smaller value chain entities. Most of the counterparties a mid-sized bank lends to will therefore never publish the data the EBA guidelines expect that bank to consider.

The guidelines anticipate this rather than resolve it. Where data quality or availability is insufficient, institutions must assess the gaps and their potential impacts, take and document remediating actions including estimates or proxies based on sectoral or regional characteristics, adjust those proxies for counterparty-specific factors where feasible, and reduce reliance on estimates over time as data improves. For counterparties other than large corporates, expert judgment, qualitative data and portfolio-level assessment are explicitly permitted.

Read plainly, that is a supervisory instruction to proceed on incomplete information and document the reasoning. It is not a waiver, and it creates a specific and underappreciated exposure: the proxy methodology itself becomes an examinable artefact. A bank that cannot explain why it mapped a borrower to a particular sector proxy, or that has used the same proxy for three years without improvement, has a finding waiting to happen.

Our analysis of which sustainability reporting standards actually apply in 2026 covers the scope tests on the corporate side of this gap.

Wider disclosure, and the end of the Green Asset Ratio

Disclosure moved in two directions at once, which is worth separating carefully because the headlines conflated them.

The scope widened. Under the capital requirements regulation mandate, the EBA has drafted amending implementing technical standards that extend ESG disclosure beyond large listed institutions to large non-listed institutions, other institutions, small and non-complex institutions and large subsidiaries. The final report was published on 22 June 2026, with an expected reference date of 31 December 2026 and 31 December 2027 for small and non-complex institutions.

At the same time the content narrowed. The same draft standards drop the Green Asset Ratio and the templates covering alignment of institutions exposures with the EU Taxonomy, on the reasoning that they duplicate the taxonomy framework and that a significant proportion of bank counterparties now fall outside taxonomy scope after the Omnibus. The Green Asset Ratio was the headline sustainability metric for EU banks for three years. Its removal from the Pillar 3 framework is the clearest signal available that supervisors have shifted their attention from portfolio greenness to portfolio risk.

These are draft standards submitted to the European Commission rather than adopted law, and the dates should be treated as expected rather than fixed.

What the US rollback did and did not change

The reversal in the United States was genuine, and it is often overstated in both directions.

What happened: the OCC withdrew from the interagency climate principles on 31 March 2025, describing them as overly burdensome and duplicative. The Federal Reserve, the FDIC and the OCC then announced on 16 October 2025 that they would rescind the joint Principles for Climate-Related Financial Risk Management for Large Financial Institutions, which had applied to institutions with more than 100 billion dollars in consolidated assets. The rescission took effect on 18 November 2025. Separately, the Federal Reserve, the FDIC and the Treasury left the Network for Greening the Financial System in January 2025, with the OCC following in February.

What did not happen: the removal of the underlying duty. The agencies rescinded the principles on the explicit reasoning that existing safety and soundness standards already require supervised institutions to have effective risk management commensurate with their size, complexity and activities, and to address all material financial risks. If severe weather exposure is material to a portfolio, it remains a supervisable risk. What disappeared was the dedicated framework naming it, not the obligation to manage it.

Three consequences follow for a US institution with international operations. Its EU subsidiaries are inside the EBA guidelines regardless of what US supervisors expect. Its UK operations sit under SS5/25. And its corporate clients with EU banking relationships will be answering the EBA data question set anyway, which means the capability exists in the market whether or not a US supervisor requires it.

The UK and Singapore

Neither the UK nor Singapore followed the US, and both moved during the same period.

The PRA published PS25/25 on 3 December 2025 alongside a new supervisory statement, SS5/25, replacing the 2019 statement that had governed UK expectations since before most banks had a climate risk function. The new statement took effect on publication. The PRA set a six-month period for firms to review their position against the expectations and build a credible plan for closing gaps, and said supervisors would not ask for evidence of those reviews until the period ended. That window has now closed.

MAS published its transition planning guidelines on 5 March 2026, supplementing the existing environmental risk management guidelines for banks, insurers and asset managers. They take effect from September 2027 after an 18-month transition period. The expectations track the EU logic: boards must embed climate considerations in risk appetite and strategy, institutions must build structured, risk-proportionate processes for engaging customers on climate risk and collecting enough data to inform decisions, scenario analysis and stress testing are expected, and proxy data limitations must be acknowledged rather than ignored.

The Singapore timing is worth noting for anyone planning a capability build. September 2027 sounds distant. An 18-month transition period for a requirement that depends on customer engagement processes and portfolio data is not generous, and the institutions that met the EU deadline in January 2026 spent roughly that long preparing.

Running a bank across the divide

The regulatory divergence is real but it is narrower than it looks, because the underlying capability is nearly identical everywhere it is required. Four things are common to the EU, UK and Singapore regimes:

1. A documented materiality assessment that identifies which ESG risks matter to this institution, refreshed on a defined cycle. This is what the ECB has fined banks for failing to produce, and it is the cheapest of the four to get wrong.
2. A counterparty data process that collects what is available, proxies what is not, records which is which, and improves over time.
3. Scenario analysis extending well beyond the normal planning horizon, with results that reach a credit committee in financial terms rather than narrative terms.
4. An engagement framework that gives relationship managers a defined sequence of actions between doing nothing and exiting a client.

A bank that builds those four honestly is close to compliant in three jurisdictions and defensible in the fourth, because the US safety and soundness standard does not object to a bank understanding its own portfolio. The costly approach is the opposite one: three regional ESG policies, three data collections and three sets of consultants.

The capability gap we see most often is not at the top of the organisation. Boards have received the training. Sustainability teams know the frameworks. The gap sits with the credit officers and relationship managers who now have to ask a borrower about asset-level hazard exposure and fossil fuel revenue dependency, interpret the answer against a sector proxy, and reflect it in tenor or pricing. That is a new technical skill being asked of an existing role, and very few institutions have resourced it as such.

Frequently asked questions

Are banks still required to manage ESG risk in 2026?

In the European Union, the United Kingdom and Singapore, yes. The EBA Guidelines on the management of ESG risks apply to EU institutions other than small and non-complex ones from 11 January 2026, with small and non-complex institutions covered by 11 January 2027 at the latest. The UK PRA supervisory statement SS5/25 took effect on 3 December 2025. MAS transition planning guidelines take effect in September 2027. In the United States, the dedicated interagency climate principles were rescinded on 18 November 2025, but general safety and soundness standards continue to require institutions to manage all material financial risks.

Has any bank actually been penalised over climate risk?

Yes. The ECB imposed its first periodic penalty payment on 10 November 2025, of 187,650 euros on ABANCA, for failing to complete a climate and environmental risk materiality assessment by a 31 March 2024 deadline. On 13 February 2026 it imposed 7,551,050 euros on Credit Agricole for the same category of failure against a 31 May 2024 deadline. Both penalties concerned the materiality assessment rather than any lending decision.

What ESG data do banks ask corporate borrowers for?

For large corporate counterparties the EBA guidelines list asset locations and exposure to physical hazards including insurance availability, scope 1, 2 and 3 emissions with targets where available, fossil fuel dependency, energy and water consumption, energy efficiency for real estate exposures alongside debt servicing capacity, the anticipated financial effects of environmental risks on the borrower cash flows, and any disclosed climate transition plan. Social and governance questions cover alignment with the OECD, UN and ILO frameworks and material negative impacts on workers and communities.

Does the EU Omnibus mean banks need less ESG data from clients?

No. Omnibus I narrowed which companies must publish sustainability reports, but it did not change what banks are supervised on. The EBA guidelines require institutions to fill the resulting gaps with documented sectoral or regional proxies and expert judgment, and to reduce reliance on proxies over time. In practice the reporting change increased the burden on banks, because data that was previously published now has to be requested, estimated or modelled.

Do these rules require banks to stop lending to high-emitting sectors?

No. The EBA guidelines set out engagement with counterparties as the primary tool and describe ending a relationship as a last resort where continuation is incompatible with risk appetite. Between the two sit adjustments to financial terms, tenor, contractual safeguards and pricing, plus sectoral policies and exposure limits. MAS states directly that institutions should not indiscriminately divest from or withdraw financing from higher-risk exposures.

Is the Green Asset Ratio still required?

The EBA final report of 22 June 2026 on amending Pillar 3 implementing technical standards removes the Green Asset Ratio and EU Taxonomy alignment templates from the bank disclosure framework, on the grounds that they duplicate the taxonomy framework and that many counterparties now fall outside taxonomy scope. These are draft standards submitted to the European Commission rather than adopted law, so the position should be confirmed before it is relied on.

Regulatory positions in this article are sourced from the European Banking Authority, the European Central Bank, the Federal Reserve, the OCC, the Bank of England and the Monetary Authority of Singapore, and are linked inline. Positions stated reflect the position at August 2026. The amending Pillar 3 implementing technical standards are identified in the text as draft rather than adopted.