ESG Risk in CRR3/CRD6: Instrumenting Environmental Risk in the Capital Stack

Under CRD6, ESG risk stops being a report you publish and becomes an input to how much capital you hold. That is a data and instrumentation problem long before it is a policy one, and most firms are still treating it as the latter.

For most of the last decade, environmental, social and governance risk lived in the sustainability team and surfaced as disclosure — a report, a taxonomy alignment percentage, a set of Pillar 3 templates. The sixth Capital Requirements Directive, Directive (EU) 2024/1619, moves it somewhere else entirely. ESG risk is now a prudential concern: something a bank must identify, measure, manage and monitor as part of core risk management, and something a supervisor will examine in the ordinary review cycle. The directive had to be transposed by 10 January 2026, with the substantive provisions applying from 11 January 2026. If your ESG work still terminates in a PDF, you are not ready for what CRD6 actually asks.

What Article 87a actually changes

CRD6 inserts Article 87a into the Capital Requirements Directive. Stripped of the drafting, it requires institutions to have robust strategies, policies and processes to identify, measure, manage and monitor ESG risks over the short, medium and long term — and the long term here is explicitly a horizon of at least ten years, well beyond the usual three-year planning window. It also requires, under the related plan-preparation obligation, that firms produce concrete plans to monitor and address the financial risks arising from ESG factors, including those flowing from the EU’s transition to a climate-neutral economy.

The word doing the work is financial. This is not a corporate transition plan of the kind CSRD asks a company to disclose about its own footprint. It is a prudential transition plan: an assessment of how ESG factors feed into credit risk, market risk, operational risk and liquidity through identifiable transmission channels, and what that does to the institution’s solvency over time. The board must approve the relevant strategies and policies, and review them at least every two years. The supervisor may then assess all of it as part of the supervisory review and evaluation process.

The instrumentation the guidelines assume

The EBA gave the detail its own document: the Guidelines on the management of ESG risks (EBA/GL/2025/01), published on 9 January 2025 and applying from 11 January 2026, with a later start of 11 January 2027 for small and non-complex institutions. Read them as a technologist and a clear data architecture falls out of the text, whether or not the drafters meant it to.

First, a materiality assessment that is evidenced, not asserted. You have to show, per portfolio and exposure class, which ESG risks are material and why — which means you need exposure data joined to sector, geography and, for the environmental piece, physical-hazard location and transition-sensitivity attributes. Most core banking systems do not carry those fields. Somebody has to source them and wire them in.

Second, transmission channels made explicit. A supervisor asking about your climate risk will not accept “we consider it material.” They will ask how a transition shock in a given sector propagates to probability of default in a named portfolio, and where that shows up in your figures. That is a mapping — from ESG driver to risk parameter to capital — and it has to be built, maintained and versioned like any other model input.

Third, counterparty transition data. To assess transition risk you need forward-looking information on your borrowers: emissions, sector pathways, whether they have credible transition plans of their own. For large corporates some of this arrives through CSRD reporting. For SME and mid-market books it largely does not, and you are left with proxies, estimates and a data-lineage problem you will have to defend. Deciding, documenting and governing those proxies is itself an examinable control.

Scenarios stop being a slide

CRD6 requires institutions to test their resilience to the adverse effects of ESG factors, including through scenario analysis, and the EBA is complementing the main guidelines with dedicated guidance on ESG scenario analysis. In practice this means climate scenarios — the kind published by bodies such as the NGFS — have to become live inputs to the risk framework rather than a one-off exercise the sustainability team ran once for a disclosure.

That has a direct engineering consequence. Your stress-testing capability needs to ingest a scenario definition, apply it through the transmission mapping to your actual exposures, and produce an impact on capital and on your risk-appetite metrics. If you have already been re-plumbing your prudential reporting for the revised risk weights and output floor — the work I covered in re-plumbing COREP under CRR3 — the ESG scenario feed wants to run through the same pipeline, not a parallel spreadsheet. The same discipline applies here as in the FRTB market-risk build: scenarios are only as good as the data model they run against, and a scenario capability that cannot trace its numbers back to positions will not survive supervisory challenge.

Where it lands: risk appetite, not the report

The test of whether a firm has genuinely internalised CRD6 is whether ESG risk shows up in the risk-appetite statement with limits that can bind. Not “we are committed to sustainability,” but a stated tolerance for transition-sensitive exposure, or for physical-risk concentration in a region, expressed as a number a monitoring system can breach and escalate. That closes the loop: material risks identified, transmission mapped, scenarios run, impact quantified, and an appetite limit that the quantified impact is measured against. When each of those steps produces evidence, you have a defensible position. When the chain breaks — usually at data or at the appetite limit — you have a report that says the right things and a framework that cannot show them.

What a supervisor will actually ask for

• The materiality assessment, with the underlying exposure data and the attributes that drove the conclusions.
• The transmission mapping from ESG drivers to risk parameters, and evidence it feeds the figures.
• Your data sources for counterparty transition information, and the documented treatment of proxies and gaps.
• Scenario results traced back to actual positions, not an illustrative deck.
• Risk-appetite limits that reference ESG risk, and the monitoring that enforces them.

None of that is a disclosure task. All of it is a question of what your data model carries and what your risk pipeline can compute. The firms that treated ESG as a reporting obligation built the wrong thing; the ones that treated it as an instrumentation problem are the ones with an answer when the reviewer asks to see the numbers move.