EBA Simplification Package, Module 7: ESG Reporting to Become an Integral Part of Supervisory Reporting

On 10 April 2026, the European Banking Authority (EBA) published Consultation Paper EBA/CP/2026/07, launching a comprehensive revision of the Implementing Technical Standards (ITS) on supervisory reporting. Alongside simplifications in existing reporting areas, the package proposes, for the first time, to embed ESG risks as a standalone module within regular supervisory reporting. Article 430(1)(h) CRR requires institutions to report the information needed to monitor ESG risks; the EBA’s mandate to define uniform reporting formats, frequencies and instructions follows from Article 430(7) CRR. The consultation closed on 10 July 2026, and the EBA intends to submit its final report to the European Commission by the end of 2026. Subject to final adoption, the first reference date under the revised framework is scheduled for 30 September 2027.

For institutions, the proposed ESG module is more than an additional set of templates. It would bring ESG risks into a dedicated, harmonised module of the regulatory reporting framework, with close substantive links to FINREP, Pillar 3 disclosures and the planned adjustments to EU-wide stress testing.

Background: From Ad Hoc Collection to Regular Reporting

To date, the EBA has collected ESG data under Decision EBA/DC/498 through an ad hoc exercise addressed exclusively to large institutions with capital market activities and closely modelled on the existing Pillar 3 ESG disclosure tables. Under the EBA’s draft proposal, this approach would be incorporated into a permanent, standardised ITS reporting framework that, in principle, applies to all institutions within the scope of the CRR—from large institutions with capital market activities to small and non-complex institutions (SNCIs). The existing ad hoc collections would continue on a transitional basis until the new requirements become fully applicable. Although the module is labelled ESG reporting, the quantitative focus of the proposed templates is currently on climate-related and other environmental risks; separate quantitative templates for social or governance risks are not envisaged.

In substance, the new module builds on the existing Pillar 3 ESG tables and is closely aligned with the CSRD/ESRS framework and the EBA guidelines on the management of ESG risks. The EBA is thereby pursuing two objectives: to avoid duplicate reporting through conceptual alignment with disclosure requirements, and to create a robust supervisory data basis for risk analysis and the SREP. Certain data points previously collected, including information on taxonomy alignment, the Banking Book Taxonomy Alignment Ratio (BTAR) and the “Top 20 issuers”, would no longer be required under the proposed supervisory ESG module. This applies only to the proposed scope of supervisory ESG reporting compared with the previous EBA ad hoc exercise; other taxonomy or disclosure requirements remain unaffected.

Proportional Structure: Three Reporting Levels

As in other modules of the Simplification Package, the EBA proposes a tiered and proportionate approach to ESG reporting. The reporting scope depends on an institution’s size and capital market activity, complemented by materiality thresholds at template level, in particular for geographic breakdowns:

• Large institutions, both with and without capital market activities, would submit a comprehensive set of seven templates. These largely mirror the Pillar 3 tables, supplemented by supervisory-specific templates such as D 04.00 on environmental concentration risk and D 11.00 on environmental risks beyond climate. Within this category, institutions with total assets above EUR 30 billion would submit the more granular template D 01.00, while institutions below this threshold would use the simplified template D 01.02. Other institutions with capital market activities and large subsidiaries would submit a simplified set of six templates, including the reduced template D 05.01 for physical risks.
• SNCIs and other institutions without capital market activities would report a highly condensed template, D 01.01, which combines key information on transition and physical risks and would be submitted annually only.

Materiality thresholds, particularly for country-level breakdowns, are intended to ensure that only significant countries are reported separately, with less significant countries grouped under “Other countries”. Institutions with predominantly domestic business would therefore benefit from simplified requirements. Reporting would generally take place at the highest EU consolidation level, consistent with the Pillar 3 disclosure framework; for certain categories of institutions, such as large subsidiaries, reporting at individual or sub-consolidated level is also envisaged.

An Overview of the Ten ESG Templates

The module comprises ten templates in total. Two of them – D 04.00 and D 11.00 – have no direct counterpart in Pillar 3 disclosure and therefore constitute genuinely supervisory data requirements:

 
Integration with FINREP, Pillar 3, and stress testing

The instructions for completing the ESG templates make numerous explicit references to FINREP tables and concepts. This reflects a core design principle of the module: ESG reporting should not operate as a separate data silo alongside financial and risk reporting but should reuse existing data and definitions wherever possible. At the same time, the close integration with FINREP and Pillar 3 confirms that, from a supervisory perspective, ESG information is no longer treated primarily as investor-oriented disclosure. It is becoming part of the established regulatory reporting architecture.

The connection with EU-wide stress testing is particularly relevant for template D 01.00, which is intended to provide additional data points needed for credit risk and climate-related stress tests and thereby reduce the need for separate ad hoc data requests. For institutions, this substantially increases the likelihood that inconsistencies between ESG reporting, FINREP, stress testing and Pillar 3 disclosures will become visible to supervisors.

Timeline

• April 10, 2026: Publication of Consultation Paper EBA/CP/2026/07, including the ESG module.
• July 10, 2026: End of the general consultation period (for certain IFRS 18-related reporting areas, May 10, 2026, was already the deadline).
• By the end of 2026: Planned finalization of the ITS and submission of the final report to the European Commission by the EBA.
• September 30, 2027: Scheduled first reporting date under the revised framework—subject to final adoption and the implementation timeline.
  
  

Position of the German Banking Association

The German Banking Industry Committee (Deutsche Kreditwirtschaft, DK/GBIC) participated in the consultation by submitting a response on the Simplification Package as a whole, including the ESG module. In principle, the DK supports the EBA’s objective of making the reporting framework more consistent, efficient and proportionate. At the same time, it takes the view that the proposed measures are likely to provide only limited relief in practice and may, in some cases, create additional burdens. In its assessment, existing requirements would often not be reduced, but replaced by new reporting obligations, additional data points or modified templates.

The DK is particularly critical of new requirements relating to ESG risks, alongside stress test integration and asset encumbrance reporting. In its detailed English-language comments on the general section of the consultation, the GBIC expressly notes that changes to the ESG module going beyond the existing CRR disclosure requirements would entail significant implementation costs. The introduction of additional thresholds and classifications, including in the FINREP and ESG modules, is also highlighted as a source of operational burden.

The DK considers the proposed implementation deadline of 30 September 2027 to be unrealistic, as it does not adequately reflect the technical adjustment effort required, particularly for new reporting requirements. With regard to the general section of the consultation package, the GBIC explicitly advocates extending the implementation deadline to at least September 2028. Overall, the DK calls for more far-reaching and effective simplifications, greater proportionality for smaller and less complex institutions, and a genuine reduction in reporting burdens and implementation costs.

What does this mean for institutions?

The practical implications of the ESG module can be grouped into three areas:

• Data integration: ESG metrics will need to be consistently linked to risk parameters such as PD, LGD and LTV, as well as to FINREP positions and off-balance-sheet items – across organisational boundaries between Risk, Finance, Treasury and sustainability functions.
• Granularity and governance: Obligor-level reporting in D 04.00, sectoral NACE breakdowns, emissions data and energy performance information, including proxy methodologies, require robust data ownership, clear control points and a consistent collateral and counterparty data model.
• Consistency across reporting frameworks: ESG data will feed simultaneously into Pillar 3 disclosures, FINREP and, prospectively, stress testing. Any inconsistencies between these frameworks are therefore likely to become immediately apparent to supervisors. Institutions need a single, technically aligned ESG data set rather than parallel data sources for disclosure and regulatory reporting.

For large and complex institutions participating in EBA stress tests, ESG metrics from D 01.00 and D 05.00 will also need to be aligned with stress test data sets. Other institutions with capital market activities and large subsidiaries face similar challenges, albeit on a smaller scale. For SNCIs and other institutions without capital market activities, the reporting scope has been deliberately streamlined; however, the core implementation challenge remains: ESG data must be embedded permanently into reporting, risk management and disclosure processes.

What Institutions Should Do Now

• Conduct an early impact analysis: Compare the future ESG data requirements, covering sector, emissions, energy performance and location data, with existing source systems, and identify data gaps by template and institution category.
• Clarify data ownership: Define which functions—Risk, Finance, Treasury, Sustainability or Regulatory Reporting—own which ESG data points, including the related control and approval processes.
• Establish consistent definitions: Ensure that ESG metrics used in regulatory reporting, Pillar 3 disclosures and internal risk management are based on the same definitions and data sources before inconsistencies become visible to supervisors.
• Prepare for finalisation of the ITS: Use the period until the ITS is finalised to document institution-specific implementation risks—such as those relating to proxy methodologies for emissions data or geographic granularity—and feed them into technical discussions with industry associations.
• Develop a realistic timeline: Given that the DK considers the 30 September 2027 deadline ambitious, institutions should prepare a project plan that reflects both the regulatory target date and the possibility of an extended implementation period.
  
  

Conclusion

With Module 7, the EBA proposes to incorporate ESG risks into a standalone and proportionate module of the harmonised supervisory reporting framework. The close conceptual alignment with Pillar 3 may reduce the effort required to develop entirely new data models, but it also requires a much deeper integration of ESG, financial and risk data. While the German Banking Industry Committee supports the EBA’s overall objective of simplification, it sees substantial room for improvement, particularly regarding proportionality for smaller institutions and the proposed implementation timeline. Institutions should use the remaining period until the ITS is finalised to perform a thorough impact analysis and establish a consistent ESG data framework—irrespective of whether the first reporting date remains September 2027 or is deferred by one year, as requested by the banking industry.