ESG Risk Management for Banks and Asset Financiers in 2026 — The Complete Guide

On 10 November 2025 the European Central Bank fined ABANCA €187,650 in periodic penalty payments. The bank had taken 65 days too long to complete a materiality assessment for climate and environmental risks. The fine was small. The signal was not. For the first time since the 2020 ECB Guide on Climate-related and Environmental Risks went into force, a European supervisor used enforcement powers against a deficient risk management process — not against a missing disclosure, not against a misstated number, but against a bank that had failed to look properly at its own book.

Advertisement

Read the press release once and the implication arrives quickly. If a Spanish significant institution can be fined for an incomplete C&E materiality check in November 2025, a German bank that finances thousands of commercial real-estate units, vehicle fleets, or industrial machines without knowing their NACE distribution by counterparty, their efficiency class, or their physical-risk exposure by site is sitting on the same audit finding. It just hasn't been written yet.

The ABANCA case is the cleanest opening into a story that most people on the operational side are still telling themselves in pieces. The pieces are these. CSRD. EBA Guidelines on ESG Risk Management. CRD VI and CRR III. The 9th MaRisk amendment. The EU Taxonomy with its Green Asset Ratio. EBA Pillar 3 ESG disclosures. PCAF and the GHG Protocol around the edges. Each is treated by its own corner of compliance, its own consultancy slide deck, its own Q3 budget line. Almost nobody has noticed that all six paths converge on exactly the same data problem at exactly the same point in 2026.

This article maps the convergence. It names every regulatory thread that is now binding on companies with physical assets, on banks and leasing companies, and on their refinancers in the DACH region and the wider EU. It says who is hit, when, by what article number, and with what consequence. And it argues — and this is the position you will either accept or reject by the end — that the small KWG-licensed institution believing itself protected by exemption thresholds is in fact the most exposed actor in the entire chain, because it has neither the data infrastructure of the Type A conglomerate nor the regulatory headroom it thinks it has.

The six convergent paths of ESG regulation in one frame

If you work in asset financing or run an industrial firm and someone tells you ESG regulation is coming, ask them which of the six. The list is not new. The convergence is.

Path 1 — MaRisk and the German ESG supervisory shift

German supervisory law, owned by BaFin and the Bundesbank. The 7th MaRisk amendment of 29 June 2023 made ESG risks audit-relevant for every KWG-licensed institution in Germany, including leasing subsidiaries and small specialised banks. The 9th amendment goes into consultation in Q1 2026 and finalises in Q3 or Q4. After it, ESG is no longer a side module bolted onto risk strategy. It is integrated into risk inventory, risk strategy, and reporting, and the new size class of "small institutions" — defined in the amendment as those with a balance sheet below €5 billion — covers roughly 950 of Germany's banks. The relief is real. The minimum floor is climate risk, and even small institutions cannot opt out of it.

Path 2 — EBA Guidelines on ESG Risk Management (EBA/GL/2025/01): what banks must deliver from 2026

Published 9 January 2025. Applicable from 11 January 2026 for all institutions, and from 11 January 2027 for small and non-complex institutions. The legal basis is Article 87a(5) of CRD VI. The guidelines require a documented C&E materiality assessment, integration of ESG risk drivers into credit, market, operational, and liquidity risk, and a transition plan with quantifiable targets that the management body itself owns and monitors. Not the sustainability team. The board.

Path 3 — CRD VI, CRR III and §§ 26c-26d KWG: the legal floor

The hard legal floor under everything. CRR III has been in force since 1 January 2025; Article 4(1) No. 52d defines ESG risks as risk drivers, and Article 177(2a) puts physical and transition risk drivers into stress test scenarios. CRD VI was due in national law by 10 January 2026. Germany did it via BRUBEG, the Bundestag passed it on 29 January 2026, and the result is two new paragraphs in the German Banking Act: §§ 26c and 26d KWG, on ESG risk management and ESG risk plans. Article 76(2) of CRD VI requires that the management body develops and supervises a transition plan with measurable targets. There is no soft version of this requirement.

Path 4 — CSRD, ESRS E1 and the Omnibus exemption that does not exempt

The Corporate Sustainability Reporting Directive remains the most-misunderstood piece in the room. The Omnibus Directive 2026/470 cut the population of directly reporting companies by roughly 80 per cent: only firms above 1,000 employees and €450 million in revenue stay in scope. Wave 1 — the former NFRD-reporting companies — has been delivering CSRD reports for FY2024 since early 2026. Wave 2, the larger non-listed firms, has been pushed back to FY2027 with first reports in 2028. Most German mid-size lenders and industrial firms are not directly in scope. Almost all of them are indirectly in scope, because their refinancing partner, their parent, or their largest customer is. The CSRD value-chain reporting cap matters less than the value-chain data request, which has no cap.

Does the CSRD Omnibus exemption remove all reporting duties for German Mittelstand firms?

No. The Omnibus narrows direct CSRD scope to firms above 1,000 employees and €450 million revenue, lifting roughly 80 per cent of originally captured companies out of report-publication duty. Customers and refinancing banks still demand the same Scope 3 numbers in the same templates. The legal duty is gone. The commercial duty is firmer than before.

Path 5 — EU Taxonomy and the Green Asset Ratio: the simplified calculation that still needs every data point

Regulation (EU) 2020/852, with Delegated Regulation (EU) 2026/73 in force from January 2026. The simplification package cut data points for financial institutions by up to 89 per cent and gave a two-year reprieve on detailed GAR disclosure. It also introduced a 10 per cent materiality threshold below which positions can be excluded. Anyone who reads this as relief is reading too quickly. The bank that calculates its GAR still needs taxonomy-alignment data per exposure, which means per leased asset, per financed building, per industrial plant on the books. The simplification reduces the number of cells in the table. It does not reduce the number of facts in each cell.

Path 6 — EBA Pillar 3 ESG disclosures and the PCAF data quality score that runs underneath everything

ITS EBA/ITS/2022/01, in phased rollout since June 2022. The early phase covered the largest 80 SIFIs. CRR III broadens the population to over 2,000 institutions. The Pillar 3 templates require disclosure of Scope 1, 2, and 3 emissions of counterparties, financed-emissions intensity by sector, GAR, BTAR, and physical-risk concentration. The templates do not ask politely; they assume the data exists.

Around the six legal paths sit two methodological frames the supervisors quietly assume you are using. The Greenhouse Gas Protocol Corporate Value Chain Standard defines the 15 categories of Scope 3 emissions, of which Category 15 — investments and financed emissions — is the only one that matters for an asset-financing institution, because financed emissions account for more than 99 per cent of a typical bank's total inventory. And the PCAF Standard, Part A, third edition (December 2025), provides the calculation methodology that the EBA explicitly references as a proxy for financed-emissions reporting. PCAF assigns each data point a quality score from 1 to 5, where 1 is verified primary data and 5 is a sector average. Institutions must publish a portfolio-weighted average of these scores. We will return to that number; it is the most important number in the room and the one almost nobody is measuring.

Who is hit and when: four institution types in the German market

The German market for regulated asset financing is not a monolith. For the regulation, four distinct populations matter, and a fifth axis runs across all of them.

Which institutions are directly subject to MaRisk and the EBA ESG Risk Management Guidelines?

Every entity holding a KWG licence — virtually all professional German banks, leasing companies and specialised credit institutions above the smallest threshold. Whether the duties bite immediately on 11 January 2026 or one year later under the small/non-complex carve-out depends on size and complexity, not on legal form or sector. There is no opt-out for the climate-risk floor.

When does the EBA ESG Risk Management Guideline apply to small KWG-licensed institutions?

For small and non-complex institutions, EBA/GL/2025/01 applies from 11 January 2027 — twelve months after the general start date of 11 January 2026. The longer 31 December 2029 horizon covers full integration of social and governance dimensions; the climate-risk floor, materiality assessment and ICAAP integration are due on the earlier date.

The fifth axis cuts through all four. Industrial firms and the large operators of physical assets — real-estate portfolios, vehicle fleets, machinery parks, industrial plant — are not banks. They are not in MaRisk. They are not, on their own balance sheet, in Pillar 3. But they sit on the upstream end of every Scope 3 calculation a financed party will ever do, and they sell into a buyer base whose credit officers will, from 2026, be required to ask the questions. Vonovia receives data requests on building-level energy performance from every refinancing partner. DHL receives them on fleet emissions. BASF receives them on industrial-plant Scope 1 under ESRS E1. Caterpillar Germany and Liebherr receive them on embodied carbon per unit and use-phase emissions per machine class. The requests used to be polite. They are now appended to RFQs.

PCAF data quality scores: the most important number in the room

Here is the convergence, distilled. Every one of the six legal paths plus the two methodological frames asks for variants of the same six data points about the same physical assets. Read the matrix slowly. It is the entire reason this article exists.

The matrix is the punchline. An institution that has resolved CO₂ per asset class, NACE per counterparty, transition risk per object, physical risk per site, taxonomy alignment per activity, and Scope 3 financed emissions is, for all practical purposes, simultaneously compliant with all six paths. An institution that has resolved none of them is fighting on six fronts at once with six different consultants, six different spreadsheets, and six different deadlines.

The harder truth is that the six data points are not equally hard. NACE codes per counterparty are administrative; the data exists in onboarding files and needs to be cleaned. Physical risk per site requires a geocoded asset register and a hazard layer. Taxonomy alignment per activity is a question of legal interpretation against the technical screening criteria, and a competent compliance officer can do it asset by asset given enough coffee. The hard one — the one that makes the others look like exercises — is CO₂ per physical asset, year of manufacture, and use profile. That number does not live in any single institution. It lives across an entire upstream market, and for most of the German asset population in active financing today — buildings of unknown energy class, fleets of mixed-age vehicles, machines of undocumented service history — it has never been measured at all.

How is a portfolio-weighted PCAF data quality score calculated?

Each financed exposure is assigned a 1-to-5 rating based on the quality of its emissions data: 1 for verified primary data from the counterparty, 5 for a sector-average estimate with no asset-level information. The institution then weights each score by the outstanding exposure value and reports the resulting weighted average. The score is, in effect, the regulator's measure of how seriously you know what you finance.

This is where PCAF data quality scores stop being a footnote and become the centre of the conversation. A bank reporting a portfolio-weighted PCAF score of 4.6 — which is roughly where the European average sits today — is reporting that almost all of its financed-emissions data is sector-average estimation, not primary measurement. The supervisors know this. They tolerate it for now. They will not tolerate it forever. The first institution that walks into its 2027 ICAAP review with a portfolio-weighted PCAF score of 2.8 instead of 4.6 will not be praised; it will be asked, politely, why everyone else can't manage the same. From that moment, the score becomes a competitive variable, and the cost of the data becomes the price of refinancing.

The supervisor's logic is simple. A portfolio-weighted score of 5 means a bank is reporting numbers it cannot defend to two decimal places. A score of 2 means the bank can. The EBA does not yet penalise high scores. The ECB has begun, in its 2025 thematic reviews, to ask why scores are not falling. The ABANCA penalty was about a missed materiality assessment; the next penalty class will be about persistently poor data quality where better data was available. That is a forecast, not a fact. Write it down for 2027.

Why the 2026 calendar matters and what changes in practice

The convergence is not abstract. It has a calendar.

11 January 2026 — the EBA Guidelines on ESG Risk Management become applicable for all institutions outside the small/non-complex carve-out. Materiality assessment, integration into ICAAP, transition plans with quantifiable targets. Article 87a(5) CRD VI is the legal hook.

29 January 2026 — the German Bundestag passes BRUBEG, transposing CRD VI into national law. §§ 26c and 26d KWG become binding. Every KWG-licensed institution in Germany now has a statutory obligation to maintain an ESG risk plan with measurable targets, owned by the management body.

Q1 2026 — BaFin and Bundesbank publish the consultation draft of the 9th MaRisk amendment. Three components flow into it: the existing MaRisk review, the supervisory communication of 26 September 2024, and the BRUBEG transposition. ESG stops being a parallel track and becomes structural. Risk inventory, risk strategy, internal reporting — all rewritten to absorb climate and environmental drivers as standard categories. Finalisation is expected in Q3 or Q4 2026.

January 2026 — Delegated Regulation (EU) 2026/73 enters into force, simplifying the EU Taxonomy reporting framework. The 89-per-cent reduction in data points for financial institutions is real. So is the 10 per cent materiality threshold. So is the two-year transition for detailed GAR disclosure. None of that removes the requirement to know the alignment status of each individual exposure on which the bank chooses to report. It changes the disclosure format. It does not change the underlying data architecture.

H2 2026 — the ECB introduces its first climate factor in the Eurosystem collateral framework. Marketable assets from non-financial corporations will, for the first time, attract a haircut linked to transition risk. Asset-backed securities backed by real estate, vehicle fleets, or industrial equipment are not yet directly in scope. The signal is what matters: collateral pricing is now a function of the climate profile of the underlying. The financing book that is funded via securitisation will feel this through pricing within twelve months of the first publication.

FY2024 CSRD reports — Wave 1 reports, from companies that previously fell under NFRD, were due in spring 2026. Most of the major European industrial counterparties of German financiers are in this wave: Vonovia in residential real estate, BASF in chemicals and industrial plant, DHL in logistics and fleet, Caterpillar's European entities and Volvo CE in heavy equipment. Their ESRS E1 disclosures cover Scope 1, 2, and 3 emissions across the value chain. Reading these reports closely is the cheapest competitive intelligence available in the market this year, because they reveal exactly which methodologies the largest counterparties have adopted and exactly how far each of them is from being able to deliver primary, asset-level data to their financing partners.

The Omnibus changes deserve a careful sentence. The Omnibus Directive 2026/470 narrowed the CSRD population by raising the size threshold to 1,000 employees and €450 million in revenue. About 80 per cent of the originally captured companies fall out of direct scope. This was sold politically as relief for the German Mittelstand and it is, at the level of report production, real relief. But the Mittelstand industrial firm that escapes its own CSRD report still sells into customers and refinancing banks that are themselves in scope, and those customers will demand the same Scope 3 data the report would have required, in the same format, on the same timeline. The exemption removes the reporting cost. It does not remove the data cost. It only moves the cost from the supplier's compliance department into the supplier's sales department, where it now appears as a condition of doing business.

For the industrial firm — the machine builder, the chemicals plant operator, the logistics company — the change in 2026 is that the CO₂ data sheet becomes a sales document. A product without a quantified embodied-carbon figure and a quantified use-phase emissions curve will, in tenders to customers refinanced through CSRD-reporting banks, score lower than an otherwise identical product that has the numbers. It does not matter that the products are physically identical. The bank's PCAF data quality score is improved by accepting the documented one. So the documented one wins.

For the operator of a fleet or an asset portfolio, the change is that the existing-asset conversation acquires a new variable. A commercial building of unknown energy class, a used vehicle of unknown maintenance history, a machine without a documented hours-of-operation log — none of these are any longer just residual-value risks. They are data-quality risks to whoever finances them next. Operators that maintain digital asset records, performance histories, and consumption data are sitting on what is now a financeable portfolio; operators that do not are sitting on assets the bank will only accept at a discount. The discount has a name in the credit memo, and the name will, increasingly, be PCAF score 5.

For the bank or leasing company, the change is structural. Credit decisions now need a documented climate component at origination, not a retrospective overlay. Collateral valuation (Sicherheitenbewertung) has, since the 7th MaRisk amendment, formally required consideration of climate risk for buildings, vehicles, and machinery. The 9th amendment will sharpen that into specific expectations about how the climate adjustment is calculated, by whom, and with what evidence. Residual-value pricing models that ignore the transition path of an asset class are now models the auditor will flag. The residual value of a non-EPC-A office tower in 2026 is not the same number as the residual value of the same building written in a 2022 model, and the 2022 model is the one most institutions are still running. The same logic holds for a Euro V truck, or for a Stage IV machine on a leasing book.

For the refinancer — the Landesbank, the cooperative central institution, the development bank — the change is the one that ties everything together. The refinancer has been, throughout 2024 and 2025, the patient party. It accepted high PCAF scores, qualitative transition plans, and aggregated portfolio summaries. From 2026 onward, the refinancer becomes the impatient party. Its own Pillar 3 templates demand counterparty-level Scope 3 data; its own GAR calculation needs taxonomy alignment per exposure; its own ICAAP review needs a credible transition plan that runs through to its downstream institutions and large industrial counterparties. The patient years are over. The data requests now arrive with deadlines.

The position: why small KWG-licensed institutions are the most exposed actor

Why are small KWG-licensed institutions more exposed than larger banks?

They sit in a structural pincer. Supervisory relief gives them a longer formal runway, but their refinancing partners are bound by full Pillar 3 and GAR duties from 2026 and will demand asset-level data the small institution has no system to produce. The runway exists in regulation, not in funding.

This pillar takes one position and the reader is welcome to disagree. The most exposed actor in the German market in 2026 is not the Type A SI subsidiary, which already has a parent group reporting under CSRD and Pillar 3 and a budget for the data layer. It is not the Type D non-KWG operator, which is genuinely outside the supervisory framework and feels only commercial pressure. It is the Type C small KWG-licensed institution — small leasing companies, small specialised banks, small regional credit institutions, balance sheet under €5 billion, classified as small and non-complex, given a transition runway out to 31 December 2029, and confident that the runway is real protection. The small equipment-finance lessor is the most concrete sub-example. The same logic applies to a small property-finance bank or a small regional savings institution.

The runway is partial. Three things shorten it.

The first is that the EBA Guidelines apply to small institutions from 11 January 2027, not 2029. Materiality assessment, ICAAP integration, and a transition plan with quantifiable targets are due eleven months later than for the larger peers, not three years later. The 2029 date covers the full ESG integration including social and governance dimensions; the climate floor is due much earlier. Reading the BRUBEG package as a four-year holiday is a misreading.

The second is that small institutions are predominantly refinanced. Their funding cost depends on counterparties — Landesbanken, cooperative central institutions, development banks — that are themselves bound by the full Pillar 3 and GAR calculations. Those refinancing partners will, from 2026, ask for asset-level data that the small institution is not regulatorily required to produce and is therefore not producing. The data gap becomes a funding-cost gap. The runway exists in the supervisory calendar and not in the funding calendar.

The third is that the small institution typically lacks the systems to absorb a sudden data demand. The Type A subsidiary has, somewhere in its parent group, an ESG data platform, a sustainability reporting team, and a budget line. The Type C institution has a CFO, a head of risk, and a controller with a Q3 deadline already. When the funding partner sends a 47-column template asking for NACE-coded financed emissions by asset class, the Type C institution either fills it with sector averages — PCAF score 5 — or asks for help. Both answers reprice the funding line.

The institutions and industrial firms that resolve the data problem first will, by the end of 2027, stop being asked for the data. They will start being the source of it for their refinancing partners, their customers, and their own supplier networks. From that point forward, they set the terms of being asked. Everyone else in their supply chain and finance chain pays them.

The next eleven months: three actions before December 2026

If you are reading this from inside the credit risk function of a bank, an asset-financing institution, or the sustainability function of an industrial firm, three things deserve your calendar before December 2026, in order of urgency and difficulty.

1. Run a documented C&E materiality assessment that survives audit. Not a slide. A working paper, with a methodology section, a counterparty-level data inventory, and a written conclusion that someone in the management body has signed. The ABANCA penalty was for failing exactly this exercise. If your last materiality assessment was older than twelve months when you read this sentence, the next one is overdue. The cost of doing it well in Q2 2026 is a fraction of the cost of doing it under a supervisory deadline letter in Q4.

2. Measure your portfolio-weighted PCAF score honestly, even if you do not yet publish it. A score above 4 is not a scandal; it is the European average. A score above 4 that is not falling year over year, when better data is available in your asset class, is the audit finding that arrives in the 2028 cycle. The first useful action is the measurement itself. Most institutions discover, on their first pass, that the score is half a point worse than they assumed and that the worst-quality data sits in a single asset segment that nobody owns. Once that segment is named, it becomes a project. Until it is named, it is a liability.

3. Read the FY2024 ESRS E1 disclosures of the three largest Wave-1 counterparties whose assets dominate your book. Not the press release, the actual report. For a property-finance bank that might be Vonovia and two more real-estate names; for a fleet financier it might be DHL and two logistics groups; for an equipment-finance lessor it might be Caterpillar and Liebherr. Note which Scope 3 categories they have measured, which they have estimated, and which they have flagged as not yet available. That is the upper bound on the data quality you will be able to achieve from your supplier side over the next two years. If your refinancing partner expects better than that upper bound, the gap is yours to close, and the closing is a 2026 project, not a 2028 one.

The European supervisor's calendar from 2026 to 2030 looks brutal because it compresses fifteen years of methodological work into four years of operational delivery. By 2030 it will look gentle, because the structures forced into existence in 2026 will, by then, be running on routine. The four-year window between now and the gentle plateau is the entire game. The institutions and industrial firms that treat 2026 as the beginning of a build, rather than the end of a pause, will end the decade in a market shape they have helped to draw.

The next pillar in this series goes one layer deeper into the PCAF data quality question — how a portfolio-weighted score is built, defended, and improved across an asset book that was never designed to produce one.

Everyone else will be operating in someone else's drawing.

Sources

1. ECB press release on ABANCA periodic penalty payments, 10 November 2025 — https://www.bankingsupervision.europa.eu/

2. EBA Final Guidelines on the management of ESG risks (EBA/GL/2025/01), 9 January 2025 — https://www.eba.europa.eu/

3. Directive (EU) 2024/1619 (CRD VI), Article 76(2), Article 87a(5) — EUR-Lex

4. Regulation (EU) 2024/1623 (CRR III), Articles 4(1)(52d), 177(2a), 449a — EUR-Lex

5. BaFin Rundschreiben 05/2023, 7. MaRisk-Novelle, 29 June 2023 — BaFin

6. BaFin / Bundesbank consultation announcement, 9. MaRisk-Novelle, Q1 2026 — BaFin

7. BRUBEG (Bankenrichtlinienumsetzungs- und Bürokratieentlastungsgesetz), Bundestag-Beschluss 29 January 2026, BT-Drs. 21/3058

8. Directive (EU) 2022/2464 (CSRD) and Omnibus Directive (EU) 2026/470 — EUR-Lex

9. Regulation (EU) 2020/852 (Taxonomy) and Delegated Regulation (EU) 2026/73 — EUR-Lex

10. EBA ITS on Pillar 3 ESG disclosures, EBA/ITS/2022/01 — EBA

11. PCAF Global GHG Accounting and Reporting Standard, Part A, 3rd edition, December 2025 — carbonaccountingfinancials.com

12. GHG Protocol Corporate Value Chain (Scope 3) Standard, Category 15 — ghgprotocol.org

13. BaFin, Risiken im Fokus 2026 — BaFin

14. Nationales Aufsichtsprogramm 2026–2028, BaFin / Bundesbank — BaFin