Critical time for transition planning
Few topics are as pressing right now as the management of environmental risk. Heat waves during the spring and summer across Europe, together with devastating wildfires, have kept the concrete and ever-increasing impacts of climate change in the headlines. Beyond the damage to nature and people, the economic consequences of climate change and the adaptation it forces are being debated with increasing urgency. As environmental risks have a growing financial impact on businesses, they also carry ever-greater weight in risk management, particularly for financial institutions.
Against this backdrop, although the European legislator has veered back and forth on the scope and timing of its sustainability requirements, undertakings can no longer avoid the reality that environmental risks affect their operations and must be prepared accordingly. The Commission’s Omnibus I package narrowed the scope of the Corporate Sustainability Due Diligence Directive ((EU) 2024/1760, “CSDDD”) and the Corporate Sustainability Reporting Directive ((EU) 2022/2464, “CSRD”) and removed the obligation to adopt a climate transition plan from the CSDDD. Under the CSRD, large companies remain obliged, regardless of the Omnibus I package, to include in their management reports a description of their climate transition plans, but only if they have adopted one.
Banks and insurers, however, face a stricter regime: sectoral legislation soon requires all banks and insurers to have a ESG risk management plan (hereafter referred as “prudential ESG risk plans”) in place. For banks, the legislative amendments implementing the obligation enters into force on 1 October 2026, while insurers must comply from January 2027. This article examines how these sectoral prudential ESG risk plans differ from the CSRD transition plans, what the key requirements are for banks and insurers respectively, including the similarities and differences between their plans, and how the plans are supervised in light of both the legislative framework and the supervisory activities signalled by the supervisory authorities.
What are prudential ESG risk plans and how do they relate to transition plans?
Banks’ obligation to have specific ESG plans was introduced by the amendments in CRD VI ((EU) 2024/1619, “CRD VI”) to Article 76(2) of the Capital Requirements Directive ((EU) 2013/36, “CRD”), which were to be implemented to the national legislation by 11 January 2026. The amendments to the Finnish Act on Credit Institutions (610/2014, as amended, “ACI”) implementing CRD VI are now set to enter into force on 1 October 2026, introducing a new Section 3 a to Chapter 9 of the ACI.
Insurance companies’ obligation to have a sustainability risk management plan will enter into force on 29 January 2027, together with the other amendments to the Solvency II Directive ((EC) 2009/138, Solvency II). This means insurers have roughly four months to prepare for the new requirements. The obligation has been implemented by adding a new Section 10 a to Chapter 6 of the Finnish Insurance Companies Act (521/2008, as amended). The insurance regulation uses the wording “sustainability risk” and “sustainability factor” instead of “ESG risk” and “ESG factor” used in the banking regulation, but in substance the definitions are aligned.
The plans referred to in the CRD and the Solvency II Directive differ from the transition plans under the CSRD (referred to hereafter as “CSRD transition plans”). Pursuant to Article 19a (and Article 29 for groups) of the CSRD, the management report shall include information, including implementing actions and related financial and investment plans, on its plans to ensure the compatibility of its business model and strategy with the transition to a sustainable economy and with limiting global warming to 1.5 °C in line with the Paris Agreement.
By contrast, Article 76(2) of the CRD requires banks, and Article 44(2b) of the Solvency II Directive requires insurers, to develop plans to manage ESG risks. These plans must include quantifiable targets and processes to monitor and address the financial risks arising in the short, medium and long term from ESG factors (and sustainability factors for insurers), including risks arising from the adjustment process and transition trends in the context of relevant Union and Member State regulatory objectives, in particular the objective of achieving climate neutrality.
In essence, whereas CSRD transition plans are an undertaking’s roadmap for adjusting its own activities to a net-zero economy, prudential ESG risk plans are designed to identify and manage the financial risks caused by sustainability factors and to prepare for the transition towards a sustainable economy. That said, while the starting points of these plans differ, the outcomes may well convergence: effectively managing of ESG-related financial risks will in practice require institutions to adapt their activities.
Prudential ESG risk plans must also include quantifiable targets and concrete actions. In addition, both the CRD and the Solvency II Directive expressly require that prudential ESG risk plans be consistent with the undertaking’s CSRD transition plans and include, in particular, actions regarding the business model and strategy that are aligned across these plans.
Similarities of the banks’ and insurers’ plans
In the CRD and the Solvency II Directive, the European Banking Authority (EBA) and the European Insurance and Occupational Pensions Authority (EIOPA) were given similar mandates to specify the content of prudential ESG risk plans in greater detail. EBA’s mandate was to issue Level 3 guidelines, while EIOPA was tasked with drafting Level 2 regulatory technical standards (hereafter “RTS”), to be finally adopted by the European Commission.
In accordance with its mandate, EBA published its guidelines on the management of ESG risks including detailed guidance on the plans in January 2025 (hereafter the “EBA Guidelines”), with an application date of 11 January 2026 (small and non-complex banks were given an additional year to comply). EIOPA was due to deliver its draft RTS in January 2026, but the RTS were among the Level 2 instruments de-prioritised by the Commission. Before the de-prioritisation, EIOPA had already published a consultation paper on the draft RTS, in which it sought to align its proposals with the EBA’s guidelines as far as possible, taking into account sector-specific characteristics and EIOPA’s slightly broader mandate, which also covered disclosure specifications and the identification of supervisory approaches. Although the RTS were not adopted, the consultation paper – prepared by EIOPA together with national insurance supervisors – offers useful insight into the expectations supervisors are likely to have for insurers’ plans.
Against this background, prudential ESG risk plans of both banks and insurers should cover the following areas:
- Governance: governance structure, allocation of tasks and responsibilities, and remuneration policies that take ESG risks into account
- Metrics: backward- and forward-looking metrics that enable target-setting and tracking of progress
- Time horizon: coverage of short-, medium- and long-term time horizons, with the specific definitions of these horizons differing between banks and insurers
- Targets: quantifiable targets addressing ESG risks – which, pursuant to the CRD and the Solvency II Directive, must take into account the reports and measures prescribed by the European Scientific Advisory Board on Climate Change in relation to the achievement Union’s climate targets
- Actions and implementation: a description of how the targets are to be achieved.
Where do the plans differ?
There are also notable differences between the two plans. Broadly speaking, the CRD plan is structured as part of the institution’s strategic planning process, whereas the Solvency II plan forms part of the Own Risk and Solvency Assessment (ORSA). The CRD plan starts from strategic objectives and goals, which translate into targets and metrics, followed by implementation. The new Chapter 9, Section 3 a, Subsection 2 of the ACI, entering into force on 1 October 2026, states that the plans shall include actions relating to the business model and strategy of the institution. In line with this, the EBA Guidelines specify that the plans should be based on a forward-looking business environment analysis and a comprehensive strategic planning process.
The Solvency II plan, by contrast, starts with a sustainability risk assessment comprising a materiality assessment and a financial risk assessment; the results of these assessments are then described, targets set and actions planned. Accordingly, the Finnish Financial Supervisory Authority (“FIN-FSA”) has recommended that insurance undertakings present their plans in their ORSA supervisory report.
The final component of the CRD plan is counterparty engagement – an element absent from the Solvency II plan and one that highlights a key difference between the two plans. Banks are required to elaborate on the effect of ESG risks on their customer relationships more broadly, whereas insurers are primarily expected to assess the impact on their underwriting and investment policies.
How are the plans supervised?
Regarding banks, Article 87a of the CRD, as implemented in Chapter 11, Section 4 a of the Finnish Act on Credit Institutions, sets out how banks’ prudential ESG risk plans are to be supervised. The FIN-FSA (and the European Central Bank, “ECB”, for directly supervised significant institutions) shall assess and monitor the development of banks’ practices concerning their ESG strategies and risk management, as well as the plans, quantifiable targets and processes included therein. The assessment must take into account each bank’s sustainability-related product offerings, transition finance policies, loan origination policies, and ESG-related targets and limits. In addition, the robustness of the plans will be assessed as part of the supervisory review and evaluation process (Chapter 11, Section 2 of the ACI).
Beyond these customary supervisory powers, supervisory authorities have been given a targeted power to require banks to reduce risks arising from ESG factors through adjustments to their business strategies, governance and risk management. For this purpose, a bank could be required to reinforce the targets, measures and actions included in its plan. This power is, however, limited to the specific situations listed in Chapter 11, Section 10 of the ACI.
As regards insurance undertakings, from 30 January 2027 onwards the FIN-FSA shall, pursuant to the amended Chapter 25, Section 1 of the Insurance Companies Act, specifically supervise that insurers fulfil the requirements relating to the management of sustainability risks. No targeted supervisory powers have been given to insurance supervisors. The RTS was, pursuant to the Solvency II Directive, intended to specify supervisory approaches in relation to the plans in a manner similar to Article 87a of the CRD.
The ECB has already issued periodic penalty payments to two banks under its direct supervision. The penalties were imposed because the banks failed to meet the ECB’s deadline for conducting a materiality assessment of their climate-related and environmental risks – a requirement set in the aftermath of the 2022 thematic review on climate-related and environmental risks, which was itself based on the ECB’s 2020 Guide on climate-related and environmental risks. Climate- and nature-related risks remain a first-order priority for the ECB in 2026–2028: the ECB has already indicated that it will conduct a thematic review assessing prudential ESG risk plans and compliance with the EBA Guidelines, and will carry out on-site inspections focused on the management of climate and nature risks. Similarly, the FIN-FSA will conduct a thematic review on climate risks and EBA Guidelines compliance for the less significant institutions under its supervision during 2026.
On the insurance side, the FIN-FSA has indicated that it is developing a supervisory model for the new sustainability provisions and plans to conduct a thematic review during 2026–2027 to assess insurance undertakings’ readiness to prepare materiality assessments, business plans and base scenarios for the ORSA, and will examine the role of governance in ESG matters. In addition, EIOPA has identified strengthening the stability and sustainability of the EU insurance sector as one of its two strategic objectives in EIOPA’s strategy towards 2030.
Conclusion
Even though the general sustainability regulatory trend may have faced headwinds, environmental and nature risks – given their significant financial and macro-prudential impacts – are at the core of prudential supervision for the years ahead. For banks and insurers, prudential ESG risk plans are not optional but a regulatory requirement that requires prompt and thorough preparation and is subject to increasingly heightened supervisory scrutiny. With the obligation to adopt a transition plan removed from the CSDDD for other sectors, the financial sector is once again the first to apply binding sustainability regulation and will likely set the benchmark for ESG planning across the broader economy.
Should you have any questions on how these requirements may affect your organisation, please do not hesitate to get in touch with Senior Counsel Silvaliisa Virri, specialising in financial regulation, or Senior Counsel Malin Holm, specialising in matters related to ESG and finance.
In October 2026, we are hosting a seminar covering insurance, banking and supervisory perspectives on what these changes mean in practice. If you are interested, contact us at hpp@hpp.fi.
