What changed in 2026, what comes in 2027, and how companies and banks can both work from the same data.

In brief

• The Guidelines of the European Banking Authority (EBA) on the management of ESG risks (EBA/GL/2025/01) apply to banks supervised by the European Central Bank (ECB) from 11 January 2026. Small and non-complex institutions (SNCIs) have until 11 January 2027 at the latest.
• The duty sits with banks, not with companies. But banks can only meet it with data, and most of that data sits with their clients. The questions land on the company.
• For large corporate clients, the Guidelines list the data points a bank should consider. For other clients, the bank chooses from that list and fills gaps with documented estimates.
• The Guidelines name ESRS and the voluntary standard for non-listed SMEs (VSME) as the reference for company disclosures. They do not name GRI or ISSB.
• A shared, structured way to collect the data helps both sides. The company answers once and reuses the answers. The bank keeps its own rating, scoring and thresholds.

Why read this

Banks in the EU must now manage ESG risks as part of ordinary risk management. To do that they need information that mostly sits with their clients. This article explains how a rule written for banks becomes a list of questions on a company’s desk.

It covers four things:

• where the obligation comes from, and who sets each part of it
• what the EBA Guidelines say about data, paragraph by paragraph
• what is fixed, what is still moving, and what comes in 2027
• how companies and banks can work from the same data without losing their independence

It does not review the governance, materiality or transition plan parts of the Guidelines in detail, because other publications cover them. It follows one thread instead: the data that reaches clients.

For companies, it shows what the questions are for, what is and is not mandatory, and what to prepare. For banks, it shows where the Guidelines leave choices open and which choices matter for data quality.

From law to questionnaire: a chain of six links

A questionnaire from a bank is the last link in a chain. Each link adds a decision, which is why two banks that follow the same law ask different questions.

Links 1 to 3 are common to all banks in the EU. Supervisors and banks add their own expectations in links 4 and 5. A company only sees link 6, which is why a questionnaire can look arbitrary when it is not.

What changed, and when

Several EU rules changed in the same period. The table puts them in order. Dates for the EBA Guidelines can differ by country and by type of bank. In Luxembourg, for example, the CSSF applies them to less significant institutions, other than small and non-complex ones, from 1 April 2026. Check the date your own supervisor has set.

Two points matter most for this article.

First, the Guidelines work on a comply-or-explain basis. Supervisors expect banks to apply them or to explain why they do not. The wording is mostly “should”, which sets an expectation rather than a fixed rule. Banks therefore have room to decide how they collect data, and that is exactly why clients will see different questionnaires.

Second, CRD VI puts ESG risk into the core of bank risk management. Banks must identify, measure, manage and monitor the short, medium and long-term effects of ESG factors, with priority given to climate-related risks. A bank cannot do this without client-level data.

Why banks need client-level data

The Guidelines do not ask banks to collect data for its own sake. Data is the input to several things banks must do. The table links each one to its source. The last column is our reading of why client data is needed.

The Guidelines do not turn each of these into a questionnaire. A bank may also use third-party data, public sources and estimates (GL 25 to 27), and the Guidelines name engagement with clients as one source among others (GL 26). In our reading, the questionnaire becomes the main route where the client is an SME, because small companies usually publish little sustainability information.

The supervisor itself treats data availability as an open question. On 24 February 2025 the EBA published a report on the availability and accessibility of ESG data and on whether a common methodology is feasible, under Article 501c(1) of CRR. It said further work would follow on how risky ESG-exposed positions are and on the possible effects of an adjusted prudential treatment.

What banks must collect

The Guidelines do not hand banks a single form. They set principles for gathering data, and then list data points for one group of clients. References such as GL 28 are paragraph numbers of the Guidelines.

The principles (GL 24 to 27). Banks need procedures to gather and use ESG information about their counterparties. They should build on internal and external data, including the counterparty’s own disclosures, “in particular” the European Sustainability Reporting Standards (ESRS) or the voluntary standard for non-listed SMEs (GL 25). Engagement with clients is named as a data source (GL 26). Where data is missing or weak, the bank should document its remediating actions, including estimates or proxies (GL 27).

Paragraph by paragraph. The data rules sit in a short run of paragraphs. Read in order, they show how the Guidelines think about data.

• GL 23. Banks need sound information management systems to identify, collect, structure and analyse ESG data, within their overall data governance and IT. They should review their practices regularly and have arrangements to assess and improve data quality.
• GL 24. Banks should gather the information needed to assess current and forward-looking ESG risks through their counterparties, “aiming at collecting client- and asset-level data at an appropriately granular level”.
• GL 25. Banks should build on internal and external data, including the counterparties’ own disclosures. The Guidelines name the ESRS and a voluntary reporting standard for non-listed SMEs, which they describe by reference to the Commission’s 2023 SME relief package. They were written before the Commission’s Recommendation on the voluntary standard of 30 July 2025.
• GL 26. Banks should assess other sources, such as engagement with clients and counterparties, or third-party data. If they use a data provider, they should understand its sources, data, methodologies and limits.
• GL 27. Where data is not good enough at first, banks should assess the gaps and their impact, and take and document remediating actions. These include estimates or proxies, for example at sector or regional level, adjusted for the counterparty where feasible. Banks should seek to reduce the use of estimates and proxies over time.
• GL 28 and GL 29. The data points for large corporates, and the bank’s own choice for other counterparties, covered below.

Two phrases matter most. “At an appropriately granular level” pushes banks towards facts about the client and its assets. “Reduce over time” means an estimate is a starting point, not a destination. In our reading, a bank that never improves its data will find it hard to explain why it complies.

Two groups of clients.

The Guidelines do not define “other types of counterparties” or give a list. This is one of the gaps each bank has to fill with its own policy.

The themes behind the data points. Our reading of the Guidelines breaks GL 28 and its related paragraphs into 178 data points. The count is our analysis, not a figure printed in the Guidelines.

The other 120 data points cover energy and water, nature and ecosystems, financial effects, reputation and litigation, data provenance, and how the bank engages with the client.

What companies will be asked

A company will not see the 178 data points. It will see questions, and the number depends on its size. In our draft question set for SMEs and other counterparties, there are 107 questions in three tiers. The tiers are our design, not a regulatory category.

A few examples show the level of detail:

In the draft set, 103 of the 107 questions allow the answer “I do not know”. The bank can then apply a documented proxy instead of leaving a blank. Many smaller companies do not yet measure everything.

The Guidelines place no direct legal duty on companies to answer. If a company does not, the bank has to fill the gap with proxies and has less accurate information about it. Answering well is in the company’s own interest.

What a company can prepare now. These are suggestions, not requirements.

• Legal entity details, the Legal Entity Identifier (LEI) if you have one, and your sector code
• The addresses and main uses of your key sites
• Energy and fuel use for the last reporting year
• Emissions data, if you measure it. If not, a note that you do not
• Any climate or sustainability policy or plan, even a short one
• Evidence such as certificates, permits and policies, saved in one place

The data problem

Because each bank chooses its own data points, a company with three banks can receive three questionnaires, in three formats, with overlapping questions. Each answer has to be looked up and entered again. For the bank, the picture is just as uneven: answers arrive in different formats, with different levels of quality, and some do not arrive at all.

The rules point to three ways to reduce this.

• Use a common reference. The Guidelines name ESRS and the voluntary SME standard (GL 25). The Commission’s Recommendation of 30 July 2025 goes further and encourages large companies and financial institutions that ask SMEs for sustainability information to base their requests on VSME “wherever possible”.
• Accept documented estimates. Where data is not available, the bank may use estimates or proxies, as long as it documents them (GL 27 and GL 29). A documented estimate is easier for a bank to manage than a blank.
• Engage with the client. The Guidelines list engagement as a source of data (GL 26). A structured, repeatable request works better than an ad hoc email.

A note on the Omnibus value chain cap. The Omnibus amendments to the Corporate Sustainability Reporting Directive (CSRD) limit what companies reporting under the CSRD may ask from business partners with 1,000 or fewer employees: no more than the voluntary standard. According to the law firm Covington, this cap applies to CSRD reporting requests, not to other commercial information exchanges. In our reading, a bank’s request under the EBA Guidelines is a prudential matter and not CSRD reporting, so neither side should assume the cap applies to it. Legal advice is the right step before relying on either reading.

A worked example: one company, three banks

The example below is illustrative. It does not describe a real client, and the details are chosen only to show the mechanism.

A manufacturer with two sites and a bank loan at each of three banks receives three requests in the same quarter.

Three things go wrong. The same emissions figure is entered three times. Each bank defines the boundary slightly differently, so the company has to check which number belongs where. And nobody records whether a figure was measured or estimated.

With a shared record, the company enters its emissions once, attaches the calculation, and marks the figure as measured or estimated. Each bank receives the part it asked for, in its own structure, with the status and the evidence attached. If a bank later adds a question, the company answers only the new part.

The company’s work falls from three requests to one record plus small additions. The banks do not give up anything: each still chooses its own questions and applies its own score.

Answer once, reuse everywhere

A company enters each piece of information once. The platform maps it to the standards that ask for it, so the same answer can serve a bank request, a VSME report and, later, other frameworks.

This only works if the mapping is honest about its limits. Our own crosswalk compares the 178 bank data points with four standards. Most links are partial, which means the standard asks for something close, but not identical.

Three points on reading the table:

• The Guidelines name ESRS and VSME. They do not mention GRI or ISSB. Those two are a convenience for companies that already report under them, not something the bank can require.
• 105 of the 178 mappings are links we proposed that are not yet validated against the field lists of each standard. We present the numbers as indicative. The ESRS counts may change once the data points are mapped to the revised ESRS, described below.
• A partial fit still saves work. The company reuses the underlying data and adjusts the wording or the scope, instead of starting from a blank form.

The result for the company is less repeated effort. The result for the bank is data that arrives in a consistent structure, with the standard it came from recorded.

How the bank keeps its own judgement

A shared data structure does not mean a shared score. The Guidelines expect each bank to integrate ESG risks into its own risk framework, and each bank owns its methodology.

In practice this means a clear split:

Two banks can receive the same answers from the same company and reach different conclusions. Their risk appetite and their portfolios differ.

The data layer does not produce a rating, a probability of default or a credit decision. Keeping that line clear leaves the bank accountable for its own models.

How it works in practice

The company holds the pen on its own answers. The shared layer records what was shared, with whom and when. The bank works only on what it has been given. The flow is our design and simplifies a longer process. The five points below group the eight steps.

• Invite and onboard. The bank invites the client. The company accepts and sets up its users.
• Fill, attach, check. The company answers once, attaches evidence, and the platform checks the quality of each answer.
• Consent and share. The company chooses what to share and with which bank. The shared layer keeps a record of each share.
• Receive, score, monitor. The bank receives the data and applies its own rules. It monitors the client over time and engages where there are gaps.
• Refresh. The company updates its answers, and the bank sees the change.

Data quality and gaps

No company will answer every question at first. What matters is that the bank can tell the difference between a fact, an estimate and a gap. Every answer in our design carries one of three statuses.

This follows GL 27, which asks banks to document remediating actions, including estimates and proxies. The statuses and record types are our design.

Three habits make the difference:

• Mark estimates as estimates, on both sides.
• Record why an answer is missing. “Not applicable” and “declined” lead to different follow-ups.
• Plan to improve over time. A gap marked open today should shrink at the next refresh.

Questions we hear

Do we have to answer our bank’s questionnaire? The Guidelines apply to banks and place no direct legal duty on companies. Your loan agreement may contain its own information obligations, so check it. If you do not answer, the bank has to use proxies and has a less accurate picture of you.

Is the voluntary SME standard (VSME) enough for the bank? The Guidelines name it as a reference (GL 25), and the Commission encourages banks to base requests to SMEs on it. But each bank chooses its own data points, and not every one has a VSME equivalent. In our indicative crosswalk, 10 of the 178 bank data points are a full fit with VSME and 48 a partial fit.

We report under GRI. Does that help? The Guidelines do not name GRI, so a bank cannot require it. Your GRI data can still be reused as a source for answers. In our indicative crosswalk, 11 data points are a full fit with GRI and 55 a partial fit.

What if we do not measure our emissions? Answer “I do not know” where the question allows it, and add what you do have, for example energy and fuel use. The bank can then apply a documented proxy. Starting to measure is the better answer over time.

Will every bank ask the same questions? No. For large corporate clients the Guidelines list the data points a bank should consider (GL 28). For other clients the bank chooses (GL 29). Expect differences between banks, and between client groups at the same bank.

Does the data layer decide anything about credit? No. It collects, structures and keeps the record. Rating, scoring and credit decisions stay with the bank.

What the simplification changes, and what it does not

Much of the 2026 news is about cutting bank reporting. It is easy to conclude that banks will ask clients for less. The sources point to a more careful picture, because three different layers are involved.

In our reading, three consequences follow.

• Fewer templates need not mean fewer questions. The Guidelines’ data expectations sit in internal risk management, not in the reporting templates.
• The questions may narrow towards what the templates keep or add: sector, location, physical exposure and emissions.
• Data quality will matter more. According to Forvis Mazars’ summary of its priorities for 2026 to 2028, the ECB will look more closely at ESG data quality, taxonomy alignment and Pillar 3 disclosures.

In our reading, a bank that simplifies its reporting without simplifying its data collection will still ask clients for the same things. A company that keeps one structured record is in a good position whichever way the templates move.

What comes in 2027

Four items matter for both sides. The last one changes what companies can be asked.

• 11 January 2027. The latest date for small and non-complex institutions to apply the Guidelines. The EBA Guidelines on environmental scenario analysis (EBA/GL/2025/04) also apply to ECB-supervised banks.
• 1 January 2027. The revised, simplified ESRS apply to financial years beginning on or after this date, with first reports in 2028. According to Linklaters, the Commission’s delegated regulation was published in the Official Journal on 21 September 2026 and enters into force on 10 November 2026. For financial year 2026, companies in scope may use the existing ESRS, the existing ESRS with the new reliefs, or the revised ESRS in full, and must say which they applied.
• 19 March 2027. The deadline for Member States to transpose the CSRD changes.
• From financial years beginning on or after 1 January 2027. According to Linklaters, the value chain cap in the voluntary standard’s delegated regulation starts to apply. Companies that must report under the CSRD cannot require more than a short list of information from business partners with 1,000 or fewer employees. The cap covers only information gathered for the requester’s own CSRD reporting.

More dates to watch. These affect what banks will want from clients, and when.

• 31 December 2026. Reference date for the revised Pillar 3 ESG disclosures of institutions other than small and non-complex ones, subject to the Commission’s further work.
• 2027. The EU-wide EBA stress test, with a climate risk module that does not affect the core results. The EBA published draft materials on 12 June 2026. According to Forvis Mazars’ summary of the ECB’s priorities, the 2027 cycle would require climate analysis at a granular, counterparty level.
• September 2027. Proposed start of the EBA’s simplified ESG supervisory reporting, subject to the Commission.
• 31 December 2027. Reference date for the Pillar 3 ESG disclosures of small and non-complex institutions.
• No date in the sources. The ECB has said it will launch a thematic review of prudential transition planning under Article 87a of CRD.

Which ESRS? The Guidelines refer to the ESRS without naming a version. The revised ESRS aim to reduce the number of mandatory data points. In our reading, the reference list for large companies may therefore move, and during the transition the same answer may need to map to two versions. This is another reason to store each answer once and map it to the standards that ask for it.

What banks can do now

These are suggestions, not requirements.

• Write the policy for “other counterparties”. The Guidelines leave the definition open (GL 29). Decide which clients fall in which group and which data points apply to each, and record why.
• Use a common reference for the questions. Basing questions on the ESRS or the voluntary SME standard lets clients reuse answers and lets you record which standard each answer came from.
• Accept and label estimates. Define how proxies are documented (GL 27), and keep facts, estimates and gaps apart in your records.
• Keep the data layer separate from the score. Collect in a shared structure, then apply your own weights, thresholds and red flags.
• Plan the refresh. Agree a cycle for updating answers and a way to follow up on open gaps.

A practical path to 11 January 2027. The table below is a suggestion for smaller banks and their clients, and can be adapted to your own supervisor’s date.

In short

The EBA ESG rules apply now, and the questions reach companies through their banks. Banks decide what to ask, and most will ask differently. A shared way to collect the data lets the company answer once and lets the bank keep its own judgement.