ESG risks have moved decisively into the core of prudential supervision. Banks are expected to treat Environmental, Social and Governance (ESG) factors as risk drivers that must be identified, measured, managed and monitored alongside traditional financial risks, and embedded into governance, risk management and capital planning frameworks.
The revised EU Banking Package – CRR III and CRD VI – positions ESG risks across all three pillars of prudential supervision:
Minimum capital requirements
As ESG risks change banks' risk profile, minimum capital requirements will progressively factor:
- Possible privileging of sustainable financial products (e.g. ISF and similar factors)
- Integration into internal models to capture ESG risk drivers
- Penalising factors for exposures prone to negative impacts from ESG risks
Banking supervision and risk management
Necessary consideration of ESG risks in:
- Business strategy & organisation
- Risk Management practices (e.g. ICAAP/ILAAP, scenario analysis and stress testing, risk pricing, etc.)
- Supervisory Review and Evaluation Process (SREP)
Reporting and disclosure
Necessary integration of ESG or sustainability indicators for reporting and disclosure purposes:
- Environment (e.g., emission reduction
- Social (e.g., labour law standards)
- Governance (e.g., prevention of corruption)
Key prudential framework elements and their implementation in Luxembourg
Across EU the integration of ESG risks into prudential supervision is progressing rapidly and Luxembourg is taking steps to ensure alignment. Key framework elements and the respective implementation dates are as follows:
The CSSF is gradually adopting the EU-level requirements being mindful of impacts on various types of institutions.
Where actions should be prioritised
Banks are operating in a fast‑moving and increasingly demanding prudential environment for ESG risks. The key challenge is not whether ESG is considered, but whether it is integrated end‑to‑end into governance, decision-making and the risk management cycle with sufficient depth, evidence and decision impact. ESG risk management is widely recognised as iterative and wide‑ranging, requiring progressive enhancement of scope (including areas such as nature and biodiversity), data feeds and methodological sophistication – supported by robust analysis and clear justification. Data limitations remain a structural constraint: institutions are expected to close data gaps and improve usability so that effort shifts from collection and quality assurance towards analytics and decision support.
Scenario analysis and stress testing are consistently highlighted as a frontier: translating climate scenarios into quantitative impacts on portfolios, capital and liquidity remains complex, and meaningful integration into ICAAP/ILAAP requires further methodological development and sustained collaboration between risk, finance and business functions.
There is still a lot to do for Banks. Taken together, the near-term priorities for banks span five areas:
- ESG risk-assessment maturity should be upgraded progressively – in scope (for example nature and biodiversity), data feeds and methodological sophistication.
- Information availability, quality and usability remain decisive: navigating complex ESG notions and taking informed decisions means closing the data gap, and doing so in the Omnibus-adjusted environment, so that more time is spent on analytics than on collection and quality assurance.
- Scenario analysis and stress-testing methodologies need to become robust and data-driven rather than reliant on prevailing expert judgement, with further progress required on integration into ICAAP/ILAAP.
- Banks should develop risk-based prudential transition plans that factor in the financial effects on future business performance.
- With the EBA having issued further guidance on prudential reporting and disclosures for ESG risks (Pillar III), institutions should be ready to produce high-quality information consistent with any other sustainability driven materials and reports.
Enforcement signals and supervisory pressure
Supervisory scrutiny is also becoming more evidence‑driven, with recurring focus areas that go beyond policy intent and into demonstrable practice. Supervisors have raised concerns where banks cannot evidence:
- coverage of all material risks and key portfolios,
- forward‑looking projections across short, medium and long‑term horizons (including beyond a 10‑year horizon in climate stress testing and materiality assessment),
- consistency of methodologies across exercises (for example, transition and physical risk approaches), and
- broad, well‑documented data coverage and granularity, including clear explanation of data gaps and proxies.
They also expect evidence that results from ESG assessments and stress tests are actually influencing the ESG strategy and framework and broader management decisions – supported by formal documentation and governance, including a formally approved “business environment scan” where required.
The ECB has already issued penalties linked to deficiencies in climate risk management, and regulators have reaffirmed ESG risk management as a core prudential priority for banks, including through targeted inspections on governance and credit risk with increasing ESG emphasis.
In Luxembourg, the CSSF has reaffirmed in its latest supervisory priorities that ESG risk management remains a core prudential focus for banks. The supervisor will continue targeted inspections on governance and credit risk — increasingly embedding ESG aspects — and may conduct inspections specifically focused on ESG risks.
How PwC Luxembourg can support
PwC Luxembourg supports banks in turning prudential ESG requirements into implementable change – covering ESG risk identification and materiality assessment, scenario analysis and stress testing, development of mitigation strategies and transition planning, the design of measurable KRIs and KPIs, and ongoing monitoring and reporting solutions.
materiality assessment
monitoring
- Map relevant transmission channels (both financial risk and non-financial risks)
- Collect feedback from various stakeholders across 3 lines of defence
- Ensure coherence with other exercises (e.g. CSRD or ISSB driven disclosures)
- Design / validate CR&E risk quantification approaches
- Select relevant scenario narratives and trajectories
- Sensitivity analysis to various CR&E risk drivers
- Portfolio-level heat-mapping and concentrations analysis
- Exposure- and process-level vulnerability analysis
- CR&E risks stress testing approaches and scenarios design (ICAAP / ILAAP)
- Definition of monitoring KRIs and targets
- Integration into risk appetite framework and internal reporting
- Prudential reporting and disclosures support (set-up, quality assurance, delivery)
- Lending / investment policies, processes and strategies
- Insurance covers optimisation
- Business continuity and third parties management
- Business model resilience analysis based on a set of scenarios
- GHG baselining
- Transition plans (set-up, quality assurance, delivery)
elements
- Training & capacity building
- Underlying data & technology
- Structured stakeholders engagement
- Governance and processes optimisation
- Policy framework enhancement
- Benchmarking with market practices
