ESG risk plan: targets, metrics and governance

Credit institutions have had to maintain a plan for managing sustainability risks since April 2026, and insurers will from January 2027. It calls for targets that can be quantified and metrics that show whether you are making progress. The name and the legal basis differ by sector; what the plan has to deliver does not. It needs data that holds up to scrutiny and a target path reaching far beyond the usual planning horizon. And it needs governance in which decisions are recorded rather than merely discussed.

What the plan is called in your sector

Credit institutions: ESG risk plan under Section 26d KWG. Germany transposed CRD VI on 30 March 2026 through the BRUBEG, its act implementing the EU banking package and cutting administrative burden. Since 1 April 2026, ESG risks have been written into the German Banking Act (KWG). The plan needs quantifiable targets and metrics across short, medium and long time horizons, with the long horizon covering at least ten years. Small and non-complex institutions may express their targets qualitatively and may limit the plan to environmental and climate risks until the end of 2029.

Alongside this come the EBA Guidelines on the management of ESG risks, which have applied since 11 January 2026, and the ninth amendment to MaRisk, BaFin's minimum requirements for risk management, published on 30 June 2026 with a transition period ending on 1 January 2027.

Insurers: sustainability risk plan under Section 26a VAG. The equivalent under insurance law arises from the Solvency II review, that is amending Directive (EU) 2025/2, which applies from 30 January 2027. Here too the targets must be quantifiable. The plan has to be methodologically consistent with the ORSA and is disclosed annually in the Solvency and Financial Condition Report.

Asset managers and management companies: There is no plan prescribed by name for them. Sustainability risks have had to be reflected in organisational arrangements and risk management since 1 August 2022, for AIFMs through Delegated Regulation (EU) 2021/1255 and for UCITS through Delegated Directive (EU) 2021/1270. SFDR disclosure applies on top. Where the company belongs to a banking group, the plan requirement bites at group level.

How this differs from a transition plan

The two plans exist side by side, and credit institutions and insurers alike need both. The ESG risk plan serves risk management. It is written for the institution and its supervisor, it is not a disclosure instrument, and nothing in it obliges you to exit emission-intensive sectors. The transition plan under ESRS E1-1, by contrast, sets out how your business model becomes compatible with climate targets, and it is written for the public. The EBA expects the two to be consistent and expects institutions to reuse information they already hold rather than collecting it twice.

The plan feeds into your capital requirement

For institutions, the quality of the planning feeds into the Supervisory Review and Evaluation Process (SREP). Methodological gaps therefore work their way through to the capital requirement. BaFin and the Bundesbank have also made ESG risks a supervisory priority in the National Supervisory Programme for 2026 to 2028.

The Deutsche Bundesbank's Monthly Report of April 2026 shows how far many institutions still have to go. Only a minority measure their financed emissions, and just as few describe concrete transition pathways. Credible targets depend on both. Some institutions still work with horizons of less than ten years, and stress test results rarely find their way back into business and risk strategy.

Our services

Gap analysis against the requirements that apply to you: We assess your existing plan against the basis that governs you, for institutions Sections 26c and 26d KWG, the EBA Guidelines and the new MaRisk, for insurers Solvency II and the VAG. You end up knowing which gaps would stand out in an examination.
Targets and metrics: Starting from your transition pathway, we derive quantifiable targets across all required horizons and underpin them with metrics that reflect how you actually steer the business.
Data basis and financed emissions: We build the calculation of financed and insured emissions to the PCAF standard, from sourcing the data within your lending and investment processes through to classification along the PCAF data quality scores.
Governance and roles: We anchor the plan in your risk appetite and clarify who is responsible for what across the management board, risk controlling, the investment function and the business units, so that what you end up with are documented steering decisions.

Consistency between risk plan and transition plan: Your risk plan, transition plan, ICAAP or ORSA and disclosures should rest on the same scenarios, assumptions and time horizons. We reconcile them and record the differences that are justified on the merits.

Audit-ready documentation: We record assumptions, data sources and methodological decisions so that supervisors, internal audit and your external auditor can follow them, including after people move on.

Whether you are a credit institution, an insurer or a management company, we will work out with you where your plan stands against the new requirements and which step makes sense next.

ESG risk plan: targets, metrics and governance

​