Sustainability in 2026: A regulatory outlook

Developed in collaboration with
The Payments Association’s ESG Working Group

This report maps immediate and near-term ESG regulatory deadlines affecting payments and financial services firms between March and December 2026, providing actionable guidance on compliance obligations across UK and EU jurisdictions as climate risk transitions from voluntary disclosure to core prudential supervision backed by civil liability and enforcement penalties.

Introduction

Introduction from our Working Group Lead

This report reflects the regulatory landscape and supervisory expectations as of March 2026. ESG regulation continues to evolve rapidly across the UK and EU. Firms must rely on the most current legislative texts, consultations, policy statements and supervisory guidance when applying any frameworks referenced herein, as implementation timelines and supervisory expectations remain subject to revision.

This introduction draws on the collective insight of The Payments Association ESG Working Group, informed by engagement across the payments and financial services ecosystem. It signals a decisive shift for our sector and highlights the scale of the responsible business opportunity emerging alongside regulatory reform.

Across the UK and EU, ESG has moved from voluntary alignment to mandatory disclosure, supervisory scrutiny and enforceable standards. For payments firms, this represents a structural reset. ESG now directly influences capital allocation, counterparty assessment, procurement outcomes and board-level risk oversight. It is no longer a reporting exercise; it is integral to market access and competitive positioning. Firms that treat ESG as peripheral increase their exposure to regulatory friction, reputational scrutiny, and constrained access to capital, and may face exclusion from bids, partnerships, and institutional supply chains where governance and transparency are baseline requirements. Those that integrate ESG strategically strengthen resilience, credibility and long-term enterprise value. In an increasingly scrutinised global marketplace, credible ESG integration will differentiate UK payments firms in securing cross-border partnerships, institutional capital and public sector mandates.

The report outlines key milestones between March and December 2026, translating complex policy developments into board-level priorities. Climate-related financial risk is embedded within prudential supervision, requiring credible transition planning and demonstrable governance maturity. Reporting frameworks are converging through UK endorsement of the ISSB standards and the publication of the UK SRS, while EU reforms under Omnibus I streamline CSRD implementation without weakening transparency expectations. ESG ratings providers are moving into formal oversight, and sector standards now clarify expectations around financed emissions and CSDDD value chain due diligence. Together, these developments are reshaping operating expectations across financial services.

The UK approach remains proportionate and consultation-led, with major consultations closing in Q1 2026 and policy statements expected in H2 2026. EU regulation continues to evolve through negotiation and national implementation, creating interim complexity that demands active management. This is not a temporary compliance cycle; it is a recalibration of supervisory expectations and market discipline.

This document is designed to move leadership teams from awareness to execution. Acting early to strengthen governance, improve data integrity and align strategy with emerging standards will not only manage regulatory risk but also reinforce resilience and long-term value. Delay will increase cost, compress timelines and reduce strategic flexibility.

Charlie Bronks, Head of Responsible Business, Crown Agents Bank & TPA ESG Working Group Lead.

Foreword from our ESG Working Group Mentor

“This report stems from a firm belief that the payments industry has both the responsibility and the opportunity to drive meaningful progress on sustainability, diversity and inclusion. Through the collaborative efforts of The Payments Association ESG working group, we hope this regulatory map will encourage organisations to take practical, informed steps to measure their environmental impact and reduce the risk and harm to our climate. It is encouraging to see the industry progressing on carbon emissions management ahead of formal regulatory direction—reflecting a genuine willingness to lead rather than wait. Our ambition is clear: to ensure the industry we are building today grows in resilience and sustainability, enabling future generations to thrive. I would encourage every organisation in the payments ecosystem to use this report as a map to begin managing and reducing their environmental impact ahead of regulatory intervention. If you have thoughts, ideas, or challenges to share, we welcome them—constructive debate will be essential to building the momentum we need.”

Willem Wellinghoff
CCO and UK chair, Ecommpay & TPA ESG WG Mentor.

Regulation timeline

Payments firms face a series of major ESG regulations between March and December 2026 as climate risk shifts from voluntary disclosure to mandatory compliance with enforcement penalties. However, ESG regulation continues to evolve rapidly. Timelines and requirements remain subject to change as regulators respond to industry feedback and implementation challenges.

Immediate (March 2026 – June 2026)

The UK and EU are implementing comprehensive ESG and climate risk regulations affecting payment firms, though timelines and requirements vary. The FCA now regulates ESG ratings providers, the UK has formally adopted ISSB standards, and the UK SRS has been published for sustainability reporting. The PRA requires board-approved climate risk gap analyses under SS5/25, elevating climate considerations to core prudential standards. In the EU, Omnibus I simplifies ESRS reporting for financial services, including financed emissions and sustainable finance disclosures, without introducing new sector-specific ESRS.

*This information was last updated on 27 February 2026.

UK regulation

CP25/34: ESG ratings: Proposed approach to regulation 

🟥 Urgent, significant impact

The Financial Conduct Authority (FCA) is bringing ESG ratings providers under regulatory oversight for the first time, requiring authorisation from June 2028. This follows government legislation in response to industry concerns about transparency, reliability, and consistency in the ESG ratings market. The regime aims to improve trust in ratings used for capital allocation, risk management and sustainability reporting. For payments firms, ESG ratings are increasingly influencing investment decisions, lending criteria and vendor selection.

Asset managers and benchmark administrators within payment groups will face new requirements when using ESG data. The regulation draws on the International Organisation of Securities Commissions (IOSCO) international standards and the International Capital Market Associations (ICMA) Code of Conduct, creating alignment with global frameworks. Firms using ESG ratings to assess counterparty risk, supply chain sustainability, or to meet their own disclosure obligations should monitor how provider authorisation affects data quality and comparability. The consultation seeks feedback on proportionate rules that support sustainable finance growth whilst addressing market integrity concerns.

Key dates:

  • 31 March 2026: consultation closes
  • Q4 2026: final rules published
  • 29 June 2028: new regime comes into effect
  • ESG ratings providers themselves (must seek FCA authorisation by 29 June 2028)
  • Asset managers and benchmark administrators within payments groups
  • Risk management and credit teams using ESG ratings for counterparty assessment
  • Vendor/supplier management teams relying on ESG data for due diligence
  • Finance and sustainability reporting professionals integrating ESG ratings into disclosures
  • Unauthorised providers face regulatory action post-June 2028
  • Using non-compliant ratings undermines due diligence defence
  • Inconsistent methodologies create greenwashing exposure
  • Provider conflicts of interest compromise data integrity
  • Opaque methodologies risk unsubstantiated ESG claims
  • Respond to consultation by 31 March 2026
  • Map ESG ratings dependencies across business functions
  • Confirm provider authorisation plans with current suppliers
  • Review data validation processes and diversify sources
  • Build implementation roadmap following Q4 2026 policy statement

UK Sustainability Reporting Standards (UK SRS)

🟥 Urgent, significant impact

The UK published the finalised UK SRS S1 (general sustainability disclosures) and UK SRS S2 (climate-related disclosures) for voluntary adoption on 25 February 2026, following the Government’s endorsement of ISSB-aligned sustainability reporting standards. This is set out in the UK Government’s policy page: UK Sustainability Reporting Standards: UK SRS S1 and UK SRS S2.

The FCA is consulting on mandatory requirements for listed and economically significant companies through CP26/5, as described in its consultation paper: CP26/5: Aligning listed issuers’ sustainability disclosures with international standards. This creates a UK-specific implementation pathway, with an initial voluntary adoption period for firms to test disclosure processes before FCA mandates—expected to target larger payment institutions, e-money firms and listed entities.

The FCA’s consultation proposes that UK SRS S2 (climate disclosures) will become mandatory (subject to final rules) for in-scope listed companies for accounting periods beginning on or after 1 January 2027, with Scope 3 emissions following a ‘comply or explain’ approach with transitional relief and broader UK SRS S1 sustainability disclosures phased in with two-year relief. The FCA aims to publish its final policy statement in autumn 2026. For payments firms, this means preparing a sustainability data infrastructure that covers governance, strategy, risk management and metrics aligned with UK SRS requirements. Early adopters may gain a competitive advantage by enhancing their ESG credentials and investor confidence. The voluntary period provides breathing room to address data gaps, establish disclosure controls and train finance teams on sustainability reporting. Importantly, UK SRS S2 includes a first-year exemption from Scope 3 greenhouse gas emissions reporting (including financed emissions for banks and asset managers), giving firms additional time on complex disclosures. Companies should anticipate mandatory adoption for firms above certain revenue or asset thresholds, potentially mirroring CSRD-style tiered implementation.

Key dates:

  • 25 February 2026: Finalised versions of UK SRS S1 and S2 published, alongside consultation response
  • 30 January 2026: FCA opens consultation on aligning listed issuers’ sustainability disclosures with UK SRS.
  • 20 March 2026: FCA Consultation response deadline
  • Autumn 2026: FCA policy statement to be published
  • 1 January 2027: UK SRS rules expected to come into force
  • ESG and sustainability reporting teams in UK payment institutions
  • Finance and accounting teams responsible for data collection and assurance
  • Legal and compliance teams reviewing governance and disclosure obligations
  • IT/data teams supporting ESG data infrastructure and reporting systems
  • Senior management preparing for voluntary adoption ahead of proposed 1 January 2027 mandatory application for listed companies
  • Late preparation creates compressed implementation when FCA mandates requirements
  • Inadequate governance over sustainability data compromises disclosure accuracy
  • Missing the 20 March 2026 FCA consultation deadline removes the opportunity to influence final rules and raise sector-specific concerns
  • Failing to plan for autumn 2026 policy statement delays compliance readiness ahead of the proposed 1 January 2027 mandatory start date
  • Download the final standards published 25 February 2026 from GOV.UK and map disclosure requirements
  • Respond to FCA consultation CP26/5 by 20 March 2026, outlining sector-specific implementation concerns
  • Establish voluntary adoption timeline to test processes before mandates
  • Build sustainability data collection infrastructure across business units
  • Review Scope 3 transitional relief provisions (paragraph C4 of UK SRS S2) to plan which emissions categories to prioritise first

PRA Supervisory Statement SS5/25 – climate-related financial risks

🟥 Urgent, significant impact

The PRA has elevated climate-related risks to core prudential concerns, requiring the same rigour as traditional financial risks. SS5/25 replaces 2019’s SS3/19 with significantly enhanced expectations for governance, risk management, climate scenario analysis and data quality. Firms must complete board-approved gap analyses by 3 June 2026, identifying material climate exposures and developing credible remediation plans with assigned ownership and delivery timelines. This six-month window is not an implementation period—firms must demonstrate early progress when supervisors engage from mid-2026.

For payment firms, this means integrating climate risks into credit assessments, operational resilience planning and capital adequacy frameworks. Physical risks (flooding, storms) affecting payment infrastructure, data centres and merchant portfolios require granular, location-specific analysis. The PRA emphasises proportionality based on risk exposure, not firm size, meaning smaller institutions with concentrated geographical exposures face equivalent scrutiny. Climate scenario analysis must inform risk appetite, sector limits and strategic planning, with impacts visible in board papers and underwriting policies by the June deadline.

Key dates:

  • 3 December 2025: SS5/25 published, replacing SS3/19
  • 3 June 2026: Gap analysis and action plan deadline
  • From June 2026: Supervisory engagement commences
  • From July 2026: Evidence requests commence
  • Risk management teams integrating climate risk into credit, operational, and capital adequacy assessments
  • Finance and treasury professionals assessing exposure to climate-affected assets
  • Board members and senior executives approving gap analyses and action plans
  • Operational resilience and infrastructure teams managing climate-exposed facilities (data centres, terminals)
  • Internal audit and compliance monitoring climate risk reporting
  • Non-compliance triggers direct supervisory intervention and remediation requirements
  • Inadequate board oversight demonstrates governance failure under prudential standards
  • Missing 3 June deadline signals insufficient climate risk management capability
  • Weak data infrastructure prevents credible scenario analysis and stress testing
  • Material climate exposures unquantified compromise capital adequacy assessments
  • Complete internal gap analysis against SS5/25 expectations before 3 June 2026
  • Secure board sign-off on climate risk materiality assessment and action plan
  • Document climate scenario analysis frameworks and update risk appetite statements
  • Build climate data inventory with ownership, lineage and uncertainty documentation
  • Prepare evidence for supervisory requests commencing July 2026

Near-term (H2 2026)

The FCA is extending SDR entity-level reporting to smaller asset managers to strengthen anti-greenwashing supervision. The EU ESG Ratings Regulation now requires ESMA authorisation of providers. The Commission is preparing CSDDD “chain of activities” guidance ahead of the July 2026 deadline, while the adopted CSRD and EU Taxonomy Omnibus I package reduces ESRS datapoints by ~61% and narrows taxonomy reporting to the largest entities. SFDR reforms remain under consultation, proposing structured product categories and clearer sustainability thresholds. The ECB is intensifying climate risk supervision through binding decisions and, where necessary, penalties. Most measures are now in implementation or supervisory phases, with key application dates between 2026 and 2029, though some delegated acts and consultations remain ongoing.

*This information was last updated on 27 February 2026.

UK regulation

FCA Sustainability Disclosure Requirements (SDR)–smaller firms

🟥 URGENT, SIGNIFICANT IMPACT

The FCA extends its SDR entity-level reporting to smaller asset managers from 2 December 2026, following the December 2025 implementation for firms with AUM of £50 billion+. Firms must publish annual sustainability entity reports that detail their governance strategy, risk management, and metrics for managing sustainability-related risks and opportunities. This forms part of the UK’s anti-greenwashing regime, alongside investment labels, naming restrictions, and product-level disclosures that have been in force since July 2024. For payment groups with asset management divisions or wealth management arms, this creates an additional reporting burden beyond Task Force on Climate-related Financial Disclosures (TCFD) requirements.

The regime introduces four voluntary investment labels (sustainability focus, sustainability improvers, sustainability impact, mixed goals) with strict qualifying criteria, whilst restricting unlabelled funds from using sustainability-related terms in names and marketing to retail investors. Entity reports must be published prominently on the main business websites and can be aligned with TCFD reporting periods. The FCA plans to expand into portfolio management, pension products, and overseas funds, creating scope creep. Distributors face obligations to communicate labels accurately and provide access to consumer-facing disclosures, embedding sustainability transparency throughout the investment chain.

Key dates:

  • ESG and sustainability reporting leads in asset management subsidiaries of payment groups
  • Product management and investment teams ensuring investment products meet SDR criteria
  • Marketing and communications teams aligning fund/product disclosures with anti-greenwashing rules
  • Compliance officers overseeing label accuracy and entity-level reporting obligations
  • IT/data teams supporting annual reporting publication on websites
  • Anti-greenwashing rule breach exposes firms to enforcement action across all products
  • Investment label misuse without meeting qualifying criteria creates consumer harm liability
  • Inadequate entity-level governance disclosures demonstrate weak ESG oversight
  • Naming and marketing violations for unlabelled funds using sustainability terms
  • Distributor failures to communicate labels accurately create regulatory censure
  • Prepare entity-level sustainability report covering 12-month period by 2 December 2026
  • Implement governance systems to oversee ESG claims and third-party data providers
  • Review investment product names and marketing materials for anti-greenwashing compliance
  • Establish processes for annual entity report publication on main business website
  • Monitor FCA expansion plans for portfolio management and overseas funds scope

EU regulation

EU ESG ratings regulation effective

🟥 URGENT, SIGNIFICANT IMPACT

The EU has become the first jurisdiction globally to formally regulate ESG ratings providers, requiring European Securities and Markets Authority (ESMA) authorisation or recognition from 2 July 2026. The regulation applies to any entity that professionally issues, publishes, or distributes ESG ratings within the EU, covering ratings of companies, bonds, indices, and other financial instruments. Providers must publicly disclose methodologies, models, and key assumptions, comply with governance principles, and manage conflicts of interest, including ownership restrictions that prevent significant influence across multiple providers.

For payments firms, this affects ESG data used in sustainability disclosures, investment decisions and counterparty assessments. Ratings quality and comparability will improve as providers meet stringent transparency requirements aligned with IOSCO recommendations. Non-EU providers (including UK post-Brexit) face complex market access through equivalence decisions, recognition or endorsement mechanisms, creating potential supply disruption if equivalence determinations stall politically. The regulation amends the Sustainable Finance Disclosure Regulation (SFDR) to require the disclosure of in-house ESG ratings on equal footing with specialist providers, increasing transparency into financial institutions’ proprietary scoring methodologies. Users remain responsible for preventing greenwashing even when relying on authorised ratings.

Key dates:

  • 1 January 2025: Regulation entered into force
  • 2 July 2026: Regulation comes into application
  • 2 August 2026: Large ESG rating providers must notify ESMA
  • 2 November 2026: Small ESG rating providers must notify ESMA
  • ESG ratings providers in the EU seeking ESMA authorisation
  • Payments firms relying on ESG data for investment, risk, or supplier assessment
  • Risk management and sustainability reporting teams ensuring methodologies meet transparency standards
  • Procurement teams assessing ESG risks of vendors and counterparties using authorised ratings
  • Legal/compliance professionals monitoring due diligence gaps from non-EU provider dependencies
  • Unauthorised ESG rating provision after July 2026 triggers enforcement action
  • Non-EU provider market access depends on equivalence decisions subject to political delay
  • Conflicts of interest through ownership structures violate provider independence requirements
  • Inadequate methodology disclosure fails transparency obligations
  • Relying on unregulated ratings post-July 2026 creates due diligence gaps
  • Identify ESG ratings dependencies across investment and risk management processes
  • Confirm provider ESMA authorisation or recognition status before July 2026
  • Review in-house ESG scoring methodologies for SFDR disclosure requirements
  • Establish alternative ratings sources to mitigate non-EU provider access risks

Corporate Sustainability Due Diligence Directive (CSDDD)

🟧 uncertain timing/impact

The CSDDD mandates comprehensive human rights and environmental due diligence across companies’ value chains, implementing the UN Guiding Principles on Business and Human Rights as a binding legal obligation within the EU. The Commission will publish guidance by 26 July 2026 covering identification processes, impact prioritisation, purchasing practice adaptation, remediation mechanisms, stakeholder engagement and climate transition plans. This guidance is intended to provide critical implementation support ahead of member state transposition.

For payment firms, implications depend on size and merchant/supplier relationships. The Commission must report by July 2026 on whether additional due diligence requirements should apply specifically to regulated financial undertakings in relation to financial services and investment activities. This is a review requirement rather than an automatic extension of scope, but it creates regulatory uncertainty for financial services firms. Payment companies with large merchant portfolios may face indirect exposure through business partner relationships, requiring risk-based due diligence on adverse impacts within their “chain of activities.”

The directive provides for civil liability where companies intentionally or negligently fail to comply with due diligence obligations and damage occurs as a result. Liability may extend to harm caused by subsidiaries or business partners where the company failed to take appropriate preventive or remedial measures. Trade unions and civil society organisations may bring representative actions on behalf of affected parties, increasing litigation and reputational risk beyond administrative enforcement.

Application will be phased, beginning with the largest in-scope entities before extending to other qualifying companies.

Key dates:

  • 25 July 2024: Directive entered into force
  • 26 July 2026: Commission guidance publication deadline
  • 26 July 2028: Member state transposition deadline
  • 26 July 2029: Application of due diligence requirements on in-scope entities
  • 1 January 2030: Publication of due diligence statement for financial years beginning on or after this date for in-scope entities
  • Senior management and board overseeing value chain due diligence
  • Procurement and vendor management teams identifying high-risk suppliers
  • ESG/sustainability teams assessing environmental and human rights impacts across suppliers and merchants
  • Legal teams evaluating civil liability exposure and grievance mechanisms
  • Operations teams integrating due diligence into supplier onboarding and monitoring
  • Civil liability exposure for adverse human rights or environmental impacts in value chain
  • Joint and several liability with subsidiaries or business partners for due diligence failures
  • Administrative fines and compliance orders from national supervisory authorities
  • Collective redress actions by trade unions or civil society on behalf of victims
  • Public procurement exclusion criteria for non-compliant companies
  • Monitor July 2026 Commission guidance publication for implementation frameworks
  • Conduct gap analysis against OECD Due Diligence Guidance for Responsible Business Conduct
  • Map value chain relationships to identify direct and indirect business partner exposures
  • Establish grievance mechanisms for stakeholders affected by operations or value chain

CSRD/EU taxonomy omnibus simplification

🟧 uncertain timing/impact

The EU’s Omnibus I simplification package has now been formally adopted and published, substantially reducing Corporate Sustainability Reporting Directive (CSRD) and EU Taxonomy reporting burdens following industry pressure to cut administrative costs. EU Taxonomy reporting is now limited to the largest companies (1,000+ employees and €450 million+ turnover), with a voluntary opt-in regime for smaller CSRD-scoped entities. Activities below the 10% materiality threshold are exempt from detailed Taxonomy alignment assessments, eliminating reporting for non-financially material economic activities.

The simplified ESRS framework reduces datapoints by approximately 61% overall (64% for non-financial entities and 89% for financial entities), removing less decision-useful disclosures while preserving core sustainability information.

For payment firms, this means fewer mandatory disclosures when they fall below the revised thresholds, reduced value-chain data-collection requirements from SME suppliers, and streamlined reporting templates. Member States must transpose the Directive within 12 months of its entry into force following publication in the Official Journal (February 2026), creating a transitional implementation window across 2026–2027. Companies already reporting under wave one benefit from immediate relief through simplified templates and expanded materiality exemptions.

The package confirms that no sector-specific ESRS standards will be developed and maintains the limited assurance requirement, without progression to reasonable assurance at this stage, reducing the risk of further near-term compliance escalation.

Key dates:

  • 26 February 2025: Commission Omnibus I proposals published
  • 9 December 2025: Provisional agreement reached
  • 24 February 2026: Council signs off on Omnibus I proposals
  • 26 February 2026: Omnibus I Directive published in the Official Journal
  • Summer 2026: Simplified ESRS delegated act adoption expected
  • 1 January 2027: EU company/ group reporting for the financial year 2027 applies, with reporting due in 2028, with non-EU companies/ groups to follow a year later
  • Finance and ESG reporting teams preparing simplified disclosures for large EU payment institutions
  • Compliance officers ensuring proper application of 10% materiality thresholds
  • Procurement teams adjusting data collection requirements from SME suppliers
  • IT/data teams updating reporting platforms to accommodate simplified ESRS templates
  • Transitional uncertainty during 12-month member state transposition period
  • Misapplying 10% materiality threshold creates taxonomy alignment errors
  • Simplified standards misinterpreted as reduced quality expectations damage credibility
  • Opt-in taxonomy reporting creates competitive disclosure disparities
  • Member state implementation variations fragment reporting consistency across EU
  • Monitor March 2026 Official Journal publication for final legislative text
  • Reassess taxonomy reporting obligations against revised thresholds and materiality criteria
  • Prepare for simplified ESRS application from financial year 2027 onwards
  • Review value chain data collection processes following SME relief provisionsW

SFDR reform consultation

🟩 Long-term/indicative

The SFDR 2.0 proposal fundamentally restructures EU sustainable finance disclosure from a transparency regime into a product categorisation system. Five new categories are included: Transition Products (Article 7), ESG Basics (Article 8), Sustainable Products (Article 9), Combination Products (Article 9a), and Non-Categorised Products (Article 6a). Each category imposes mandatory minimum investment thresholds of 70%, exclusions, and permitted investment types, replacing the current Articles 6/8/9 framework.

Financial advisers and portfolio management services are removed from the scope entirely, narrowing obligations to product manufacturers. Entity-level principal adverse impact (PAI) reporting is eliminated; PAI disclosures are now required only at the product level for the Transition and Sustainable categories, reducing administrative burden. Reform addresses market criticism of SFDR’s complexity, the risk of greenwashing in its quasi-labelling system, and duplication with CSRD requirements. For payment firms with investment management subsidiaries or ESG-linked products, trilogue negotiations throughout 2026 create strategic uncertainty regarding category threshold decisions, product development roadmaps, and the permissibility of marketing claims. Implementation likely late 2028, following an 18-month adoption period.

Key dates:

  • 20 November 2025: Commission published SFDR 2.0 proposal
  • Ongoing 2026: Trilogue negotiations (Parliament, Council, Commission)
  • Expected implementation: 18 months after final adoption (likely late 2028)
  • Start-up period: 2027-2028
  • Product development teams managing ESG-linked investment products
  • Compliance officers interpreting product categorisation rules and marketing restrictions
  • Portfolio managers and fund managers adjusting investment allocations to meet 70% thresholds
  • ESG reporting teams updating methodologies for product-level PAI reporting
  • Legal teams monitoring ongoing EU trilogue negotiations for regulatory clarity
  • Trilogue negotiations create regulatory uncertainty on final category criteria and thresholds throughout 2026
  • Product categorisation decisions require 70% minimum investment commitments with potential lock-in effects
  • Non-categorised products face strict marketing restrictions preventing any ESG claims
  • Data governance and methodology documentation requirements for estimates lack detailed implementing standards
  • Potential misalignment between SFDR 2.0 categories and existing CSRD/taxonomy disclosure obligations
  • Monitor trilogue negotiations and institutional positions on category criteria through 2026
  • Conduct gap analysis of existing Article 8/9 funds against proposed category thresholds and exclusions
  • Review ESG product marketing materials for compliance with new claim restrictions for non-categorised products
  • Establish data governance frameworks for formalised estimate methodologies and documentation requirements
  • Engage with trade associations on implementation concerns during legislative process

UK government endorsement of ISSB standards

🟩 Long-term/indicative​

The UK has formally endorsed International Sustainability Standards Board (ISSB) standards, established at COP26 to create a global baseline for sustainability reporting. Following the Government’s endorsement on 25 February 2026, the UK is now positioned within an international framework already adopted across jurisdictions, including Australia, Brazil, Canada, Japan and Singapore, enabling cross-border comparability for investors. For payments firms operating internationally, UK endorsement means alignment with global parent company reporting, simplified multi-jurisdictional compliance and consistent investor expectations across markets.

The ISSB’s IFRS S1 (general sustainability) and S2 (climate) standards focus on financially material sustainability information, mirroring how IFRS accounting standards created international financial reporting consistency. Multinational payment groups can harmonise sustainability disclosures across subsidiaries rather than managing fragmented national requirements. This reduces compliance costs and improves capital market access. UK endorsement reinforces its commitment to sustainable finance leadership and is likely to influence EU, US and Asian regulatory convergence. Firms with international operations should now prepare for the implementation and aligned disclosure expectations across major financial centres.

Key dates:

  • 25 February 2026: UK Government endorses IFRS Sustainability Disclosure Standards
  • 26 June 2023: IFRS S1 and S2 published by ISSB
  • Sustainability reporting leads and ESG teams in multinational payment groups
  • Finance and accounting professionals aligning disclosures with IFRS-based ISSB standards
  • Compliance officers monitoring cross-border sustainability reporting obligations
  • Corporate strategy and investor relations teams coordinating harmonised disclosures
  • Divergence from global ISSB baseline creates multinational compliance complexity
  • Delayed UK adoption disadvantages access to ESG-focused international capital
  • Inconsistent cross-border disclosures expose governance weaknesses to global investors
  • Non-alignment with parent company jurisdictions duplicates reporting requirements
  • Late preparation limits participation in international sustainable finance markets
  • Review international operations for jurisdictions already adopting ISSB standards
  • Align group-level sustainability reporting frameworks with global ISSB baseline
  • Engage global parent companies on harmonised disclosure approach
  • Monitor international ISSB developments for future standard additions

ECB climate risk supervision

🟥 URGENT, SIGNIFICANT IMPACT

The ECB has shifted from climate risk remediation to active enforcement. This marks a fundamental change in supervisory approach. Following the 2022 climate stress test and thematic review, the ECB now issues binding decisions backed by periodic penalty payments. These apply to non-compliance with climate risk management expectations set out in its 2020 guide. Supervisory priorities for 2026-2028 emphasise continuous follow-up on remaining shortcomings. Key activities include a thematic review of transition planning aligned with CRD 6 amendments, a horizontal assessment of Pillar 3 ESG disclosure compliance, and an in-depth analysis of physical risk capabilities.

Ninety per cent of surveyed banks now assess themselves as materially exposed to climate and nature risks, up from 50% in 2021. For payment institutions and banks, climate risk is now a core prudential concern integrated into SREP cycles, capital planning, and operational acts. Physical climate disasters are increasing in frequency, indicating a persistent, unidirectional shock that requires quantitative integration beyond disclosure compliance.

Key dates:

  • Ongoing 2026-2028: continuous supervisory activity under new priorities
  • 11 January 2026: CRD 6 transition planning requirements effective
  • November 2025: first climate-related enforcement penalty imposed (€187,650)
  • Risk management teams integrating climate risk into SREP cycles and capital planning
  • Finance teams adjusting stress-testing models for physical and transition risks
  • Senior management ensuring compliance with CRD 6 and ECB enforcement decisions
  • Operations teams managing climate-exposed infrastructure (data centres, terminals)
  • Internal audit and compliance teams preparing evidence for ongoing supervisory engagement
  • Periodic penalty payments for non-compliance with binding supervisory decisions (€187,650 ABANCA precedent)
  • SREP qualitative requirements and operational acts imposed for persistent climate risk weaknesses
  • Fitness and propriety challenges for senior management failing to establish adequate climate practices
  • Pillar 3 ESG disclosure deficiencies subject to horizontal supervisory assessment and enforcement
  • Legal challenges complex where soft-law expectations (ECB guidance, EBA guidelines) embedded in binding individual decisions
  • Complete CRD 6 transition planning requirements by 11 January 2026 deadline to avoid targeted thematic review findings
  • Remediate outstanding shortcomings from 2022 climate stress test and thematic review before enforcement escalation
  • Enhance physical risk modelling capabilities ahead of targeted deep-dive supervisory reviews
  • Implement comprehensive climate risk governance frameworks integrated into ICAAP and stress testing
  • Monitor 2026 SREP cycle for climate-related binding decisions and prepare coordinated governance, compliance, and legal response strategies

Members in Focus - MY EU PAY on ESG Regulatory Integration

Sarah Dees, CEO, MY EU PAY

ESG regulation is accelerating across the EU, but the real challenge for payment institutions is understanding how these frameworks interconnect and create compounding compliance obligations. In this episode, Sarah Dees explains the practical issues payments firms must address to navigate the shift from voluntary disclosure to mandatory accountability with civil liability exposure.

  • Firms are moving from isolated ESG reporting to integrated value chain management, but regulators expect comprehensive due diligence, transparent methodology and demonstrable progress on climate risk action plans.
  • Payment institutions face unique challenges around supply chain visibility, banking partner emissions and merchant portfolio exposure, where the CSRD-to-CSDDD accountability loop creates both disclosure and enforcement obligations.

Supply chain due diligence

This section examines how CSRD and CSDDD supply chain obligations apply to payments firms, analysing sector-specific exposures in hardware manufacturing and merchant portfolios, alongside practical implementation frameworks for value chain due diligence.

Regulatory context

European payments firms face unprecedented supply chain accountability under two directives reshaping value chain compliance. The Corporate Sustainability Reporting Directive (CSRD) mandates comprehensive upstream and downstream reporting through European Sustainability Reporting Standards (ESRS). With Wave 1 companies—large banks, listed firms, and insurers with 500+ employees—disclosing their first supply chain impacts in 2025 based on 2024 data. The directive’s double materiality principle requires firms to report how their entire value chain affects both financial performance and societal impact, with particular emphasis on Scope 3 emissions representing suppliers, logistics, and end-of-life activities.

The Corporate Sustainability Due Diligence Directive (CSDDD) establishes direct civil liability for adverse impacts across corporate “chains of activities”—covering own operations and business partner relationships. Following the December 2025 simplification, the directive applies from July 2029 to firms with 5,000+ employees and €1.5 billion+ turnover. Member States transpose by July 2028, with implementing guidance from July 2026. CSDDD’s risk-based approach prioritises Tier 1 supplier due diligence, requiring in-depth assessment of Tier 2+ suppliers only when plausible information indicates severe impacts.

For payments providers, compliance centres on hardware supply chains (conflict minerals in terminals), data centre procurement, and merchant portfolio exposure—where geographic concentration in Asia, limited supplier visibility, and extended manufacturing networks create heightened due diligence obligations and potential civil liability exposure.

Payments industry supply chain exposures

Payments firms face concentrated supply chain risks across four critical exposure areas, where limited visibility and geographic dependencies create heightened compliance challenges under CSRD and CSDDD frameworks.

Hardware manufacturing represents the sector’s primary conflict mineral exposure. Payment terminals, card production, and POS devices depend on tin, tungsten, tantalum, and gold (3TG)—minerals frequently sourced from conflict-affected regions. Industry research reveals 80% of firms cannot trace these materials to their country of origin, creating direct civil liability risk under CSDDD when human rights violations or environmental harm occur in component supply chains. Semiconductor manufacturing, circuit boards, and electronic assemblies embed these minerals throughout payment infrastructure.

Data centre infrastructure procurement introduces substantial upstream emissions exposure. Leading payments providers report that data centres account for approximately 60% of their operational footprint, requiring extensive supply chains for servers, cooling systems, networking hardware, and power infrastructure. While facilities themselves generate Scope 1 and 2 emissions, the manufacturing and transport of this equipment—sourced globally from semiconductor fabs, component manufacturers, and systems integrators—represents significant Scope 3 upstream emissions requiring value chain disclosure under CSRD.

Geographic concentration in Asian manufacturing hubs creates systemic supply chain risk. Over 70% of payment hardware production occurs across China, Taiwan, Vietnam, and Malaysia, exposing firms to multi-tier visibility gaps, extended due diligence timelines, and potential regulatory arbitrage where environmental and labour standards vary significantly from EU requirements.

Merchant portfolio exposure presents unique downstream accountability for acquirers and PSPs. Business relationships with merchants create indirect exposure to customer supply chain impacts—particularly in high-risk sectors like fashion, agriculture, and electronics retail—where CSDDD’s “chain of activities” definition may extend liability to acquirers facilitating transactions for non-compliant merchants.

Key compliance challenges

Payments firms navigating dual CSRD and CSDDD obligations face four systemic barriers that distinguish supply chain compliance from traditional operational reporting.

Scope 3 data gaps represent the sector’s most critical challenge. Value chain emissions typically account for 70-90% of total carbon footprint, yet only 24% of financial services firms currently disclose comprehensive Scope 3 data. For payments providers, this encompasses upstream hardware manufacturing, logistics networks, and downstream merchant activity—categories where primary data collection remains nascent, and estimation methodologies vary widely across reporting frameworks.

Multi-tier visibility deficiencies prevent effective due diligence. Research indicates 80% of firms cannot determine conflict mineral origins beyond Tier 1 suppliers, while extended payment hardware supply chains frequently span 5-7 tiers from raw material extraction to final assembly. CSDDD’s risk-based approach permits Tier 1 focus unless “plausible information” triggers deeper investigation—yet firms lack mechanisms to receive or verify such intelligence from lower-tier suppliers.

SME supplier engagement compounds data challenges. Payment supply chains heavily feature small and medium enterprises lacking resources for sustainability reporting. CSRD’s “value chain cap” protects suppliers under 1,000 employees from excessive data requests, creating legitimate boundaries but simultaneously limiting upstream visibility essential for materiality assessments.

Regulatory tension emerges between CSRD’s “reasonable efforts” disclosure standard and CSDDD’s civil liability framework. Firms must balance transparent reporting of data limitations against legal exposure when gaps prevent identification of adverse impacts, particularly as July 2026 guidance clarifies enforcement expectations and liability thresholds.

Practical implementation framework

Payments firms can adopt a phased, risk-based approach that balances regulatory compliance with operational feasibility across the 2026–2029 implementation timeline.

Risk-based prioritisation enables efficient resource allocation by assessing suppliers through a three-factor matrix: procurement spend concentration, sector risk profile (electronics manufacturing, data centres, logistics), and geographic exposure to conflict-affected regions or weak governance zones. This methodology aligns with CSDDD’s guidance permitting focused Tier 1 due diligence while maintaining surveillance mechanisms for lower-tier red flags. Firms should prioritise the top 20% of suppliers by spend, which typically represents 70–80% of total supply chain emissions and human rights exposure.

CSRD’s phase-in provisions allow pragmatic data quality progression. Years 1–2 permit emissions estimates using industry averages and spend-based calculations, while Years 3–4 transition toward primary supplier data through engagement programmes. Wave 1 reporting entities benefit from July 2025 “quick fix” provisions allowing Scope 3 omissions for firms under 750 employees during initial reporting cycles, providing an extended runway for supplier data systems.

Supplier engagement strategies require cross-functional collaboration. Research across European industrial sectors shows procurement teams involved in 93% of CSRD compliance efforts, working alongside finance (97%), legal (90%), and sustainability functions (99%) to build supplier capacity. Payments firms should leverage standardised questionnaires aligned with Voluntary Sustainability Reporting Standards for SMEs (VSME), reducing burden while maintaining compliance.

Technology and collaboration platforms accelerate due diligence efficiency. The Responsible Minerals Initiative (RMI) provides conflict mineral traceability tools benchmarked against CSDDD requirements, while industry consortia enable shared supplier audits—distributing verification costs and avoiding duplicative requests that strain SME partners’ capacity.

Key takeaway points

This year’s findings point to an ESG regulatory landscape moving rapidly from voluntary disclosure to mandatory compliance enforcement, with clear implications for payment firms across governance, risk management and capital adequacy frameworks.

Between March and December 2026, payments and financial services firms face compressed implementation timelines across multiple jurisdictions. Requiring simultaneous preparation for UK sustainability reporting standards, PRA climate risk requirements, EU sector-specific disclosure obligations, and international ratings provider oversight regimes.

The regulatory landscape demonstrates clear directional convergence, with the UK’s endorsement of the ISSB standards aligning with global reporting baselines, whilst the EU simplifies administrative burdens through the Omnibus package. However, this convergence occurs alongside heightened supervisory intensity, evidenced by the ECB’s shift to binding enforcement decisions backed by periodic penalties and the PRA’s elevation of climate risk to core prudential status.

Firms must prioritise immediate compliance actions for June 2026 deadlines whilst building strategic capabilities to meet near-term requirements through 2027 and 2028. The shift from gap analysis to supervisory engagement creates accountability for demonstrable progress rather than theoretical planning.

Success requires integrating sustainability obligations into existing governance, risk management and capital adequacy frameworks, treating ESG regulation as fundamental business infrastructure rather than isolated compliance workstreams. Regulatory uncertainty persists amid ongoing trilogue negotiations and member-state transposition timelines, necessitating adaptive compliance strategies responsive to evolving legislative outcomes.

ESG working group members

Alexandra MacBean

Travers Smith LLP
Senior Associate, Operational Risk & Environment

Alina Straßburger

Copecto
Marketing Manager

Charlie Bronks

Crown Agents Bank
Group Head of Sustainability & ESG Working Group Lead

Christopher Bowsher

Lloyds
Senior Business Architecht

Chryssi Chorafa

The Payments Association
Ambassador
Darek Paleczny headshot

Darek Paleczny

Worldline
Chief Risk & Compliance Officer

Irina Velkova

Grant Thornton
Director, FSA

Jasmine Ranson

Pay.UK
ESG & Health and Safety Officer

Kerry Berchem

Burges Salmon
Practice Development Lawyer

Maja Trajanoska

Netcetera
Co-Head of Engineering
Miranda McLean square

Miranda McLean

ecommpay
Chief Marketing Officer

Sarah Bridget-Dees

My EU Pay
CEO

Siobhan Wright

Trust Payments
Chief People Officer
Willem Wellinghoff headshot

Willem Wellinghoff

ecommpay
Chief Commercial Officer

Recent ESG working group outputs

The Payments Association ESG Working Group is currently researching the development of an industry standard framework for measuring the carbon impact of payments transactions.

The vision for a standard framework is driven by the fact that organisations in the Payments space are increasingly concerned with measuring and managing their carbon footprint. While several, mostly large, organisations have already carried out in-house research, SMEs, potentially lacking resource, may have the desire but not the means.

The ESG Working Group believes that it is in the industry’s interest to have a ratified set of guidelines which could facilitate consistency, promote collaboration, and drive sustainable innovation.

The fintech industry has always been forward-thinking, but when it comes to ESG, it’s clear that we are behind.

 ESG policies are vital for companies wanting to reduce their carbon footprint and protect the environment. They are also imperative to meet customer needs and achieve any long-term business goals as these issues related to climate change only become more pressing.

The time to act on ESG policies is now, they can no longer wither behind purely short-term and profit-led initiatives.

The ESG Working Group is constantly striving to contribute towards creating materials that promote ESG within the industry. These resources are intended to help you introduce and implement your ESG strategy, with insights from The Payments Association member companies. Together, we can make a difference.

In our latest episode of the Insights Podcast, Charlie Bronks, Crown Agents Bank, and Karine Martinez, Edenred, talk successful ESG policies, greenwashing and what effective green action really means. 

Previously, Tony Craddock sat down with Steve Round, chair of the Ecology Building Society and co-founder of SaaScada, who delved into how integrating ESG factors can redefine the financial services industry. He discussed the unique challenges and opportunities facing legacy banks and fintechs in making genuinely inclusive financial products that cater to all income levels. 

October 2024

Insights podcast: Reduce, reuse, recycle!

August 2024

Insights podcast: Banking on Change: Aligning Finance with Social and Environmental Progress

April 2024
Get in touch

Interested in joining our ESG Working Group?

Read more Payments Intelligence

Q2 2026 Regulation Roadmap

A forward-looking overview of key regulatory developments across payments, crypto and financial services, with timelines and practical implications.

Read More »

Upload your profile photo

You need to be logged in to do this!

Membership

Merchant Community Membership

Are you a member of The Payments Association?

Member benefits include free tickets, discounts to more tickets, elevated brand visibility and more. Sign in to book tickets and find out more.