California's Climate-Related Financial Risk Act (CRFRA) - SB 261

Introduction

The evolution of ESG reporting has consistently been led by European standard setters. Many US state and federal organizations have proposed ESG reporting standards, but no US-based requirements were established until recently. In October 2023 new legislation was enacted, impacting many companies worldwide. California Governor, Gavin Newsom, approved SB 261, the Climate-Related Financial Risk Act (CRFRA). This bill sets ESG reporting standards that affect all entities operating in California with annual revenue in excess of $500M in the previous fiscal year.

Beginning in January 2026, covered companies will be required to disclose their climate-related risks and what measures they have taken to reduce and adapt to those reported risks. These disclosures must be updated every two years. Reports should be modeled after the recommendations in the TCFD framework or the guidance found in IFRS’s S2. The reports must be made available to the public on the company’s website. This article discusses the reporting requirements for companies subject to the standards set in the CRFRA.

Covered Companies

The CRFRA only affects large companies “doing business” in the state of California. According to California’s Franchise Tax Board, “doing business” can refer to any of the following three activities.

1. The company engages in any transaction for the purpose of financial gain within California
2. The company is organized and/or domiciled in California
3. The company’s sales, property, or payroll exceeds specified amounts found on the Franchise Tax Board’s website

If it has been determined that a company does business in California, its revenue determines whether it will need to comply with the CRFRA standards. A company that does business in California and exceeds $500M in revenue in 2025 will need to implement the new greenhouse gas disclosure requirements beginning January 2026.

• Note that companies in the insurance industry are exempt from this bill as they are subject to other greenhouse gas reporting requirements.

Reporting Requirements

Covered companies are required to report on two key items. (1) The company’s climate-related financial risk and (2) the measures adopted to reduce and adapt to the disclosed climate-related financial risks. Climate-related financial risks should be reported according to the framework established by the Task Force on Climate-related Financial Disclosures (TCFD) or the reporting principles published in IFRS S2. As of October 2023, the TCFD has ceased ongoing updates to its framework, deferring to the IFRS for sustainability reporting guidance. As such, companies that report according to IFRS S2 standards will also be compliant with the TCFD framework. The reporting requirements mentioned in this article are derived from IFRS S2. Compliance with S2 requires disclosures related to four key elements of a company’s climate risk, governance, strategy, risk management, and metrics and targets. With the SEC’s new ESG disclosure guidance, it is probable that California will adjust the bill’s wording to acknowledge the new rules and address how they fit in with the state’s requirements.

Governance

The governance section of a company’s disclosures should focus on two areas (1) “the board’s oversight of climate-related activities and opportunities” and (2) “management’s role in assessing and managing climate-related risks and opportunities.” When discussing board oversight, the company should include details regarding how often the board is briefed on climate-related issues. It is also important to disclose how the climate-related information received affects board strategy, budgeting, and decision-making. Stakeholders are also interested in how the board monitors progress towards disclosed climate-related goals and targets. When disclosing board oversight, companies should include information about how the climate-related responsibilities of the board are reflected in the terms of reference, mandates, role descriptions, and other relevant policies.

The recommended disclosures for management are focused on the organizational structure of a company’s workforce. Featured details should include the roles of those responsible for climate-related tasks and how management monitors climate-related issues.

Strategy

Strategy disclosures are focused on understanding a company’s plan for managing climate-related risks and opportunities. The recommended disclosures can be split into three sections, (1) the climate-related risks and opportunities the company identifies, (2) the impact of climate-related risks and opportunities on the future of the company’s business, strategy, and financial planning, and (3) the resilience of the company’s strategy in various climate-related scenarios.

Regarding section 1, reporting identified risks and opportunities, companies should describe short-, medium-, and long-term factors they feel are relevant. In addition to general risk and opportunity descriptions, companies should disclose climate-related issues (short-, medium-, and long-term) that could materially affect the financial position of the business. Included in that disclosure should be a description of the process used to determine whether identified risks and opportunities pose a threat of material impact. Companies should consider industry specific risks and disclose them in this section of their report.

The impact of climate-related risks and opportunities on a company’s business, strategy, and financial planning, section 2, should include detailed information about how the company has responded to and plans to respond to climate risks. This guidance also requires disclosure of transition plans and strategy related to climate-related targets. S2 provides more information on the quantitate and qualitative disclosures required in different circumstances. Factors such as significant measurement uncertainty and undue cost or effort can affect these reporting requirements.

The final section of the strategy disclosure should describe the resilience of a company’s strategy in various scenarios. Commentary on resilience should be geared towards the following categories.

• Significant areas of uncertainty
• The company’s ability to adjust its strategy over time
• How and when climate-related scenario analysis was performed

Scenario analysis will be entity specific. Management should consider the risks related to industry, location, and other contributing factors when identifying relevant scenarios for disclosure.

Risk Management

Risk management disclosures should present the processes used to identify, assess, prioritize, and monitor climate-related risks and opportunities. Additionally, companies should report on whether and how these processes are integrated into and inform the company’s risk management process. When companies disclose their processes for identifying, assessing, prioritizing, and monitoring risks, they should include the following details:

• The input parameters used to identify risks and opportunities (data sources and scope of operations covered)
• How the company uses climate-related scenario analysis to inform its identification of risks and opportunities
• Whether it has changed climate-related risk management processes since the prior period
• How the entity prioritizes climate-related risks relative to other types of risk

Metrics and Targets

The goal of metric and target disclosures is to communicate performance in relation to climate-related risks and opportunities, progress towards climate-related targets previously set, and targets the entity is required to meet by law or regulation. This section requires disclosures related to seven different topics.

1. Greenhouse gas (GHG) emissions
2. Transition risks
3. Physical risks
4. Climate-related opportunities
5. Capital deployment
6. Internal carbon prices
7. Remuneration

These topics are required by entities in all industries. Additional requirements relevant for each industry can be found in IFRS S2.

Conclusion

California’s Climate-Related Financial Risk Act will require a significant increase in the quality and consistency of ESG data reported by entities. Increased reporting will give shareholders the information they’re looking for, while encouraging large companies to integrate solutions to climate-related issues into their general operations. The implementation timeline could shift as California legislature addresses potential negative impacts of the current timeline, but for now, many large companies are busy preparing for a January 1, 2026 implementation.