Estonia adopts EBA ESG risk-management rules for banks

Estonian banks and investment firms face a new comply-or-explain supervisory expectation on managing environmental, social and governance risksFI. Finantsinspektsioon has issued the EBA Guidelines on the management of ESG risks (EBA/GL/2025/01, final report of 8 January 2025) as a Finantsinspektsiooni soovituslik juhend; the Finantsinspektsioon guideline page states an effective date of 7 October 2026FI. Under Article 16(3) of the EBA founding regulation, competent authorities and financial institutions must make every effort to comply with EBA guidelines by incorporating them into their practices as appropriate.

The guidelines, mandated by Article 87a(5)(a)–(c) of the capital requirements directive, set minimum standards and reference methodologies for ESG-risk identification, measurement, management and monitoring, specify the content of Article 76(2) CRD plans, and lay down criteria for assessing ESG impact on risk profile and solvency over the short, medium and long term. They apply to institutions other than small and non-complex institutions from 11 January 2026FI, and to small and non-complex institutions at the latest from 11 January 2027FI. Addressees are competent authorities and institutions within the meaning of Article 4(1)(3) of Regulation (EU) No 575/2013.

At the core is a regular, comprehensive materiality assessment of ESG risks — at least yearly, or every two years for small and non-complex institutionsFI, and more often after material changes such as significant new public policies or shifts in business model or portfolios. On that basis institutions must identify and measure ESG risks through sound data processes combining exposure-, portfolio- and sector-based, portfolio-alignment and scenario-based methodologiesFI, and integrate them as drivers of every traditional risk category: credit, market, operational, reputational, liquidity, business-model and concentration risk.

Management must run over the short, medium and a long-term horizon of at least 10 years, embedded in risk appetite, internal controls across the three lines of defence, ICAAP and internal reporting with backward- and forward-looking metrics. Institutions must also draw up Article 76(2) plans with timelines and intermediate quantifiable targetsFI to monitor and address financial risks from the transition toward EU climate-neutrality-by-2050 and related regulatory objectives — risk-based prudential plans that must sit consistently alongside CSRD and CSDDD transition plans where those also apply, with EBA encouraging one integrated strategic planning process to limit duplication.

Proportionality turns first on materiality rather than size: smaller institutions are not immune where exposures concentrate in ESG-sensitive sectors or physical-risk zones. Differentiated provisions still let small and non-complex and other non-large institutions use qualitative approaches, estimates and proxies, representative exposure samples and lighter monitoring metrics, while large institutions face more extensive requirements. For Estonian compliance and risk officers the immediate consequence is that the 11 January 2026 application date for non-SNCI institutions is already runningFI: materiality assessments, data processes and Article 76(2) planning must be in place nowFI, with small and non-complex institutions following at the latest by 11 January 2027.