ESG Risk
Ask a bank what ESG risk means and you get a legal definition. Ask a rating agency and you get a score. Ask a sustainability team and you may get something else again: the harm a company does to the world.
Those are related, but only the first two are risk in the financial sense. Knowing which one someone means is most of the work.
ESG risk is the risk that environmental, social or governance factors cause financial loss to a company, an investor or a lender. Climate change is the largest example, through physical and transition risk. It shows up as ordinary credit, market and operational risk.
What ESG risk is
ESG risk is the chance that something environmental, social or governance-related costs money: a flood that shuts a factory, a carbon price that raises costs, a labour scandal that loses a contract, a bribery case that ends in a fine. The loss falls on the company, and through it on the investors and lenders exposed to that company.
The three letters group the sources. Environmental risk comes from climate change, pollution, water and nature, and from the rules and markets that respond to them. Social risk comes from how a company treats its workers, its supply chain, its customers and the communities around it. Governance risk comes from how it is run: board oversight, controls, ethics and pay.
The direction matters. ESG risk looks from the outside in: what ESG factors could do to the company’s finances. The opposite question, what the company does to people and the environment, is its ESG impact. The double materiality concept keeps the two apart, and the difference decides which rules apply.
Definition at a glance
| What it is | The risk of financial loss caused by environmental, social or governance factors |
|---|---|
| Also called | Sustainability risk (EU fund rules); sustainability-related risk (ISSB) |
| Who carries it | Companies directly; investors, banks and insurers through what they hold or lend to |
| Largest component | Climate risk, split into physical and transition risk |
| How it shows up | Through ordinary financial risks: credit, market, operational, liquidity, reputational |
| Not the same as | ESG impact (harm the company causes) or an ESG rating (a provider’s grade of it) |
How the law defines it
EU banking rules, Capital Requirements Regulation, Article 4(1)(52d), as amended by Regulation (EU) 2024/1623: “‘environmental, social and governance risk’ or ‘ESG risk’ means the risk of any negative financial impact on an institution stemming from the current or prospective impact of environmental, social or governance (ESG) factors on that institution’s counterparties or invested assets; ESG risks materialise through the traditional categories of financial risks.”
EU fund and adviser rules, Sustainable Finance Disclosure Regulation (EU) 2019/2088, Article 2(22): “‘sustainability risk’ means an environmental, social or governance event or condition that, if it occurs, could cause an actual or a potential material negative impact on the value of the investment.”
ISSB, IFRS S1: a company reports on sustainability-related risks and opportunities “that could reasonably be expected to affect the entity’s cash flows, its access to finance or cost of capital over the short, medium or long term”.
The three agree on the core idea: a negative financial effect that comes from an ESG factor. They differ in whose finances: a bank’s, an investment’s value, or the reporting company’s own. Under SFDR, firms selling investment products must publish how they integrate sustainability risks into their decisions and, for each product, their assessment of the likely impact of those risks on returns. The European Commission proposed replacing SFDR in November 2025; until a new regulation is agreed and applies, the current rules stand.
The kinds of ESG risk
EU banking law splits ESG risk into named parts, each defined the same way: the risk of negative financial impact from the factor’s effect on a bank’s counterparties or invested assets. The examples are ours.
| Kind | Arises from | Example |
|---|---|---|
| Physical risk (environmental) | The physical effects of environmental factors | Floods, heat or drought damaging assets or cutting output |
| Transition risk (environmental) | The transition to an environmentally sustainable economy | Carbon prices, product bans or falling demand for high-carbon goods |
| Social risk | Social factors | Forced labour found in a supply chain; a major safety failure |
| Governance risk | Governance factors | Bribery, weak board oversight, misstated accounts |
A driver, not a new category
ESG risk is not a separate line in a risk register. The EU definition says it “materialise[s] through the traditional categories of financial risks”, and the European Banking Authority’s Guidelines on the management of ESG risks tell banks to treat ESG risks as “potential drivers of all traditional categories of financial risks, including credit, market, operational (including litigation), reputational, liquidity, business model, and concentration risks”.
| Financial risk | How an ESG factor can drive it |
|---|---|
| Credit | A borrower’s profits fall as carbon costs rise, so it is more likely to default |
| Market | Shares or bonds of carbon-heavy companies are repriced |
| Operational and litigation | A storm damages premises; a company is sued over misleading green claims |
| Reputational | Customers or staff leave after a social scandal |
| Liquidity | Clients draw deposits to pay for disaster recovery |
| Business model and concentration | A lender is heavily exposed to one sector or region under pressure |
The same Guidelines set the time frame. Banks should manage ESG risks over the short and medium term and over “a long-term horizon of at least 10 years”. They apply from 11 January 2026, and to small and non-complex institutions from 11 January 2027 at the latest.
ESG risk versus ESG impact
| ESG risk | ESG impact | |
|---|---|---|
| Direction | Outside in: the world affects the company | Inside out: the company affects the world |
| Question | Could this cost us money? | Does this harm people or nature? |
| Materiality | Financial materiality | Impact materiality |
| Where reported | ISSB-based rules (IFRS S1 and S2); both sides under the EU’s ESRS | ESRS and GRI; adverse impacts of investments under SFDR |
| Example | A carbon price raises a cement maker’s costs | The cement maker’s emissions add to climate change |
The two often meet. A company with high scope 1 emissions has a large climate impact, and the same emissions are its transition risk once carbon is priced. That is why an emissions inventory sits under both kinds of disclosure.
How ESG risk is measured
- Companies identify sustainability-related risks and report them under rules based on IFRS S1 and S2, or under ESRS in the EU. For climate, IFRS S2 asks for scenario analysis of resilience.
- Investors often buy an outside view. Morningstar Sustainalytics’ ESG Risk Rating scores a company’s unmanaged ESG risk on an absolute scale where lower is better, in five bands from negligible to severe. MSCI’s AAA to CCC rating grades resilience to financially relevant, industry-specific ESG risks against industry peers. The two answer different questions; see ESG rating.
- Banks follow the EBA Guidelines: a materiality assessment of ESG risks at least every year, or every two years for small and non-complex institutions, feeding into credit decisions, limits and plans.
Worked micro-example
A food manufacturer buys most of its tomatoes from a region that faces worsening drought.
- The company sees physical risk: failed harvests raise input costs and can halt a production line. Under IFRS S2 this is a climate-related risk to disclose if it could reasonably be expected to affect cash flows.
- Its bank sees credit risk driven by an environmental factor: if margins fall, so does the company’s ability to repay.
- A fund holding its shares sees a sustainability risk under SFDR: an event that could reduce the value of the investment.
The same drought is also an impact question if the company’s water use deepens the shortage for others. That belongs to impact reporting, not to ESG risk.
Common mistakes
- Calling harm a risk. A company’s pollution is an impact; it becomes ESG risk only where it can come back as a financial cost.
- Treating ESG risk as a separate silo. It shows up as credit, market or operational risk, and is managed there.
- Equating a rating with the risk. A rating is one provider’s estimate, and providers disagree.
- Reading a Sustainalytics score the wrong way up. It is a risk score: lower is better.
- Looking only a few years ahead. Physical and transition risks build over decades; EU banks must look at least 10 years out.
- Leaving out social and governance risk. Climate gets the attention, but fines, scandals and supply-chain failures cost money too.
Transition risk starts with knowing your emissions. Build an inventory with every factor sourced, then see which disclosure rules apply to you.
Frequently asked questions
Environmental: floods, heat or drought damaging assets, and carbon prices or product bans raising costs. Social: forced labour found in a supply chain, or a serious safety failure. Governance: bribery, weak board oversight or misstated accounts. Each is an ESG risk because it can cost the company, or its investors and lenders, money.
Climate risk is the largest part of ESG risk. It covers physical risk from the effects of climate change and transition risk from the move to a low-carbon economy. ESG risk also includes other environmental factors, such as pollution and nature loss, and social and governance risks.
SFDR defines it as “an environmental, social or governance event or condition that, if it occurs, could cause an actual or a potential material negative impact on the value of the investment”. Fund managers and advisers must publish how they integrate these risks and, for each product, their assessment of the likely impact on returns.
In the EU, under the European Banking Authority’s Guidelines on the management of ESG risks, which apply from 11 January 2026, and to small and non-complex institutions by 11 January 2027 at the latest. Banks treat ESG risks as drivers of credit, market, operational and other financial risks, assess their materiality regularly and plan over a horizon of at least 10 years.
ESG risk is the risk that environmental, social or governance factors cause financial loss to a company, an investor or a lender. EU banking law defines it as the risk of negative financial impact stemming from the current or prospective impact of ESG factors on a bank’s counterparties or invested assets. It shows up through ordinary financial risks such as credit, market and operational risk.
Need someone who does this? 6 carbon accounting & inventory providers in our directory →