ESG supplier risk
Also called supply chain ESG risk, sustainability supplier risk
ESG supplier risk is the chance that a supplier's environmental, social or governance failures harm a firm through legal liability, regulatory breach, lost business or reputational damage. Examples include forced labour, pollution and bribery in the supply chain. Firms manage it by screening, questioning and monitoring suppliers against set standards.
How it works
Firms score suppliers on country, sector and activity, then send higher-risk suppliers questionnaires on emissions, labour practices and anti-bribery controls. Answers are checked against certifications, audits and adverse media. Contracts carry codes of conduct and the right to request evidence. Serious findings lead to corrective action plans and, where they fail, suspension or exit from the relationship.
For banks the risk runs two ways. Their own suppliers create direct exposure, and their borrowers' supply chains create credit and reputational risk. EU rules will require the largest companies to carry out risk-based human rights and environmental due diligence from July 2029, and EBA guidelines require banks to manage ESG risks across their business. Supplier data also feeds sustainability reporting.
The rules
Requires in-scope companies to identify, prevent and address adverse human rights and environmental impacts in their own operations and chains of activities.
Large EU and non-EU companies meeting turnover thresholdsNarrows CSDDD scope and sets compliance from 26 July 2029, with penalties capped at 3% of net worldwide turnover.
EU companies with over 5,000 employees and €1.5bn turnover; non-EU companies with €1.5bn EU turnoverRequire institutions to identify, measure, manage and monitor ESG risks as part of their risk management framework.
EU credit institutions; small and non-complex institutions from 11 January 2027Common questions
When do CSDDD duties apply?
After the Omnibus I amendments published on 26 February 2026, member states transpose the CSDDD changes by 26 July 2028. In-scope companies comply from 26 July 2029, with annual statements for financial years from 1 January 2030.
Does ESG supplier risk only matter to companies in CSDDD scope?
No. Smaller suppliers receive questionnaires from in-scope customers, banks assess ESG risk in lending, and national laws such as Germany's supply chain act apply their own thresholds. Reputational exposure applies at any size.
What data do firms collect from suppliers?
Typical requests cover greenhouse gas emissions, labour and human rights policies, health and safety records, anti-bribery controls and certifications. Higher-risk suppliers may face on-site audits or third-party assessments to verify their answers.
Our coverage
News and analysis on third-party risk from RegTech Post.
Read the coverage →RegTech PostOsapiens Acquires Lucent AI to Integrate Risk Management Into Sustainability ComplianceRead the article →RegTech PostThe ESG Data Stack: How Tech Firms Are Building the Backbone of Sustainable CommerceRead the article →
