ESG Reporting Requirements for Fintech Companies in the DACH Region

Update, 11 October 2026: The CSRD timeline in this article reflects the original phase-in and is no longer current. The 2025 “stop-the-clock” directive postponed the later waves by two years, and the Omnibus Directive (EU) 2026/470, in force since 18 March 2026, limits reporting to undertakings with more than 1,000 employees and a net turnover above €450 million. Listed SMEs are therefore no longer in scope, assurance stays at the limited level, and once the directive is transposed into national law, undertakings with up to 1,000 employees may decline data requests from reporting customers that go beyond the voluntary standard. Our article “CSRD After the Omnibus” covers the current status.

Environmental, Social, and Governance (ESG) reporting has moved from a voluntary exercise in corporate responsibility to a binding regulatory obligation for large companies across Europe. For fintech firms in the DACH region — most of which are not in scope themselves but are asked for data by customers, banks and investors that are — understanding the evolving ESG regulatory landscape is a matter of operational necessity, not merely strategic preference.

The transformation has been remarkably fast. A decade ago, corporate sustainability reporting in the DACH region was largely a voluntary exercise practised by a handful of listed companies and motivated by investor relations rather than legal compulsion. Today, an interlocking set of European directives and regulations — principally the Corporate Sustainability Reporting Directive (CSRD), the EU Taxonomy Regulation, and the Sustainable Finance Disclosure Regulation (SFDR) — has created a mandatory, standardised, and externally assured reporting regime that touches fintech companies directly and their business partners even more extensively.

This article maps the principal legal instruments, their phased application timelines, the Swiss counterpart, and the practical steps that DACH fintech companies should take — whether they are already in scope, approaching scope, or likely to be drawn in through the supply chains of larger customers.

The Corporate Sustainability Reporting Directive (CSRD)

The CSRD (Directive (EU) 2022/2464), which replaces and significantly expands the scope of the earlier Non-Financial Reporting Directive (NFRD, Directive 2014/95/EU), is the cornerstone of the EU's sustainability reporting framework. The directive requires companies to report detailed sustainability information in accordance with the European Sustainability Reporting Standards (ESRS), developed by the European Financial Reporting Advisory Group (EFRAG) and adopted by the European Commission in 2023.

The CSRD introduces several fundamental shifts compared to the NFRD. Reporting must follow detailed, sector-agnostic ESRS standards rather than open-ended national frameworks. Sustainability information must be included in the management report, not published separately. The information must be subject to external assurance at the level of limited assurance; the originally planned move to reasonable assurance was dropped by Directive (EU) 2026/470. Disclosures must cover not only the company's own operations but also its upstream and downstream value chain. And the directive applies the concept of double materiality, requiring reporting on both how sustainability matters affect the company (financial materiality) and how the company's activities affect people and the environment (impact materiality).

Phased Application Timeline

The CSRD's phased application timeline is critical for DACH fintech companies to understand in order to plan their reporting journey:

• From financial year 2024: Large public-interest entities already subject to the NFRD, being those with more than 500 employees. The first CSRD reports under this cohort were published in 2025.
• From financial year 2025: Other large undertakings meeting at least two of three criteria — more than 250 employees, net turnover exceeding EUR 50 million, or total assets exceeding EUR 25 million. First reports due in 2026.
• From financial year 2026: Listed SMEs, small and non-complex credit institutions, and captive insurance undertakings, with a potential opt-out until financial year 2028 for listed SMEs.
• From financial year 2028: Certain non-EU companies with significant activities in the EU, subject to specific thresholds.

The phased timeline reflects a deliberate legislative choice to spread the compliance burden and give smaller and less complex entities more time to build the necessary reporting infrastructure. It also means that at any given point during the phase-in period, different DACH fintech companies will be at very different stages of their CSRD journey.

National Transposition

In Germany, the CSRD is to be implemented through amendments to the Handelsgesetzbuch (HGB — German Commercial Code); as of October 2026, however, the implementing act has not been promulgated, and Sections 289b to 289e and 315b and 315c HGB still contain the non-financial statement rules of the predecessor directive. Austrian implementation follows a similar path through amendments to the Unternehmensgesetzbuch (UGB) and related legislation. Transposition into national law has been uneven across EU member states and has been subject to delays in several jurisdictions, creating some short-term uncertainty about the precise date of first applicability for specific companies.

Since the Omnibus Directive, most growth-stage fintech companies sit below the thresholds of 1,000 employees and €450 million net turnover and therefore outside direct scope. For parent undertakings, however, the consolidated figures of the group count; firms that head a group or are growing fast should therefore review their classification regularly.

Double Materiality in Practice

Double materiality deserves special attention because it is one of the most demanding conceptual elements of the CSRD framework. A company must assess, document, and report on matters that meet either the financial materiality test (the matter could reasonably be expected to affect the company's development, performance, or position) or the impact materiality test (the company's activities have, or could have, significant actual or potential impacts on people or the environment). Many traditional reporting processes focus almost exclusively on financial materiality; the impact-materiality dimension often requires new data sources, new methodologies, and new stakeholder-engagement processes.

The materiality assessment itself is subject to ESRS 1, the cross-cutting standard that sets out the general principles for the preparation of sustainability statements. ESRS 1 describes a structured process for identifying relevant sustainability matters, applying thresholds, and documenting the resulting conclusions. The output of the materiality assessment then drives which topical ESRS standards a company must apply in detail, making this early-stage exercise disproportionately important for the eventual reporting burden.

A point frequently missed by first-time reporters is that the materiality assessment is not a one-off exercise. It must be refreshed periodically to reflect changes in the business, the external environment, and stakeholder expectations. Documentation of the assessment process, the inputs considered, and the reasoning behind inclusion and exclusion decisions is essential for both external assurance and subsequent supervisory or investor scrutiny.

ESRS Topical Standards

The ESRS include two cross-cutting standards (ESRS 1 and ESRS 2) and ten topical standards covering environment (climate change, pollution, water and marine resources, biodiversity and ecosystems, resource use and circular economy), social matters (own workforce, workers in the value chain, affected communities, consumers and end-users), and governance (business conduct). Each topical standard sets out disclosure requirements that are triggered where the topic is material to the reporting entity.

For most fintech companies, the climate change standard (ESRS E1) is expected to be the most consequential, given regulatory focus on climate-related risks and opportunities across the financial sector. The social standards, particularly ESRS S1 on own workforce and ESRS S4 on consumers, are also commonly material for customer-facing fintechs. The governance standard (ESRS G1) covers matters including business conduct, corporate culture, anti-corruption measures, and political engagement.

The EU Taxonomy Regulation

The EU Taxonomy Regulation (Regulation (EU) 2020/852) establishes a classification system for environmentally sustainable economic activities. Companies subject to the CSRD must disclose the proportion of their revenue, capital expenditure, and operating expenditure that qualifies as Taxonomy-aligned — meaning it contributes substantially to one of six environmental objectives while not significantly harming the others and meeting minimum social safeguards. Since 1 January 2026, reliefs apply (Delegated Regulation (EU) 2026/73): activities that together account for less than 10% of the denominator of the relevant indicator need not be assessed, and the operating-expenditure indicator may be omitted where operating expenditure is not material to the business model.

The six environmental objectives are climate change mitigation, climate change adaptation, sustainable use and protection of water and marine resources, transition to a circular economy, pollution prevention and control, and protection and restoration of biodiversity and ecosystems. For an economic activity to be Taxonomy-aligned, it must substantially contribute to at least one of these objectives, do no significant harm (DNSH) to any of the others, and respect minimum safeguards including the OECD Guidelines for Multinational Enterprises and the UN Guiding Principles on Business and Human Rights.

The Green Asset Ratio

For fintech companies, particularly those involved in lending, the Taxonomy creates an indirect but significant obligation. Credit institutions must disclose their Green Asset Ratio (GAR) — broadly, the proportion of their banking book that finances Taxonomy-aligned activities, relative to total eligible assets. The methodology is prescribed by Commission Delegated Regulation (EU) 2021/2178 and subsequent amendments, and it has proven to be one of the more technically challenging elements of the Taxonomy framework in practice.

Payment institutions and electronic money institutions (EMIs), while not directly subject to the GAR requirement, may face Taxonomy-related disclosure obligations through the CSRD's general reporting requirements, through the expectations of investors, or through the reporting needs of business partners higher up the value chain. Fintech lenders structured as credit institutions face the most direct exposure, but almost any fintech working with large corporate customers will at some point be asked to provide Taxonomy-relevant data about its own activities and those of its customers.

A complication that deserves specific attention is the interaction between Taxonomy alignment and data availability. Assessing whether a given corporate counterparty meets the substantial contribution, DNSH, and minimum safeguards criteria requires detailed information about the counterparty's operations. Where the counterparty is itself subject to the CSRD and publishes Taxonomy-aligned data, the calculation is tractable; where it is not, the reporting entity must make reasonable assumptions or exclude the exposure from the numerator. The resulting GAR values tend to be modest in the early years of the regime as data quality improves, and investors reading the disclosures should interpret them with caution.

Technical Screening Criteria

The substantive content of Taxonomy alignment is set out in delegated regulations that define, sector by sector, the technical screening criteria for substantial contribution and DNSH. The criteria are highly specific and often involve quantitative thresholds such as emissions per unit of output, energy efficiency levels, or material composition requirements. Fintech firms evaluating their loan portfolios against these criteria frequently need to engage specialists or rely on third-party data providers to make reliable determinations.

The Sustainable Finance Disclosure Regulation (SFDR)

The SFDR (Regulation (EU) 2019/2088) applies to financial market participants — including investment firms, fund managers, and insurance companies offering investment products — and financial advisers. It requires entity-level and product-level disclosures on sustainability risks, the integration of sustainability factors into investment decisions, and adverse impacts on sustainability.

Fintech companies offering investment products or robo-advisory services in Germany or Austria are directly subject to SFDR requirements. This includes classifying financial products under the SFDR's disclosure categories: Article 6 (baseline disclosures), Article 8 (“light green” products that promote environmental or social characteristics), and Article 9 (“dark green” products that have sustainable investment as their objective). Each category carries specific pre-contractual, website, and periodic disclosure requirements.

Financial market participants that exceed certain size thresholds must also publish a statement on Principal Adverse Impact (PAI) indicators, covering a defined set of sustainability indicators at entity level. The PAI statement is one of the most data-intensive obligations of the SFDR and has required significant investment in ESG data infrastructure across the industry.

The SFDR is being overhauled: on 20 November 2025 the Commission proposed (COM(2025) 841) to replace the Article 8 and 9 classification with three product categories (sustainable, transition and ESG basics), to delete the entity-level PAI statement and to take pure financial advisers out of scope. The legislative procedure is still ongoing; until the amendment is adopted and applies, the rules described above remain binding. Firms operating under SFDR should follow the procedure as well as the regulatory technical standards (RTS) and supervisory guidance from the European Supervisory Authorities.

The interaction between the SFDR and the CSRD is particularly important for fintech firms offering investment products. A firm that falls within the SFDR scope as a financial market participant and also meets the CSRD size thresholds as a corporate entity will produce disclosures under both frameworks, drawing on overlapping but distinct data sets. Coordinating the two workstreams — so that the firm tells a consistent story across all its sustainability disclosures — is a material operational challenge for compliance and finance teams.

The Swiss Approach

Switzerland has developed its own sustainability reporting framework, distinct from the EU's approach. The Swiss Code of Obligations (Obligationenrecht, OR), through the new provisions in Articles 964a to 964c, requires large Swiss companies to report on environmental matters, social issues, employee-related matters, respect for human rights, and anti-corruption measures. These provisions have been in force since January 1, 2022 and applied for the first time to the 2023 financial year; the first reports were published in 2024.

The Ordinance on Climate Disclosures, in force since January 1, 2024, specifically mandates climate-related financial disclosures aligned with the Task Force on Climate-related Financial Disclosures (TCFD) recommendations. Swiss public-interest entities exceeding specified size thresholds must therefore provide climate-related disclosures covering governance, strategy, risk management, and metrics and targets.

While not identical to the CSRD, the Swiss framework shares the fundamental expectation that significant companies provide transparent, standardised sustainability reporting. Swiss fintech firms with EU operations face the additional complexity of potentially needing to comply with both Swiss and EU frameworks, producing reports that satisfy different but overlapping expectations. Firms in this position typically work from a single underlying ESG data set and generate framework-specific disclosures from that source, rather than maintaining parallel reporting tracks.

Beyond the Code of Obligations requirements, FINMA has integrated climate risk considerations into its supervisory framework for Swiss banks and insurers, with particular focus on transition risks, physical risks, and the management of climate-related financial exposures. Swiss fintech firms supervised by FINMA should expect climate-risk questions as part of routine supervisory dialogue, even where they are not formally within the scope of the Code of Obligations disclosure requirements.

Switzerland has also engaged with the international development of sustainability reporting standards, including through its participation in the International Sustainability Standards Board (ISSB) process. The ISSB standards, published by the IFRS Foundation, are being adopted in various jurisdictions worldwide and may in time become a reference for further Swiss regulatory development. Fintech firms building their ESG data infrastructure would be well advised to consider both the ESRS and the ISSB standards in their architecture, even where only one currently applies.

Practical Implications for Fintech Companies

Even fintech companies not yet within the mandatory reporting scope should prepare proactively. The reasons are both commercial and regulatory:

• Investor expectations: Institutional investors and venture capital firms increasingly require ESG data as part of their due diligence and portfolio monitoring processes, often irrespective of whether the fintech is formally in CSRD scope
• Enterprise client requirements: Large companies subject to CSRD must assess sustainability across their value chain, creating downstream data requirements for their fintech service providers. A fintech that cannot provide the data may lose the contract
• Regulatory trajectory: The 2026 Omnibus Directive narrowed the mandatory scope considerably; the data requests from banks, investors and large customers did not shrink with it. Building reporting capabilities incrementally is less disruptive than implementing them under time pressure once a customer or investor demands the data
• Talent attraction: Sustainability credentials are increasingly relevant to the recruitment and retention of skilled professionals in the DACH region, particularly among younger cohorts
• Financing conditions: Sustainability-linked financing terms are becoming more common in corporate lending, and firms with weak ESG data infrastructure may find themselves disadvantaged

Implementation Roadmap

For fintech companies planning their ESG reporting journey, a structured implementation roadmap typically proceeds through several stages. An initial gap assessment identifies which frameworks apply, when they are expected to apply, and where the company currently stands against the relevant requirements. This phase is usually best conducted with external assistance, given the specialised knowledge required to interpret the evolving rules.

Next comes the build-out of the ESG data infrastructure. Reporting under ESRS, the Taxonomy, and the SFDR requires structured, auditable data across numerous indicators. Spreadsheets and ad-hoc data collection do not scale, and an early investment in proper data architecture pays significant dividends when the reporting obligations become binding. A clear policy framework then defines the company's sustainability commitments, governance responsibilities, and internal controls.

Governance is a critical dimension. Board-level accountability for sustainability reporting is expected under the CSRD framework, and many of the ESRS disclosures require information about governance arrangements themselves. External assurance preparation begins well before the first assured report is due; the assurance provider will expect well-documented processes, auditable evidence, and clear lines of responsibility.

Data Infrastructure Considerations

The most common technical bottleneck in ESG reporting is the aggregation of data from disparate internal and external sources into a coherent, auditable data set. Relevant data typically lives across finance systems, HR systems, facilities management, procurement, customer databases, and vendor-provided ESG data feeds. Bringing these sources together requires clear data definitions, robust extract-transform-load processes, and the ability to restate prior-period data if the underlying methodology changes. Purpose-built ESG reporting platforms have emerged to address these needs, though the choice of platform should be driven by the firm's specific scope and maturity rather than by generic vendor claims.

Equally important is the relationship between the ESG data set and the financial reporting data set. Under the CSRD, the sustainability statement is part of the management report, which means the two must be consistent. Discrepancies between operational metrics, headcount figures, or geographic breakdowns across the two statements are a standard audit finding and should be avoided through integrated data governance rather than reconciled through ad-hoc adjustments.

Governance and Board Accountability

The CSRD and ESRS explicitly place responsibility for the sustainability statement on the management body. This is not a delegable responsibility. Board members are expected to understand the key sustainability risks and opportunities facing the firm, to engage substantively with the materiality assessment, and to challenge the reporting output where appropriate. Many boards benefit from dedicated ESG training, particularly where the board was formed before sustainability became a mandatory reporting topic.

Supervisory boards in German companies face particular expectations. Their role in overseeing the management board extends to sustainability matters, and many supervisory boards have established dedicated sustainability committees to support this oversight. The composition of these committees, the frequency of their meetings, and the depth of their engagement with sustainability topics all come under external scrutiny, particularly once assurance providers begin issuing opinions on the governance section of the sustainability statement.

A further practical point concerns anchoring sustainability reporting in corporate planning. Companies that treat the process purely as a compliance exercise tend to separate reporting from the rest of their strategy and financial planning. The result is often inconsistent statements, conflicting metrics, and a report that says little about the company's actual strategic direction. Mature organisations build sustainability into the annual planning cycle, set targets with binding timelines, and link the achievement of those targets to management remuneration where appropriate. Close integration of ESG targets, financial planning, and remuneration turns reporting into a steering instrument rather than after-the-fact documentation.

Common Pitfalls

Recurring pitfalls in DACH ESG reporting preparation include underestimating the data-infrastructure burden, treating the exercise as a marketing project rather than a rigorous reporting obligation, relying on voluntary frameworks as a substitute for the specific requirements of ESRS or the Taxonomy, and failing to engage the board early. The reputational risks of weak or unreliable ESG reporting are substantial, particularly as supervisors and civil society actors scrutinise early reports for greenwashing.

The firms that begin building ESG data collection, governance, and reporting infrastructure now — even without a legal obligation of their own — will be better positioned both operationally and commercially as the regulatory framework continues to mature. The cost of preparation is real but finite; the cost of rushed last-minute compliance, or of losing a major customer because the required data cannot be produced, is typically much larger.