See the full list of cookies
Look up a CNPJ Talk to an expert Menu

Regulation, updated on

The regulatory map of social, environmental and climate risk.

The challenge is not knowing the regulation. It is turning regulatory requirements into opportunities and portfolio management, with evidence and an audit trail.

Informational content; does not constitute a legal opinion.

regulations and references mapped
23
in force
16
published, with a future effective date
4
proposed or voluntary
3

Count from the table below, reviewed on .

Compliance is the institution's responsibility.

ESGreen provides data, evidence and an audit trail. Each requirement below is mapped to a data point, a piece of evidence and a report.

In force
regulation published and applicable.
Published
regulation published with a future effective date.
Proposed
text under public consultation; may change in the final version.
Voluntary
adoption not mandatory as of the review date.
≈ Estimate
year estimated from an official document, with no date yet set in regulation (for the Brazilian Sustainable Taxonomy, the MRV System guidance document, with T0 = 2025).
Review date
each row shows when it was last checked. Deadlines are set by regulators and may change.

Four recent changes that alter risk and reporting routines

  • The GRSAC now comes with numbers.

    BCB Resolution 586 and BCB Normative Instruction 772, of September 3, 2026, overhaul the GRSAC report with quantitative tables starting January 1, 2027. First disclosure by S1 and S2 in 2028, with a December 2027 reference date.

  • IFRS S1/S2 reporting became voluntary for listed companies.

    CVM Resolution 244, of May 29, 2026, removed the requirement set out in CVM 193. For financial institutions, CMN 5,185 keeps the report mandatory, with reasonable assurance.

  • Rural credit now requires documented monitoring.

    CMN 5,268/2025 added to section 9 of the MCR (Rural Credit Manual) the PRODES/INPE check for vegetation clearing and remote sensing monitoring of contracts above 300 ha, “documented, auditable and assessable by the Central Bank”.

  • Rural insurance gained social and environmental restrictions.

    Since May 3, 2026, CNSP 485/2025 bars coverage for properties without an active CAR, under embargo for illegal deforestation, or belonging to producers listed in the MTE employer registry.

Regulations, deadlines and where ESGreen fits in

23 regulations and references that affect the social, environmental and climate risk of financial institutions and companies in Brazil.

Segment
Status

12 normas exibidas

Clear filters
Regulations, deadlines and where ESGreen fits in. Informational content; does not constitute a legal opinion.
#RegulationWhoDeadline and statusWhat it requiresHow ESGreen helpsContent
R01 BCB Res. 586/2026 + BCB IN 772/2026new GRSAC; revoke BCB Res. 139 and IN 153
See details for BCB Res. 586/2026 + BCB IN 772/2026
Deadline
Published September 3, 2026; in force from January 1, 2027. S1 and S2: first disclosure in 2028, reference date Dec 2027. S3: from the December 31, 2028 reference date. S4: commitment tables on the same timeline as S3
Who
S1 to S4 institutions
What it requires
Annual GRSAC report with quantitative tables and counterparties classified by CNAE. The CP 127/2025 draft provided for exposures and financed emissions by sector, agricultural credit by biome, exposures to power generation by source, exposure to drought and heavy rainfall by region, exposures to social and environmental risk, a transition plan and voluntary commitments.
How ESGreen helps
IRC-ESGreen (Climate Risk Index) and ESGreen Score as inputs for the new tables: classification by CNAE, risk per counterparty and climate exposure by land parcel and region.
S1 to S4 institutions Published Published September 3, 2026; in force from January 1, 2027. S1 and S2: first disclosure in 2028, reference date Dec 2027. S3: from the December 31, 2028 reference date. S4: commitment tables on the same timeline as S3 Reviewed:

Annual GRSAC report with quantitative tables and counterparties classified by CNAE. The CP 127/2025 draft provided for exposures and financed emissions by sector, agricultural credit by biome, exposures to power generation by source, exposure to drought and heavy rainfall by region, exposures to social and environmental risk, a transition plan and voluntary commitments.

IRC-ESGreen (Climate Risk Index) and ESGreen Score as inputs for the new tables: classification by CNAE, risk per counterparty and climate exposure by land parcel and region.
R02 CMN Res. 5,185/2024IFRS S1/S2 for financial institutions
See details for CMN Res. 5,185/2024
Deadline
In force since January 1, 2025. Fiscal year 2026 for publicly traded institutions and S1 and S2 leaders; 2028 for S3
Who
Publicly traded financial institutions and prudential conglomerate leaders
What it requires
Report of sustainability-related financial information under CBPS pronouncements 01 and 02 (IFRS S1/S2), with reasonable assurance by an independent auditor.
How ESGreen helps
Evidence trail ready for reasonable assurance: every data point with source, date and version. Physical risk inputs for IFRS S2.
Content
Publicly traded financial institutions and prudential conglomerate leaders In force In force since January 1, 2025. Fiscal year 2026 for publicly traded institutions and S1 and S2 leaders; 2028 for S3 Reviewed:

Report of sustainability-related financial information under CBPS pronouncements 01 and 02 (IFRS S1/S2), with reasonable assurance by an independent auditor.

Evidence trail ready for reasonable assurance: every data point with source, date and version. Physical risk inputs for IFRS S2.
R03 CMN Res. 5,268/2025rural credit, MCR section 9
See details for CMN Res. 5,268/2025
Deadline
In force. PRODES/INPE: since Apr 2026 for properties above 4 fiscal modules; from Jan 2027 for the others. Remote sensing: contracts above 300 ha since March 1, 2026
Who
Institutions that provide rural credit, including cooperatives
What it requires
Check for vegetation clearing after July 31, 2019, including adjacent areas, and remote sensing monitoring before and during the contract, "documented, auditable and assessable by the Central Bank". These add to the section 9 impediments, such as a missing or canceled CAR, embargoes and the MTE employer registry.
How ESGreen helps
Checks by CPF, CNPJ and property, climate risk by land parcel, and a record of the source, date and version of each check.
Institutions that provide rural credit, including cooperatives In force In force. PRODES/INPE: since Apr 2026 for properties above 4 fiscal modules; from Jan 2027 for the others. Remote sensing: contracts above 300 ha since March 1, 2026 Reviewed:

Check for vegetation clearing after July 31, 2019, including adjacent areas, and remote sensing monitoring before and during the contract, "documented, auditable and assessable by the Central Bank". These add to the section 9 impediments, such as a missing or canceled CAR, embargoes and the MTE employer registry.

Checks by CPF, CNPJ and property, climate risk by land parcel, and a record of the source, date and version of each check.
R04 CMN Res. 4,945/2021PRSAC
See details for CMN Res. 4,945/2021
Deadline
In force since July 1, 2022 (replaced CMN Res. 4,327/2014)
Who
All institutions in the National Financial System (SFN), including cooperatives
What it requires
Social, Environmental and Climate Responsibility Policy approved, implemented and applied to clients, operations and suppliers.
How ESGreen helps
From policy to evidence: the PRSAC applied to clients, suppliers and operations, with continuous monitoring, history and protocols.
All institutions in the National Financial System (SFN), including cooperatives In force In force since July 1, 2022 (replaced CMN Res. 4,327/2014) Reviewed:

Social, Environmental and Climate Responsibility Policy approved, implemented and applied to clients, operations and suppliers.

From policy to evidence: the PRSAC applied to clients, suppliers and operations, with continuous monitoring, history and protocols.
R05 CMN Res. 4,943/2021 and 4,944/2021risk management
See details for CMN Res. 4,943/2021 and 4,944/2021
Deadline
In force since 2022
Who
4,943: S1 to S4. 4,944: S5 (simplified regime)
What it requires
Inclusion of social, environmental and climate risk in the risk management framework, risk appetite and stress tests.
How ESGreen helps
ESGreen Score and IRC-ESGreen as inputs for risk appetite, limits and stress tests.
Content
4,943: S1 to S4. 4,944: S5 (simplified regime) In force In force since 2022 Reviewed:

Inclusion of social, environmental and climate risk in the risk management framework, risk appetite and stress tests.

ESGreen Score and IRC-ESGreen as inputs for risk appetite, limits and stress tests.
R06 BCB Res. 151/2021DRSAC
See details for BCB Res. 151/2021
Deadline
In force. Semiannual submission, in February and August
Who
Regulated institutions subject to submission
What it requires
Document submitted to the Central Bank with social, environmental and climate risk assessments of credit and securities exposures and their debtors.
How ESGreen helps
Risk flags per counterparty, with source and date, ready to feed into the document.
Regulated institutions subject to submission In force In force. Semiannual submission, in February and August Reviewed:

Document submitted to the Central Bank with social, environmental and climate risk assessments of credit and securities exposures and their debtors.

Risk flags per counterparty, with source and date, ready to feed into the document.
R07 BCB Circular 3,978/2020PLD/FT
See details for BCB Circular 3,978/2020
Who
Institutions authorized by the Central Bank
What it requires
Anti-money laundering policy and procedures, including knowing your clients, employees, partners and outsourced service providers.
How ESGreen helps
Continuous monitoring of suppliers and partners, with restrictive lists, international sanctions and news.
Institutions authorized by the Central Bank In force Reviewed:

Anti-money laundering policy and procedures, including knowing your clients, employees, partners and outsourced service providers.

Continuous monitoring of suppliers and partners, with restrictive lists, international sanctions and news.
R08 CMN Res. 4,893/2021cybersecurity and cloud
See details for CMN Res. 4,893/2021
Who
Institutions authorized by the Central Bank, when contracting data and cloud services
What it requires
Cybersecurity policy and requirements for contracting data processing, data storage and cloud computing services.
How ESGreen helps
Trust page and supplier due diligence materials sent on request.
Institutions authorized by the Central Bank, when contracting data and cloud services In force Reviewed:

Cybersecurity policy and requirements for contracting data processing, data storage and cloud computing services.

Trust page and supplier due diligence materials sent on request.
R14 Brazilian Sustainable Taxonomy (Decree 12,705/2025) and MRV System
See details for Brazilian Sustainable Taxonomy (Decree 12,705/2025) and MRV System
Deadline
Voluntary at first. Decree of October 31, 2025. The MRV System guidance document estimates, with no date yet set in regulation: Wave 1 (S1 and S2 banks, asset managers and funds, listed companies except smaller ones) and the MRV Portal in ≈2027; Wave 2 (S3 to S5, credit cooperatives, insurers, pension funds and other companies) in ≈2028; mandatory verification in ≈2029
Who
Non-financial companies, banks, asset managers and funds; then cooperatives, insurers and pension funds
What it requires
Classification of activities by CNAE and alignment indicators: PAES (companies), PAS and POVS (banks) and PIS (asset managers and funds), with verification by accredited verifiers in the mandatory phase.
How ESGreen helps
Ready for the TSB MRV System: classification by CNAE (economic activity code) and evidence per transaction and per investee.
Non-financial companies, banks, asset managers and funds; then cooperatives, insurers and pension funds Voluntary Voluntary at first. Decree of October 31, 2025. The MRV System guidance document estimates, with no date yet set in regulation: Wave 1 (S1 and S2 banks, asset managers and funds, listed companies except smaller ones) and the MRV Portal in ≈2027; Wave 2 (S3 to S5, credit cooperatives, insurers, pension funds and other companies) in ≈2028; mandatory verification in ≈2029 Reviewed:

Classification of activities by CNAE and alignment indicators: PAES (companies), PAS and POVS (banks) and PIS (asset managers and funds), with verification by accredited verifiers in the mandatory phase.

Ready for the TSB MRV System: classification by CNAE (economic activity code) and evidence per transaction and per investee.
R19 ZARCAgricultural Climate Risk Zoning, MAPA (Ministry of Agriculture)
See details for ZARC
Deadline
In force. Published by crop, state and crop year
Who
Rural credit and rural insurance
What it requires
Official climate risk reference by municipality, crop and planting window.
How ESGreen helps
ZARC is static, by municipality and crop year. IRC-ESGreen is dynamic, by land parcel, recalculated with each run. The two views complement each other.
Rural credit and rural insurance In force In force. Published by crop, state and crop year Reviewed:

Official climate risk reference by municipality, crop and planting window.

ZARC is static, by municipality and crop year. IRC-ESGreen is dynamic, by land parcel, recalculated with each run. The two views complement each other.
R20 EUDREU Regulation 2023/1115, as amended
See details for EUDR
Deadline
Published. December 30, 2026 for large and medium operators; June 30, 2027 for micro and small operators. Deforestation cutoff: December 31, 2020
Who
Exporters of soy, cattle, coffee, cocoa, palm oil, rubber and wood to the European Union, and those who finance them
What it requires
Due diligence with proof of zero deforestation and geolocation of production areas.
How ESGreen helps
Checks for embargoes, deforestation and territorial overlaps by CNPJ, CPF and property of producers and suppliers.
Exporters of soy, cattle, coffee, cocoa, palm oil, rubber and wood to the European Union, and those who finance them Published Published. December 30, 2026 for large and medium operators; June 30, 2027 for micro and small operators. Deforestation cutoff: December 31, 2020 Reviewed:

Due diligence with proof of zero deforestation and geolocation of production areas.

Checks for embargoes, deforestation and territorial overlaps by CNPJ, CPF and property of producers and suppliers.
R23 LGPDLaw 13,709/2018
See details for LGPD
Who
All organizations that process personal data
What it requires
A legal basis for each purpose, an appointed data protection officer and handling of data subject rights.
How ESGreen helps
Appointed data protection officer (DPO), legal bases and a channel for data subjects, described on the Trust page.
All organizations that process personal data In force Reviewed:

A legal basis for each purpose, an appointed data protection officer and handling of data subject rights.

Appointed data protection officer (DPO), legal bases and a channel for data subjects, described on the Trust page.

Reviewed: September 30, 2026. Deadlines set by regulators and subject to change. ≈ = estimate, with no date set in regulation. Proposed = text under public consultation.

Deadlines may change. The direction won't.

Every requirement in this table moves in the same direction: from drafting to consultation, from publication to entry into force. And the evidence each one will demand needs a track record, which cannot be built overnight.

Status of social, environmental and climate risk rules
  1. Under development

    Foreseen in an official document, with no date set in a rule yet.

    • TSB: MRV Portal and first wave (S1 and S2 banks, asset managers, funds and listed companies) TSB
    • TSB: second wave, with credit cooperatives, insurers and pension funds TSB
    • TSB: mandatory verification by accredited verifiers TSB
  2. Proposed

    Under consultation or with a proposed timeline. The direction is already set.

    • SUSEP: new sustainability rules, with climate scenarios and ESG in underwriting SUSEP 666
    • SBCE: monitoring plan for regulated facilities SBCE
  3. Published

    Rule published. The requirement takes effect in stages.

    • EUDR: zero-deforestation due diligence for large and medium-sized operators EUDR
    • New GRSAC: quantitative tables in the report BCB 586
    • CMN 5,268: PRODES check for properties of up to 4 fiscal modules CMN 5.268
    • CVM 244: “comply or explain” model CVM 193/244
    • CBAM: sale of certificates CBAM
    • Previc 728: ESG plan and double materiality, starting with S1 and S2 entities Previc 728
    • EUDR for micro and small operators EUDR
    • New GRSAC: first quantitative disclosure, starting with S1 and S2 BCB 586
    • CMN 5,185: IFRS S1/S2 reporting for S3 institutions CMN 5.185
    • CSDDD: supply chain due diligence by large European companies, passed on to suppliers CSDDD
  4. In force

    Already applies. Evidence must be kept up to date.

    • CMN 5,185: IFRS S1/S2 reporting with reasonable assurance for publicly traded institutions and S1 and S2 leaders CMN 5.185
    • CVM 244: voluntary IFRS S1/S2 reporting for listed companies CVM 193/244
    • CNSP 485: socio-environmental restrictions in rural insurance CNSP 485
    • CMN 5,268: PRODES check and remote monitoring in rural credit CMN 5.268
    • CBAM: definitive regime for European imports CBAM

The same regulation, read by segment

Frequently asked questions

Short answers to the most common questions.

Still have questions? Talk to an expert

Does ESGreen guarantee my institution's compliance with these regulations?

No. Compliance is the institution's responsibility. ESGreen provides data, evidence and an audit trail that support compliance: every data point with source, date and version. ESGreen does not certify, does not issue assurance and does not provide legal opinions.

What changes in the GRSAC report with BCB Resolution 586?

Published on September 3, 2026, BCB Resolution 586 and BCB Normative Instruction 772 replace BCB Resolution 139 and IN 153 and take effect on January 1, 2027. The report now includes quantitative tables, with counterparties classified by CNAE (economic activity code). S1 and S2 make their first disclosure in 2028, with a December 2027 reference date; S3 follows from the December 31, 2028 reference date.

Is IFRS S1/S2 reporting mandatory in Brazil?

It depends on who reports. For publicly traded financial institutions and S1 and S2 conglomerate leaders, CMN Resolution 5,185 makes the report mandatory from fiscal year 2026, with reasonable assurance; for S3, from 2028. For listed companies in general, CVM Resolution 244, of May 29, 2026, made reporting voluntary.

What did CMN Resolution 5,268 change in rural credit?

The rule requires a PRODES/INPE check for vegetation clearing after July 31, 2019, since April 2026 for properties above 4 fiscal modules and from January 2027 for the others. For contracts above 300 ha, since March 1, 2026, it requires remote sensing monitoring that is documented, auditable and assessable by the Central Bank.

What is the Brazilian Sustainable Taxonomy MRV System and when does it become mandatory?

It is the Monitoring, Reporting and Verification system of the TSB, established by Decree 12,705/2025. Adoption is voluntary at first. The MRV System guidance document estimates the MRV Portal and Wave 1 around 2027, Wave 2, with credit cooperatives and insurers, around 2028, and mandatory verification by accredited verifiers around 2029. These are estimates, with no date yet set in regulation. The sequence, however, is already defined: institutions that classify transactions by CNAE starting now will reach the mandatory phase with a track record.

How often is this map reviewed?

Each row shows the date of its last review, and the overall date appears at the top of the page. Regulations under public consultation appear as proposed until the final text is published. The status of each milestone in the table is reviewed by the ESGreen team and does not change automatically with the calendar: if a regulator postpones a deadline, the milestone stays where it is until the review.

How we assess

Which requirement weighs most on your agenda?

In a 30-minute conversation, we show how ESGreen data connects to the requirements your institution has already identified, with evidence and an audit trail.

  • A reading of the rules that apply to your segment
  • Demo of reporting and evidence deliverables
  • Pre-assessment of CNPJs in your base

Or write to contato@esgreen.com.br

An ESGreen specialist replies within one business day to schedule a time.

Tell us what you need

Fields marked with * are required.

We use this email to reply.

Client, supplier or partner. An expert gets back to you with the pre-assessment.

0 of 2,000