Central Bank overhauls the GRSAC report: what changes for banks and borrowers

While the capital markets were debating the reach of CVM Resolution 244 and the future of IFRS S1 and S2 reporting, Brazil's central bank took a direction of its own, and a firmer one. In September 2026 it issued BCB Resolution No. 586, which replaces BCB Resolution No. 139/2021 and overhauls the GRSAC Report, the report on social, environmental and climate risks and opportunities of financial institutions. This text draws on the content of the resolution (in Portuguese) and on BCB Normative Instruction No. 772, which provides the tables.

From a descriptive report to a report with numbers

Since 2022, the GRSAC mostly asked for text: how the institution organizes governance, strategy and management of social, environmental and climate risks. The new version brings in metrics. Article 4 of Resolution 586 lists twelve tables, covering:

• Governance, strategy and management of social, environmental and climate risk, along the lines of what already existed.
• Climate and transition risk: portfolio exposures by economic sector and, in the published layouts, financed emissions, with a specific table for agricultural credit.
• Physical risk: two tables, one for drought and one for intense rainfall, relating the credit portfolio to climate hazard indicators.
• Climate transition plan, for institutions that have one.
• Exposure to social and environmental risks: the table drawing the most attention, because it crosses the portfolio with public registries, such as the list of employers caught using slave-like labor, protected areas and Indigenous lands, environmental fines and embargoes and tailings dams in emergency status.
• Commitments on social, environmental or climate issues made by the institution (two tables).

A table on business opportunities remains optional.

The bar does not rise equally for everyone

The central bank divides institutions into prudential segments, from S1 (the largest) to S5 (the smallest). The new resolution applies to segments 1 to 4, and the text does not mention S5. Within that group, requirements vary:

• S1, S2 and S3: all the tables in Article 4, except optional ones. For S3 this is the biggest change, since the 2021 version asked far less of this segment.
• S4: only the governance table and the two tables on social, environmental and climate commitments. This is a new obligation: declaring the commitments the institution has made.
• S5: out of scope. The idea circulated that the rule would reach it, but the resolution does not include it.

Deadlines: what is in the text and what still needs checking

• The new rules take effect on January 1, 2027.
• Disclosure is annual, with a December 31 reference date and a deadline of up to 90 days. For the first report, the deadline can reach 180 days.
• Article 12 provides a transition for segments 3 and 4: the newer tables may be disclosed optionally from the reference date of December 31, 2028.
• The report must remain available on the institution's website for five years, and the information must also be published in open data format.

Market analyses indicate that segments 1 and 2 will make their first disclosure in 2028, with December 2027 data. Since sources read it differently, especially for segment 3, each institution's timeline should be checked against the official text.

What this means for borrowers

First, the report belongs to the bank, but the data comes from the portfolio, that is, from clients. To fill in the tables, institutions will need to know, for each financed company, which sector it works in, where it operates, its standing before public registries and which physical risks affect it. In practice, companies should expect more questions and requests for evidence in credit operations. Some fronts deserve attention:

• Social and environmental compliance: embargoes, fines, licenses, overlap with protected areas and the supplier chain itself may start to weigh in the analysis.
• Location of operations: georeferenced properties and units, including the CAR rural registry where applicable, help the bank measure exposure to drought and intense rainfall.
• Emissions: companies that keep a greenhouse gas inventory can respond more easily. For banks, financed emissions depend on their clients' data.
• Transition plan and commitments: public goals and commitments must be consistent with what the company actually does.
• Data quality: the rule admits different levels of precision, from exact location to approximations. Those with organized information avoid rework.

What banks can do right away

For segment 3 institutions, which go from a very lean report to a broad set, the path includes: mapping which registries and databases are already part of credit granting; defining how often the portfolio will be crossed with public registries; georeferencing the portfolio for physical risk; recording the quality level of each piece of data used; and structuring governance and internal responsibilities. The sooner the process starts, the more room there is to test and correct before the first disclosure.

Two regulatory paths, one message

The central bank and the CVM move at different paces, but the message for those who depend on credit and capital is similar: reliable social, environmental and climate information, with verifiable data, is becoming part of financial routine. Those who organize early reach the first disclosure cycle with more confidence, and can use it to their advantage with banks and investors.

Talk to KICK

KICK Group supports institutions and companies in structuring indicators, risk analysis and materiality, inventories and action plans, and ESG reporting, including through the B.KICK platform. Want to understand how this change affects your business?

Request more information

Write to contato@kickgroup.com.br. Source: BCB Resolution No. 586/2026 (in Portuguese). This text is informational and does not replace reading the official regulation.