← Back to blog

CVM reopens the debate on mandatory sustainability reporting: now what?

Thoughtful executive in her office, with holographic panels of a tree, a dollar sign, a person and a growth chart representing ESG and finance

Brazil's securities regulator, the CVM, has put mandatory sustainability reporting for listed companies back on the table. On October 29, 2026, it launched Public Call for Input ASA/CVM 02/2026, a preliminary consultation to hear from companies, investors and experts about the costs and benefits of the regime created by CVM Resolution 193. The information comes from Capital Reset (in Portuguese).

A history of back and forth

  • 2023: CVM Resolution 193 aligned Brazil with the international IFRS S1 and S2 standards from the ISSB and set mandatory reporting for listed companies from fiscal year 2026, after a voluntary period.
  • Between 2023 and 2026: the rule went through successive updates (Resolutions 219, 227 and 244). The call itself acknowledges that the sequence of rules may have caused wasted investments and reduced predictability for companies.
  • May 2026: CVM Resolution 244 made the regime voluntary, on a “comply or explain” basis. The move drew strong opposition from capital market and financial sector organizations.
  • October 2026: five months later, the CVM opens the consultation. It has 51 questions organized around seven hypotheses and ten regulatory alternatives, ranging from keeping the voluntary regime to full mandatory reporting, including phasing by company size and rules limited to the climate standard (IFRS S2).

What applies today and what comes next

The voluntary regime remains in force. From January 1, 2027, a listed company that chooses not to publish the report will have to justify the decision in a notice to the market. Contributions to the consultation can be sent to the CVM until February 2027, and in the 2027 regulatory agenda the board will decide whether to carry out a Regulatory Impact Analysis.

Among the proposals is a middle path defended by part of the market: a phased process with relief in the first years and full mandatory reporting in 2028. In other words, the debate has moved from “whether” to “how and when”.

What about other countries?

The call includes a mapping of international experience across 16 jurisdictions. It shows a trend toward simplification:

  • the European Union, through the Omnibus I directive, cut the number of companies subject to reporting by about 80% and the mandatory data points by 60%;
  • the United States and Canada suspended or proposed repealing their mandatory climate rules;
  • Türkiye doubled its revenue thresholds to exempt mid-sized companies;
  • most countries postponed reporting of indirect emissions (scope 3) by one to three years and kept assurance at the limited level.

Regulators also report a common difficulty: the cost of compliance is easy to measure, but the benefit of the information to investors is hard to put a monetary value on.

What IFRS S1 and S2 are and what changes in the report

IFRS S1 and S2 were issued by the ISSB in 2023 and have Brazilian equivalents, CBPS 01 and 02. IFRS S1 sets the general requirements for disclosing sustainability-related risks and opportunities that affect a company's financial prospects. IFRS S2 deals specifically with climate. Both structure reporting around four pillars: governance, strategy, risk management, and metrics and targets.

In practice, the sustainability report stops being a communication piece and moves closer to the financial statements:

  • the focus is financial materiality: what can affect cash flow, access to capital and company value;
  • the information is published together with the financial statements, for the same period and with the same management accountability;
  • it requires traceable data, such as the emissions inventory (scopes 1, 2 and, on its own timeline, 3), and climate scenario analysis;
  • it goes through assurance, which demands internal controls and evidence, not just good narratives.

Waiting for the final decision is a risk

Whatever the outcome of the consultation, the global push from investors, banks and customers for reliable sustainability information does not depend on a resolution. And reaching the necessary maturity takes time. That is why the best moment to plan is now, and the path includes:

Infographic of the maturity journey for IFRS (CVM) sustainability reporting in five steps: diagnosis and governance, engagement and materiality, data collection and management, preparation and interoperability, assurance and disclosure
The five steps of the maturity journey to the IFRS S1 and S2 report.
  • Maturity diagnosis: understand where the company stands against the IFRS S1 and S2 requirements.
  • Materiality: identify which sustainability topics really affect the business and prioritize them.
  • Updated risk analysis: bring climate and social risks and opportunities into corporate risk management.
  • Indicators and data: define metrics, owners, sources and collection routines, with enough quality to support assurance.
  • Getting the house in order: align areas such as finance, legal, risk, operations and sustainability, with clear governance and workflows.
  • Training managers and the board: decision makers need to understand what is being reported and why.
  • Goals and action plan: turn the diagnosis into trackable commitments, with deadlines and evidence.

Those who start now gain time to test processes, fix gaps and reach the first report with confidence, whether it is mandatory or voluntary.

Talk to KICK

KICK Group supports companies at every one of these stages, from maturity diagnosis and materiality to structuring indicators, goals and action plans, including through the B.KICK platform. Want to understand where to start in your company?

Request more information

Write to contato@kickgroup.com.br. News source: Capital Reset (in Portuguese), published on 10/30/2026.

Cookie preferences

Choose which categories you allow. You can change your mind at any time with the “Cookie preferences” link in the footer.

Necessary

Keep the site working and secure (such as the reCAPTCHA on the contact form). Always on.

Always on

Google Analytics: counts visits and shows which pages are most viewed, in aggregate, so we can improve the site. _ga and _ga_* cookies, for up to 13 months.