Risk management and disclosure under GRSAC

Introduction

GRSAC is institutional disclosure on social, environmental and climate matters; it is not a customer’s sustainability certification or a form that every Brazilian company must publish. To understand a bank’s request, separate policy, management, public disclosure and information sent to the supervisor.

This guide helps identify responsibility for each layer and how company information can support a lender’s analysis without automatically transferring the regulatory obligation. The guide covers the regulatory transition announced for 2027 and data preparation, without setting an institution-specific compliance calendar.

Management and disclosure instruments

Regulatory references: CMN Resolution 4,945 identifies the PRSAC policy layer; BCB Resolution 151 identifies information supplied to the supervisor. CMN-4945:policy BCB-151:reporting

BCB’s prudential index organizes the responsibility and risk-management framework. BCB-INDEX:framework The table’s operational distinction is Enverium interpretation, not a claim of equivalence between regimes or comprehensive coverage of the rules.

What changes between 2026 and 2027

BCB’s index connects the Resolution 139/IN 153 regime with the transition to Resolution 586/IN 772. BCB-INDEX:grsac The September 2026 government announcement states that new requirements take effect on January 1, 2027, with phased implementation by segment. GOV-2026:transition

Effective date, information reference date and publication deadline are different things. Do not infer that every table is due on January 1. This edition does not confirm the consolidated text’s transitional provisions, first deadlines, exceptions and repeals. BCB-586:transition The incorporated version of the layouts also needs confirmation. BCB-772:layout

The earlier reference contains GVR, EST, GER, MEM and OPO tables with their own rules. BCB-139:tables Do not mechanically rename old files: first record each information item’s meaning, perimeter and newly applicable instruction.

Financial institution workflow

Enverium proposed practice: appoint an applicability-matrix owner and an owner for each dataset. Regulatory staff determine the regime; risk staff explain interpretation; data teams document extraction and transformations; the authorized body approves disclosure.

Build a catalog connecting each public assertion to internal evidence and a cutoff date. When a narrative says a process is used, seek records of its operation, not merely the approved policy. When a number changes, explain whether this reflects economic change, data correction, method or perimeter.

Keep an explicit list of information withheld for access or confidentiality reasons, with competent assessment of how to meet the applicable requirement. A disclosure request does not authorize dumping individual customer records onto the internet.

Workflow for a company receiving a bank request

Enverium proposed practice: ask which decision or field the request supports. Confirm period, entity, facility, unit and accepted method. A multi-site company may have consolidated data that cannot answer a location-specific question.

Supply available information with its quality and limitations. If a full inventory does not yet exist, do not enter “zero” to close the questionnaire. Identify the gap, partial coverage and owner of any improvement. A contractual information obligation requires its own assessment; it does not prove the company has become an institution required to publish GRSAC.

Responsibilities for supplying data

Fictional example: Banco Aurora requests Horizonte’s emissions and facility locations. Horizonte thinks it must produce its own GRSAC report. The bank explains that it is collecting evidence for analysis and preparation of institutional disclosure, subject to confirmation of its regulatory matrix.

The company supplies an inventory covering two of three facilities, identifies the year and distinguishes measured from estimated data. The bank preserves that limitation, checks appropriate use and decides how to handle the gap under the applicable method. Neither party calls the response a “GRSAC certificate.”

The lesson is to separate authorship and accountability: the company is responsible for what it supplies; the institution is responsible for its transformations, interpretation and disclosure. Receiving a file does not automatically transfer responsibility for a published total.

Preparation checklist

• Identify the obligated entity, segment and perimeter to confirm.
• Separate policy, management, public disclosure and supervisory reporting.
• Record instrument, edition, reference date and deadline separately.
• Distinguish received data, transformed data and published assertions.
• Preserve gaps, estimates and methodological changes.
• Obtain technical review and approval from the responsible team before publication.

Limitations and claims to avoid

Avoid “every company needs GRSAC,” “PRSAC replaces risk management” and “a public report proves there is no risk.” Do not treat an earlier template or public consultation as the final effective rule either.

Official communication helps explain the direction of change, but does not replace operative provisions. First deadlines and segment-specific transition conditions are not confirmed in this edition; the institution’s calendar must follow the applicable provisions.

Further reading

Use the applicability matrix and evidence workflow. PCAF, IFRS and IFC have distinct purposes and conditions; sharing data between them does not imply regulatory equivalence.