CSRD Third-Country Reporting: What Non-EU Groups Must Understand Before the Scope Applies

ByOfficer

Last updated: June 2026

A group headquartered in New York, Tokyo or Sao Paulo with no EU listing and no intention of ever seeking one can still be pulled into European sustainability reporting. CSRD third-country reporting reaches groups through the size of their European activity, not through a securities admission. If a non-EU group sells enough into the Union and holds a large enough subsidiary or branch there, an EU entity it controls becomes legally responsible for publishing a sustainability report covering the whole global group. The parent does not file. A subsidiary or branch does, and it carries the legal responsibility whether or not head office cooperates.

This is the part that catches groups late. The duty lands on a European operating company or branch, often one with no reporting function of its own and no line of sight into group-level emissions or workforce numbers, rather than at the top of the structure where sustainability data usually lives. The European Commission rewrote the entry conditions in February 2026, raising the turnover gate sharply, so a number of groups that spent 2024 and 2025 preparing have just dropped out of scope, while others now need to recheck whether they are still in.

The first reports are not due until 2029, for financial years starting on or after 1 January 2028. That sounds distant. The work that decides who is in scope, which entity files, and whether the data even exists has to happen well before then, which is why the standard-setting and the threshold reset matter now rather than in 2028.

Related reading: our guide to CSRD sustainability reporting

CSRD third-country reporting: the trigger is EU activity, not an EU listing

The legal basis is Chapter 9a of the EU Accounting Directive (Directive 2013/34/EU), inserted by the Corporate Sustainability Reporting Directive (Directive (EU) 2022/2464). Chapter 9a is short. It runs across four articles, 40a to 40d, and it builds a reporting obligation for groups that are governed by the law of a third country but trade significantly inside the Union.

Article 40a sets out the obligation. A Member State requires that a subsidiary established in its territory, whose ultimate parent is governed by third-country law, publishes a sustainability report at the group level of that ultimate third-country parent. Where the group has no qualifying EU subsidiary, the same duty attaches to an EU branch instead. The report is about the global group, prepared from the parent down, even though the entity that publishes it sits one or several levels below.

This is a different mechanism from the one most people associate with CSRD. The familiar route, in Articles 19a and 29a of the same directive, makes an EU undertaking report on itself and its own group. Article 40a does something else. It makes a European subsidiary or branch the publication vehicle for a report that describes a parent and a group sitting outside EU jurisdiction. Under this route the European entity serves as the publication vehicle, putting the group’s report on the European public record rather than describing its own sustainability performance.

Who is caught after the February 2026 Omnibus reset the gate

The original thresholds in Article 40a were these. The third-country group had to generate net turnover of more than EUR 150 million in the Union in each of the last two consecutive financial years. On top of that, the group needed either a large EU subsidiary (or a non-micro listed SME subsidiary that is a public-interest entity), or, failing such a subsidiary, an EU branch with net turnover above EUR 40 million in the preceding financial year.

Those numbers changed. Directive (EU) 2026/470 of 24 February 2026, the content directive in the Commission’s Omnibus simplification package, raised the bar. The third-country group’s EU net turnover threshold moved from EUR 150 million to EUR 450 million, still tested across each of the last two consecutive financial years. The qualifying subsidiary or branch test was reset to a single net-turnover gate of EUR 200 million, replacing the old large-undertaking size test for subsidiaries and the EUR 40 million figure for branches. The same Omnibus directive cut the equivalent reporting population for EU companies down to undertakings above EUR 450 million net turnover and more than 1,000 employees, so the third-country reset is part of a wider proportionality move, not a standalone carve-out.

So the post-Omnibus position runs in two limbs. The group, at its ultimate level, generated more than EUR 450 million of net turnover in the Union for each of the last two consecutive financial years. And it has an EU subsidiary or, absent that, an EU branch with net turnover above EUR 200 million in the preceding financial year. Both limbs have to be satisfied. A large EU turnover with no sufficiently large EU subsidiary or branch does not bring the group in, and a large EU subsidiary inside a group whose EU turnover stays under EUR 450 million does not either.

Here is where teams most often get the arithmetic wrong. The EUR 450 million is net turnover in the Union, not worldwide. A group with USD 30 billion of global revenue is not automatically in scope; the question is what it books inside the EU. When I reconcile a group’s EU turnover, the figure rarely sits in one tidy place. It is spread across statutory accounts filed in several Member States, each prepared on its own local accounting framework, and the directive defines net turnover here as revenue under the financial reporting framework on which the entity’s financial statements are drawn up. Pulling those numbers onto a single consistent EU basis, for two consecutive years, is the real scoping exercise, and it is more work than reading a single consolidated revenue line.

The Omnibus also added a route out for one structure. Where the third-country parent is a financial holding undertaking whose subsidiaries run independent business models and operations, the directive lets Member States exempt those subsidiaries and branches from the Article 40a publication duty. That recognises that a pure holding company over unconnected businesses is a poor candidate for a single group-level sustainability narrative. It is a specific derogation tied to genuine independence between the subsidiaries, not a general escape hatch for any group with a holding company at the top.

The EU subsidiary or branch carries the duty, not the parent

Article 40c is the provision that surprises group legal teams. It fixes responsibility on the European entity. For a subsidiary, the members of its administrative, management and supervisory bodies have collective responsibility for ensuring, to the best of their knowledge and ability, that the group’s sustainability report is drawn up under Article 40a and is published under Article 40d. For a branch, the branch itself carries that responsibility.

The rule runs the other way round. The legal exposure for getting this wrong sits with the directors of an EU subsidiary that may be a sales company or a regional operating entity with no sustainability team. Those directors are responsible for a report describing a parent they do not control and a global footprint they cannot directly measure. The directive softens this with a knowledge-and-ability standard rather than strict liability, but the named responsible party is the European entity, not head office.

That allocation drives a practical sequence that should start long before 2028. The EU subsidiary or branch needs a data channel to the parent, an internal owner for the obligation, and a fallback plan for the case where group data arrives late or incomplete. None of that is automatic. In my experience the European entity often learns it is the named filer only when group finance forwards a data request and the local board asks why a sustainability report is being prepared in its name. The earlier the responsible entity is identified inside the structure, the less of a scramble the first cycle becomes.

What the report must contain, and the standard behind it

Article 40a points to the content blocks of Article 29a(2), the consolidated reporting article, rather than inventing a separate content list. The third-country report covers the information in points (a)(iii) to (a)(v), points (b) to (f) and, where appropriate, point (h) of Article 29a(2), all at the group level of the ultimate third-country parent. In plain terms, that pulls in the group’s policies, targets, the role of administrative and management bodies, principal actual and potential adverse impacts, and the actions taken on those impacts. It is recognisably the CSRD content set, scoped to the global group.

The standard the report must follow is set by Article 40b. That article required the Commission to adopt, by 30 June 2024, a delegated act providing sustainability reporting standards specifically for third-country undertakings. That deadline passed without the standards being adopted, which is why there is still no final third-country standard in force and why EFRAG is actively developing one now. The reporting obligation exists in primary law; the dedicated standard that operationalises it does not yet.

Article 40a(2) provides flexibility while that gap remains. By derogation, the third-country report may instead be drawn up under the EU sustainability reporting standards adopted pursuant to Article 29b (the ESRS that EU companies use), or in a manner equivalent to those standards as determined by a Commission equivalence implementing act. A group already reporting under a recognised non-EU framework may be able to lean on the equivalence route rather than rebuild from scratch, though equivalence has to be formally determined, not assumed.

The mechanism for missing data is worth reading closely, because it is the realistic outcome for many first cycles. Where the EU subsidiary or branch cannot get the information needed to draw up the report, it must request that information from the third-country parent. If the parent still does not provide everything, the subsidiary or branch publishes the report with all the information it does hold, and issues a statement that the third-country undertaking did not make the necessary information available. The obligation is to publish what you have and to be transparent about the gap, not to fabricate the missing parts. That structure tells you the EU lawmakers anticipated incomplete cooperation from parents outside their jurisdiction.

This is also the cleanest way to see how the third-country route differs from the EBA’s prudential reporting for third-country branches. The sustainability obligation here is a group-level disclosure routed through an EU entity; it is not a solo return on the branch’s own balance sheet. Teams that handle third-country branch reporting under the EBA framework should not assume the same scoping logic carries across, because one looks at the branch and the other looks through it to the global parent.

The N-ESRS exposure draft and the consultation window

EFRAG, the EU’s technical adviser on sustainability standards, is building the dedicated standard, referred to as the Non-EU ESRS, or N-ESRS, for non-EU groups. EFRAG completed the bulk of the technical development across 2024 and early 2025, then paused while the broader ESRS simplification ran its course, and has now resumed to finalise the exposure draft and consultation package.

The near-term dates are set. EFRAG is opening a public consultation on the draft N-ESRS in the second half of July 2026, running for 100 days. Alongside it, EFRAG is running educational webinars on 22 July 2026 across three time slots covering different time zones, at 9:00, 13:30 and 17:30 CEST, with a European Commission legal officer presenting the legal background of the Article 40a regime. Before the consultation opens, EFRAG is field-testing the draft and has asked interested companies to register their expression of interest before 1 July 2026, with the field-test questionnaire due within 70 days of the start and follow-up interviews in October 2026. After weighing the responses, EFRAG plans to deliver its technical advice to the European Commission.

The N-ESRS departs from ESRS Set 1, and treating it as a copy would be a mistake. It is being designed for an entity that publishes on behalf of a parent it does not control, drawing on group-level information that may have been prepared under another framework. That shapes the standard toward interoperability with non-EU reporting, a workable treatment of references to EU law that a non-EU group will not have applied, and a content set proportionate to what a third-country parent can realistically deliver. A non-EU group watching this process should read the exposure draft as the most direct signal yet of what its eventual EU report will need to contain.

Publication, assurance, and the statement that admits a data gap

Article 40d governs publication. The subsidiary or branch publishes the report, together with the assurance opinion and any data-gap statement, within 12 months of the balance sheet date of the financial year the report covers. Publication runs through the Member State business register machinery, under the company-law disclosure rules in Directive (EU) 2017/1132, with free public access. The Commission also maintains a public list of the third-country undertakings that publish a sustainability report, built from information Member States may pass up annually.

Assurance applies here too, and it is not optional in principle. Article 40a(3) requires the report to be published with an assurance opinion from a person or firm authorised to give such an opinion either under the law of the third country or under a Member State’s law. If the parent does not provide an assurance opinion, the EU subsidiary or branch again issues a statement saying so. The Omnibus directive separately pushed the Commission’s deadline for adopting limited assurance standards to 1 July 2027 and dropped the earlier requirement to move to reasonable assurance, so the assurance regime that will apply to these reports is itself still settling.

One detail that trips up reporting teams: the publication route under Article 40d does not, in itself, import the digital tagging obligation that EU issuers face. EU undertakings reporting under Articles 19a and 29a must mark up their sustainability statements in the single electronic reporting format, the work covered in our note on the ESMA ESEF taxonomy update. The third-country publication obligation is built on the company-law register rules rather than the transparency-directive markup rules, so teams should confirm the format expectation for their Member State of publication rather than assume an automatic ESEF tagging requirement.

The timeline: nothing to file before 2029, plenty to map before 2028

CSRD entered into force on 5 January 2023, and Member States had to transpose it by 6 July 2024. The third-country regime in Articles 40a to 40d applies for financial years starting on or after 1 January 2028, which puts the first third-country sustainability reports into the public registers in 2029. The stop-the-clock directive of April 2025 (Directive (EU) 2025/794) postponed the EU company reporting waves but left the third-country start date at 2028, and the February 2026 Omnibus reset the thresholds without moving that first-application date.

The gap between now and 2028 is preparation time, not slack. It is the window to settle three questions that cannot be answered quickly. First, is the group actually in scope after the EUR 450 million and EUR 200 million reset, tested over two consecutive years of EU net turnover. Second, which single EU subsidiary or branch is the responsible filer, and does that entity have a board and an owner ready to carry the duty. Third, can the parent produce, on a repeatable basis, group-level sustainability data that maps to the eventual N-ESRS content. A group that answers those in 2028 is already late, because the first reporting year will have started.

It is also worth holding the threshold reset loosely. The Accounting Directive requires the Commission to review the monetary thresholds at least every five years for inflation, and the inflation-review mechanism in the amended Article 3(13) now expressly covers the Article 40a(1) subparagraphs. The EUR 450 million and EUR 200 million figures are the current numbers, not permanent ones, and a group sitting just under either line should re-test its position as turnover and the thresholds both move.

What non-EU groups can settle now

None of the preparation work depends on the final N-ESRS text. A group can run the two-limb scope test today against its last two years of EU net turnover and its largest EU subsidiary or branch turnover. It can identify, inside the legal structure, the single entity that would be the responsible filer, and brief that entity’s board that a duty is coming. It can test whether group sustainability data can be cut to a European publication on a yearly cycle, and where the data gaps sit that would otherwise force a public statement of non-availability.

The cross-references in this regime reward early reading. The content blocks borrow from Article 29a(2), the available standards in the interim borrow from the EU ESRS through the Article 40a(2) derogation, and the simplification context sits in the broader CSRD Omnibus package. Financial groups also face overlapping ESG disclosure work under prudential rules, so a bank inside a non-EU group should line this up against its ESG Pillar 3 disclosure obligations rather than treat the two as unrelated streams.

Frequently Asked Questions

Does a non-EU parent company file the report itself?

No. Under Article 40a, the EU subsidiary or, where there is no qualifying subsidiary, the EU branch publishes the report. Article 40c places the responsibility on that European entity, including collective responsibility on the directors of a subsidiary. The parent is the subject of the report, not the filer.

Is the EUR 450 million threshold based on global or EU turnover?

EU turnover. The test is net turnover of more than EUR 450 million generated in the Union, measured at the group level (or the individual level where there is no group), for each of the last two consecutive financial years. Worldwide revenue is not the trigger.

What changed in the February 2026 Omnibus for third-country undertakings?

Directive (EU) 2026/470 raised the group’s EU turnover threshold from EUR 150 million to EUR 450 million and set the qualifying subsidiary or branch threshold at EUR 200 million of net turnover, replacing the old large-undertaking size test for subsidiaries and the EUR 40 million branch figure. It also allowed Member States to exempt subsidiaries of a third-country financial holding undertaking whose businesses are independent of one another.

When are the first third-country sustainability reports due?

For financial years starting on or after 1 January 2028, with the first reports published in 2029. The stop-the-clock directive of 2025 and the 2026 Omnibus did not move this first-application date.

Which standard does the third-country report follow?

Article 40b requires a dedicated third-country standard, which the Commission has not yet adopted and which EFRAG is developing as the N-ESRS. In the interim, Article 40a(2) lets the report be drawn up under the EU ESRS or under a framework formally determined to be equivalent.

What happens if the parent will not provide the data?

The EU subsidiary or branch must request the information from the parent. If it is still not provided, the entity publishes the report with all the information it holds and issues a statement that the third-country undertaking did not make the necessary information available. The same approach applies to a missing assurance opinion.

Does the third-country report need assurance?

Yes. Article 40a(3) requires an assurance opinion from a person or firm authorised under the law of the third country or of a Member State. If none is provided, the subsidiary or branch states that the assurance opinion was not made available. The Commission’s limited assurance standards were rescheduled by the Omnibus to 1 July 2027.

Related Articles

Key Takeaways

  • CSRD third-country reporting (Chapter 9a, Articles 40a to 40d of Directive 2013/34/EU) reaches non-EU groups through the size of their EU activity, not through an EU listing.
  • After Directive (EU) 2026/470 of 24 February 2026, the group’s EU net turnover threshold is EUR 450 million across two consecutive years, and the qualifying EU subsidiary or branch threshold is EUR 200 million of net turnover.
  • The EUR 450 million test is EU turnover, not worldwide revenue, and reconciling it across Member-State statutory accounts is the real scoping work.
  • The EU subsidiary or branch is the legal filer and carries responsibility under Article 40c. The parent is the subject of the report, not the publisher.
  • The report covers the global group under the Article 29a(2) content blocks, and follows a dedicated third-country standard that EFRAG is still developing as the N-ESRS.
  • EFRAG opens its N-ESRS public consultation in the second half of July 2026 (100 days), with webinars on 22 July 2026 and technical advice to the Commission to follow.
  • First reports are due for financial years starting on or after 1 January 2028, published in 2029. Scope-testing, filer identification and data mapping need to happen before then.
  • Where the parent will not supply data or assurance, the EU entity publishes what it holds and issues a statement disclosing the gap.

Sources and References

  • Directive (EU) 2022/2464 (Corporate Sustainability Reporting Directive), Chapter 9a, Articles 40a to 40d and recital 20 – EUR-Lex
  • Directive 2013/34/EU (Accounting Directive), as amended – EUR-Lex
  • Directive (EU) 2026/470 of 24 February 2026 (Omnibus content directive, amending Directives 2006/43/EC, 2013/34/EU, (EU) 2022/2464 and (EU) 2024/1760), recital 26 and Article 2 (amending Directive 2013/34/EU) – EUR-Lex
  • Directive (EU) 2025/794 of 14 April 2025 (stop-the-clock directive) – EUR-Lex
  • EFRAG, Non-EU ESRS (N-ESRS) for non-EU groups, project and research phase – EFRAG
  • EFRAG, resumed work on the sustainability reporting standard for non-EU groups and field-test call for expression of interest – EFRAG
  • EFRAG, save-the-date webinars on ESRS for third-country undertakings, 22 July 2026 – EFRAG

Where this leaves a non-EU group’s reporting function

The instinct of a non-EU group is to read CSRD as a European problem for European companies. Article 40a closes that door. A group with enough EU turnover and a large enough EU subsidiary or branch owns a European reporting obligation, discharged through an entity that may never have filed a sustainability report before. The February 2026 reset narrowed who is caught, but for the groups still over the line it sharpened the rest of the design: one EU filer, one global-group report, one dedicated standard arriving through EFRAG, and one hard start date in 2028. The groups that come out of this cleanly are the ones that run the scope test and name the filer now, while the standard is still in draft and the first reporting year has not yet begun.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.

Similar Posts