CSRD Sustainability Reporting: What Luxembourg Entities Need to Know

Last updated: March 2026

If you work in reporting at a Luxembourg bank, fund manager, or insurance company, the CSRD has probably been on your radar since 2023. You may have started a gap analysis. You may have budgeted for an ESG data platform. And then the Omnibus hit, the scope shrank by roughly 80%, the timelines shifted, and your project plan became a question mark. That is the reality right now. The rules exist, but they look nothing like the version most teams prepared for.

This article walks through the CSRD as it actually stands in March 2026: the original framework, the Omnibus overhaul that entered into force on 18 March 2026, the Stop-the-Clock postponement, and what all of this means for entities operating in Luxembourg, where transposition has not yet happened.

Related reading: FINREP Reporting Explained

What the CSRD Was Supposed to Do

The Corporate Sustainability Reporting Directive (Directive (EU) 2022/2464) replaced the Non-Financial Reporting Directive (NFRD) and expanded sustainability disclosure requirements across the EU. Adopted on 14 December 2022, the CSRD introduced a standardised reporting framework under the European Sustainability Reporting Standards (ESRS), developed by the European Financial Reporting Advisory Group (EFRAG) and adopted by the Commission as Delegated Regulation (EU) 2023/2772 on 31 July 2023.

The original CSRD had three ambitions that set it apart from the NFRD. It widened the scope from roughly 11,700 to an estimated 50,000 companies across the EU. It mandated reporting against a common standard (ESRS) instead of allowing companies to pick their own framework. And it required third-party assurance of sustainability statements for the first time.

For reporting teams, the change was not just about more disclosures. It meant building data pipelines, establishing internal controls, and embedding sustainability reporting into the same governance structures as financial reporting. I have seen teams in Luxembourg treat this as a side project. It is not. The data collection effort alone, especially along the value chain, dwarfs anything the NFRD required.

The Original Phased Timeline

The CSRD introduced a staggered rollout by company type:

Wave 1 (FY 2024, first reports in 2025): Large public-interest entities already subject to the NFRD with more than 500 employees. This wave is live. First sustainability statements under ESRS were published in early 2025.

Wave 2 (FY 2025, first reports in 2026): All other large undertakings meeting at least two of three size criteria: more than 250 employees, net turnover above EUR 50 million, or total assets above EUR 25 million.

Wave 3 (FY 2026, first reports in 2027): Listed SMEs, small and non-complex credit institutions, and captive insurance undertakings.

Wave 4 (FY 2028, first reports in 2029): Third-country undertakings with substantial EU activity.

That was the plan. Two legislative interventions changed it.

The Stop-the-Clock Directive: Wave 2 and Wave 3 Postponed

Before the Omnibus even landed, the EU adopted the Stop-the-Clock Directive (Directive (EU) 2025/794) on 14 April 2025. This directive postponed the reporting obligations for Wave 2 and Wave 3 entities by two years.

The effect is straightforward:

Wave 2 entities, originally due to report on FY 2025, now report on FY 2027 at the earliest (first reports in 2028).

Wave 3 entities, originally due to report on FY 2026, now report on FY 2028 at the earliest (first reports in 2029).

Wave 1 entities were not affected. If your entity was already reporting under the NFRD and had more than 500 employees, you filed your first ESRS-based sustainability statement in 2025 as planned. The Stop-the-Clock bought time for everyone else while the Omnibus negotiations played out.

The Omnibus: Directive (EU) 2026/470

The Omnibus is the bigger story. The Commission published its proposal on 26 February 2025. The European Parliament and Council reached a provisional agreement on 9 December 2025. Parliament adopted the text on 16 December 2025. The Council officially adopted it on 24 February 2026. Directive (EU) 2026/470 was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026.

This is not a proposal. It is adopted law. Every section of this article reflects the Omnibus as it now stands.

Scope: From 50,000 Companies to Around 10,000

The original CSRD cast a wide net. The Omnibus pulled it back dramatically. Under the adopted text, mandatory sustainability reporting now applies only to undertakings that meet both of the following thresholds:

More than 1,000 employees, AND net annual turnover exceeding EUR 450 million.

Both criteria must be met. This is a significant narrowing. The original CSRD used two-of-three criteria (250 employees, EUR 50M turnover, EUR 25M balance sheet) that captured a far larger population. The Omnibus replaced those thresholds entirely.

Listed SMEs have been removed from scope altogether. Under the original CSRD, they would have entered in Wave 3. Under the Omnibus, they have no mandatory reporting obligation, though they may report voluntarily using the VSME standard that EFRAG submitted to the Commission in December 2024.

The Commission estimates this reduces the number of in-scope companies from roughly 50,000 to around 10,000 across the EU.

ESRS Data Points: A 70% Reduction

The ESRS Set 1 standards, as adopted in Delegated Regulation (EU) 2023/2772, contained approximately 1,144 data points across 12 standards (two cross-cutting, five environmental, four social, one governance). Under the Omnibus, the Commission is mandated to revise the ESRS, targeting a reduction from 1,073 mandatory data points to approximately 320. That is a 70% cut.

The revision is expected to be finalised by mid-2026. Until then, Wave 1 entities continue reporting against the current ESRS Set 1. In practice, this means the first wave of reporters is working with the full standard set while the rules are being rewritten beneath them. I expect this to create confusion, particularly around what is considered “material” under the revised framework versus the current one.

Assurance: Only Limited, Not Reasonable

The original CSRD required limited assurance initially, with a review clause for transitioning to reasonable assurance by October 2028. The Omnibus has removed the reasonable assurance transition entirely. Only limited assurance is mandated going forward.

For reporting teams, this is a practical relief. Reasonable assurance would have required the same level of evidence and testing as a financial audit. Limited assurance is a lighter-touch engagement. But do not read this as a signal that quality does not matter. Enforcement bodies, including ESMA, have made clear they expect sustainability statements to meet a high bar even under limited assurance.

Sector-Specific Standards: Dropped

The original CSRD mandated the Commission to adopt sector-specific ESRS by June 2026, covering high-impact sectors like oil and gas, mining, and financial services. The Omnibus removes this obligation. There is no longer a requirement to adopt mandatory sector-specific standards. The Commission may develop voluntary sector guidance, but the binding mandate is gone.

In practice, this means financial institutions in Luxembourg will not face a tailored ESRS standard for banking or fund management. Reporting will be based on the general ESRS standards, with sector-specific disclosures handled through the materiality assessment rather than a dedicated standard.

Value Chain Cap

One of the most operationally painful aspects of the original CSRD was the value chain reporting requirement. Companies had to collect sustainability data from suppliers, customers, and other counterparties, many of whom had no reporting infrastructure of their own.

The Omnibus introduces a value chain cap. For sustainability reporting purposes, companies in scope cannot request information from value chain partners with fewer than 1,000 employees that exceeds what is specified in the Voluntary SME Standard (VSME). This limits the data burden on smaller companies and, in practice, constrains how far the reporting entity can go in its value chain disclosures.

Third-Country Undertakings: Revised Thresholds

The original CSRD required third-country companies with net EU turnover above EUR 150 million and at least one EU subsidiary or branch to report. The Omnibus revises these thresholds:

Parent undertakings: net EU turnover exceeding EUR 450 million.

Subsidiaries or branches: generated turnover exceeding EUR 200 million.

The timeline for third-country reporting has also shifted. Original Wave 4 (FY 2028) deadlines are subject to the broader postponement effects. Entities should monitor the final transposition dates in their relevant Member State.

Double Materiality: The Core Concept

Regardless of the scope changes, the CSRD’s double materiality principle remains intact under the Omnibus. Companies must assess and report on sustainability matters from two perspectives:

Impact materiality: how the company’s activities affect people and the environment.

Financial materiality: how sustainability matters affect the company’s financial position, performance, and cash flows.

A topic is material if it is significant from either perspective. The materiality assessment drives the entire reporting exercise. If a topic is not material under either lens, the company does not report on it under ESRS but must disclose why it concluded it was not material.

EFRAG published Implementation Guidance IG1 on materiality assessment to support companies in this process. From what I have seen in practice, the materiality assessment is where most teams struggle. It requires cross-functional input from sustainability, risk, finance, and operations, and the methodology needs to be documented and auditable.

ESRS Set 1: What Gets Reported

The current ESRS Set 1 comprises 12 standards organised into three layers:

Cross-Cutting Standards

ESRS 1 (General Requirements) sets out the architecture: reporting boundaries, time horizons, materiality principles, and connectivity with financial statements. ESRS 2 (General Disclosures) contains mandatory disclosures on governance, strategy, impact/risk/opportunity management, and metrics. ESRS 2 applies to all in-scope entities regardless of the materiality assessment.

Topical Standards

Five environmental standards: ESRS E1 (Climate Change), E2 (Pollution), E3 (Water and Marine Resources), E4 (Biodiversity and Ecosystems), E5 (Resource Use and Circular Economy).

Four social standards: ESRS S1 (Own Workforce), S2 (Workers in the Value Chain), S3 (Affected Communities), S4 (Consumers and End-Users).

One governance standard: ESRS G1 (Business Conduct).

Topical standards are subject to the materiality assessment. If climate change is not material (an unlikely finding for most financial institutions, but possible), the entity can omit ESRS E1 disclosures with an explanation.

Remember that the Omnibus mandates a revision of these standards with a target reduction to around 320 data points. The revised standards are expected by mid-2026. Until then, the current Set 1 applies to Wave 1 reporters.

Assurance and Digitisation

Sustainability statements must be assured by a statutory auditor or an independent assurance services provider (where Member States allow it). The standard is limited assurance, as confirmed by the Omnibus. The assurance covers compliance with ESRS, including the materiality assessment methodology and the digital tagging of the report.

The CSRD requires sustainability statements to be prepared in XHTML format with Inline XBRL tagging, using the ESRS XBRL taxonomy. This enables machine-readable access to sustainability data and aligns with the European Single Electronic Format (ESEF) already used for financial statements of listed companies. For entities new to XBRL, this is a meaningful IT project.

Luxembourg: Transposition Still Pending

Luxembourg has not yet transposed the CSRD into national law. Bill of Law 8370 was submitted to the Chamber of Deputies (Chambre des Députés) on 29 March 2024. However, the transposition has been postponed in light of the Omnibus changes. Since the Omnibus (Directive (EU) 2026/470) entered into force on 18 March 2026 and materially amends the CSRD’s scope and requirements, Luxembourg is waiting to incorporate these amendments into its transposition rather than adopt a law that would immediately need revision.

This creates a practical gap. Wave 1 entities in Luxembourg (large PIEs with 500+ employees already reporting under the NFRD) are reporting based on the directly applicable ESRS Delegated Regulation, but the national law establishing the full CSRD framework, including enforcement mechanisms, penalties, and the designation of competent authorities, is not yet in place.

The CSSF has not issued specific guidance on CSRD implementation for supervised entities beyond its general expectation that institutions prepare for the new requirements. ESMA’s July 2024 public statement (“Off to a good start: first application of ESRS by large issuers,” ESMA32-992851010-1597) provides the closest thing to supervisory guidance for first-time reporters, covering materiality assessment, transitional reliefs, and connectivity between financial and sustainability reporting.

For entities that thought they were in Wave 2 or Wave 3, the combined effect of the Stop-the-Clock postponement and the Omnibus scope reduction means many Luxembourg companies may no longer be in scope at all. Any entity with fewer than 1,000 employees or net annual turnover below EUR 450 million is now outside the mandatory reporting perimeter.

What This Means for Different Entity Types in Luxembourg

Banks and Credit Institutions

Large Luxembourg banks that were already NFRD reporters (Wave 1) continue reporting under ESRS. The CSSF supervises these entities for prudential purposes and will presumably oversee sustainability reporting once national transposition is complete. Smaller banks falling below the new Omnibus thresholds (fewer than 1,000 employees or turnover below EUR 450 million) are no longer in mandatory scope. They can report voluntarily.

Fund Managers and Management Companies

Most Luxembourg management companies are well below the Omnibus thresholds. The CSRD’s impact on the fund industry was always indirect: funds themselves are not in scope, but the management company might have been. Under the new thresholds, very few management companies will qualify. The more pressing ESG reporting obligation for the fund industry remains the Sustainable Finance Disclosure Regulation (SFDR) at product level.

Insurance Undertakings

Large insurance groups headquartered in Luxembourg that met the NFRD criteria are in Wave 1. The Commissariat aux Assurances (CAA) supervises insurance entities, but specific CSRD guidance for the Luxembourg insurance sector has not been published. Captive insurance undertakings, originally in Wave 3, benefit from both the Stop-the-Clock postponement and the Omnibus scope reduction.

Non-Financial Corporates

Luxembourg-based holding companies, industrial groups, and service companies above both Omnibus thresholds remain in scope. Those below either threshold are out. Given Luxembourg’s economy is dominated by financial services and smaller corporate structures, the Omnibus likely removes a significant number of entities that would have been captured under the original CSRD criteria.

Interaction with Other ESG Frameworks

SFDR and Taxonomy Regulation

The CSRD does not exist in isolation. The Sustainable Finance Disclosure Regulation (Regulation (EU) 2019/2088) requires financial market participants to disclose sustainability risks and adverse impacts at entity and product level. CSRD data feeds directly into SFDR compliance: principal adverse impact indicators under SFDR rely on data that the CSRD makes available from investee companies.

The Taxonomy Regulation (Regulation (EU) 2020/852) requires in-scope companies to disclose the proportion of their activities that are taxonomy-aligned. Under the Omnibus, the Green Asset Ratio (GAR) reporting obligation now applies only to CSRD companies with turnover exceeding EUR 450 million. Others can report voluntarily.

CSDDD

The Corporate Sustainability Due Diligence Directive was also amended by the Omnibus package. The interaction between CSRD reporting and CSDDD due diligence obligations means companies may need to align their sustainability governance structures to serve both frameworks. In practice, the value chain data collection for CSRD and the due diligence requirements under CSDDD overlap substantially.

Practical Steps for Luxembourg Entities

Step 1: Reassess Scope

Apply the Omnibus thresholds to your entity. Do you have more than 1,000 employees AND net annual turnover exceeding EUR 450 million? If not, you are outside mandatory scope. If you are in a group, check whether the parent entity is in scope, as consolidated reporting may still apply.

Step 2: Monitor Luxembourg Transposition

Bill 8370 remains pending before Parliament. The final transposed law will incorporate the Omnibus amendments. Watch for the revised text, which will establish the national enforcement framework, competent authority designation, and any Luxembourg-specific options (such as allowing independent assurance providers alongside statutory auditors).

Step 3: Do Not Stop Preparing

If you are in scope, the Omnibus does not eliminate reporting. It simplifies it. The data collection, governance, and assurance requirements still require significant preparation. If you are out of scope but have investors, lenders, or value chain partners who need your ESG data, voluntary reporting under the VSME standard is likely the practical path.

Step 4: Align with Existing Frameworks

If your entity already reports under SFDR, Taxonomy, or Pillar 3 disclosure requirements, map the overlaps. Much of the data infrastructure you have built for those frameworks feeds into CSRD compliance. Avoid building parallel systems.

Frequently Asked Questions

Has the CSRD been transposed in Luxembourg?

No. Bill of Law 8370 was submitted to Parliament on 29 March 2024 but has been postponed pending incorporation of the Omnibus amendments. There is no “Law of 22 December 2023” or any other enacted CSRD transposition law in Luxembourg.

Is the Omnibus still a proposal?

No. Directive (EU) 2026/470 was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026. It is adopted, binding law.

What are the new scope thresholds under the Omnibus?

More than 1,000 employees AND net annual turnover exceeding EUR 450 million. Both criteria must be met. Listed SMEs have been removed from scope entirely.

Are listed SMEs still required to report?

No. The Omnibus removed listed SMEs from the CSRD’s mandatory scope. They may report voluntarily using the VSME standard.

What happened to the reasonable assurance requirement?

The Omnibus removed the transition to reasonable assurance. Only limited assurance is required going forward.

Are sector-specific ESRS standards coming?

The Omnibus removed the obligation to adopt mandatory sector-specific standards. The Commission may develop voluntary guidance, but there is no binding mandate for sector-specific ESRS.

How many ESRS data points are there now?

The current ESRS Set 1 contains approximately 1,144 data points. The Omnibus mandates a revision reducing mandatory data points from 1,073 to approximately 320, a 70% cut. The revised standards are expected by mid-2026.

What is the Stop-the-Clock Directive?

Directive (EU) 2025/794, adopted on 14 April 2025, postponed Wave 2 and Wave 3 CSRD reporting obligations by two years. Wave 2 entities now report on FY 2027 at the earliest. Wave 3 entities report on FY 2028 at the earliest.

Key Takeaways

• The CSRD (Directive (EU) 2022/2464) replaced the NFRD and introduced standardised sustainability reporting under ESRS.
• The Omnibus (Directive (EU) 2026/470) entered into force on 18 March 2026, reducing mandatory scope to entities with more than 1,000 employees AND turnover exceeding EUR 450 million.
• Listed SMEs have been removed from mandatory scope. They may report voluntarily.
• The Stop-the-Clock Directive (Directive (EU) 2025/794) postponed Wave 2 and Wave 3 obligations by two years.
• Only limited assurance is required. The transition to reasonable assurance has been removed.
• Mandatory sector-specific ESRS standards have been dropped. Only voluntary guidance may follow.
• ESRS data points are being reduced from 1,073 to approximately 320 (70% cut), with revised standards expected by mid-2026.
• Luxembourg has not transposed the CSRD. Bill 8370 is pending before Parliament and delayed to incorporate Omnibus changes.

Related Articles

• FINREP Reporting Explained – A practical guide to FINREP templates, scope, and filing requirements for Luxembourg credit institutions.
• COREP Reporting Explained – How COREP works, which templates apply, and common pitfalls in capital adequacy reporting.
• Pillar 3 Disclosure Requirements for Luxembourg Banks – A guide to public disclosure obligations under CRR, including ESG-related Pillar 3 disclosures.
• EMIR Reporting Explained – How derivatives transaction reporting works under EMIR Refit.
• DORA Register of Information – A practical guide to the ICT third-party service provider register required under DORA.

Sources and References

• Directive (EU) 2022/2464 (CSRD) – Corporate Sustainability Reporting Directive amending the Accounting Directive, Transparency Directive, and Audit Directive https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2464
• Delegated Regulation (EU) 2023/2772 – ESRS Set 1 adopted by the Commission on 31 July 2023 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2772
• Directive (EU) 2026/470 (Omnibus) – Amending the CSRD, CSDDD, and Taxonomy Regulation; published in OJ 26 February 2026, in force 18 March 2026 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026L0470
• Directive (EU) 2025/794 (Stop-the-Clock) – Postponing Wave 2 and Wave 3 CSRD reporting obligations by two years https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025L0794
• ESMA Public Statement: “Off to a good start: first application of ESRS by large issuers” (ESMA32-992851010-1597, 5 July 2024) https://www.esma.europa.eu/sites/default/files/2024-07/ESMA32-992851010-1597_-_ESRS_Statement.pdf
• ESMA Statement on ESRS supervision in the Omnibus environment (June 2025)
• Luxembourg Chamber of Deputies – Bill of Law 8370 (CSRD transposition) https://www.chd.lu/en/dossier/8370
• EFRAG ESRS Implementation Guidance (IG1 Materiality Assessment, IG2 Value Chain, IG3 Datapoints) https://www.efrag.org/en/projects/esrs-implementation-guidance

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.