California GHG Emissions and Climate Risk Bills Near Finalization // Cooley // Global Law Firm

Last week, the California Legislature passed two far-reaching climate disclosure bills – SB 253, the Climate Corporate Data Accountability Act (CCDAA), and SB 261, the Climate-Related Financial Risk Act (CRFRA) – together, the California Climate Accountability Package. The passage of these bills puts California in the position to implement first-of-its-kind mandatory climate disclosure in the US. While these bills are similar to the climate rule proposed by the Securities and Exchange Commission (SEC) in March 2022, the bills reach further on several fronts, as discussed below. Because the bills would apply to both public and private companies over certain revenue thresholds, they are expected to significantly broaden the number of companies required to publish public climate disclosures. Gov. Gavin Newsom has until October 14, 2023, to sign or veto the bills and, if he does neither, they will automatically become law – though he has indicated that he plans to sign both bills.

In summary, SB 253 requires disclosure of and independent third-party assurance on all global greenhouse gas (GHG) emissions – Scopes 1, 2 and 3 – for any entity “doing business in California” with global annual revenues exceeding $1 billion. SB 261 requires disclosure of climate-related financial risks, in accordance with recommendations from the Task Force on Climate-Related Financial Disclosures (TCFD), for entities doing business in California with global annual revenues exceeding $500 million. A discussion of the requirements of each bill, as well as a comparison to other climate disclosure rules, follows below. Although both bills provide broad outlines of climate reporting expectations, the California Air Resources Board will be responsible for developing implementing regulations, which will presumably contain more detailed reporting instructions.

What do you need to know about the California Climate Accountability Package?

SB 253: The Climate Corporate Data Accountability Act (CCDAA)

1. Who is subject to SB 253?
• SB 253 applies to large US companies “doing business in California” with annual revenues exceeding $1 billion (calculated on a global basis). Applicability is based on the reporting entity’s revenue for the prior fiscal year. Public and private companies are subject to SB 253.
• The bill does not define “doing business in California.” We anticipate that California will take a broad view of the phrase based on other state regulations. The California Franchise Tax Board’s definition for “doing business” in the state includes any entity that “engages in any transaction for the purpose of financial gain within California.”
2. What disclosures does SB 253 require?
• Companies must annually publicly disclose their Scopes 1, 2 and 3 GHG emissions for the prior fiscal year in conformance with the Greenhouse Gas Protocol standards and guidance. 
• “Scope 1 emissions” means all direct GHG emissions that stem from sources that a company owns or directly controls, regardless of location, including, but not limited to, fuel combustion activities.
• “Scope 2 emissions” means indirect GHG emissions from consumed electricity, steam, heating or cooling purchased or acquired by a company, regardless of location.
• “Scope 3 emissions” – also known as “full value chain emissions” – means indirect upstream and downstream GHG emissions, other than Scope 2 emissions, from sources that a company does not own or directly control, and may include, but are not limited to, purchased goods and services, business travel, employee commutes, and processing and use of sold products. The exact requirements for Scope 3 emissions disclosure are likely to be an important focus of the California Air Resources Board’s regulations.  
• Because companies subject to the bill will be required to report their Scope 3 value chain emissions, we expect to see an increase in emissions data requests from large companies to their suppliers and vendors. As a result, many companies with revenues well below $1 billion that are not directly subject to reporting obligations should expect to come under additional pressure from their customers and vendors to calculate and produce GHG emissions data. 
3. When do companies need to publish their GHG emissions under SB 253?
• Companies need to start reporting their direct and indirect (Scopes 1 and 2) emissions beginning in 2026. Emissions reporting for indirect, full value chain (Scope 3) emissions would not begin until 2027.
• The California Air Resources Board is required to adopt regulations concerning the annual reporting process on or before January 1, 2025.  
4. Will GHG emissions disclosures need to be verified?
• Yes. The final bill requires companies to obtain third-party assurance for their emissions reporting, at a limited assurance level, beginning in 2026 for Scopes 1 and 2 emissions, and at a more stringent, reasonable assurance level in 2030. The third-party assurance for Scope 3 emissions shall be performed at a limited assurance level in 2030.
• “Limited assurance” is the baseline level of assurance, where an independent auditor obtains sufficient and appropriate evidence, limiting assurance to specific aspects of the reporting. “Reasonable assurance” is the highest level of assurance and is more rigorous and intensive, requiring evidence to demonstrate the reporting is free of material misstatements.
5. Who will oversee this new disclosure regime?
• The California Air Resources Board will develop and adopt regulations implementing this new disclosure regime on or before January 1, 2025. The bill also requires the state to review these rules in 2029 and update them as necessary by 2030.
6. What are the penalties for failing to report?
• A company that fails to file the required report, or that fails to make adequate disclosures in a filed report, may face an administrative penalty of up to $500,000.

SB 261: The Climate-Related Financial Risk Act (CRFRA)

1. Who is subject to SB 261?
• SB 261 applies to public and private large US companies “doing business in California” with annual revenues exceeding $500 million (calculated on a global basis). Applicability is based on the reporting entity’s revenue for the prior fiscal year. Public and private companies are subject to SB 261.
2. What disclosures does SB 261 require?
• Companies will be required to publish a biannual climate-related financial risk report that discloses their:
• Climate-related financial risk, built upon recommendations of the TCFD or a comparable disclosure regime.
• The measures adopted to mitigate and adapt to the disclosed climate-related financial risk.
• “Climate-related financial risk,” as defined in the bill, includes all material risk of harm to immediate and long-term financial outcomes due to physical and transitional risks – such as risks to corporate operations, provision of goods and services, supply chains, employee health and safety, capital and financial investments, institutional investments, financial standing of loan recipients and borrowers, shareholder value, consumer demand, and financial markets and economic health. The exact nature of alignment with TCFD recommendations remains unclear under the statute and will likely be clarified by future implementing regulations, including whether mandatory disclosures will need to align with the governance and metrics/targets pillars of the TCFD, in addition to strategy and risk management.
• In an effort to minimize the burden on companies that are already publishing climate risk reports either voluntarily or to comply with a mandatory requirement, such as future SEC or Corporate Sustainability Reporting Directive (CSRD) disclosures, the bill provides that companies may satisfy the biannual reporting requirement with a comparable climate-related financial risk reporting framework, including the International Sustainability Standards Board (ISSB) framework. 
• The bill provides that climate-related financial risk reports may be consolidated at the parent company level and does not require a subsidiary of a parent company subject to the bill to file its own separate report.
3. When do companies need to report under SB 261?
• On or before January 1, 2026, companies will need to publish an initial climate-related financial risk report. Reports will be required every two years after the initial report. Reports must be posted publicly on the company’s website and filed with the California Air Resources Board.
• If a company cannot provide all of the required disclosures in its report, it must provide a detailed explanation of any reporting gaps, describe the steps it is taking to comply and provide complete disclosures in the future.
4. What are the penalties for failing to report?
• A company that fails to file the required report, or that fails to make adequate disclosures in a filed report, may face an administrative penalty of up to $50,000. 

Comparison with the SEC’s proposed climate rule and EU mandatory ESG reporting standards

How does the final California Climate Accountability Package compare with the SEC’s proposed climate rule?

• Timing. Although the California Climate Accountability Package is poised to be adopted while the SEC is still preparing the final version of its own climate disclosure rule, it is likely that initial SEC disclosures – once adopted – will apply for companies that are large accelerated filers in fiscal year 2024. As a result, for those companies, SEC disclosures may be due in 2025, a year in advance of California reporting obligations.
• Application. The California Climate Accountability Package goes further than the SEC proposed climate rule, as it applies to both public and private companies that do business in the state and meet certain annual revenue thresholds. The SEC’s proposed climate rule targets only public companies reporting to the SEC, including US public companies and foreign private issuers. In this respect, the California rules more closely approximate the CSRD (discussed below), which applies to non-EU entities that meet certain presence and size thresholds.  
• Scope 3 emissions. SB 253 requires that all covered companies report their Scope 3, or full value chain, emissions, while the SEC’s proposed climate rule requires Scope 3 emissions disclosure only if the company has set Scope 3 reduction targets or has determined that its Scope 3 emissions are material.
• Although the California rules may be subject to litigation, SEC climate rulemaking is exposed to unique litigation and political vulnerabilities, particularly with regard to statutory authority. In addition to reporting under the CSRD, or customer and investor expectations for climate disclosure, these new rules will create an additional layer of obligations for a large number of mature public and private companies – independent of the fate of the SEC’s rule. 

How does the California Climate Accountability Package relate to EU reporting standards?

Many US companies will be required in the near future to comply with the CSRD adopted by the EU and the European Sustainability Reporting Standards (ESRS). The CSRD requires mandatory reporting obligations for large, non-EU parent companies and subsidiaries doing business in Europe, even if the parent companies are not listed on a European exchange.

Compared with the California bills, the CSRD has a lower revenue threshold. Large EU companies – including subsidiaries of non-EU companies, listed or not – are required to report in 2026 on 2025 data, if they satisfy at least two of the following criteria: a balance sheet total of more than 20 million euros, a net turnover of 40 million euros, or an average of more than 250 employees over the financial year. Non-EU parent companies are required to report in 2029 on 2028 data. For those companies subject to both the CSRD and the California rules, reporting obligations should generally be complementary, particularly given that SB 261 contemplates satisfying reporting obligations with equivalent disclosures under other mandatory regimes, such as the CSRD. 

What should companies do to prepare?

Internal organization is a critical step in preparing for effective climate reporting. Companies should start by assigning internal responsibility for climate reporting, which often includes setting up a cross-functional committee of management team members from operations, legal and finance. Companies also should begin building an internal system for climate reporting and related data governance and disclosure controls.

Identifying appropriate outside advisers also will be an important early task – particularly, finding the right emissions accounting firm for a given business and industry to gather emissions data and prepare audit-ready GHG emissions disclosure. Climate reporting can be time-consuming and logistically challenging, especially given the need to gather full value chain GHG emissions data. It is critical for companies to first understand their carbon footprint, including their own emissions profile and that of their full value chain, before embarking on climate-related financial risk reporting.

While many companies are already publishing some GHG emissions data or TCFD-aligned climate reporting, these disclosures may not fully comply with the new California requirements, particularly with regard to Scope 3 or methodological requirements. In addition to conducting a careful gap analysis of existing reporting against these new rules, companies may want to consider other changes to account for the shift from voluntary to regulated disclosure – including adopting additional controls, improving data quality and refining methodological approaches.

If you have any questions or would like support adjusting to this new reporting regime, please contact a member of Cooley’s ESG and sustainability advisory team.