GRSAC: separating policy, risk management and disclosure

Short answer and objectives

GRSAC is institutional disclosure on social, environmental and climate matters; it is not a customer’s sustainability certification or a form that every Brazilian company must publish. To understand a bank’s request, separate policy, management, public disclosure and information sent to the supervisor.

This guide helps identify responsibility for each layer and how company information can support a lender’s analysis without automatically transferring the regulatory obligation. Source status: a regulatory change has been announced for 2027; this edition is not an operational compliance calendar.

Four layers, four questions

Normative references requiring consolidated-text confirmation: CMN Resolution 4,945 identifies the PRSAC policy layer; BCB Resolution 151 identifies information supplied to the supervisor. CMN-4945:policy BCB-151:reporting

BCB’s prudential index organizes the responsibility and risk-management framework. BCB-INDEX:framework The table’s operational distinction is Enverium interpretation, not a claim of equivalence between regimes or comprehensive coverage of the rules.

What changes between 2026 and 2027

Officially announced status: BCB’s index connects the Resolution 139/IN 153 regime with the transition to Resolution 586/IN 772. BCB-INDEX:grsac The September 2026 government announcement states that new requirements take effect on January 1, 2027, with phased implementation by segment. GOV-2026:transition

Effective date, information reference date and publication deadline are different things. Do not infer that every table is due on January 1. Verification pending: transitional provisions, first deadlines, exceptions and repeals require consolidated-text review. BCB-586:transition The incorporated version of the layouts also needs confirmation. BCB-772:layout

The earlier reference contains GVR, EST, GER, MEM and OPO tables with their own rules. BCB-139:tables Do not mechanically rename old files: first record each information item’s meaning, perimeter and newly applicable instruction.

Financial institution workflow

Enverium proposed practice: appoint an applicability-matrix owner and an owner for each dataset. Regulatory staff determine the regime; risk staff explain interpretation; data teams document extraction and transformations; the authorized body approves disclosure.

Build a catalog connecting each public assertion to internal evidence and a cutoff date. When a narrative says a process is used, seek records of its operation, not merely the approved policy. When a number changes, explain whether this reflects economic change, data correction, method or perimeter.

Keep an explicit list of information withheld for access or confidentiality reasons, with competent assessment of how to meet the applicable requirement. A disclosure request does not authorize dumping individual customer records onto the internet.

Workflow for a company receiving a bank request

Enverium proposed practice: ask which decision or field the request supports. Confirm period, entity, facility, unit and accepted method. A multi-site company may have consolidated data that cannot answer a location-specific question.

Supply available information with its quality and limitations. If a full inventory does not yet exist, do not enter “zero” to close the questionnaire. Identify the gap, partial coverage and owner of any improvement. A contractual information obligation requires its own assessment; it does not prove the company has become an institution required to publish GRSAC.

Fictional case: one request, two responsibilities

Fictional example: Banco Aurora requests Horizonte’s emissions and facility locations. Horizonte thinks it must produce its own GRSAC report. The bank explains that it is collecting evidence for analysis and preparation of institutional disclosure, subject to confirmation of its regulatory matrix.

The company supplies an inventory covering two of three facilities, identifies the year and distinguishes measured from estimated data. The bank preserves that limitation, checks appropriate use and decides how to handle the gap under the applicable method. Neither party calls the response a “GRSAC certificate.”

The lesson is to separate authorship and accountability: the company is responsible for what it supplies; the institution is responsible for its transformations, interpretation and disclosure. Receiving a file does not automatically transfer responsibility for a published total.

Preparation checklist

• Identify the obligated entity, segment and perimeter to confirm.
• Separate policy, management, public disclosure and supervisory reporting.
• Record instrument, edition, reference date and deadline separately.
• Distinguish received data, transformed data and published assertions.
• Preserve gaps, estimates and methodological changes.
• Obtain real technical review and approval before publication.

Limitations and claims to avoid

Avoid “every company needs GRSAC,” “PRSAC replaces risk management” and “a public report proves there is no risk.” Do not treat an earlier template or public consultation as the final effective rule either.

Official communication helps explain the direction of change, but does not replace operative provisions. This edition deliberately retains open questions: turning them into exact dates without confirmed sources would reduce, not increase, its reliability.

Further reading

Use the applicability matrix and evidence workflow. PCAF, IFRS and IFC have distinct purposes and conditions; sharing data between them does not imply regulatory equivalence.