Germany’s Federal Financial Supervisory Authority sustainable finance strategy ordered improvements on 79 separate sustainability-risk issues across the banks it directly supervises, and folded its sustainable finance team into a standalone department. The number reads like a routine compliance scorecard. The detail underneath does not: only 10 percent of those banks told the regulator that physical climate risk has any material influence on their books.
That figure, drawn from a BaFin survey of less significant credit institutions and published alongside the 2026 Risks in Focus assessment, is the gap the regulator is now trying to close before extreme weather and transition shocks start arriving on loan portfolios that have not been scenario-tested for either.
Inside BaFin’s 79-Issue Order to German Banks
The 79 issues are not a single headline failure. They are a list of remediation points covering governance, the integration of sustainability risks into enterprise risk frameworks, and the way climate factors flow into strategic decision-making and capital planning. BaFin worked through the list during its 2026 supervisory cycle and ordered fixes at the institutions where the gaps were most material.
The structural move sits next to the list. BaFin elevated its sustainable finance centre to an independent department, a signal that the regulator wants permanent supervisory bandwidth on sustainability rather than a project team that gets reshuffled when the next priority lands. The change took effect alongside the publication of the 2026 supervisory programme.
The Bonn-based authority is the second-largest national supervisor in the euro area by number of supervised institutions, behind the Bank of Italy. Most of those institutions are smaller cooperative banks, savings banks and private credit institutions that fall outside direct European Central Bank supervision. They sit under BaFin and Bundesbank, and they are the population where the deficiencies cluster.
BaFin’s read is mixed rather than damning. Supervised entities have made progress on sustainability risk management since the 2019 guidance notice. The issue is that progress has not closed the distance between supervisory expectation and current practice, especially on the parts of the framework that depend on hard data rather than policy statements.
The 10 Percent Problem on Physical Risk
Of all the figures in the 2026 review, the recognition number is the one that should land hardest in the risk committees. BaFin asked credit institutions and insurers under direct supervision how material physical climate risks were to their business. The split came back sharply skewed.
- 10 percent of surveyed banks said physical climate risks have a substantial influence on the risk types they treat as material.
- 50 percent of surveyed insurers gave the same answer, a five-times higher rate of recognition.
- 70 percent of surveyed credit institutions flagged data availability as the constraint on doing more.
- 60 percent of surveyed insurers reported the same data ceiling.
The pattern is not that banks ignore climate. Most credit institutions surveyed do reflect physical hazards in their risk inventories and materiality analyses, BaFin found. The pattern is that very few then push those hazards through into the risk types that actually drive capital and provisioning. Drought stress on agricultural collateral, flood exposure on mortgage books along the Rhine and Elbe, heat-driven productivity loss on mid-corporate borrowers: each can show up in an inventory file and still be coded immaterial in the internal capital adequacy process.
That accounting matters because the loss vectors are no longer hypothetical for German lenders. The 2021 Ahrtal floods produced billions in property damage along loan-collateral footprints, and 2024’s late-summer floods across central Europe hit a similar geography. Banks that read those events as one-off weather, not as a recalibration of physical-risk parameters, are the ones writing the 90 percent.
Where the Data Wall Is Built
BaFin’s findings keep coming back to data. Banks know what they need to assess. They struggle to assemble it. The constraint sits in four places, and the regulator’s playbook now targets each one.
- Geo-coded collateral data. Smaller banks often hold property collateral with addresses but no consistent geo-coordinates, which makes overlaying flood, subsidence and heat maps a manual exercise.
- Sectoral emissions disclosure. Transition-risk modelling needs counterparty-level emissions intensity. Outside the largest corporate borrowers, that data is sparse and lags the reporting cycle.
- Hazard map coverage. Germany’s federal-state structure means hazard data sits in different registries with different update cadences.
- ESG ratings divergence. Third-party ESG scores diverge across providers, so banks using ratings as inputs end up with materially different outputs depending on the vendor.
BaFin’s response is to push banks toward usable inputs rather than perfect ones. The Risks in Focus 2026 priorities, summarised in a PwC Legal analysis of the supervisory programme, ask banks to strengthen physical-risk modelling using geo-datasets and hazard maps, and to align the SFDR (Sustainable Finance Disclosure Regulation, an EU rule on how funds report sustainability), MiFID II sustainability preferences and fund-name conventions end-to-end. That last point matters because mis-aligned product disclosures are where greenwashing cases get built.
Branson Draws a Line Around Small Banks
The contrarian beat of the week is not the 79 issues. It is what BaFin president Mark Branson said about which banks should be inside the EU rule book at all. At the regulator’s annual press conference, Branson restated his case for proportionality, arguing that loading the full sustainability reporting stack onto small German lenders produces compliance traffic without changing climate outcomes.
We will not win the fight against climate change with reports from small banks.
That is Mark Branson, BaFin president, speaking at the authority’s annual press conference in Frankfurt on May 12. The line is consistent with the policy choice BaFin has already made on the European Banking Authority’s ESG risk management guidelines. BaFin has flagged that it will be only partially compliant with the EBA standard and will not apply it to less significant institutions, the same cohort that produced most of the 79 issues.
The split is unusual. National supervisors typically signal full compliance with EBA guidelines, then negotiate the edges. BaFin is publicly carving out a tier. The argument is that supervisory effort should follow material climate impact, and the material impact in Germany sits inside larger banks with corporate-loan exposure and traded books, not inside community lenders with simple mortgage portfolios.
The counter-argument, made by climate-finance researchers and some EU officials, is that aggregate small-bank exposure to physical risk is not small in absolute terms even when each balance sheet is. A 10 percent recognition rate in this cohort is exactly the data point that complicates Branson’s case.
The CSRD and Greenwashing Pipeline
Behind the supervisory order, three regulatory currents are building toward enforcement, and they will reach banks on different timelines. Reading them together is how a risk officer should be sequencing the work.
First, the German Corporate Sustainability Reporting Directive implementation law. BaFin is preparing to enforce sustainability reporting under the German CSRD transposition, which means audited disclosures under the European Sustainability Reporting Standards will become a balance-sheet input rather than a sustainability-team output. The regulator’s balance-sheet control function has signalled it will tighten ESG reporting screws for the audit cycle ahead.
Second, greenwashing supervision. BaFin is stepping up anti-greenwashing controls across investment products, fund names and marketing claims. The mechanism is the SFDR, MiFID II and fund-name guidance stack. Banks selling investment products through their networks carry direct exposure when the underlying funds, or the way they are described, fail to match disclosure language.
Third, climate-risk modelling reviews. BaFin’s banking-supervision arm is going deeper on physical-risk model assumptions, particularly for regionally concentrated lenders. Other supervisors are doing similar work; central banks deploying AI tools to map climate risk exposures have made the technique mainstream over the past two years, and BaFin’s reviewers will expect to see comparable capability inside banks themselves.
Two calendar markers anchor the year. April 2026 brought mandatory liquidity management tool implementation for investment fund managers, which closed one piece of the supervisory loop. January 2027 brings new liquidity risk management plan requirements under Solvency II amendments, a structurally separate change that nonetheless affects how insurance-bank cross-holdings get treated.
Banks and Insurers, Side by Side
The split between banks and insurers in BaFin’s survey is sharper than the headline number suggests. The two sectors are looking at the same hazards through different lenses, and that is showing up in their risk frameworks.
| Indicator | Surveyed Banks | Surveyed Insurers |
|---|---|---|
| Physical climate risk treated as materially influential | 10% | 50% |
| Data availability cited as a constraint | 70% | 60% |
| Inclusion in risk inventory and materiality analysis | All credit institutions surveyed | Most insurers surveyed |
| Primary supervisory pressure point | Loan-book physical exposure, governance integration | Underwriting concentration, regional catastrophe risk |
| Top regulatory deadline ahead | CSRD audit cycle and ESRS governance | Solvency II liquidity risk plan, January 2027 |
Insurers are five times more likely to call physical climate risk material. They have one structural advantage: their loss data is already organised around weather events. A non-life insurer that paid out on flood claims has those claims sitting in the same datasets that feed pricing and reserving. A bank holding a mortgage on the same flooded street typically does not connect the collateral file to the hazard map without a separate exercise. The gap is not awareness; it is infrastructure.
What Lands on Risk Officers’ Desks Next
Three concrete pieces of work follow from the 2026 cycle, and they belong on the chief risk officer’s desk before the next supervisory dialogue. The first is honest materiality reassessment. The cohort that produced the 10 percent figure includes banks whose collateral books sit in flood-exposed federal states, and the next BaFin engagement will not accept a generic immateriality finding without underlying hazard analysis.
The second is the data plumbing. Geo-coded collateral, hazard-map overlays, counterparty emissions feeds and SFDR-aligned product-data pipelines are the four data assets BaFin’s framework now assumes exist. The banks that already have them spent the past two cycles building. The ones that do not are now on a clock.
The third is the proportionality bet. Branson’s small-bank exemption argument may hold inside the German supervisory perimeter, but it does not automatically hold inside the EBA framework or under future ECB stress tests. Smaller German lenders that lean on the partial-compliance position as a planning assumption are taking a regulatory view that is currently national, not European. The same dynamic that central banks naming geopolitics as their top risk concern has produced for sovereign exposure is now showing up in climate supervision: national supervisors are willing to break from common frameworks when the political logic supports it.
If the next severe-weather season hits the same exposed states without a meaningful rise in the recognition number, BaFin’s order list grows. If CSRD enforcement bites first and audit findings start naming banks publicly, the 79 issues will look like the soft version of the cycle to come.
