California’s Climate-Related Financial Risk Disclosure statute (SB 261) is here to stay for large corporations doing business in the state. If your company has ≥ $500 million in annual revenue (public or private) and does business in California, you’ll have to put out a biennial climate-related financial risk report—with the initial report due January 1, 2026.
High-level, SB 261 requires covered companies to produce a public report describing material climate-related financial risks and the steps it has taken to manage or adapt to those risks. The law points to existing frameworks— Task Force on Climate-related Financial Disclosures (TCFD), in this instance—for structure (governance, strategy, risk management, metrics/targets). Like the California Transparency in Supply Chains obligations, the report must appear on your company website, and the California Air Resources Board (CARB) maintains a public docket where firms post the link starting December 1, 2025 (docket kept open through July 1, 2026, for first-year reports). CARB’s July 9, 2025, FAQs reaffirm the January 1, 2026, deadline and indicate that first-year reports can reasonably use FY 2023/24 or FY 2024/25, depending on your fiscal year. They also outline that good-faith efforts (best available data) serve in enforcement, realizing that data maturity improves over time.
Litigation status: on August 18, 2025, a federal district court rejected a preliminary injunction that would have put SB 261 (and SB 253) on hold. Translation: deadlines still apply while the case proceeds—so keep preparing.
Penalties: SB 261 allows for administrative penalties of up to $50,000 for each report year for failure to file or inadequate reports (in addition to SB 253’s higher limit).
CARB says SB 261 would include firms conducting business in California with ≥ $500 million in total annual revenue (other than SB 253’s ≥ $1 billion).
In early staff proposals, CARB mentions the Franchise Tax Board tests (e.g., California sales, property, payroll thresholds, or commercial domicile) as most likely to be the standard for “doing business,” to be finalized in rulemaking. If you exceed the revenue threshold and pass one of those tests, expect to be in scope.
Your climate-related financial risk report needs to address, in plain language and with decision-useful detail:
CARB encourages adherence to best practice frameworks (e.g., TCFD), and legislation allows for flexibility to choose an appropriate framework.
4. Materiality scoping: Conduct top-down risk enumeration by business unit/value chain stage, with clear demarcation of physical vs transition risks.
5. Heatmaps & prioritization: Use financial impact bands (EBITDA, capex, opex, revenue at risk) and probability to rank material risks; map each risk onto controls/mitigations in place.
6. Resilience tests: If at all possible, do scenario-based stress tests (e.g., policy or commodity price shocks) to stress the strategy to different futures, though SB 261 does not mandate quantitative scenario testing.
7. Document up to TCFD headings: Adopt the same format as prior (Governance, Strategy, Risk Management, Metrics/Targets).
8. Controls & sign-off: Approaches this as Management’s Discussion & Analysis (MD&A)—involve internal audit/control; ensure legal review (safe-harbor statements, forward-looking statements).
9. Web & docket: Have a public web page available and be ready to place the link into CARB’s public docket on December 1, 2025; try to publish before January 1, 2026.
10. Document “good-faith”: If certain measures are evolving, disclose approaches/sources and your strategy for improving data quality over time.
If you can knock down the $500 M+ barrier to doing business, start now. Make SB 261 a board-level, finance-led exercise based on financially material climate risks and the controls you’re implementing to manage them. Publish a clean, TCFD-aligned report on your site, and expect to be able to drop the link to CARB’s docket in December.
Contact Enviropass for any compliance questions.