California SB 261 Climate Risk Report: 2026 Compliance Guide

The first California SB 261 climate-related financial risk report is due on or before January 1, 2026, and CARB's December 2025 proposed regulations are now the most detailed official signal of what a compliant report must contain. If your company has annual revenues of $500 million or more and does business in California, this law applies to you, whether you are public or private, incorporated in California or not.

This guide covers what changed with CARB's proposed rulemaking, what the report must contain, who is actually in scope, and how to build a compliant process before the deadline.

Key takeaway: SB 261 is a financial disclosure law, not just an ESG checkbox. The CFO office and audit committee own it, and the January 1, 2026 first-report deadline has not moved despite regulatory uncertainty.

What Is the California SB 261 Climate Risk Report?

SB 261 requires covered entities to publish a biennial climate-related financial risk report disclosing the climate-related financial risks the company faces and the measures it has adopted to reduce and adapt to those risks. The statute, formally titled the Greenhouse Gases: Climate-Related Financial Risk Act and signed by Governor Gavin Newsom on October 7, 2023, is codified in California Health and Safety Code Sections 38532 et seq.

The law is explicitly modeled on the TCFD framework, organizing disclosures across four pillars: Governance, Strategy, Risk Management, and Metrics and Targets. It does not require verbatim TCFD compliance, but a report that addresses all four pillars will be substantively aligned.

SB 261 sits alongside two companion laws, SB 253 (GHG emissions reporting) and SB 219 (2024 amendments to both), forming the most expansive subnational climate disclosure regime in the United States. For a detailed breakdown of SB 253's separate GHG emissions obligations, see Finrep's California SB 253 reporting guide.

What Did CARB's December 2025 Proposed Regulation Change?

CARB posted proposed rulemaking documents on December 23, 2025, covering both the SB 253 GHG reporting program and the SB 261 climate-related financial risk disclosure program. These documents, including the Notice of Public Hearing, Staff Report, and Proposed Regulation Text, are the most current and detailed official guidance available and represent a significant step beyond the statute's text alone.

Key points from the proposed regulation:

• CARB confirmed the January 1, 2026 first-report deadline remains in place for SB 261.
• The proposed regulation text provides additional specificity on content, format, and submission requirements that the statute left open.
• CARB has not yet finalized the regulations as of August 2026, meaning companies must currently comply under the statute's existing requirements while tracking the rulemaking closely.
• CARB stated it will "endeavor to design these programs to be the least burdensome for implementation and compliance."

One important signal: CARB issued a December 5, 2024 Enforcement Notice indicating it would exercise enforcement discretion for the first SB 253 reporting cycle if entities demonstrate good-faith compliance efforts. That notice was specific to SB 253. Companies should not assume the same discretion automatically applies to SB 261, and should proceed with preparation regardless.

What Did SB 219 Change About SB 261?

SB 219, signed September 27, 2024, amended both SB 253 and SB 261 in several meaningful ways, but did not move the January 1, 2026 first-report deadline for SB 261.

The key SB 219 changes relevant to SB 261 compliance:

• Subsidiary treatment clarified: If a subsidiary independently qualifies as a covered entity based on its own revenue and California nexus, it does not need to prepare a separate SB 261 report. The parent company's report can cover it, reducing duplicative reporting burden for large corporate groups.
• CARB's regulatory deadline extended: CARB's deadline to develop and adopt regulations was extended from January 1, 2025 to July 1, 2025. CARB did not meet that deadline either, but compliance dates remain unchanged.
• Fee-upon-filing removed: The requirement for covered entities to pay a fee upon filing was removed.
• Scope 3 scheduling: For SB 253, scope 3 GHG emissions will be disclosed on a schedule specified by CARB rather than 180 days after scope 1 and 2 disclosures. This affects SB 253, not SB 261 directly, but matters for companies coordinating both programs.

Who Must File a California SB 261 Climate Risk Report?

SB 261 applies to any U.S. company doing business in California with total annual revenues of $500 million or more, covering both public and private companies. This is the single most important threshold to understand, and it catches a far larger universe of companies than most federal climate disclosure frameworks.

The $500 Million Revenue Threshold

The $500 million floor is significantly lower than SB 253's $1 billion threshold, meaning many companies subject to SB 261 are not subject to SB 253's GHG emissions reporting. A company with $600 million in annual revenue doing business in California must file a climate risk report under SB 261 but has no SB 253 obligation.

What "Doing Business in California" Means

This is the most common source of confusion, particularly for holding companies, subsidiaries, and foreign multinationals. The statute uses the same "doing business in California" standard applied for California franchise tax purposes, a broad test that captures companies with sales, payroll, or property in California above certain thresholds. Incorporation in California is not required.

For foreign multinationals: SB 261 applies to U.S. legal entities, not directly to foreign companies. However, a foreign multinational with U.S. subsidiaries that collectively meet the $500 million revenue threshold and have California nexus is effectively in scope through those subsidiaries.

Who Is Excluded

Insurance companies are explicitly excluded from SB 261's scope, as they are regulated separately.

The Private Company Angle

SB 261 is one of the first major climate financial risk disclosure laws to explicitly cover large private companies. Most federal climate disclosure frameworks, including the SEC's climate rule (currently stayed), target public companies. A private company with $700 million in revenue and California operations has never before faced a public climate risk disclosure obligation of this kind. For many such companies, this is their first encounter with TCFD-style reporting, and they have no established internal process for it.

SB 261 vs. SB 253: The Key Differences

Confusing these two laws is the most common compliance mistake. They have different thresholds, different content requirements, different timelines, and different assurance obligations.

Companies above the $1 billion threshold must comply with both laws. Companies between $500 million and $1 billion must comply with SB 261 only.

What Must the SB 261 Climate Risk Report Contain?

A compliant SB 261 report must address the climate-related financial risks the company faces and the measures adopted to reduce and adapt to those risks, structured across the TCFD's four pillars.

Here is what each pillar requires in practice:

Pillar 1: Governance

Disclose how the board oversees climate-related risks and how management identifies, assesses, and manages them. This means naming the board committee or individual director responsible for climate risk oversight, describing how often climate risk appears on the board agenda, and explaining management's reporting lines for climate risk. Audit committees that have not yet been briefed on SB 261 should be.

Pillar 2: Strategy

Describe the actual and potential impacts of climate-related risks on the business, strategy, and financial planning across short, medium, and long-term horizons. This is where physical risks (flooding, wildfire, extreme heat affecting operations or supply chains) and transition risks (carbon pricing, regulatory changes, technology shifts, market preference changes) are identified and assessed. The statute does not prescribe specific scenarios or time horizons, consistent with TCFD's principles-based approach, but a risk-based approach that prioritizes material physical and transition risks is the recommended starting point for the first cycle.

Pillar 3: Risk Management

Explain the processes used to identify, assess, and manage climate-related risks, and how those processes integrate into the company's overall enterprise risk management framework. This section answers: how does climate risk get from the sustainability team to the CFO's risk register?

Pillar 4: Metrics and Targets

Disclose the metrics and targets used to assess and manage climate-related risks and opportunities. SB 261 does not require GHG emissions disclosure (that is SB 253's job), but companies may reference emissions data where relevant to their risk assessment.

The Mitigation Measures Requirement

SB 261 adds a California-specific requirement beyond the standard TCFD template: explicit disclosure of the measures the company has adopted to reduce and adapt to climate-related financial risks. A report that only identifies risks without describing mitigation actions is not compliant.

Can You Use an Existing TCFD, CSRD, or IFRS S2 Report to Satisfy SB 261?

Yes, with conditions. SB 261 explicitly allows covered entities to satisfy the reporting requirement by referencing or incorporating a report prepared under another national or international climate risk disclosure framework, provided that report meets SB 261's substantive requirements.

This "satisfy by reference" provision is significant for:

• Companies already preparing TCFD reports: A TCFD-aligned report that addresses all four pillars and includes mitigation measures is well-positioned to satisfy SB 261. Verify that the mitigation measures section is explicit, as this is a California-specific addition.
• CSRD reporters: Companies preparing reports under the European Sustainability Reporting Standards (ESRS) are likely to have substantial overlap with SB 261's requirements. See Finrep's ESRS and ISSB alignment guide for how these frameworks map to each other.
• IFRS S2 reporters: The ISSB's IFRS S2 Climate-related Disclosures standard, effective January 1, 2024, is the successor to TCFD and is explicitly built on the TCFD framework. IFRS S2-aligned reports are well-positioned to satisfy SB 261's substantive requirements, though companies should verify alignment with CARB's final regulations once issued.
• SEC climate rule filers: The SEC's climate disclosure rule, adopted March 2024, has been stayed pending litigation. Companies cannot rely on SEC filings to satisfy SB 261 in the near term. California's law is the operative climate disclosure obligation for many large companies right now. For the full SEC climate rule status, see Finrep's SEC climate disclosure rule status guide.

The practical implication: if your company already produces a substantive TCFD or IFRS S2 report, you likely do not need to build a separate SB 261 document from scratch. You do need to confirm the report covers mitigation measures explicitly and meets any additional specificity CARB's final regulations require.

Where Do You Publish the SB 261 Report?

Covered entities must make the climate-related financial risk report publicly available, typically on the company website. The statute does not require filing with a state agency, but CARB's proposed regulations may specify additional submission or docket-filing requirements. Companies should monitor the final regulation text for any mandatory CARB submission step.

The report is a public document. Investors, journalists, regulators, and litigants will read it. The bar is not merely compliant; it is defensible.

What Are the Penalties for Non-Compliance?

Civil penalties for SB 261 non-compliance can reach $50,000 per reporting year, enforced by CARB. This applies to failure to publish the required report, submission of a materially deficient report, or failure to meet any CARB submission requirements once finalized.

To put this in context: $50,000 per reporting year is a relatively modest financial penalty for a company with $500 million or more in revenue. The more significant risk is reputational, since the report is public and its absence or inadequacy is visible to investors, customers, and regulators.

CARB's enforcement posture for early compliance cycles has been pragmatic, as evidenced by the December 2024 enforcement discretion notice for SB 253. But companies should not bank on discretion as a compliance strategy, particularly as CARB's regulatory infrastructure matures.

Who Owns SB 261 Compliance Inside the Company?

This is a question most top-ranking articles do not address, and it is where many companies stall. SB 261 is a financial disclosure law, which means the CFO office has a direct stake in it, not just the sustainability team.

A workable governance model:

• CFO or Chief Accounting Officer: owns the financial risk assessment and the link between climate risk and financial planning; ensures the report is consistent with other financial disclosures.
• General Counsel: owns the legal sufficiency analysis, including the "doing business in California" determination and any safe harbor language for forward-looking statements.
• Chief Sustainability Officer or ESG lead: owns the TCFD framework alignment, scenario analysis methodology, and data collection from business units and suppliers.
• Audit Committee: should be briefed on SB 261 obligations, review the report before publication, and understand how climate risk integrates into the enterprise risk management framework.
• Investor Relations: should coordinate on whether the SB 261 report is published as a standalone document or integrated into existing sustainability or annual reporting.

The Supply Chain Implication

One consequence of SB 261 that rarely gets attention: covered entities will need climate risk data from their suppliers and business partners to assess physical and transition risks across their value chains. As Grant Thornton's ESG professionals note, "even entities who are not subject to the reporting requirements will benefit from being familiar with the new requirements," because covered entities are likely to implement policies and procedures across their value chains.

If your company is a supplier to a large California-nexus business, expect climate risk data requests to arrive regardless of whether you are directly covered by SB 261.

SB 261 Compliance Timeline

With the January 1, 2026 first-report deadline now passed, companies that have not yet published their first report are in a remediation posture. For the second reporting cycle (due January 1, 2028), here is the recommended preparation sequence:

1. Confirm scope: Verify that the company meets the $500 million revenue threshold and the "doing business in California" standard. Engage legal counsel for holding company and subsidiary structures.
2. Assess existing reports: Determine whether existing TCFD, IFRS S2, or CSRD reports satisfy SB 261's substantive requirements, including the mitigation measures section.
3. Assign governance: Designate owners across CFO, legal, sustainability, and audit committee. Brief the board.
4. Conduct the climate risk assessment: Identify material physical and transition risks using a risk-based approach. Prioritize risks with the clearest financial materiality.
5. Draft the report: Structure across the four TCFD pillars. Include explicit mitigation measures. Use plain language that a non-specialist investor can understand.
6. Legal review: Confirm the "doing business in California" analysis, safe harbor language for forward-looking statements, and consistency with other public disclosures.
7. Publish and monitor: Post the report on the company website. Track CARB's final regulations for any mandatory submission step.
8. Track CARB's rulemaking: Monitor the CARB program page for finalized regulations and any updated guidance on content, format, or submission.

FAQ: California SB 261 Climate Risk Report

Does SB 261 apply to private companies? Yes. SB 261 explicitly covers both public and private U.S. companies with annual revenues of $500 million or more that do business in California. This is one of the first major climate financial risk disclosure laws in the United States to reach large private companies.

Is third-party assurance required for the SB 261 report? No. Unlike SB 253, which requires limited assurance for GHG emissions disclosures, SB 261 does not mandate third-party assurance of the climate-related financial risk report. Companies may choose to engage external advisors voluntarily to strengthen the report's credibility.

Can a TCFD or IFRS S2 report satisfy SB 261? Yes, if it meets SB 261's substantive requirements, including explicit disclosure of mitigation measures. The statute allows covered entities to satisfy the requirement by referencing a report prepared under another recognized framework. Verify alignment with CARB's final regulations once issued.

Does the stayed SEC climate rule relieve California obligations? No. The SEC's climate disclosure rule has been stayed pending litigation and does not currently require any disclosures. California's SB 261 is an independent state law obligation. The stay of the federal rule has no effect on SB 261 compliance.

What is the penalty for not filing an SB 261 report? Civil penalties can reach $50,000 per reporting year, enforced by CARB. The more significant risk for most companies is reputational, since the report is a public document.

Does a foreign multinational need to file under SB 261? SB 261 applies to U.S. legal entities, not directly to foreign companies. However, a foreign multinational with U.S. subsidiaries that collectively meet the $500 million revenue threshold and have California nexus is effectively in scope through those subsidiaries.

What did SB 219 change about SB 261? SB 219 (signed September 27, 2024) clarified subsidiary treatment, extended CARB's regulatory development deadline, and removed the fee-upon-filing requirement. It did not change the January 1, 2026 first-report deadline.

For companies already navigating the broader climate disclosure landscape, SB 261 is best understood not as a standalone California compliance project but as the most immediately enforceable piece of a global disclosure architecture that includes IFRS S2, CSRD, and eventually a revived or replaced SEC rule. Building a process that satisfies SB 261 now creates the foundation for everything that follows.