The Compliance Officer's ESG Regulation Cheat Sheet

If you work in UK financial-services compliance, "ESG" is no longer a policy-team topic — it's a live compliance obligation. This is a plain-English map of the seven regulations that actually affect what compliance officers, MLROs, and CCOs need to check in 2026: Consumer Duty, SDR, the anti-greenwashing rule, TCFD, ISSB, and (for cross-border firms) EU SFDR and CSRD.

1. UK Consumer Duty (in force 31 July 2023)

The single biggest UK conduct-regulation change since RDR (2013). Not strictly an "ESG regulation" — but the vulnerability, fair-value, and foreseeable-harm elements overlap heavily with the "S" and "G" of ESG.

Who it applies to: all FCA-authorised firms with a UK retail customer nexus.

Cross-cutting duty: firms must act in good faith, avoid foreseeable harm, and enable customers to pursue their financial objectives.

Four outcome-areas:

• Products & services — designed for an identified target market, appropriate to their needs.
• Price & value — fair value assessments, evidenced.
• Consumer understanding — communications that support good decisions.
• Consumer support — accessible, no unreasonable barriers.

What compliance officers should check:

• Fair-value assessments are documented for every product / service, refreshed periodically.
• Target-market definitions exist, with distribution monitoring against them.
• Vulnerable-customer identification framework in place (per FG21/1 — see below).
• Board-level MI shows customer outcomes by segment, not just aggregate.
• Complaints data feeds back into product-governance decisions.

2. Vulnerable Customer Framework — FCA FG21/1 (2021)

Slightly older but still a live inspection focus, and the "S" limb of ESG in disguise.

Definition of vulnerability: someone especially susceptible to harm due to personal circumstances. Four drivers: health, life events, resilience, capability.

What compliance officers should check:

• Staff trained to identify vulnerability signals across all channels.
• Communications adapted (large print, alt channels, plain language, patience with pace).
• Product design considers vulnerable use (cooling-off periods, third-party notifications).
• Vulnerability data captured with lawful basis (GDPR special-category if health-based).
• MI compares outcomes for vulnerable vs non-vulnerable customers — that's how the FCA judges effectiveness.

3. UK Sustainability Disclosure Requirements (SDR)

The FCA's flagship UK sustainability regime, in force through 2024-2026. Direct response to concerns that "ESG" labels had become marketing rather than substance.

Who it applies to: UK FCA-authorised asset managers (in scope now); wider scope for financial advisers, distributors, and pension providers rolling through 2025-2026.

Core mechanics:

• Investment labels — four labels (Sustainability Focus, Sustainability Improvers, Sustainability Impact, Sustainability Mixed Goals). Strict criteria for use.
• Naming and marketing rules — restricts use of terms like "sustainable", "ESG", "green", "impact" unless the product qualifies under the label criteria.
• Consumer-facing disclosures — short standardised summary at product level.
• Product-level disclosures — deeper detail on strategy, metrics, targets.
• Entity-level disclosures — how the firm itself manages sustainability risks.

4. Anti-Greenwashing Rule (in force 31 May 2024)

A distinct FCA rule (ESG 4.3.1R) alongside SDR. Applies more broadly.

Who it applies to: ALL FCA-authorised firms making sustainability-related claims — not just asset managers.

The rule: sustainability-related claims about products or services must be:

1. Fair
2. Clear
3. Not misleading
4. Substantiated with evidence

What compliance officers should check:

• Every ESG-related claim in marketing materials, product docs, financial promotions, website content has a documented evidence base.
• Financial-promotions approval process explicitly checks anti-greenwashing compliance.
• Sales materials + client-facing scripts don't overstate sustainability credentials.
• Website content (particularly older content) reviewed and updated / withdrawn where claims can't be substantiated.
• Third-party fund-manager or product-provider sustainability claims relied on by the firm have been independently verified — you can't hide behind their evidence if you re-broadcast it.

5. TCFD (Task Force on Climate-related Financial Disclosures)

Originally voluntary (2017), now mandatory in the UK for many listed and large companies + FCA-regulated firms. Being progressively subsumed into ISSB IFRS S2 (see next).

Four pillars of TCFD disclosure:

1. Governance — how the board and management oversee climate.
2. Strategy — actual + potential impacts of climate on business, strategy, planning.
3. Risk management — how climate risks are identified, assessed, integrated.
4. Metrics + targets — used to assess and manage climate risks and opportunities.

Physical vs transition risk distinction:

• Physical risk — acute (floods, storms) + chronic (sea-level rise, temperature).
• Transition risk — policy, technology, market shifts driven by decarbonisation (stranded assets, business-model obsolescence).

6. ISSB IFRS S1 and S2 (issued 2023, adopting jurisdictions expanding)

The International Sustainability Standards Board issued IFRS S1 (general sustainability disclosures) and IFRS S2 (climate specifically) in June 2023. Aligns with TCFD but extends it. UK is adopting via UK Sustainability Reporting Standards; EU via CSRD; many other jurisdictions worldwide.

What compliance officers should track:

• Whether your firm's group is in scope (depends on jurisdiction adoption timing).
• Data collection infrastructure — you'll need reliable emissions data, transition-plan documentation, scenario-analysis outputs.
• Assurance readiness — external assurance of sustainability disclosures is on the horizon.

7. EU SFDR and CSRD (for firms with EU exposure)

If your firm markets funds into the EU, distributes financial products to EU retail, or has EU corporate presence, two directives apply:

SFDR (Sustainable Finance Disclosure Regulation) — the EU\'s asset-manager-focused disclosure regime. Article 6 / 8 / 9 fund classifications. Under review — SFDR 2.0 expected to restructure into a labelling regime more similar to UK SDR.

CSRD (Corporate Sustainability Reporting Directive) — expanded corporate sustainability reporting under the European Sustainability Reporting Standards (ESRS). Large EU companies + many non-EU companies with EU turnover in scope. Detailed double-materiality reporting required.

The Cross-Reference Table (bookmark this)

The Five Actions Compliance Officers Should Already Have Done

1. Consumer Duty gap analysis — every product, every distribution channel, every customer segment. Documented, board-reviewed, actioned.
2. Fair-value assessments for every product / service, refreshed at least annually, evidencing why price is reasonable relative to benefits.
3. Anti-greenwashing sweep — every marketing material, website page, financial promotion audited for sustainability claims + evidence.
4. Vulnerability MI — outcome data tracked for vulnerable vs non-vulnerable customer segments, reported to the board.
5. SDR readiness — if you touch investment products, know exactly which SDR labels (if any) you're using, and evidence backing each.

Where the "Other 3" ESG Categories Sit

This cheat sheet has focused on the direct compliance-officer obligations. Three related areas sit adjacent — worth knowing exist even if not always in your direct scope:

• Sanctions + financial crime — ESG-related sanctions evasion (green-labelled trades used as cover), carbon-credit market abuse, and greenwashing fraud. See our CISI GFC vs CFC vs RFS guide for how compliance qualifications cover these.
• Governance + culture — board oversight of sustainability, ESG-aligned executive pay, sustainability-related conflicts of interest. UK Corporate Governance Code 2024 revisions have deepened this.
• ESG data + assurance — the technical infrastructure needed to actually produce the disclosures. This is where operational tooling comes in. If your firm needs an ESG data + reporting platform, ESGFlux is our sister platform built for exactly this use case.

Preparing People for These Roles

The ESG regulatory landscape is one of the fastest-hiring areas in UK financial services. Every large firm is building out ESG compliance capacity. If you're either a compliance professional wanting to add ESG credentials, or a firm training staff into ESG-adjacent roles, three CISI qualifications carry most of the relevant content:

• CISI GFC (Global Financial Compliance) — Consumer Duty, ethics, governance, financial crime, all covered. £49 lifetime access. The foundation qualification for anyone in a compliance-officer role.
• CISI ICWIM (International Certificate in Wealth & Investment Management) — ESG suitability + investment-management ESG integration. £49 lifetime access.
• CISI ESG Awareness Award (a short specific ESG qualification — worth investigating if your role is heavily ESG-focused).

Frequently Asked Questions

Does the anti-greenwashing rule apply if we don't market ESG products?

If you make ANY sustainability-related claim anywhere — website, marketing, financial promotions, product docs, sales scripts — the rule applies. Even generic corporate claims ("we support the transition to net zero") need evidence. The safe posture: audit every sustainability word your firm publishes.

How does Consumer Duty differ from the old TCF regime?

TCF (2006) was six outcomes framed as principles. Consumer Duty (2023) is higher standard: firms must ACT to deliver GOOD outcomes for retail customers, and evidence they've done so via MI. Also introduces the cross-cutting duty of good faith, foreseeable-harm avoidance, and enabling financial objectives. In practice, Consumer Duty adds evidencing + outcomes-focused monitoring on top of what TCF conceptually required.

Is TCFD reporting still needed if ISSB IFRS S2 applies?

Practically no — IFRS S2 is built on TCFD's four-pillar structure and largely supersedes it once a jurisdiction adopts. But there\'s a transitional period. Check your specific jurisdiction\'s adoption timing. UK Sustainability Reporting Standards are progressively replacing standalone TCFD requirements.

What\'s the difference between SFDR and SDR?

SFDR is the EU regime (Article 6/8/9 fund classifications, in force since 2021, under review as SFDR 2.0). SDR is the UK regime (four labels, rolled out 2024-26). Same underlying goal (defeat greenwashing in investment products), different mechanics. Firms marketing into both need to comply with both.

Who owns ESG compliance in the firm — legal, compliance, or a separate ESG team?

Increasingly a coordinated model. Compliance owns the day-to-day rule interpretation + monitoring. Legal handles interpretation of complex EU / UK instruments. A dedicated ESG or sustainability team (in larger firms) owns strategy + reporting. Board oversight sits with the risk / audit committee. Small firms often merge these into a single "compliance + sustainability" role.

How does ESG-related financial crime intersect with this?

Greenwashing can be fraud (if the misrepresentation is intentional and material). Carbon-credit markets have seen VAT-carousel fraud. Sanctions evasion sometimes uses "green" cover for restricted trades. These sit under the financial-crime side of compliance — see our GFC vs CFC vs RFS guide for how CISI qualifications cover them.