Advance Notice of Proposed Rulemaking on Reconsideration of Personal Financial Data Rights Rule
SIFMA provided comments to the Consumer Financial Protection Bureau (CFPB) on the Advance Notice of Proposed Rulemaking on Reconsideration of…
September 11, 2025
Submitted electronically via https://ww2.arb.ca.gov/
Liane M. Randolph
Chair
California Air Resources Board
1001 I Street,
Sacramento, CA 95814
Re: Comments on the implementation of SB 253 and SB 261 following the August 21, 2025 Climate Disclosure Workshop
Dear Chair Randolph:
The Securities Industry and Financial Markets Association (“SIFMA”)1 appreciates the opportunity to submit this letter to the California Air Resources Board (“CARB”) to inform the implementation of the Climate Corporate Data Accountability Act (“SB 253”) and the Climate-Related Financial Risk Act (“SB 261”), each as amended by the Greenhouse gases: climate corporate accountability: climate-related financial risk Act (“SB 219”).
Many SIFMA members have been working to implement new climate disclosure regulations now required or under development by regulators and governmental authorities across the globe. Additionally, many firms have been voluntarily disclosing greenhouse gas (“GHG”) emissions and information regarding climate-related financial risks for some time, often based upon international voluntary frameworks and standards developed by non-governmental entities to inform voluntary disclosure practices, such as the recommendations of the Task Force on Climate-related Financial Disclosures (“TCFD”), the Greenhouse Gas Protocol (the “GHG Protocol”), the Sustainability Accounting Standards Board standards, the World Economic Forum Stakeholder Capitalism Metrics and the Global Reporting Initiative standards.
Our members may also consider financially material climate-related information disclosed by others when making investment and other business decisions. As such, SIFMA is well positioned to provide views as to how regulations adopted by CARB can elicit reliable and useful information for users while limiting the burden imposed on reporting companies. We have provided below a list of recommendations to further inform CARB’s approach to regulation under SB 253 and SB 261.2
During CARB’s August 21, 2025 virtual public workshop on SB 253, SB 261 and SB 219 (the “August Workshop”), CARB staff proposed a June 30 deadline for scope 1 and scope 2 reporting under SB 253.3 A June 30 reporting deadline does not provide companies with sufficient time to collect and reconcile data, prepare materials for reporting, complete internal reviews and approvals by various bodies necessary to ensure the accuracy and completeness of reporting and obtain assurance from a third party assurance provider.4
As noted in the March 8th SIFMA Letter and for the reasons set forth therein, companies should not be required to publish reports under SB 253 until 12 months following the last day of the fiscal year that is covered under the report (for example, a company with a fiscal year ended December 31 would be required to publish their report by December 31 of the following year).
A June 30 deadline may require companies to rely on preliminary or incomplete data, making it difficult to obtain assurance and greatly increasing the risk of errors that will undermine confidence in the data being presented. A June 30 deadline gives companies less than six months after fiscal year end to collect, reconcile, and assure scope 1 and scope 2 emissions data. For financial institutions, this data is sourced from hundreds of
offices and subsidiaries across multiple jurisdictions. Each local office relies on utility providers, landlord or facility managers to supply energy use and fuel consumption data, and bills and records may not be finalized until months after fiscal year end. If a company cannot assemble complete and verified data by a June 30 deadline, it may have to rely on estimates, proxies or incomplete information. This could limit the ability to complete internal controls and assurance reviews and may result in disclosures that need to be revised once more accurate data becomes available. Such outcomes would reduce comparability across entities and risk undermining confidence in the reporting process.
Moreover, SB 253 may greatly increase demand for the services of external assurance providers that have limited resources and personnel with the necessary expertise, making it both more difficult and expensive to obtain assurance and potentially reducing the reliability of the assurance process. Compressing the timeline by which companies need to obtain assurance by requiring reports by June 30 will substantially exacerbate those challenges, especially in the first several years of reporting.
Beyond these near-term challenges, the assurance requirement itself will become significantly more demanding over time. SB 253 phases in limited assurance for scope 1 and scope 2 emissions starting in 2026 and escalates to reasonable assurance for scope 1 and scope 2 emissions beginning in 2030. Limited assurance itself is not a “light touch.” It requires evidence-based testing, sampling of invoices and demonstration of internal
controls. Reasonable assurance requires substantially greater effort and time to obtain. Limited assurance requires a negative conclusion (“we did not find anything to suggest the disclosure is materially misstated”). In contrast, reasonable assurance requires a positive conclusion (“we reviewed all relevant evidence and this disclosure is accurate”). It requires significantly more evidence, a broader audit scope and more extensive testing
than limited assurance. Obtaining reasonable assurance is a resource-intensive process that cannot be rushed. A deadline of six months after fiscal year end (June 30 for companies with a December 31 fiscal year end) simply does not provide for sufficient time to obtain reasonable assurance. When reasonable assurance requirements come into effect, compliance would become impractical, with companies being put into the untenable position of needing to choose between publishing data without assurance by that deadline as a best efforts means trying to come as close to compliance as possible or to pressure assurance providers into rushed, incomplete reviews. Neither of those approaches accomplishes the goals of SB 253.
It makes little sense to establish a deadline today that both regulators and companies know will not be feasible once the reasonable assurance requirement takes effect. A deadline of 12 months after fiscal year end (for example, December 31 for companies with a December 31 fiscal year end) is necessary to provide companies with sufficient time to produce accurate and assured disclosure in compliance with the statutory requirements.
If CARB believes that the benefits of requiring earlier disclosure of scope 1 and 2 emissions exceed the significant costs and risks to data accuracy resulting from that approach, then we believe a deadline of nine months after fiscal year end (for example, September 30 for companies with a December 31 fiscal year end) for reporting scope 1 and scope 2 emissions would at least mitigate the risks and costs described above and would be more feasible to comply with than a June 30 deadline.
While CARB did not address a deadline for scope 3 emissions reporting under SB 253 in its August Workshop, we believe that it is critical to consider the full extent of reporting that will be required under SB 253 when developing regulations in order to develop a regime that will provide useful, reliable and complete information to stakeholders without unnecessarily requiring companies to engage in duplicative work and incur unnecessary costs. Towards that end, we believe that scope 1, scope 2 and scope 3 emissions disclosure should be due on the same date and that a June 30 deadline is unworkable for scope 3 emissions.
Scope 3 emissions reporting depends on third-party data that is outside an entity’s control and is often delayed, inconsistent, or incomplete and, for financial institutions, may require obtaining data from thousands of other parties across multiple jurisdictions, many of whom lack mature disclosure systems. Data from vendors that support scope 3 reporting is typically not available until later in the year, and methodologies continue to evolve. Financial institutions often face a 12-18 month lag in counterparties’ emissions data, meaning scope 3 disclosures inherently trail by one or two years. Requiring disclosure of scope 3 emissions by June 30 may therefore force companies to disclose based on incomplete or outdated information, undermining the purpose of SB 253. Twelve months after fiscal year end (for example, December 31, 2027 for companies with a December 31, 2026 fiscal year end) is the earliest achievable deadline for scope 3 emissions reporting, providing the minimum time necessary to assemble reliable, decision-useful disclosures.
As noted above, disclosure of scope 1, 2 and 3 emissions should be aligned to a single timeline and requiring scope 3 emissions to be reported by June 30 would produce disclosures that are unreliable and not decision-useful, undermining the intent of SB 253. Setting an earlier deadline for scope 1 and scope 2 emissions disclosures than for scope 3 emissions reporting would create inefficiencies, inconsistency and confusion for investors. Companies would be required to take assurance providers through repetitive walkthroughs, control testing and methodological explanations two times per year, driving up costs without improving disclosure quality. With staggered reporting deadlines, investors would see partial information based on scope 1 and scope 2 emissions data, only to have the reported emissions profile change once the scope 3 emissions data is published later in the year. Aligning all scopes on a single reporting deadline of 12 months after fiscal year end is the only approach that reduces duplication, improves comparability between companies by providing a more fulsome picture of each company’s emissions and provides stakeholders with complete, reliable and decision useful disclosures.
In the California Corporate Greenhouse Gas Reporting and Climate-Related Financial Risk Disclosure Programs, Frequently Asked Questions Related to Regulatory Development and Initial Reports, posted July 9, 2025 (the “July 9 FAQs”), CARB acknowledged feedback from stakeholders that climate risk-related data is often collected on a fiscal year basis and that it takes time to process climate information into a report. Based on this feedback, CARB indicated that “it is reasonable to expect that initial climate-related financial risk reports submitted by January 1, 2026, may cover fiscal years (FY) 2023/2024 or FY 2024/2025 depending on the organization. However, CARB suggested in the July 9 FAQs that this flexibility as to the reporting period only applies to “initial” reports to be submitted by January 1, 2026. CARB should adopt a similar approach to all future disclosures under SB 261, permitting biennial reports to be submitted either on a calendar year or fiscal year basis, based on the most recent data available at the time the report is due and, consistent with existing sustainability reporting practices, reporting on only the most recent period rather than a two-year period.
Setting a single date for all companies to report by, regardless of their fiscal year ends, will result a reporting deadline that is impossible to comply with for some companies. Using the date CARB proposed in the August
Workship as an example, a company with a June 1 fiscal year end cannot reasonably be expected to report greenhouse gas emissions data within a month of that fiscal year end. Any reporting deadline CARB ultimately
adopts should be structured to require reports within a specified number of days of a company’s fiscal year end – not a single calendar date that applies to all companies regardless of their fiscal year end. [↩]