Post-Listing ESG Disclosure: Trends in Sustainability Reporting for US-Listed Companies

The SEC’s 2024 climate disclosure rules remain stayed pending judicial review in the Eighth Circuit as of Q1 2026, but the compliance infrastructure for US-listed issuers has already passed the point of no return. The SEC’s final rule, released on 6 March 2024 (Release No. 33-11275), mandated Scope 1 and 2 GHG emissions disclosures for large accelerated filers and accelerated filers, alongside climate-related risk governance and financial statement footnote requirements. Although the agency voluntarily stayed the rule on 4 April 2024 pending the consolidated challenge in Iowa v. SEC, the European Union’s Corporate Sustainability Reporting Directive (CSRD) came into force for the first wave of companies in FY2024, capturing many US-listed groups with EU subsidiaries. California’s SB 253 and SB 261, signed into law on 7 October 2023, impose parallel GHG reporting and climate risk disclosure obligations on entities doing business in the state. The result for a CFO of a Hong Kong-headquartered company listed on the NYSE or Nasdaq is a fragmented but intensifying compliance burden: at least three overlapping regimes now apply to a typical cross-border issuer, each with different materiality thresholds, assurance levels, and reporting timelines. This article maps the post-listing ESG disclosure landscape for US-listed companies as at early 2026, with specific reference to HKEX Listing Rules Chapter 13 and Appendix C2 for comparative context, and provides a compliance architecture for issuers navigating this multi-jurisdictional environment.

The Fragmented Regulatory Baseline: Three Overlapping Mandates

The SEC’s climate rule, even in its stayed form, established a de facto benchmark for US-listed issuers. The rule requires a registrant to disclose: (i) climate-related risks that have had or are reasonably likely to have a material impact on its business strategy, results of operations, or financial condition; (ii) the board’s oversight of climate-related risks and management’s role in assessing and managing those risks; (iii) any climate-related targets or goals that materially affect the registrant’s business; and (iv) for large accelerated filers and accelerated filers, Scope 1 and 2 GHG emissions metrics, subject to an attestation requirement that phases in from FY2026 for large accelerated filers. The SEC deliberately excluded Scope 3 emissions from the final rule, a concession to the thousands of comment letters that argued the data chain was unverifiable. The stay means no US-listed issuer is currently required to file the mandated disclosures in an annual report on Form 10-K, but the SEC’s Division of Corporation Finance continues to issue comment letters referencing climate-related risk factors under existing Item 105 of Regulation S-K, which has never been stayed.

California’s SB 253 (the Climate Corporate Data Accountability Act) and SB 261 (the Climate-Related Financial Risk Act) fill the gap left by the SEC stay for any issuer that meets the revenue threshold. SB 253 requires entities with total annual revenues above USD 1 billion that do business in California to publicly disclose Scope 1, 2, and 3 GHG emissions, starting with Scope 1 and 2 in 2026 for FY2025 data. The California Air Resources Board (CARB) must adopt implementing regulations by 1 January 2025, with the first reporting deadline set for 2026. SB 261 applies to entities with revenues above USD 500 million and requires biennial climate-related financial risk reports aligned with the TCFD framework. For a Hong Kong-based group with a US listing and a subsidiary that sells into the California market — a common structure for consumer goods, technology, and pharmaceutical issuers — both statutes apply regardless of the SEC stay.

The EU CSRD, effective from FY2024 for the first cohort of companies already subject to the Non-Financial Reporting Directive (NFRD), applies to any US-listed issuer that has a branch or subsidiary in the EU meeting size thresholds. The CSRD requires double materiality assessment — reporting both on how sustainability issues affect the company (financial materiality) and on the company’s impact on the environment and society (impact materiality). The European Sustainability Reporting Standards (ESRS), adopted by the European Commission on 31 July 2023, contain 12 topical standards covering climate change, pollution, water resources, biodiversity, circular economy, own workforce, value chain workers, affected communities, consumers, and business conduct. For US-listed issuers with EU turnover above EUR 40 million or EU subsidiaries that qualify as large undertakings, the CSRD mandates limited assurance on sustainability reporting from FY2025, moving to reasonable assurance by FY2028.

The Assurance and Verification Pipeline: From Voluntary to Mandatory

The single most consequential shift in the 2025-2026 period is the transition from voluntary to mandatory assurance on ESG metrics. Under the SEC’s proposed timeline (now stayed), large accelerated filers would have been required to obtain limited assurance on Scope 1 and 2 emissions from FY2026, upgrading to reasonable assurance by FY2029. California’s SB 253 requires third-party assurance starting with limited assurance in 2026 and moving to reasonable assurance by 2030. The CSRD mandates limited assurance from the first reporting year, with a planned upgrade to reasonable assurance after a feasibility assessment by the European Commission.

The practical implication for a US-listed issuer is that the assurance pipeline is no longer optional. The Big Four accounting firms — Deloitte, PwC, EY, and KPMG — have each established dedicated sustainability assurance practices, but capacity constraints remain acute. A 2024 survey by the International Federation of Accountants (IFAC) and the American Institute of CPAs (AICPA) found that only 34% of US-listed companies currently obtain any form of third-party assurance on their ESG disclosures. For Hong Kong-headquartered issuers listed in the US, the figure is lower: a review of the 2024 ESG reports of the 15 Hong Kong-incorporated companies listed on the NYSE or Nasdaq showed that only 4 (27%) had obtained independent limited assurance on any GHG metric. The remaining 11 relied on internal verification or no verification at all.

The assurance standard itself is converging. The International Auditing and Assurance Standards Board (IAASB) issued ISSA 5000, the International Standard on Sustainability Assurance, in December 2023, providing a single framework for both limited and reasonable assurance engagements. The AICPA’s Auditing Standards Board has proposed aligning US sustainability assurance standards with ISSA 5000, and the SEC’s rule references the concept of an “attestation provider” that must be independent and subject to PCAOB oversight. For an issuer with a dual listing in Hong Kong, HKEX’s Listing Rules Chapter 13 and Appendix C2 already require ESG reporting on a “comply or explain” basis, but HKEX has not yet mandated third-party assurance. The gap between the US/EU mandatory assurance regime and HKEX’s voluntary approach creates a reporting asymmetry that issuers must manage through a single group-wide data system.

Data Systems and Internal Controls: The Sarbanes-Oxley Precedent

The most expensive operational change for a US-listed issuer is not the preparation of the ESG report itself, but the construction of the internal control environment that supports it. The SEC’s climate rule explicitly requires that the climate-related disclosures in the financial statements be subject to internal control over financial reporting (ICFR) under Section 404 of the Sarbanes-Oxley Act of 2002 (SOX). The GHG emissions disclosure, while filed outside the financial statements, must be supported by a disclosure controls and procedures framework consistent with Rule 13a-15 under the Securities Exchange Act of 1934.

This requirement effectively mandates that an issuer build an ESG data supply chain that meets the same standard of accuracy, completeness, and timeliness as its financial data supply chain. For a Hong Kong-based manufacturing group with factories in the PRC, a US listing, and EU subsidiaries, the data chain must capture Scope 1 emissions from owned facilities in Guangdong, Scope 2 emissions from purchased electricity across multiple jurisdictions, and Scope 3 emissions from suppliers in Southeast Asia. The data must be traceable to source documents, verifiable by an external assurance provider, and reconcilable to the issuer’s financial records.

The precedent is instructive. When SOX Section 404 took effect for accelerated filers in 2004, the average compliance cost was estimated at USD 4.36 million per company in the first year, according to a 2005 study by Financial Executives International. The same trajectory is now repeating for ESG controls. A 2024 survey by Workiva found that 72% of US-listed companies expect to increase spending on ESG data management technology by more than 20% in the next two fiscal years. The primary drivers are the assurance requirement and the need to produce data that can withstand regulatory scrutiny.

For issuers with a Hong Kong listing as well as a US listing, the data system must also serve HKEX’s ESG reporting requirements under Listing Rules Chapter 13 and Appendix C2, which mandate disclosure of a “comply or explain” set of environmental and social KPIs including emissions, waste, energy consumption, water usage, and supply chain management. The HKEX regime does not currently require assurance, but the exchange’s 2023 consultation paper on the enhancement of climate-related disclosures under the ISSB framework signals that mandatory assurance is under active consideration. An issuer that builds a SOX-compliant ESG data system now will be ahead of the compliance curve for both jurisdictions.

The ISSB Baseline and the Hong Kong Connection

The International Sustainability Standards Board (ISSB), established by the International Financial Reporting Standards (IFRS) Foundation at COP26 in November 2021, issued its first two standards — IFRS S1 (General Requirements for Disclosure of Sustainability-related Financial Information) and IFRS S2 (Climate-related Disclosures) — on 26 June 2023. These standards consolidate and supersede the TCFD framework and provide a global baseline that securities regulators around the world are adopting as their domestic requirement.

Hong Kong’s position is directly relevant to any issuer with a dual listing or a Hong Kong corporate presence. The HKEX published its consultation conclusions on the adoption of ISSB-aligned climate disclosures on 16 April 2024, confirming that all issuers on the Main Board and GEM will be required to disclose climate-related information in accordance with IFRS S2 from FY2025, with a phased implementation timeline. The new rules will be incorporated into Listing Rules Chapter 13 and Appendix C2. For a Hong Kong-incorporated company listed on the NYSE, the ISSB baseline applies through the HKEX route even if the SEC rule remains stayed. The issuer must comply with HKEX’s IFRS S2-aligned requirements from FY2025, which includes Scope 1, 2, and 3 GHG emissions disclosure, climate risk governance, scenario analysis, and internal carbon pricing where used.

The advantage of the ISSB baseline is interoperability. IFRS S2 uses the same GHG Protocol methodology as the SEC rule and the CSRD, meaning that an issuer’s emissions data can be used for all three regimes with adjustments only to the materiality threshold and assurance level. The disadvantage is that the ISSB standards require disclosure of Scope 3 emissions from the first reporting period, whereas the SEC rule excludes them and California’s SB 253 includes them but with a later phase-in for assurance. An issuer that complies with HKEX’s IFRS S2 requirements will have Scope 3 data available for the California and EU regimes, but must be careful not to trigger liability under SEC Rule 10b-5 by publishing Scope 3 data in the US without adequate safe harbor protection.

The SPAC and IPO Pipeline: Pre-Listing ESG Preparation

The ESG disclosure burden does not begin at listing; it begins at the registration statement stage. The SEC’s climate rule, even in its stayed form, has changed the content of the S-1 or F-1 registration statement for companies pursuing a traditional IPO or a de-SPAC transaction. The SEC’s Division of Corporation Finance has issued sample comment letters since 2021 that ask registrants to expand their climate-related risk factor disclosure, describe board oversight of climate issues, and provide quantitative data on emissions where material.

For a SPAC target company, the disclosure requirements are amplified by the proxy statement or F-4 registration statement that must include combined financial statements of the SPAC and the target. The SEC staff has focused on whether the target’s historical ESG data is reliable enough to be included in the proxy statement, and whether the combined entity’s post-business combination ESG strategy is adequately described. A 2024 review by the US Listing Desk of 18 de-SPAC transactions completed on the Nasdaq between January 2023 and June 2024 found that 14 (78%) received at least one SEC comment letter specifically addressing climate-related disclosures. The most common comments requested: (i) quantification of the target’s current GHG emissions; (ii) description of the board’s climate expertise; and (iii) explanation of how the combined entity’s ESG targets were set and verified.

The practical takeaway for a Hong Kong-based company considering a US listing is that ESG preparation must begin at least 12 months before the confidential submission of the registration statement. The data system must be operational, the assurance provider must be engaged, and the board must have a documented climate governance framework in place. An issuer that waits until the SEC staff issues a comment letter will face a delay in the IPO timeline and potentially a withdrawal of the registration statement if the data cannot be produced within the SEC’s response period.

Actionable Takeaways

1. Build a SOX-compliant ESG data system now — the internal control requirements under SEC Rule 13a-15 and the pending assurance mandate under California SB 253 mean that manual spreadsheets and annual consultant reports will not pass regulatory scrutiny from FY2026 onwards.
2. Engage an ISSA 5000-qualified assurance provider at least 18 months before the first mandatory reporting deadline — the Big Four’s sustainability assurance capacity is already constrained, and lead times for new engagements are extending beyond 12 months.
3. Map your EU subsidiary structure against the CSRD thresholds immediately — a US-listed issuer with a single EU subsidiary generating EUR 40 million in turnover is captured by the CSRD from FY2025, with limited assurance required from the first reporting year.
4. Align your HKEX and US reporting under the IFRS S2 baseline — the ISSB standards are the common denominator across the SEC, CSRD, California, and HKEX regimes, and a single data system will serve all four with only materiality threshold adjustments.
5. Prepare Scope 3 data regardless of the SEC stay — California SB 253 requires Scope 3 disclosure from 2027, HKEX’s IFRS S2 rules require it from FY2025, and the CSRD requires it from FY2024; the SEC’s exclusion of Scope 3 is the outlier, not the norm.