Virtual CFO & Compliance

ESG Compliance & Reporting for SMEs

Your customer, lender or investor just asked you an ESG question — a supplier questionnaire, a CBAM data request, a diligence checklist. We prepare the answer: data, disclosures and policies you can stand behind. We prepare and advise; we never assure.

Why founders pick CapEasy

5.0★ across 335+ Google reviews

2,700+ founders served across India

Overview

ESG lands on an Indian SME from outside, not from a regulator. SEBI’s BRSR rules bind the top 1,000 listed companies, not you — but those companies must now look down their value chain, EU customers must collect embedded-emissions data from their suppliers, lenders run ESG questions in credit assessment, and PE/VC funds run ESG diligence at Series A and beyond. The question arrives as a customer questionnaire, a CBAM data request or a diligence checklist, usually with a deadline, and “we don’t have that” reads as risk.

It helps to know what is actually mandatory, because much of the market copy overstates it. Under SEBI’s current rules (after the March 2025 easing), ESG disclosure by value-chain partners of the top 250 listed companies is voluntary, and the net was narrowed to partners individually above 2% of the customer’s purchases or sales. RBI’s climate-disclosure framework for banks exists only in draft and stands deferred. What is hard law today: the EU’s CBAM definitive regime has applied since 1 January 2026 to six sectors — iron and steel, aluminium, cement, fertilisers, electricity and hydrogen — and EU importers must declare embedded emissions, which in practice means their Indian suppliers must produce the data. The commercial pressure is real either way: voluntary for the regulator is often non-negotiable for the purchase order.

Our lane is deliberately drawn: we prepare and advise — we never assure. Assurance of sustainability reports is a separate regulated function performed by independent assurance practitioners; where your customer requires it we work alongside your assurance provider, with an evidence pack built so every number traces to a source document. What we produce is the work an SME actually needs: the data collection, the emissions arithmetic with documented methodology, the policy suite, and the answers on the questionnaire in front of you.

The same evidence infrastructure carries the Indian governance filings most growing companies already owe — CSR-2 for companies over the section-135 thresholds (now filed linked with AOC-4), the POSH Internal Committee’s annual report for any workplace with 10 or more employees, and EPR registration on CPCB’s portal for producers, importers and brand owners of plastic packaging. One data spine, several filings — which is why this sits in our compliance practice rather than beside it.

Who it’s for

  • SME suppliers to large listed companies receiving ESG or BRSR value-chain questionnaires from their customers
  • Exporters of iron and steel, aluminium, cement, fertilisers or hydrogen products into the EU, facing CBAM embedded-emissions data requests from importers
  • Startups raising Series A or later where the fund runs ESG due diligence as standard
  • Companies answering EcoVadis, CDP or customer-specific sustainability questionnaires to keep or win MNC procurement
  • Growing companies that owe the Indian governance family anyway — CSR-2, POSH annual report, EPR registration — and want it run as one discipline

Eligibility & requirements

  • BRSR value-chain reporting is currently voluntary for the value-chain partners of the top 250 listed entities, scoped to partners individually above 2% of the customer’s purchases or sales by value — but a customer can and often does make it a commercial condition regardless
  • CBAM: since 1 January 2026 EU importers of covered goods above 50 tonnes a year must be authorised declarants and annually declare embedded emissions; certificate purchases begin February 2027 covering 2026 imports. The data burden on the Indian supplier is already live
  • Emissions data must be built on a documented methodology (GHG Protocol Scope 1 and 2 as the base layer) — an estimate without a methodology cannot survive a verifier, a customer audit or next year’s comparison
  • CSR-2 applies over the section-135 thresholds (net worth ₹500 crore, turnover ₹1,000 crore, or net profit ₹5 crore); POSH requires an Internal Committee and an annual report at 10 or more employees; EPR registration on the CPCB portal applies to producers, importers and brand owners of plastic packaging
  • Anything you publish or submit must be evidence-backed: ESG misstatement carries liability regardless of who — or what — drafted the number

How CapEasy handles it

  1. Read the ask first — the questionnaire, CBAM request or diligence list in front of you decides scope; we answer what is actually asked before building anything speculative
  2. Data mapping: which metric lives in which system, who owns it, and what evidence stands behind it — the workbook that makes every later year cheaper
  3. Emissions baseline where needed: Scope 1 and 2 measured on GHG Protocol methodology, documented so the number is defensible, and marked indicative where it is indicative — never dressed as audit-grade
  4. Policy suite sized for an SME: environment, human rights, anti-bribery, supplier code — the documents questionnaires score you on, written to match how you actually operate
  5. Questionnaire and disclosure drafting — supplier ESG formats, EcoVadis/CDP responses, investor DD packs — every claim traceable to the evidence pack, reviewed and signed off by a named human
  6. The governance family run on the same spine: CSR-2 preparation and filing, the POSH annual report cycle, EPR registration and returns
  7. Where your customer requires independent assurance, we prepare the evidence pack to be assured and coordinate with the assurance practitioner — we do not provide the assurance ourselves

Documents you’ll typically need

  • The trigger document: the customer questionnaire, CBAM data request, tender ESG annexure or investor DD checklist
  • Twelve months of electricity bills and fuel purchase records (diesel, LPG, petrol) for the emissions baseline
  • HR basics: headcount, gender split, contractor usage, existing POSH committee records if any
  • Existing policies, codes or certifications, however informal — ISO 14001 or 45001 work feeds directly in
  • For CBAM: product-level production data for exported goods and the importer’s data-request format
  • For CSR-2: board CSR policy, committee composition and spending records for the reporting year

CapEasy is a private consultancy and is not affiliated with any government authority. We help you assess eligibility and prepare and file your application; eligibility and approval depend on your specifics and the relevant department’s discretion.

Frequently asked

ESG Compliance & Reporting for SMEs — questions founders ask

Almost certainly not by regulation — and it is worth being precise, because plenty of marketing says otherwise. SEBI’s BRSR binds the top 1,000 listed companies; the value-chain disclosure that touches their suppliers is voluntary under the current rules, narrowed in March 2025 to partners individually above 2% of the customer’s purchases or sales. What is effectively mandatory is commercial: a large customer, an EU importer under CBAM, or an investor in diligence can each make ESG data a condition of doing business with you. The obligation is contractual, and it is no less real for that.

The Business Responsibility and Sustainability Report is SEBI’s ESG disclosure format for the top 1,000 listed companies, with a stricter assured subset (BRSR Core) that reaches the top 1,000 in FY 2026-27. The top 250 must also report on their value chain — which is where you come in. If you are above roughly 2% of a listed customer’s purchases or sales, your data may appear in their report. Disclosure by you is voluntary under SEBI’s rules; your customer’s procurement team, holding the questionnaire, tends to see it differently.

The EU’s Carbon Border Adjustment Mechanism prices the carbon embedded in imports of six product groups: iron and steel, aluminium, cement, fertilisers, electricity and hydrogen. The definitive regime has applied since 1 January 2026 — EU importers above 50 tonnes a year must be authorised declarants and declare embedded emissions annually, with certificate purchases starting February 2027 for 2026 imports. If you export covered goods to the EU, your importer needs your emissions data now; without it they must use less favourable default values, which lands on your pricing conversation.

No, and the line matters. Assurance — an independent opinion on sustainability information — is a regulated professional function that must be independent of whoever prepared the information. We are the preparation side: data, methodology, disclosures, policies. Where assurance is required we build the evidence pack so it can be assured efficiently, and coordinate with your assurance practitioner. A firm offering to both prepare your report and assure it is describing a conflict, not a convenience.

Scope 1 is what you burn: fuel in your vehicles, generators and processes. Scope 2 is what you buy as energy — chiefly grid electricity. They are the base layer of the GHG Protocol, the accounting standard almost every questionnaire and framework builds on, and for most SMEs they can be computed from records you already hold: electricity bills and fuel purchases. Scope 3 — everything upstream and downstream — is where measurement gets genuinely hard, and an SME is rarely asked for it first.

Industry bodies describe a simplified voluntary format, often called BRSR Lite, positioned for smaller and unlisted companies — but we could not locate a SEBI or MCA instrument formally establishing it, so treat the label as market practice rather than a regulatory format for now. The practical answer for an SME is simpler: report against what your counterparty actually asks — their questionnaire, their framework — and keep your underlying data in a shape that can serve any format later.

Your CapEasy experts

Connect with us

Talk to the people who handle this work every day — no call centre, no hand-offs.

Ayush Joshi

Ayush Joshi

Co-Founder

Ex-OYO and Tenaciousfly. 7+ years in business development, strategic acquisitions, financing and debt syndication.

Aditya Jain

Aditya Jain

Co-Founder

Ex-Bank of America. 4+ years in investment banking, EU & Indian compliances, ESG compliances, and project management.

Manav Raval

Virtual CFO & Tax Specialist

Section 80-IAC, tax planning and startup compliance. Previously at Toyota Motor Corporation and Jaguar Land Rover.

Ayush Faldu

Virtual CFO & Tax Specialist

Financial strategy, budgeting and cash flow — a CFO’s judgement, monthly.

Book a free consultation.

An honest assessment of where you are and what comes next — no cost, no pressure, no inflated promises.