California has enacted the most comprehensive state-level climate disclosure laws in the United States. Two companion bills, California SB 261 (climate-related financial risk) and SB 253 (greenhouse gas emissions), together require thousands of companies to report on both their climate exposure and their carbon footprint. Following the SEC’s decision to stop defending its federal climate rule in March 2025, these California climate disclosure laws now set the de facto standard for corporate climate reporting in the US.
Together with the SB 219 amendments signed in September 2024, this California Climate Accountability Package affects an estimated 5,000+ public and private companies. Below, you will find the full requirements for each law, an SB 261 compliance checklist based on CARB’s guidance, the current litigation and injunction status, and practical steps for preparation.
What Is California SB 261?
California SB 261, formally known as the Climate-Related Financial Risk Act (CRFRA), requires companies with annual revenues exceeding $500 million that do business in California to publish biennial reports on their climate-related financial risks. Governor Newsom signed SB 261 into law on October 7, 2023, alongside its companion bill SB 253.
Where SB 253 asks “what do you emit?”, SB 261 asks “how does climate change threaten your business?” Reports must follow the TCFD framework or an equivalent standard such as IFRS S2 (ISSB), covering governance, strategy, risk management, and metrics across both physical and transition risks.
Who Must Comply and Exemptions
SB 261 applies to any US business entity (corporation, partnership, LLC, or other form) with total annual revenues exceeding $500 million that does business in California. The “doing business” standard follows the California Franchise Tax Board definition. An entity qualifies if it is organized or incorporated in California, is commercially domiciled in the state, or has California-based sales exceeding approximately $735,019 (adjusted annually for inflation).
The $500 million threshold is lower than SB 253’s $1 billion cutoff, which means SB 261 captures a broader set of mid-size companies. Both laws apply to private and public companies alike. A Texas-based private company with $600 million in revenue and meaningful California sales is subject to SB 261 even though it has no SEC filing obligations.
Several categories are exempt from California SB 261 requirements:
- Insurance companies regulated by the California Department of Insurance
- Tax-exempt nonprofit organizations and charities
- Government entities and majority government-owned businesses
- Entities conducting only wholesale electricity transactions in California
- Entities with solely payroll-related California activity
Disclosure Requirements Under TCFD
SB 261 reports must address the four pillars of the TCFD framework. Each pillar requires specific climate risk disclosures:
Governance: Describe how the board and management oversee climate-related risks. This includes the frequency of board review, the committees involved, and how climate risk factors into executive decisions.
Strategy: Identify the climate-related risks and opportunities affecting the organization over the short, medium, and long term. Explain how these risks influence business strategy, financial planning, and operational resilience under different climate scenarios.
Risk Management: Describe the processes used to identify, assess, and manage climate-related risks. Explain how these processes integrate with the organization’s overall risk management framework.
Metrics and Targets: Disclose the metrics used to assess climate risk exposure and any targets set to manage those risks. Quantitative data on physical hazard exposure, financial impact estimates, and progress toward risk reduction goals fall here.
Reports are biennial (every two years) and must be posted on the company’s website. The penalty for non-compliance or filing an inadequate report is up to $50,000 per reporting year. SB 261 does not require third-party assurance, unlike SB 253.
First-year flexibilities apply: companies may exclude GHG emissions data from their SB 261 reports, and scenario analysis is not required in the first reporting cycle. These concessions acknowledge that many companies are building their climate risk data capabilities for the first time.
SB 261 Compliance Checklist
CARB published a draft compliance checklist outlining a structured approach to SB 261 reporting. The checklist is nonauthoritative but maps directly to the TCFD pillars that SB 261 requires. The table below summarizes what each pillar demands and what data you need to fulfill it.
| TCFD Pillar | What to Disclose | Data You Need |
|---|---|---|
| Governance | Board oversight structure, management roles, review frequency, committee responsibilities | Organizational charts, board meeting minutes, governance policies |
| Strategy | Climate risks and opportunities (short/medium/long-term), financial impact, scenario resilience | Physical risk assessments by location, transition risk analysis, scenario modeling outputs |
| Risk Management | Identification processes, assessment criteria, integration with enterprise risk management | Risk registers, location screening results, materiality assessments |
| Metrics & Targets | Risk exposure metrics, climate targets, performance tracking against goals | Hazard scores per location, exposure quantification, financial loss estimates |
The Strategy and Metrics pillars are the most data-intensive. They require location-level physical climate risk data: which hazards threaten which sites, how severe the exposure is under different scenarios, and what the projected trajectory looks like over 10, 20, or 30 years. Physical climate risk data covering multiple hazards, scenarios, and time horizons for each operating location forms the quantitative backbone of these two pillars. Platforms like Continuuiti provide this data layer, covering 12 climate hazards across three SSP scenarios for up to 5,000 locations in a single batch. Transition risk assessment, climate-related opportunities, and governance documentation require separate workstreams.
Remember: scenario analysis is optional in the first reporting year, so companies can phase in the Strategy pillar’s most complex requirement over time.
SB 253: California’s Emissions Reporting Law
While SB 261 addresses how climate change creates financial risk, its companion law SB 253 focuses on what companies emit. The Climate Corporate Data Accountability Act (CCDAA) creates the first mandatory state-level greenhouse gas emissions reporting requirement in the US. Companies must follow the Greenhouse Gas Protocol methodology to disclose annual Scope 1, 2, and 3 emissions.
SB 253 applies to US business entities with total annual revenues exceeding $1 billion that do business in California. The higher revenue threshold means fewer companies fall in scope compared to SB 261, but those that do face more demanding disclosure requirements, including mandatory third-party assurance.
Reporting Timeline and Deadlines
SB 253 is not subject to the Ninth Circuit injunction that paused SB 261. The first deadline stands:
- August 10, 2026: First disclosure of Scope 1 and Scope 2 emissions (annual thereafter)
- 2027: First disclosure of Scope 3 emissions (within 180 days of Scope 1/2 report)
- 2026 onward: Limited assurance required for Scope 1 and 2
- 2030 onward: Reasonable assurance for Scope 1 and 2; limited assurance for Scope 3
Penalties can reach $500,000 per reporting year for non-compliance. However, SB 219 added a Scope 3 safe harbor: companies making good-faith efforts to report Scope 3 data will not face penalties for inaccuracies during the initial transition period (through 2030). CARB has stated it will exercise enforcement discretion for initial submissions, accepting “best-available data” from filers who demonstrate genuine compliance efforts.
SB 261 vs SB 253 vs SEC: How They Compare
Three climate disclosure regimes are relevant to large US companies. The table below compares California’s two laws with the SEC’s federal climate rule.
| Feature | SB 261 (CRFRA) | SB 253 (CCDAA) | SEC Climate Rule |
|---|---|---|---|
| Focus | Climate-related financial risk | GHG emissions reporting | Both (financial risk + emissions) |
| Revenue threshold | $500 million+ | $1 billion+ | N/A (SEC registrants by filer type) |
| Applies to private companies | Yes | Yes | No (SEC registrants only) |
| Reporting frequency | Biennial | Annual | Annual (with filings) |
| Framework | TCFD / ISSB / equivalent | GHG Protocol | Custom (SEC-defined) |
| Physical risk disclosure | TCFD-aligned (all four pillars) | Not required | Financial statement notes (1% threshold) |
| Transition risk disclosure | TCFD-aligned | Not required | Strategy disclosure |
| Scope 3 emissions | Not required | Required (from 2027) | Eliminated |
| Assurance required | No | Yes (phased) | Yes (phased) |
| Maximum penalty | $50,000/year | $500,000/year | SEC enforcement |
| Current status (April 2026) | Injunction (enforcement paused) | In effect (deadline Aug 10, 2026) | Stayed; in abeyance |
Companies with $1 billion+ in revenue doing business in California must comply with both SB 261 and SB 253, preparing two distinct report types: a TCFD-aligned risk assessment and a GHG Protocol emissions inventory. The SEC climate rule is effectively dead after the commission withdrew its defense, leaving California’s laws as the primary US climate disclosure mandate.
Current Legal Status and Injunction
Both California climate disclosure laws face legal challenges, but their trajectories differ. SB 253 is active and approaching its first deadline. SB 261 enforcement is paused by a federal court injunction. Here is the full timeline:
- October 7, 2023: Governor Newsom signs SB 253 and SB 261 into law
- September 2024: SB 219 amendments signed, giving CARB more implementation flexibility and adjusting deadlines
- August 2025: US District Court upholds both laws, ruling that plaintiffs “failed to show laws likely violate First Amendment”
- November 18, 2025: Ninth Circuit Court of Appeals grants injunction on SB 261, pausing enforcement of the January 1, 2026 reporting deadline
- December 1, 2025: CARB opens a voluntary public docket, accepting SB 261 reports from companies choosing to file ahead of any mandate
- January 9, 2026: Ninth Circuit oral arguments. Judges questioned the “breadth of SB 261’s disclosure mandate” and described some requirements as “vague and ill-defined”
- February 26, 2026: CARB approves regulations for both SB 253 and SB 261, despite the injunction on SB 261
Roughly 100 companies voluntarily submitted climate risk reports to CARB’s public docket by late January 2026, before the injunction paused enforcement. This voluntary compliance signals that large companies are building their reporting infrastructure regardless of the court’s timeline.
SB 253 is not subject to the injunction. Its first Scope 1 and Scope 2 reporting deadline of August 10, 2026 remains on track. CARB will provide an alternate SB 261 reporting date after the Ninth Circuit appeal is resolved.
Most compliance advisors recommend preparing for California SB 261 as though enforcement will resume. Even if the Ninth Circuit narrows the mandate, the underlying TCFD reporting infrastructure that companies build for SB 261 directly serves overlapping requirements under CSRD, IFRS S2, and CDP.
How to Prepare for Compliance
Companies can take concrete steps now to prepare for both California climate disclosure laws, regardless of the SB 261 injunction outcome.
Step 1: Determine if you are in scope. Check your total annual revenue against both thresholds: $500 million for SB 261 and $1 billion for SB 253. Assess whether you “do business” in California under the Franchise Tax Board definition. Companies between $500 million and $1 billion are subject to SB 261 only. Those above $1 billion face both laws.
Step 2: Assess physical climate risk across your locations. The Strategy and Metrics pillars of SB 261 require location-level data on which climate hazards threaten which sites and how exposure changes under different scenarios. See the compliance checklist above for the specific data each TCFD pillar demands. Start by mapping your facilities, supply chain hubs, and critical assets to coordinates, then screen each location for physical risk exposure.
Step 3: Evaluate transition risk exposure. SB 261 also requires analysis of transition risks: how regulatory changes, market shifts toward low-carbon alternatives, and technology disruption could affect your business model and financial position. Carbon-intensive industries face the highest transition risk exposure.
Step 4: Structure your report using CARB’s TCFD checklist. Use the four-pillar framework above as your report skeleton. Address each disclosure item systematically. First-year filers can defer scenario analysis, but covering governance, strategy, risk management, and basic metrics builds the foundation for more detailed reports in subsequent cycles.
Step 5: For SB 253, begin your GHG inventory. Start collecting Scope 1 and Scope 2 emissions data now using the GHG Protocol. Begin mapping Scope 3 data sources across your supply chain early. Companies already reporting to CDP will have much of this data in place.
Step 6: Evaluate overlapping climate disclosure requirements. Data collected for California climate disclosure compliance can serve multiple frameworks. Companies subject to IFRS S1 and S2 or the EU’s CSRD can build one data infrastructure that feeds multiple reports. Aligning early avoids duplicating effort across jurisdictions.
Other States Following California’s Lead
California is the vanguard, but other states are advancing their own climate disclosure legislation. If enacted, these bills would create overlapping state-level compliance obligations for large companies.
- New York (S3456): Passed the State Senate and awaits Assembly and Governor signature. Would require Scope 1 and 2 reporting from 2027, Scope 3 from 2028. Companies with $1 billion+ revenue doing business in both California and New York would face dual state compliance.
- Illinois (HB 3673): Introduced February 2025, carried over to the 2026 session. No committee movement yet.
- New Jersey (SB 4117): Moved out of committee in March 2025 but stalled since.
- Colorado (HB 25-1119): Indefinitely postponed. Effectively dead.
At the federal level, the retreat continues. The SEC stopped defending its climate rule, and the OCC rescinded its 2023 banking climate risk principles in October 2025. The SEC’s 2010 Climate Guidance remains in effect as a baseline materiality requirement, but it lacks the prescriptive detail of California’s laws. The result is a regulatory landscape where states are filling the gap left by federal pullback, pushing companies toward comprehensive climate disclosure regardless of which specific mandate forces the issue. A link to our full SEC climate disclosure rule analysis provides deeper context on the federal side.
Frequently Asked Questions
What is California SB 261?
California SB 261, the Climate-Related Financial Risk Act (CRFRA), requires US companies with over $500 million in annual revenue that do business in California to publish biennial climate-related financial risk reports. Reports must follow the TCFD framework and are overseen by the California Air Resources Board (CARB). Penalties for non-compliance reach $50,000 per reporting year.
Is SB 261 still in effect?
SB 261 is enacted law but its enforcement is currently paused. The Ninth Circuit Court of Appeals granted an injunction in November 2025, blocking the January 1, 2026 reporting deadline while legal challenges proceed. The law has not been struck down, and CARB approved implementing regulations in February 2026 despite the injunction.
What is the penalty for not complying with SB 261?
The maximum penalty for failing to publish or filing an inadequate SB 261 report is $50,000 per reporting year. Unlike SB 253, SB 261 does not require third-party assurance of the report contents.
Who does SB 261 apply to?
SB 261 applies to any US business entity with total annual revenues exceeding $500 million that does business in California. This includes private companies, regardless of where they are headquartered. “Doing business” follows the California Franchise Tax Board definition and covers entities with California sales above approximately $735,000.
What is the difference between SB 253 and SB 261?
SB 253 requires GHG emissions reporting (Scope 1, 2, and 3) using the GHG Protocol for companies with $1 billion+ revenue. SB 261 requires climate-related financial risk reports following the TCFD framework for companies with $500 million+ revenue. SB 253 mandates third-party assurance; SB 261 does not. Companies above $1 billion must comply with both.
Do California climate disclosure laws apply to private companies?
Yes. Both SB 253 and SB 261 apply based on revenue thresholds and California business activity, not on whether a company is publicly traded. A private company with $500 million in revenue and meaningful California sales is subject to SB 261. This is a key distinction from the SEC climate rule, which applied only to SEC registrants.
When is the SB 253 reporting deadline?
The first SB 253 reporting deadline is August 10, 2026, for Scope 1 and Scope 2 emissions. Scope 3 emissions disclosure begins in 2027, within 180 days of the Scope 1/2 report. Unlike SB 261, SB 253 is not subject to the Ninth Circuit injunction and its deadlines are on track.
What frameworks can be used for SB 261 reporting?
SB 261 reports must align with the TCFD Final Report Recommendations (June 2017), the IFRS Sustainability Disclosure Standards (ISSB), or an equivalent framework. Most companies are using the TCFD four-pillar structure, as CARB’s draft compliance checklist maps directly to it.
Conclusion
California SB 261 and SB 253 represent the most comprehensive climate disclosure requirements in the US. With the SEC stepping back and other states advancing similar bills, California’s laws set the floor for what large companies must report. The injunction on SB 261 pauses the immediate deadline, but the roughly 100 companies that voluntarily filed reports demonstrate that the market is not waiting for the courts. Building TCFD-aligned physical risk data capabilities and GHG inventories now positions companies to comply efficiently when enforcement resumes, while simultaneously serving overlapping global frameworks.
