CSRD Sustainability Reporting: What US CFOs with Dutch Subsidiaries Must Know

1. What CSRD Is and Why US Companies Should Care

The Corporate Sustainability Reporting Directive (CSRD) is the EU's sweeping overhaul of sustainability reporting requirements. It replaced the Non-Financial Reporting Directive (NFRD) and mandates that in-scope companies publish detailed sustainability reports aligned with the European Sustainability Reporting Standards (ESRS).

Why a US CFO should care: CSRD does not stop at the EU border. It reaches back to the ultimate parent company of any in-scope EU subsidiary. If your Dutch BV is in scope — or if your US group's EEA turnover exceeds certain thresholds — your entire global group may face a sustainability reporting obligation enforced by Dutch regulators and audited under EU standards.

This is not optional ESG marketing. It is a legal compliance obligation carrying financial penalties, director liability, and potential exclusion from EU public procurement.

2. The Omnibus Changes (March 18, 2026) — The Ground Has Shifted

The Omnibus I Directive was published in the Official Journal of the EU on February 26, 2026, and enters into force on March 18, 2026. It dramatically narrows the scope of CSRD.

What Changed

Note: The original CSRD used the EU Accounting Directive definition of a "large undertaking," which required exceeding two out of three criteria (250 employees, EUR 50M net turnover, EUR 25M total assets). The post-Omnibus test is cumulative — both the employee and turnover thresholds must be exceeded. The EU company turnover threshold was updated from EUR 40M to EUR 50M by Delegated Directive (EU) 2023/2775, effective January 1, 2024, before the Omnibus.

Scope Reduction

The Omnibus reduces the number of in-scope companies by approximately 80–85%. The vast majority of medium-sized EU companies — and the US parents that would have been caught through them — are now out of scope.

Who Is Still In Scope

• Large EU companies exceeding both >1,000 employees AND >EUR 450M net turnover
• Non-EU parent groups with >EUR 450M EEA net turnover AND at least one EU subsidiary/branch with >EUR 200M turnover
• Wave 1 companies (former NFRD reporters) that still exceed the new thresholds

Who Fell Out of Scope

• EU companies with 250–1,000 employees
• Listed SMEs (entirely removed)
• Non-EU parents with EUR 150M–450M EEA turnover
• Companies with EU subsidiaries/branches generating EUR 40M–200M turnover

3. The Non-EU Parent Reporting Obligation — The Blindspot

This is the section that matters most for US CFOs.

The Mechanism

Even after the Omnibus, if a US-parented group meets both of these conditions:

1. Consolidated EEA net turnover exceeds EUR 450M (across two consecutive fiscal years), AND
2. The group has at least one EU subsidiary or branch generating >EUR 200M net turnover

...then the Dutch subsidiary must publish a group-level sustainability report covering the entire worldwide operations of the US parent. Not just the Dutch entity. Not just Europe. The whole group.

Why This Is a Blindspot

Many US CFOs view their Dutch BV as a small holding company, a regional sales office, or an IP licensing entity. They do not expect a 15-person Dutch office to trigger a reporting obligation that reaches back across the Atlantic to cover the entire US parent group.

But under CSRD, the Dutch subsidiary is the designated publisher. It must:

• Prepare (or cause to be prepared) a sustainability report under ESRS standards covering the full non-EU parent group
• Publish that report in its Dutch annual report
• Obtain limited assurance from an EU-accredited auditor
• File with the Dutch commercial register (Kamer van Koophandel)

Consolidation Shortcut

If the US parent has multiple EU subsidiaries in scope, one EU subsidiary can publish on behalf of all in-scope EU entities until January 6, 2030. This means you can designate a single EU entity to handle the reporting, but you cannot avoid it entirely.

Post-Omnibus: Many US Parents Are Now Out

The threshold increase from EUR 150M to EUR 450M removes a large number of mid-market US companies from scope. A US group generating EUR 200M–400M in the EEA is now clear. However, any US group with significant European operations — especially in tech, pharma, industrial, or financial services — may still comfortably exceed EUR 450M.

4. Dutch Implementation Status

Transposition — Still Pending

The Netherlands has not yet transposed the original CSRD into national law. Key timeline:

• July 6, 2024: EU transposition deadline — Netherlands missed it
• January 13, 2025: Draft implementation bill submitted to Dutch House of Representatives
• 2025: European Commission opened an infringement procedure against the Netherlands for late transposition
• March 18, 2026: Omnibus I enters into force — Dutch draft legislation must now be amended to reflect the new thresholds
• March 19, 2027: Member States must transpose Omnibus I provisions into national law

Dutch Ministerial Exemptions for FY2025–FY2026

The Dutch Minister has announced the intention to grant exemptions in advance for FY2025 and FY2026 to companies that will fall outside the revised CSRD scope under the new Omnibus thresholds. This means:

• If your Dutch subsidiary would have been in scope under the old thresholds but is now out of scope under the Omnibus, the Netherlands will not require reporting for FY2025 or FY2026
• This exemption applies even though the Omnibus formally applies only from FY2027 onward

Dutch Approach: One-to-One Transposition

The Dutch government has stated it will transpose CSRD on a one-to-one basis — no gold-plating, no additional national requirements beyond what the directive mandates.

Enforcement Body

The Autoriteit Financiele Markten (AFM) — the Netherlands Authority for the Financial Markets — will be the competent supervisory authority for CSRD compliance in the Netherlands.

5. Timeline — When Do Different Categories Report?

Post-Omnibus Reporting Timeline

Key Dates for US Parents with Dutch Subsidiaries

• June 30, 2026: European Commission expected to adopt NESRS (Non-EU Reporting Standards)
• January 1, 2028: First fiscal year for non-EU parent group reporting (FY2028)
• 2029: First sustainability statement published by the designated EU subsidiary
• March 19, 2027: Deadline for Member States (including NL) to transpose Omnibus I

6. What Reporting Actually Requires

European Sustainability Reporting Standards (ESRS)

In-scope companies must report under the ESRS, a comprehensive set of standards covering:

• ESRS 1: General requirements
• ESRS 2: General disclosures (always mandatory)
• ESRS E1–E5: Environmental (climate change, pollution, water, biodiversity, circular economy)
• ESRS S1–S4: Social (own workforce, workers in value chain, affected communities, consumers)
• ESRS G1: Governance (business conduct)

Double Materiality Assessment

Every reporting company must conduct a double materiality assessment, evaluating:

1. Impact materiality ("inside-out"): How does the company affect people and the environment?
2. Financial materiality ("outside-in"): How do sustainability matters affect the company's financial position, performance, and cash flows?

A topic is material — and must be reported on — if it is material from either perspective. The assessment process itself must be disclosed.

Assurance Requirements

• Initial requirement: Limited assurance (lower than financial audit standard)
• Future requirement: Reasonable assurance (comparable to financial audit), expected by approximately 2028–2030
• Assurance must be provided by an EU-accredited auditor or assurance provider
• The assurance opinion covers the sustainability report, including the double materiality assessment

Digital Filing

Reports must be prepared in XHTML format with sustainability information tagged using XBRL taxonomy (the EU's digital reporting format), enabling machine-readable data extraction.

Non-EU Parent Reports (NESRS)

For non-EU parents, the reporting standards (NESRS) are still being developed by EFRAG and must be adopted by the Commission by June 30, 2026. These are expected to be somewhat simpler than full ESRS but will still require comprehensive sustainability data at the group level.

7. Interaction with SEC Climate Rules

SEC Climate Disclosure Rule — Stayed and Undefended

The SEC's climate disclosure rule, finalized in March 2024, has been voluntarily stayed pending legal challenges in the Eighth Circuit. Following the Trump administration's inauguration in January 2025, the SEC moved to pause the litigation and has effectively abandoned defense of the rule. As of March 2026, the rule is stayed and undefended — but it has not been formally rescinded through notice-and-comment rulemaking. The Eighth Circuit has ordered the SEC to determine whether the rule will be "rescinded, repealed, modified, or defended in litigation," and state intervenor-respondents remain in the case.

Comparison: SEC Rule vs. CSRD

Practical Implications for Dual-Listed or Dual-Obligated US Companies

• No current overlap in practice: With the SEC rule stayed, CSRD is effectively the only binding sustainability reporting obligation for US companies with EU operations
• Data infrastructure overlap: Companies preparing for CSRD can leverage the same data infrastructure for any future SEC or state-level (e.g., California SB 253/261) climate disclosures
• Investor expectations persist: Even without SEC mandates, institutional investors increasingly expect climate disclosure aligned with ISSB/TCFD frameworks, which overlap significantly with ESRS E1
• Rule not dead: A future administration could revive the SEC rule without starting from scratch, and the Eighth Circuit's order creates ongoing pressure for resolution

Risk of Regulatory Fragmentation

US companies with EU operations face a fragmented landscape: CSRD in Europe, potential (if revived) SEC rules federally, California climate laws at the state level, and ISSB-aligned regimes in other jurisdictions. Building CSRD-grade data infrastructure now creates optionality for future compliance elsewhere.

8. Cost of Compliance

Initial Setup Costs

Ongoing Annual Costs

Key Cost Drivers for Non-EU Parents

For US-parented groups reporting through a Dutch subsidiary, additional cost factors include:

• Global data aggregation: Collecting sustainability data from all worldwide operations, not just EU
• Value chain mapping: ESRS requires disclosure on upstream and downstream impacts
• Cross-border coordination: Aligning group-level data with EU standards from a US headquarters
• EU auditor engagement: Assurance must be provided by an EU-accredited provider, potentially requiring engagement of a separate firm from the US financial auditor

Cost Context

EFRAG estimates total first-reporting costs for all in-scope EU companies at approximately EUR 1.7 billion, with recurring annual costs of EUR 1.9 billion. Per company, average initial costs are approximately EUR 287,000 for large companies, with ongoing assurance costs averaging EUR 320,000 annually.

9. Penalties for Non-Compliance

EU Framework — Member State Discretion

The CSRD requires Member States to establish "effective, proportionate, and dissuasive" penalties, but leaves the specifics to national law. This creates variation across the EU.

Netherlands-Specific Enforcement

• Supervisory authority: Autoriteit Financiele Markten (AFM)
• Financial sanctions: The AFM can impose administrative fines for failure to publish a compliant sustainability report
• Criminal penalties: Under Dutch law, failure to appoint an accredited assurance provider or obstruction of their audit is classified as an economic offense under the Wet op de Economische Delicten (Economic Offences Act), Article 1(4). Penalties include fines of the fourth category (approximately EUR 55,000 as of 2026) and up to 2 years imprisonment for responsible directors. Prosecution under general Criminal Code provisions (Articles 225, 326, 336 — fraud, forgery) could yield higher penalties (up to 6 years imprisonment and fifth-category fines of EUR 110,000).
• Director liability: Dutch law allows shareholders and stakeholders to claim damages from the company, its directors, and other directly responsible officers
• Public procurement exclusion: Non-compliant companies may face exclusion from EU/Dutch public tenders

Broader EU Penalty Benchmarks

Across the EU, penalties for CSRD non-compliance can include:

• Administrative fines varying by Member State — for example, Germany permits fines of up to EUR 10 million or 5% of annual revenue; the Netherlands-specific range is approximately EUR 10,000–900,000
• Public naming and shaming (publication of non-compliance)
• Court orders requiring compliance
• Personal liability for directors and officers

Reputational Risk

Beyond formal penalties, non-compliance carries significant reputational risk:

• ESG ratings agencies and investors will note non-compliance
• EU customers and partners may avoid non-compliant suppliers
• The sustainability report is public — its absence is equally public

10. Mitigation — Can a US Parent Structure Around CSRD?

Structural Approaches (Limited Effectiveness)

Practical Mitigation Strategies

1. Threshold monitoring: Actively track consolidated EEA turnover and subsidiary-level turnover against the EUR 450M / EUR 200M thresholds. If close to the line, legitimate commercial structuring may help.

2. Voluntary reporting instead: Companies below thresholds can adopt the voluntary ESRS standards (VSME — Voluntary SME standard) to satisfy stakeholder expectations without full CSRD compliance. This demonstrates good faith without the full cost.

3. Consolidated EU reporting: If in scope, designate a single EU subsidiary to report on behalf of all EU entities, minimizing duplication.

4. Leverage existing frameworks: If the company already reports under GRI, TCFD, or ISSB, much of the underlying data can be repurposed for ESRS — reducing incremental effort.

5. Phased preparation: Even if reporting is not required until FY2028 (publishing 2029), begin building data infrastructure now. The data collection challenge (especially Scope 3, value chain, social metrics) takes 12–18 months to establish properly.

6. Engage Dutch counsel early: The Netherlands' transposition is still in flux. Engage a Dutch law firm (e.g., NautaDutilh, Loyens & Loeff, De Brauw, Stibbe) to monitor legislative developments and advise on the specific interaction between the Omnibus thresholds and the Dutch implementing legislation.

7. Dual-use data strategy: Build ESG data infrastructure that can serve both CSRD/ESRS and any future US requirements (SEC, California, ISSB-aligned). This turns a compliance cost into strategic infrastructure.

Key Takeaways for US CFOs

1. The Omnibus is good news for mid-market companies. If your EEA turnover is under EUR 450M, you are likely out of scope. Breathe.

2. Large US groups are still caught. If your group exceeds EUR 450M EEA turnover and has a Dutch subsidiary generating >EUR 200M, CSRD reaches your entire worldwide group — through that Dutch entity.

3. The Dutch subsidiary is the trigger AND the publisher. Your small Dutch BV may be responsible for publishing a group-wide sustainability report covering US headquarters and all global operations.

4. You have time, but not much. Non-EU parents report starting FY2028 (published 2029). Data infrastructure takes 12–18 months to build. The clock starts now.

5. The Netherlands is granting FY2025–FY2026 exemptions for companies that fall out of scope under the new thresholds. If that is you, take the exemption — but keep monitoring.

6. SEC climate rules are stayed and undefended, but not rescinded. CSRD is the only binding ESG reporting law that currently affects US companies. Do not assume the US regulatory vacuum means you have no obligations.

7. Penalties are real. Dutch enforcement includes fines, director liability, and criminal penalties. This is not a soft-law framework.

8. You cannot easily structure around it. Moving entities between Member States does not help. Reducing turnover below thresholds is the only structural escape, and it must be genuine.

Sources

• EU Sustainability Rules Reset: What the 2026 Changes Mean — ISS Corporate
• Council and Parliament Strike a Deal — Consilium
• EU Sustainability Reporting Revamp — Crowell & Moring
• Omnibus Explained: Key Changes — Accountancy Europe
• EU Sustainability Omnibus I Adopted — Morrison Foerster
• Sustainability Omnibus Enters into Force — Allen & Overy / A&O Shearman (Netherlands)
• 5 Takeaways from Dutch Implementation Proposal — Coolset
• Introduction to Dutch Implementation of CSRD — RSM Netherlands
• CSRD Implementation: Where We Are — De Brauw
• CSRD: A Second Step Towards NL Implementation — NautaDutilh
• NESRS: CSRD Reporting Standards for Non-EU Companies — PwC NL
• CSRD for Non-EU Companies — CoreFiling
• Non-EU Groups Standard Setting — EFRAG
• EU Rolls Back CSRD Obligations — Wilson Sonsini
• Omnibus I Directive Published — Arthur Cox
• Simplified, Not Abandoned — White & Case
• Omnibus I: Clarity on CSRD and CSDDD — Stibbe
• EU Agrees Omnibus Changes — KPMG
• Council Signs Off Simplification — Consilium (Feb 2026)
• EU Omnibus Package: Stop-the-Clock — Sidley Austin
• CSRD Under Omnibus: Updated Scope and Timelines — Coolset
• Regulatory Climate Shift: SEC Updates — Harvard Law
• Companies Face Fragmented Disclosure Landscape — ESG Dive
• SEC Climate Rule vs CSRD — AuditBoard
• CSRD Unpacked: Enforcement and Penalties — Novata
• Cost of Non-Compliance: CSRD Fines Across Europe — Verv
• CSRD Compliance Costs — Position Green
• CSRD Costs Expected to Exceed EUR 100,000 — Corporate Disclosures
• CSRD: Large Companies Must Report — Business.gov.nl
• Corporate Sustainability Reporting — European Commission
• Impact of CSRD on Non-EU Entities — Grant Thornton
• Assessing CSRD Impact on Non-EU Groups — Forvis Mazars
• What US Companies Need to Know About CSRD — PwC US
• CSRD for US Companies — Wolters Kluwer
• Omnibus Directive Finalised — PwC Viewpoint
• EU Formally Adopts Omnibus I — Lexology