A founder running a ₹40 crore auto-components company told us his BRSR exposure was zero because he isn't listed. Three months later his largest customer — a NIFTY 500 manufacturer — sent him a 22-field ESG data request with a contractual deadline and a clause saying non-response would remove him from the approved vendor list. He was right that BRSR does not apply to him. He was wrong that it does not affect him. That gap is where most unlisted Indian companies are sitting in September 2026.
What the law actually requires
Business Responsibility and Sustainability Reporting sits in Regulation 34(2)(f) of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, as amended by the SEBI notification of 5 May 2021. It requires the top 1,000 listed entities by market capitalisation to include a BRSR in their annual report. The format follows the nine principles of the National Guidelines on Responsible Business Conduct (NGRBC), and the report is split into three sections: Section A (general disclosures), Section B (management and process disclosures) and Section C (principle-wise performance disclosures).
The part founders confuse is BRSR Core, introduced by SEBI's circular SEBI/HO/CFD/CFD-SEC-2/P/CIR/2023/122 dated 12 July 2023. BRSR Core is a subset — nine specified ESG attributes with defined KPIs, including greenhouse gas footprint, water footprint, energy footprint, embracing circularity, employee wellbeing and safety, gender diversity, enabling inclusive development, fairness in engaging with customers and suppliers, and openness of business. These nine attributes are the only ones that must be assured by an independent assurance provider. The rest of the BRSR remains a disclosure obligation without mandatory assurance.
The assurance obligation phases in by market capitalisation:
- FY 2023-24 — top 150 listed entities
- FY 2024-25 — top 250 listed entities
- FY 2025-26 — top 500 listed entities
- FY 2026-27 — top 1,000 listed entities
That last line matters. From the financial year that began on 1 April 2026 — the year currently running — the entire BRSR universe of 1,000 companies is inside the assurance net for BRSR Core. If your company is listed and anywhere in the top 1,000 by market cap, reasonable assurance on the nine Core attributes is a current-year obligation, not a future one.
The second half of the framework is the value chain disclosure. Under the same July 2023 circular, listed entities must report BRSR Core KPIs for their value chain partners — defined as the upstream and downstream partners that individually account for 2% or more of the entity's purchases or sales by value, covering at least 75% of purchases and sales respectively. SEBI's December 2024 decision deferred mandatory value chain assessment, and the disclosure is on a comply-or-explain basis with the assessment or assurance of value chain data becoming a live requirement from FY 2026-27. In practice, listed buyers began collecting supplier data a full year ahead so that their own reporting would hold up.
There is a third layer that unlisted companies frequently miss. Section 134(3)(m) of the Companies Act 2013, read with Rule 8(3) of the Companies (Accounts) Rules 2014, already requires every company's Board Report to disclose conservation of energy, technology absorption, and foreign exchange earnings and outgo. And Section 135 requires companies meeting the CSR thresholds — net worth of ₹500 crore, turnover of ₹1,000 crore, or net profit of ₹5 crore in the immediately preceding financial year — to constitute a CSR Committee, spend 2% of average net profits of the preceding three financial years, and file Form CSR-2 as an addendum to AOC-4. Unspent CSR under Section 135(6) must be transferred to an Unspent CSR Account within 30 days of the financial year end and deployed within three years, failing which it goes to a Schedule VII fund. So an unlisted Pvt Ltd is not outside the sustainability disclosure regime — it is inside a narrower version of it.
Practical implications
For listed companies in the top 1,000. Reasonable assurance is materially harder than limited assurance. Under SAE 3000 (Revised) and the ICAI's assurance framework, a limited assurance conclusion is expressed negatively — "nothing has come to our attention" — and relies mostly on enquiry and analytical procedures. Reasonable assurance requires the assurance provider to obtain sufficient appropriate evidence to express a positive opinion. For a greenhouse gas figure, that means source documents for fuel consumption, electricity bills reconciled to the general ledger, emission factor documentation and a recalculation. Companies that produced defensible-looking BRSR numbers from a spreadsheet for three years routinely fail at this step.
A BRSR that is filed but not assured, or assured by a provider that does not meet SEBI's independence conditions, is a Regulation 34 non-compliance. Under the SEBI (LODR) framework and the standard operating procedure for non-compliance, stock exchanges levy fines for delayed or deficient annual report disclosures, and persistent non-compliance can result in the scrip being moved to the restricted trading category. SEBI's circular also bars the assurance provider from having any conflict of interest — it cannot be providing non-audit or non-assurance services, including consulting on the same subject matter, to the listed entity or its group entities.
For the unlisted supplier. There is no SEBI penalty. The consequence is commercial and it arrives faster. A listed buyer whose own BRSR Core assurance requires value chain data will not accept "we don't track that." Procurement contracts in FY 2026-27 increasingly carry ESG data warranties, and a supplier who cannot produce Scope 1 and Scope 2 emissions, water withdrawal by source, waste generated by category, and gender-disaggregated wage data loses the tender to one who can. Banks have started asking too — several lenders now ask for an ESG baseline as part of the credit appraisal for facilities above ₹25 crore.
On the MCA21 v3 side, none of this triggers a filing flag directly, because BRSR is a SEBI obligation filed with the exchanges, not with the ROC. But CSR-2 does. MCA21 v3's rule engine cross-checks AOC-4 financial data against CSR applicability thresholds, and a company that crosses ₹5 crore net profit without a corresponding CSR-2 is a straightforward system-generated inconsistency. Penalty under Section 135(7) is twice the unspent amount required to be transferred, or ₹1 crore, whichever is less, for the company; and one-tenth of the unspent amount or ₹2 lakh, whichever is less, for every officer in default.
Step-by-step: what to do
- Establish which regime applies to you. If listed, check your market-cap rank as of 31 March 2026 against the top 1,000 list published by the exchanges — that fixes your FY 2026-27 assurance obligation. If unlisted, check your Section 135 CSR applicability against net worth ₹500 crore / turnover ₹1,000 crore / net profit ₹5 crore for FY 2025-26.
- Build the nine BRSR Core data sets now, not at year end. Greenhouse gas (Scope 1 and Scope 2, in tCO2e per rupee of turnover), water withdrawal and consumption by source, energy consumed by renewable and non-renewable source, waste generated and recycled, employee turnover and safety incidents (LTIFR), gender diversity in board and workforce, spend on suppliers from marginalised groups, complaints from customers, and revenue from related-party transactions as a share of total. Each needs a named owner and a monthly capture cadence.
- Trace every number to a source document. For reasonable assurance the working paper must show the invoice, meter reading, HR record or payroll register behind the figure. Build the audit trail as you capture the data — reconstructing 12 months of it in March is where budgets and timelines break.
- Appoint the assurance provider by Q2, not Q4. Confirm in writing that the provider has no conflicting engagement with the company or any group entity on the same subject matter, and that it will report under SAE 3000 (Revised) or ISAE 3000. Get the scoping memo and the readiness gap report before December so there is time to fix the gaps.
- Map your value chain partners. List upstream and downstream partners at 2% or more of purchases or sales by value, work down until you cover 75% of each, and send them the data template early. This is the single longest-lead item in the whole exercise.
- If you are the unlisted supplier, build a voluntary baseline. One financial year of Scope 1, Scope 2, water, waste, and workforce diversity data, prepared on the BRSR Core definitions, converts an ESG questionnaire from a fire drill into a copy-paste. It also gives you something to put in front of a lender.
- Do not skip CSR-2. If Section 135 applies, file Form CSR-2 as an addendum to AOC-4 for the relevant financial year, and reconcile the unspent CSR account balance before the Board Report is signed.
FAQ
Does BRSR apply to an unlisted private limited company?
No. Regulation 34(2)(f) of SEBI LODR applies only to the top 1,000 listed entities by market capitalisation. An unlisted Pvt Ltd has no BRSR filing obligation. It may still face BRSR-derived data requests contractually, as a value chain partner of a listed buyer, and it remains subject to Section 134(3)(m) Board Report disclosures and Section 135 CSR if the thresholds are crossed.
What is the difference between limited and reasonable assurance?
Limited assurance gives a negatively-worded conclusion based mainly on enquiry and analytical review. Reasonable assurance gives a positive opinion and requires substantive testing against source evidence — recalculation, vouching to invoices, and controls testing. BRSR Core requires reasonable assurance on the nine specified attributes; the remainder of the BRSR is disclosed without mandatory assurance.
Can our statutory auditor provide the BRSR Core assurance?
Only if there is no conflict of interest under SEBI's July 2023 circular. The assurance provider cannot be engaged in any non-audit or non-assurance work, including ESG consulting or data preparation, for the listed entity or its group entities on the same subject matter. Most companies appoint a separate firm to avoid the independence question entirely.
What happens if we file the BRSR without the required assurance?
It is treated as a deficiency in the annual report disclosure under Regulation 34 and attracts fines under the SEBI–exchange standard operating procedure for LODR non-compliance, escalating with the period of default. Persistent non-compliance can lead to the scrip being moved to the restricted trading category and to action against the company and its officers under Section 15HB of the SEBI Act.
For a compliance audit of your company, visit pvtltd.co
---
See Also
- "Our internal auditor already covers it": what RBI's concurrent audit mandate for NBFCs actually requires
- "We're private, so Ind AS doesn't apply to us": What the ₹250 crore net worth threshold actually triggers
- "It's just an internal review": what actually triggers a forensic audit and how the findings end up in an NCLT petition or an FIR
Ready to incorporate or sort your compliance?
Our team handles every filing. You focus on building.