The CSDDD

For in-depth insights into the latest regulations affecting the insurance industry, visit our ESG Insurance Regulatory Guide.

Following arduous negotiations, the European Council has ultimately reached consensus on the text for the Corporate Sustainability Due Diligence Directive (CSDDD or the Directive).

The text adopted on 24 April 2024 by the European Parliament in its plenary session includes a compromise in relation to the services sector, and an increase of the threshold for all other companies (EU and non-EU) to fall within the scope of the Directive, namely a net worldwide turnover of more than EUR450 milion for each of the last two consecutive financial years and 1,000 employees on average is required.

The Directive will be implemented in phases, starting with a two-year transposition into national law by Member States, phased-in as follows:

• 3-year period for companies with over 5000 employees and EUR1500 million turnover (from 2027)
• 4-year period for those with over 3000 employees EUR900 million turnover (from 2028)
• 5-year period for companies with over 1000 employees and EUR450 million turnover, and for companies having entered into franchising or licensing agreements with over EUR80 million turnover in the EU and EUR22.5 million in royalties (from 2029).

The core provision, Article 6 of the CSDDD establishes the obligation for Member States to ensure that companies take appropriate measures to identify and assess actual or potential adverse human rights and environmental impacts “arising from their own operations or those of their subsidiaries and, where related to their chains of activities, those of their business partners.”

Under the agreed text, the financial sector – including insurers – will not have the same due diligence obligations as other sectors. As the provision of services by downstream business partners is omitted from the definition of value chains/chain of activity, service providers - including financial services providers - have no due diligence obligations in relation to their downstream market (see recital (26): “The definition of the term “chain of activities” should not include the activities of a company's downstream business partners related to the services of the company. For regulated financial undertakings, the definition of the term “chain of activities” should not include downstream business partners that receive their services and products. Therefore, as regards regulated financial undertakings, only the upstream but not the downstream part of their chains of activities should be covered by this Directive.”); albeit the Commission can decide whether to expand the duties of the financial services sector no later than 2 years after entry into force of the Directive.

What does this mean for insurers?

Due to their size, (most) insurance companies will be within scope of the CSDDD in view of their turnover and number of employees, and therefore will have to comply with the due diligence requirements at operational level, and in their upstream market.

Under the agreed text, insurance companies will have to:

• carry out due diligence regarding potential human rights adverse impacts and environmental adverse impacts of their own business activities,
• carry out due diligence of their upstream business partners/business relationships,
• take appropriate measures to prevent, or where prevention is not possible or not immediately possible, adequately mitigate potential adverse impacts that have been, or should have been, identified,
• bring take appropriate measures to bring actual adverse impacts that have been, or should have been, identified to an end, and
• adopt and put into effect a transition plan for climate change mitigation aligned with the Paris Agreement’s objective of limiting global warming to 1.5 °C. Such requirements should be understood as an obligation of means and not of results.

This mainly means that insurance companies have to take appropriate measures to identify actual or potential adverse human rights and environmental impacts arising from their own operations or those of their subsidiaries and, where related to their value chains, from their established business relationships in their upstream market.

According to recital (19) “Companies should take appropriate steps to set up and carry out due diligence measures, with respect to their own operations, those of their subsidiaries, as well as those of their direct and indirect business partners throughout their chains of activities in accordance with this Directive. This Directive should not require companies to guarantee, in all circumstances, that adverse impacts will never occur or that they will be stopped. ” The Directive does not require companies to guarantee, in all circumstances, that adverse impacts will never occur or that they will be stopped. Therefore, the main obligation in the Directive is an “obligations of means”.

Subject to the transposition of the Directive by the Member States, companies within the scope of the CSDDD infringing national provisions adopted pursuant to the Directive, may be exposed to pecuniary penalties, albeit the potential reputational impacts of infringement may be of equal concern.

What can be part of the chain of activities in case of insurance companies?

Under Recital 25 of the CSDDD, the chain of activities covers “activities of a company’s upstream business partners related to the production of goods or the provision of services by the company, including the design, extraction, sourcing, manufacture, transport, storage and supply of raw materials, products or parts of the products and development of the product or the service, and activities of a company’s downstream business partners related to the distribution, transport and storage of the product, where the business partners carry out those activities for the company or on behalf of the company”.

Upstream market

Economically speaking, an upstream market is one at a previous stage of the value/production/distribution chain where a given product or service is found.

However, what constitutes the upstream market of an insurance company is less obvious.

The currently agreed text of the CSDDD provides under Article 3(g)(i) “activities of a company’s upstream business partners related to the production of goods or the provision of services by the company, including the design, extraction, sourcing, manufacture, transport, storage and supply of raw materials, products or parts of the products and development of the product or the service”.

The absence of a definitive definition for an upstream market is unhelpful and would certainly benefit from the publication of additional guidance, particularly through comparative analysis with other market concepts like the banking industry.

We can speculate that the design of the insurance product, including the process of writing the policy could be an upstream market, ie, brokers that create policy wordings or consultancies used for policy design. In case of a re-insurer, the primary insurer would likely be an upstream market. Banks, by lending money to insurers to develop their products or services, could also be part of the upstream market for insurance companies.

Article 13 provides for “meaningful engagement with stakeholder”, and Article 19 establishes that the Commission, in consultation with Member States and other appropriate organisations, shall issue guidelines, including general guidelines and sector-specific guidelines or guidelines for specific adverse impacts. This will hopefully produce some sector specific guidelines by the Commission as it might be helpful to appreciate the definition of the upstream market in the insurance sector.

Downstream market

Whilst not caught by the CSDDD itself, part of the downstream market for insurance companies will be their clients, ie the policyholders, and for re-insurers their primary insurers, as specifically mentioned in an earlier version of the CSDDD text, when it was proposed in November 2023.

However, underwriters must already carry out relevant due diligence when assessing a new risk, which will likely include and assessment of the exposure of their policyholders with regards to human rights violations or environmental risks.

At the same time, it is worth noting that under recital 51 “Regulated financial undertakings are expected to consider adverse impacts and to use their so-called “leverage” to influence companies. The exercise of shareholders’ rights can be a way to exercise leverage.”

It is not clear whether the exclusion of the downstream market from the scope of the CSDDD for financial undertakings will have any substantial effect on the financial sector (and to a lesser extent, the insurance sector), considering that insurance and financial companies are regulated companies already subjected to due diligence obligations regarding their business partners (eg AML and KYC obligations).

Regardless, insurers can still be the subject of due diligence requests of their impact by any of their clients who are in scope (ie the insurer will be in the upstream value chain of its client), thus insurers may well receive due diligence inquiries that they need to respond to.

The Directive will come into force from the 20th day after it has been published in the Official Journal of the European Union (expected end of May 2024) and then will have to be transposed by Member States within two years.

One can foresee complexities for insurers to navigate the transposition of the Directive if Member States apply the Directive differently.