BRSR Core FY 2025-26: Top 500 ESG Assurance Rule, Assessment vs Assurance & the 30 Sep Deadline

By CS Sapna Malpani, Practising Company Secretary, Bangalore  |  Last updated: 21 June 2026

BRSR Core FY 2025-26: The Top 500 ESG Assurance Rule, the “Assessment or Assurance” Choice, and the Annual Report Deadline Your Board Cannot Miss

Around 250 listed companies are about to file an ESG number they have never had checked by an outsider before. From BRSR Core FY 2025-26, the assurance net widens from the top 250 listed entities to the top 500 by market capitalisation, measured as at 31 March 2026. For the 251 to 500 band, this is the first year their sustainability data must carry an independent assessment or assurance and sit inside the annual report. Miss it, file it late, or file it with a qualified conclusion, and the cost runs from daily stock-exchange fines to a SEBI penalty of up to Rs 1 crore, plus a governance black mark that follows the company into every fundraise and IPO room.

Why BRSR Core FY 2025-26 matters more than the year before

The Business Responsibility and Sustainability Report has been part of the SEBI Listing Obligations and Disclosure Requirements (LODR) framework for the top 1,000 listed entities since FY 2022-23. What changed is the introduction of an assured layer. SEBI carved out a sub-set of the BRSR, called BRSR Core, and required it to be independently checked on a phased timeline. FY 2025-26 is the year that phase reaches the top 500.

The legal anchor is Regulation 34(2)(f) of the SEBI LODR Regulations, 2015, which places the BRSR inside the annual report of the listed entity. The detailed framework comes from SEBI’s BRSR Core circular of 12 July 2023 (SEBI/HO/CFD/CFD-SEC-2/P/CIR/2023/122), as amended by the 20 December 2024 circular on Industry Standards (SEBI/HO/CFD/CFD-PoD-1/P/CIR/2024/177) and the 28 March 2025 circular that recalibrated the value chain rules. The current position is consolidated in the SEBI LODR Master Circular dated 30 January 2026.

For a company in the 251 to 500 band, the practical jump is large. Last year the BRSR Core was a self-declared disclosure for them. This year an external party must form a conclusion on the underlying numbers, test the evidence, and put their name to it. That shift exposes weak data governance that nobody outside the company had reason to look at before.

Phased applicability at a glance

According to CS Sapna Malpani, the companies most caught out are not the ESG laggards but the well-run mid-caps that assumed BRSR Core was a finance-team formality. “The number on the page may be fine. The problem is the absence of a documented trail an external reviewer can follow, and that gap only surfaces once someone is contractually required to test it.”

The big change: assessment OR assurance

The single most misunderstood point about BRSR Core applicability in 2026 is the verification standard. Until the end of 2024, the framework spoke only of reasonable assurance. The 20 December 2024 circular changed the language of the BRSR Core approach from “Data and Assurance” to “Data and Assessment or Assurance“. A listed entity may now choose.

An assessment is carried out against the Industry Standards on Reporting of BRSR Core developed by the Industry Standards Forum, which brings together ASSOCHAM, FICCI and CII in consultation with SEBI. An assurance is the familiar engagement under recognised assurance standards, where the provider expresses a formal conclusion. Reasonable assurance is the most rigorous form and remains available. The choice carries real consequences for cost, effort and the weight a conclusion carries, so the board should record why it picked one route.

One thing the choice does not change: the provider must be independent and free of conflict of interest, whichever route you take. The engagement is profession agnostic, so a Chartered Accountant, a Company Secretary or a Cost Accountant may do it, but the same person or firm cannot both prepare and check the numbers, and the audit committee must verify independence before the appointment.

What counts as BRSR Core, and where the data fails

BRSR Core is a defined set of key performance indicators under nine ESG attributes. These cover the greenhouse gas footprint, water usage, energy consumption, waste management, the wellbeing and safety of employees and workers, gross wages paid to women, enterprise spend on job creation in smaller towns, openness of business, and a few others. For each, the entity reports an intensity ratio, both output-based and adjusted for revenue at purchasing power parity, using the IMF conversion rate disclosed in a note.

The data layer is where most companies stumble. The recurring failures an assessor or assurer flags are missing KPI definitions, manually compiled spreadsheets with no audit trail, thin source evidence, and weak internal controls over ESG data. Greenhouse gas accounting is the sharpest example. Only about 27 percent of the top 1,000 listed companies voluntarily disclosed their Scope 3 emissions for FY 2024, which tells you how immature value chain data still is. Where supplier data is incomplete, companies fall back on conservative estimates, and estimates invite closer scrutiny and the risk of a qualified conclusion.

The value chain rules were eased, not removed

A lot of boards conflate the entity’s own BRSR Core with value chain ESG disclosure. They are separate obligations on separate timelines, and the value chain piece was deliberately softened.

After SEBI’s 28 March 2025 recalibration, value chain ESG disclosure applies to the top 250 listed entities, but only on a voluntary basis from FY 2025-26, with the assessment or assurance of that value chain data also voluntary from FY 2026-27. The scope was narrowed too: the value chain now means upstream and downstream partners that individually contribute at least 2 percent of the entity’s purchases or sales, and an entity may cap its disclosure at the partners that together make up 75 percent of purchases and sales by value.

This matters to more than listed entities. Large private companies that supply or distribute for a listed top-250 name will start receiving ESG data requests as those listed customers prepare their value chain numbers. A private supplier with no carbon or water data is a weak link in someone else’s report, and increasingly a factor in whether the contract renews. This is the angle that pulls unlisted ICP 1 companies into a rule that looks, on paper, like a listed-company problem.

What it costs to get this wrong

BRSR is part of the annual report under Regulation 34(2)(f), so a default is a LODR default, enforced through the uniform fine structure stock exchanges apply under SEBI’s Standard Operating Procedure (Master Circular SEBI/HO/CFD/PoD2/CIR/P/0155 dated 11 November 2024).

The fines are the visible cost. The hidden cost is larger. A qualified assurance conclusion on sustainability data is read by institutional investors, index providers and ESG rating agencies, and it surfaces in the due diligence of any company heading towards a fundraise or a listing. For an IPO-bound company, a clean BRSR Core track record is becoming part of the readiness checklist, in the same bracket as a clean secretarial audit.

How to close your BRSR Core obligation: a step-by-step

The window is tighter than it looks. The disclosure has to be ready for the FY 2025-26 annual report, which for most companies must go out before an AGM held on or before 30 September 2026. Assessment and assurance engagements take weeks once data requests, sampling and management responses are factored in, so the runway is now, not September.

1. Confirm applicability. Use the recognised stock exchange list of top entities by market capitalisation as at 31 March 2026. Borderline names near rank 500 should treat themselves as in scope until the list is confirmed.
2. Make the assessment-or-assurance decision early. An assessment may be lighter to run, but an assurance, particularly reasonable assurance, carries more weight with investors. Record the rationale in the board or audit committee minutes.
3. Appoint an independent provider. Confirm ESG competence, check there is no conflict of interest, and route the appointment through the audit committee. The provider cannot have prepared the data it is now checking.
4. Fix the data architecture. Write down KPI definitions, keep source evidence for every figure, and put basic internal controls around ESG data the way you would around financial data. This single step prevents most qualified conclusions.
5. Pressure-test Scope 3 and estimates. Where you have estimated emissions or supplier data, document the method and the assumptions. Assessors probe estimates hardest.
6. Embed and disclose. Place the assessed or assured BRSR Core in the annual report, finalised before the AGM, and file the annual report with the exchanges within the LODR timeline.

The deeper implication for boards and the CS function

BRSR Core moves sustainability data out of the marketing brochure and into the territory of audited disclosure, and that re-draws who is accountable. The audit committee now owns the independence of the ESG provider. The board owns the assessment-versus-assurance choice. The Company Secretary, who already shepherds Regulation 34 and the annual report, becomes the natural coordinator of the whole exercise: confirming the applicability band, minuting the board’s decisions, and getting the disclosure into the report on time.

According to CS Sapna Malpani, the next two reporting cycles will separate companies that treat ESG data as a compliance artefact from those that build it like financial data. “Once the top 1,000 are in from FY 2026-27, an unassured or qualified BRSR Core will stand out the way a qualified statutory audit does today. Boards that fix their data governance this year will not be scrambling next year, and they will pass investor diligence without a special project.” Each cycle pulls more companies into scope and raises the bar on the data behind the numbers, so the work done now is not wasted when the top 1,000 join.

BRSR Core vs the provisions it is often confused with

Three things get mixed up. BRSR Core is not the full BRSR: the Core is the assured sub-set of KPIs, the full BRSR is the wider report. BRSR Core is not value chain disclosure: the entity’s own Core is mandatory for the top 500 this year, while value chain disclosure is voluntary for the top 250. And an assessment is not the same as reasonable assurance: both satisfy the rule, but they sit at different points on the rigour scale and send different signals. Getting these distinctions right in the board paper prevents a company from either over-engineering an assessment-only obligation or under-delivering where investors expect assurance. For the governance backdrop, our guide on promoter reclassification under SEBI LODR Regulation 31A covers another LODR area where the fine print decides the outcome.

Sources and references

• SEBI — Industry Standards on Reporting of BRSR Core, Circular SEBI/HO/CFD/CFD-PoD-1/P/CIR/2024/177 dated 20 December 2024: sebi.gov.in
• SEBI — BRSR Core: Framework for assurance and ESG disclosures for value chain, Circular dated 12 July 2023: sebi.gov.in
• SEBI — LODR Master Circular dated 30 January 2026 (compliance by listed entities): sebi.gov.in
• SEBI LODR Regulation 34 (annual report): LODR Regulation 34 reckoner
• SEBI — SOP for non-compliance and fines, Master Circular SEBI/HO/CFD/PoD2/CIR/P/0155 dated 11 November 2024 (BSE guidance note): bseindia.com
• KPMG First Notes — SEBI introduces key changes in BRSR reporting (Jan 2025): kpmg.com
• Vinod Kothari Consultants — BRSR disclosures for value chain partners eased by SEBI (Apr 2025): vinodkothari.com
• ICSI — Chartered Secretary Journal, BRSR Core: icsi.edu

Frequently asked questions

Which companies must report BRSR Core for FY 2025-26?

For FY 2025-26, BRSR Core with assessment or assurance applies to the top 500 listed entities by market capitalisation, determined as at 31 March 2026 by the recognised stock exchanges. This is the first reporting year for roughly 250 companies in the 251 to 500 band, since the top 250 were covered from FY 2024-25 and the top 150 from FY 2023-24. From FY 2026-27 the requirement extends to the top 1,000.

Is reasonable assurance still mandatory for BRSR Core?

Not in its earlier rigid form. SEBI’s 20 December 2024 circular replaced the single requirement of reasonable assurance with a choice between an assessment and an assurance of BRSR Core, carried out under the Industry Standards developed by the Industry Standards Forum in consultation with SEBI. Reasonable assurance remains the highest option. The board should record why it selected its chosen route.

What is BRSR Core and how is it different from the full BRSR?

BRSR Core is a sub-set of the full Business Responsibility and Sustainability Report: a defined set of key performance indicators under nine ESG attributes, including the greenhouse gas footprint, water and energy intensity, waste, employee wellbeing and gross wages paid to women. Only these Core KPIs must be assessed or assured. The full BRSR is the wider report that sits in the annual report under Regulation 34(2)(f) of the SEBI LODR Regulations.

Are BRSR Core value chain disclosures mandatory for FY 2025-26?

No. After the 28 March 2025 recalibration, value chain ESG disclosures apply to the top 250 listed entities on a voluntary basis from FY 2025-26, and the related assessment or assurance is voluntary from FY 2026-27. The value chain covers upstream and downstream partners individually contributing at least 2 percent of purchases or sales, and an entity may limit disclosure to partners forming 75 percent of purchases and sales by value.

Who can provide BRSR Core assurance or assessment?

The engagement is profession agnostic. The provider need not be a Chartered Accountant; it may be a Chartered Accountant, a Company Secretary, a Cost Accountant or another qualified professional, provided the provider is independent, competent in ESG subject matter and free of conflict of interest with the entity or its group. ICAI’s SSAE 3000 and SSAE 3410, and the IAASB’s ISAE 3000, are the standards generally applied, and the audit committee must satisfy itself on independence.

What is the penalty if a top 500 company does not get BRSR Core assured or assessed?

BRSR sits in the annual report under Regulation 34(2)(f). Default is enforced through the uniform fines stock exchanges levy under SEBI’s SOP, including about Rs 2,000 per day for delayed or non-submission of the annual report, escalating to freezing of promoter holding and suspension of trading for prolonged default. SEBI can additionally act under Section 15HB of the SEBI Act, with a penalty up to Rs 1 crore. A qualified or adverse conclusion is also a governance signal that investors and IPO due diligence teams read closely.

This article is for general information and is not legal or compliance advice. BRSR Core applicability, assurance and value chain rules turn on the specific facts of each listed entity and the latest SEBI position. For advice on your company, consult a practising professional. Prepared by CS Sapna Malpani, Practising Company Secretary, Bangalore.