For the financial year that ended on 31 March 2026, the number of listed companies that must get their sustainability numbers independently verified has doubled. BRSR Core FY 2025-26 now applies to the top 500 listed entities by market capitalisation, up from the top 250 last year. That brings roughly 250 mid-cap companies into the assurance net for the first time, and most of them are discovering the rules only now, with their annual report and AGM a few weeks away. Miss it and the company faces per-day exchange fines, a residual penalty up to Rs 1 crore under the SEBI Act, and up to Rs 25 crore under the Securities Contracts (Regulation) Act for failing to meet a listing condition.
Quick Summary
Who must comply: Top 500 listed entities by market cap (FY 2025-26) for the BRSR Core subset.
Deadline: Before the AGM. Companies with a March year-end must hold the AGM by 30 September 2026, so roughly 100 days remain.
What is new: You may now choose assessment or assurance; the provider must be independent.
Penalty for non-compliance: Per-day exchange fines, up to Rs 1 crore (SEBI Act s.15HB) and up to Rs 25 crore (SCRA s.23E).
Key action: Confirm your rank, map the 9 attributes, and appoint a conflict-free provider now.
What BRSR Core Is, and Why FY 2025-26 Is the Year It Bites
The full Business Responsibility and Sustainability Report (BRSR) has applied to the top 1000 listed companies by market capitalisation since FY 2022-23. It is a long disclosure filed inside the annual report. On its own, BRSR is a self-declared document, so SEBI added a layer to make the most material numbers trustworthy.
That layer is BRSR Core: a subset of about 40 key performance indicators grouped under 9 ESG attributes. Unlike the wider report, BRSR Core must be independently verified, and SEBI introduced it through a circular dated 12 July 2023 with a deliberate glide path so companies got time to build their data systems. FY 2025-26 is the year the glide path reaches the top 500.
The practical problem is that the top 500 list, by market cap, sweeps in companies that never treated sustainability data as audit-grade. A company ranked, say, 380th may have published a BRSR for two years using rough internal estimates. Those estimates now have to survive an independent reviewer who checks the underlying records. That is a different exercise, and it cannot be finished in the last week before the board meeting.
The Compliance Glide Path (Where You Sit This Year)
FY 2023-24 — Top 150 listed entities (first cohort under assurance)
FY 2024-25 — Top 250 listed entities
FY 2025-26 — Top 500 listed entities YOU ARE HERE
FY 2026-27 — Top 1000 listed entities (full coverage)
Rank is fixed by market capitalisation as on 31 March 2026. If your company crossed into the top 500 during the year, you are in scope for the report you are finalising right now. There is no soft-landing year and no separate application. The obligation is automatic the moment the rank applies.
What Changed on 28 March 2025
The rules were eased on one front and tightened on another by SEBI circular SEBI/HO/CFD/CFD-PoD-1/P/CIR/2025/42 dated 28 March 2025, which sits within the SEBI Master Circular for LODR dated 11 November 2024. Three changes matter for the work you are doing this quarter.
1. Assessment or assurance, your choice. Earlier, BRSR Core needed reasonable assurance, which in practice meant a chartered accountant or assurance firm. SEBI now lets a company choose between assessment and assurance, both carried out as per the standards of the Industry Standards Forum (ISF). The stated aim was to cut cost and make the process profession-agnostic, so Company Secretaries, cost accountants and other qualified professionals can take it up.
2. The independence bar got real teeth. SEBI requires the provider to have the expertise and, more pointedly, no conflict of interest. The circular spells out that the provider must not sell products or offer other consulting services to the listed entity. A firm already running your internal audit, your tax work, or your ESG consulting is usually disqualified from also verifying your BRSR Core. Many companies have learned this the hard way after appointing the friendly firm that built their report.
3. Value chain got deferred. The same circular made ESG disclosures for the value chain voluntary for the top 250 for FY 2025-26, and the related assessment or assurance voluntary from FY 2026-27. The value chain now covers upstream and downstream partners contributing at least 2% of purchases and sales, and a company may limit disclosure to 75% of that value. So the value chain is a lighter touch this year. BRSR Core for your own entity is not.
SEBI also added new KPIs such as job creation in small towns, openness of business, and gross wages paid to women, and brought in Purchasing Power Parity adjusted intensity ratios so Indian numbers compare cleanly across borders.
The 9 Attributes You Must Get Verified
| # | BRSR Core Attribute | What gets checked |
|---|---|---|
| 1 | Greenhouse gas footprint | Scope 1 and Scope 2 emissions and intensity |
| 2 | Water footprint | Withdrawal, consumption, discharge intensity |
| 3 | Energy footprint | Total energy, share of renewables |
| 4 | Embracing circularity | Waste generated, recycled, disposed |
| 5 | Employee wellbeing and safety | Safety incidents, wellbeing spend, coverage |
| 6 | Gender diversity | Wages paid to women, POSH complaints |
| 7 | Inclusive development | Jobs in smaller towns, sourcing from MSMEs |
| 8 | Fairness with customers and suppliers | Concentration of purchases and sales, data privacy |
| 9 | Openness of business | Share of trading houses, related parties, dealers |
The reviewer does not take your word for the totals. They trace a sample back to meter readings, payroll, purchase ledgers and HR records. If your data lives in a spreadsheet that nobody can tie to a source document, that is where the engagement stalls.
Assessment vs Assurance: Which to Pick
| Assessment | Assurance | |
|---|---|---|
| Basis | ISF assessment standards | Recognised assurance standards |
| Who can do it | Wider set of professionals | Assurance practitioners |
| Typical cost | Lower | Higher |
| Independence rule | Applies | Applies |
| Best for | Cost-conscious first-timers | Companies eyeing global investors |
Assessment is the cheaper, lighter route and suits a company entering the regime for the first time this year. A company that already markets itself to overseas funds, or one preparing for a larger capital raise, often keeps the assurance label because international investors recognise it. Either way the independence rule is the same, and either way the verified BRSR Core must reach the board before the annual report is signed.
What You Must Do Now: A 6-Step Plan
With the AGM deadline of 30 September 2026 about 100 days out, the work has to start this month. Here is the order that keeps an engagement from stalling.
Step 1 — Confirm the rank. Check your market-cap rank as on 31 March 2026 against the exchange list. If you are at or above 500, you are in scope. Borderline ranks should assume they are in and confirm with the exchange.
Step 2 — Map the 9 attributes to your data owners. Assign each attribute to the person who holds the source records: plant heads for emissions and water, HR for wages and diversity, procurement for sourcing and concentration. Gaps found now are fixable; gaps found by the reviewer are not.
Step 3 — Decide assessment or assurance. Most first-year top-500 companies pick assessment for cost. Lock the choice early because it shapes who you can appoint.
Step 4 — Appoint a conflict-free provider. Run the independence test before you sign: does the firm sell you any other service? If yes, look elsewhere. This single check trips up more companies than any data gap.
Step 5 — Run the engagement and fix the trail. Give the provider source documents, not summaries. Expect questions on intensity ratios and the new KPIs, which most internal teams have never reported before.
Step 6 — Embed BRSR Core in the annual report and file. The verified BRSR, including the BRSR Core, goes into the annual report that is approved by the board, circulated to shareholders, and filed with the exchanges under the LODR Regulations before the AGM.
The Real Cost of Getting It Wrong
BRSR Core is not a stand-alone form with its own fee. It lives inside the annual report under the LODR Regulations, so non-compliance is treated as a listing default and the consequences stack up.
| Trigger | Consequence | Source |
|---|---|---|
| Annual report / disclosure default | Per-day fine levied by BSE and NSE | SEBI SOP under LODR |
| Residual violation (no specific penalty) | Up to Rs 1 crore | Section 15HB, SEBI Act 1992 |
| Failure to comply with listing condition | Up to Rs 25 crore | Section 23E, SCRA 1956 |
| Continued default | Promoter holding freeze, scrip suspension | SEBI SOP under LODR |
The exchange fine is the visible cost. The larger cost is reputational. A qualified or missing BRSR Core review is read by ESG rating agencies and institutional investors as a governance red flag, and it surfaces in due diligence the moment the company tries to raise capital or attract a strategic partner.
BRSR Core FY 2025-26, By The Numbers
Listed entities now in scope
ESG attributes that must be verified
To the 30 Sept 2026 AGM deadline
Top penalty under SCRA s.23E
The Deeper Implication for IPO-Bound Boards
According to CS Sapna Malpani, the companies most exposed are not the seasoned top-150 names but the IPO-bound and recently listed boards that have never run an audit-grade sustainability process. A company planning to list in the next two years should treat BRSR Core readiness as part of its pre-IPO governance work, not as a post-listing afterthought, because the data systems take a full reporting cycle to build and the independence rule limits which advisers can verify the result.
The direction of travel is obvious. SEBI went from the top 150 to the top 500 in two years, and the top 1000 join next year. Scope only grows. The value chain disclosures that are voluntary now will not stay voluntary. Build clean, traceable data this year and the next report becomes a refresh. Leave it to the fortnight before the board meeting and you will pay for the same fire drill every September.
How BRSR Core Differs From the Full BRSR
The two are often confused, and the difference decides how much independent work you owe. The full BRSR is a self-declared disclosure across all ESG principles, filed by the top 1000. BRSR Core is the smaller, high-materiality subset of about 40 KPIs under 9 attributes that must be independently assessed or assured. Every company in scope files the full BRSR; only the Core subset carries the verification obligation, and only the top 500 carry it for FY 2025-26.
Key Takeaways
- ✅ BRSR Core FY 2025-26 applies to the top 500 listed entities by market cap, up from top 250.
- ✅ Companies ranked roughly 251 to 500 enter the assurance net for the first time this year.
- ✅ You may choose assessment or assurance since the SEBI circular of 28 March 2025.
- ✅ The provider must be independent and cannot sell you other services.
- ✅ 9 attributes and about 40 KPIs must be traced to source records, not estimates.
- ✅ Value chain ESG disclosures stay voluntary this year; BRSR Core for your entity does not.
- ✅ Finish before the AGM, which for a March year-end falls by 30 September 2026.
Sources and References
- SEBI Circular SEBI/HO/CFD/CFD-PoD-1/P/CIR/2025/42 dated 28 March 2025 — assessment or assurance, value chain, green credits: sebi.gov.in
- SEBI Circular SEBI/HO/CFD/CFD-SEC-2/P/CIR/2023/122 dated 12 July 2023 — BRSR Core glide path: sebi.gov.in
- SEBI Master Circular for compliance with LODR dated 11 November 2024 (Annexure on BRSR): sebi.gov.in
- Section 15HB, Securities and Exchange Board of India Act, 1992 — residual penalty up to Rs 1 crore: indiacode.nic.in
- Section 23E, Securities Contracts (Regulation) Act, 1956 — penalty up to Rs 25 crore for listing-condition default: indiacode.nic.in
- SEBI standard operating procedure for non-compliance with LODR — per-day exchange fines: nseindia.com / bseindia.com
Are You in the Top 500 and Unsure Where to Start?
Map your BRSR Core readiness before the engagement, not during it. Use the MCA & SEBI Penalty Calculator to size your exposure, then book a confidential review.
Talk to CS Sapna Malpani | WhatsApp
Frequently Asked Questions
Who must comply with BRSR Core in FY 2025-26?
For FY 2025-26, BRSR Core assessment or assurance applies to the top 500 listed entities by market capitalisation. The earlier phases covered the top 150 for FY 2023-24 and the top 250 for FY 2024-25. So companies ranked roughly 251 to 500 enter the verification net for the first time this year, and they file the report being finalised now.
What is the difference between BRSR and BRSR Core?
BRSR is the full Business Responsibility and Sustainability Report filed by the top 1000 listed companies inside the annual report. BRSR Core is a smaller subset of about 40 KPIs grouped under 9 ESG attributes that must be independently verified through assessment or assurance. Every company in scope files the full BRSR, but the verification obligation attaches only to the Core subset.
Can a company choose assessment instead of assurance for BRSR Core?
Yes. Since the SEBI circular dated 28 March 2025, a listed entity may choose either assessment or assurance for BRSR Core, carried out as per the standards of the Industry Standards Forum. Assessment was introduced to lower cost and make the process profession-agnostic, so a wider set of qualified professionals can take it up. The independence rule applies to both routes.
Can our statutory auditor provide BRSR Core assurance?
Only if there is no conflict of interest. SEBI requires the provider to have no conflict, which the circular describes as not selling products or offering other consulting services to the listed entity. A firm already doing your tax, internal audit or ESG consulting is usually disqualified from also verifying your BRSR Core, so check independence before you appoint anyone.
What is the penalty for not getting BRSR Core assurance?
BRSR Core sits inside the annual report under the LODR Regulations, so a default is treated as a listing breach. The stock exchanges levy per-day fines under the SEBI standard operating procedure. On top of that, Section 15HB of the SEBI Act allows a residual penalty up to Rs 1 crore, and Section 23E of the Securities Contracts (Regulation) Act allows up to Rs 25 crore for failure to comply with a listing condition. Continued default can lead to a promoter holding freeze.
When is the BRSR Core FY 2025-26 deadline?
BRSR Core for FY 2025-26 forms part of the annual report, which must be approved and circulated before the AGM. For a company with a March year-end, the AGM must be held by 30 September 2026, so the assessment or assurance has to be completed before that date. Counting from mid-June, that leaves about 100 days.
Do IPO-bound companies need to worry about BRSR Core?
Yes, on a forward-looking basis. BRSR Core does not apply until a company is listed and ranked, but the data systems and the independent-provider relationship take a full reporting cycle to build. An IPO-bound board that prepares BRSR Core readiness before listing avoids a first-year scramble and presents cleaner governance to investors during due diligence. You can read our related guide on related party transactions under Section 188 for another area diligence teams scrutinise.
This article is general information, not legal or compliance advice. BRSR Core applicability depends on your exact market-cap rank and facts. For advice on your company, contact CS Sapna Malpani or browse the compliance blog.