ESG and Climate Risk: What GCC Banks Are Not Yet Pricing In
In this article
At a glanceWhat climate risk actually means for a GCC bank's balance sheetWhere the governance gap actually sitsWhat regulators across the region are signallingWhat this means for the CRO specificallyWhere this leaves risk leadersBoardroom questionsContinue readingAt a glance
How climate exposure can enter credit decisions, portfolio concentration and stress testing—and why disclosure alone does not establish risk management.
There is a version of the ESG conversation happening in GCC banking that I find unconvincing. It involves well-designed sustainability reports, carefully worded commitments to net zero, and green bond issuances that generate positive headlines. None of that is without value. But it is not the same as genuinely pricing climate risk into credit decisions, stress testing portfolio exposure to transition scenarios, or building the governance structures that would catch a climate-related concentration before it becomes a problem.
The gap between ESG communication and ESG risk management is one of the most significant governance gaps I see across the region right now. And it is closing more slowly than the underlying risk is building.
This article is not about whether GCC banks should take ESG seriously. That question is settled, both by regulatory direction and by the economic reality of what climate transition means for a region whose financial system remains significantly exposed to hydrocarbon-linked sectors. The question worth asking is whether institutions are treating ESG as a risk management challenge or as a communications challenge. The answer, in most cases I've observed, is still closer to the latter.
What climate risk actually means for a GCC bank's balance sheet
Climate risk enters a bank's balance sheet through two distinct channels, and most ESG frameworks I've reviewed across the region handle one reasonably well and the other barely at all.
Physical risk, the direct financial impact of climate events on borrowers and collateral, is increasingly well understood at a conceptual level. Flood risk to real estate collateral, heat stress on agricultural and construction sector borrowers, water scarcity affecting industrial operations. These are quantifiable, they are mappable against existing portfolios, and the data to assess them, while imperfect, exists and is improving. The institutions that are doing this work are building genuine risk intelligence. The ones that aren't are carrying exposures they haven't priced.
Transition risk is harder and more consequential for the GCC specifically. This is the financial impact of the global shift away from carbon-intensive activities: stranded asset risk in hydrocarbon-linked sectors, repricing of carbon-intensive collateral as regulatory and market conditions change, and the speed at which borrowers in exposed sectors can credibly transition their own business models. For banks with significant exposure to government-related entities, construction, petrochemicals, and energy, transition risk is not a distant theoretical concern. It is a portfolio-level question that belongs in the credit risk framework now, not when the external pressure makes it unavoidable.
Where the governance gap actually sits
The ESG governance gap in most GCC institutions I've observed is not primarily a data problem, though data is genuinely difficult. It is a structural problem: climate and ESG risk sits in a sustainability function that reports separately from the risk function, produces its own metrics, and operates on a different reporting cycle to the credit and risk committees that make actual portfolio decisions.
This structural separation means that ESG considerations, even where they're genuinely understood, rarely influence individual credit decisions in real time. The sustainability team knows the portfolio's carbon intensity. The credit committee approving the next facility to a carbon-intensive borrower may not have that context in front of them when the decision is made. That is a governance failure, not a data failure.
The integration that's needed is not complicated in principle: climate risk factors need to be embedded into credit assessment frameworks, large exposure monitoring, and stress testing, in the same way that any other material risk factor would be. What makes it hard in practice is that it requires the risk function to take ownership of something that has been treated as someone else's responsibility.
What regulators across the region are signalling
The CBB, along with the Saudi Central Bank, the UAE Central Bank, and regional standard-setters, has been moving steadily toward formal climate risk expectations for financial institutions. The direction is consistent with what the Basel Committee, the Network for Greening the Financial System, and the FSB have established internationally: institutions should be assessing, disclosing, and managing climate-related financial risks as a core part of their risk framework, not as a parallel ESG exercise.
For GCC institutions that are waiting for mandatory requirements before building the capability, the window to build it ahead of regulatory pressure is narrowing. The institutions that will be best positioned are the ones that have already embedded climate considerations into their credit and risk frameworks, not the ones that respond to a regulatory deadline with a framework built in six months.
What this means for the CRO specifically
The CRO's role in ESG risk is analogous to the role I described in operational resilience: not to own it, but to ensure it is genuinely integrated into the risk framework rather than sitting adjacent to it. That means three specific things.
First, ensuring climate risk factors are incorporated into credit assessment and large exposure monitoring, even where the methodology is still developing. Imperfect integration now builds capability faster than waiting for a perfect framework.
Second, driving scenario analysis that includes credible climate transition scenarios alongside traditional macro stress tests. What does the portfolio look like under an accelerated transition scenario. Which sectors and counterparties are most exposed. That analysis belongs in the risk committee, not only in the sustainability report.
Third, being honest with the board about what the institution doesn't yet know about its climate exposure. The worst governance outcome is a board that believes climate risk is managed because a sustainability report has been published. The CRO's job is to make sure the board understands the difference between disclosure and risk management.
Where this leaves risk leaders
If you're assessing your institution's genuine ESG risk management posture rather than its ESG communication posture, three questions are worth asking honestly: does your credit assessment framework currently include any climate risk factors for carbon-intensive sectors or counterparties; does your stress testing include a credible climate transition scenario; and does your risk committee receive ESG risk information on the same cycle and in the same format as credit and market risk information. Most institutions will find the honest answer to at least two of those three is no.
That is not a criticism. It is a starting point. The institutions that treat it as such, and start building the capability now rather than waiting for regulatory pressure, will be significantly better positioned as the regional and global frameworks tighten.
Where is your institution on this journey, and where do you see the biggest barrier to genuine integration of climate risk into the core risk framework?
Boardroom questions
- Where does climate risk influence our credit decisions today?
- Which transition scenario would most challenge our portfolio?
- What climate exposure remains uncertain, and how is that uncertainty reported?