Physical Climate Risk Assessment: What Banks and Insurers Now Ask SMEs For

A loan renewal form or an insurance broker's questionnaire now asks something that would have seemed out of place five years ago: is this site in a flood zone, and what happens to your operations if it floods for a week? That's a physical climate risk assessment question, and it's showing up more often because the banks and insurers asking it are, themselves, now required to know the answer.

This guide explains what physical climate risk actually means, why banks and insurers are asking SMEs for it now specifically, and how to put together a basic, defensible assessment using free public data rather than an expensive third-party report.

What "Physical Climate Risk" Actually Means

Physical climate risk is distinct from transition risk. Transition risk is about policy, market, and technology shifts as the economy decarbonises — carbon pricing, changing customer demand, regulation. Physical risk is about the direct physical consequences of a changing climate hitting a specific site, and it splits into two categories that climate disclosure standards consistently use:

• Acute physical risk — event-driven hazards: flooding, storms, wildfires, and extreme heat events. These are the risks with an obvious "did it happen or not" moment.
• Chronic physical risk — gradual, longer-term shifts: sea level rise, rising average temperatures, changing precipitation patterns, and increasing water stress. These build up over years rather than arriving as a single event.

Both categories matter for the same underlying reason: a site that floods, a factory that can't run in extreme heat, or a region that stops getting reliable rainfall for its processes represents a real financial risk to whoever has money tied up in that site — which is exactly why lenders and insurers, not just environmental teams, now ask about it.

Why Banks Are Asking Now: EBA Pillar 3 and the Trickle-Down to SME Borrowers

The European Banking Authority's binding technical standards on Pillar 3 ESG disclosures require banks to report their exposures broken down by transition risk and by physical climate risk, split into the chronic and acute categories above. To produce that disclosure honestly, a bank needs to know, site by site, which of its borrowers sit in areas exposed to flooding, storms, wildfire, or heat stress — information the bank generally doesn't have unless it asks the borrower directly.

The EBA's related guidelines on managing ESG risk apply generally from 11 January 2026, and for small and non-complex institutions — many of the regional and community banks that actually lend to SMEs — from 11 January 2027. That one-year gap matters: it means the larger banks are already asking, and the smaller, more locally-focused lenders many SMEs actually borrow from are about to start.

If a bank has already asked you for this alongside general non-financial or ESG data, our guide to why your bank needs non-financial data covers the broader context of that request; this article focuses specifically on the physical risk piece within it.

Why Insurers Are Asking Too: Underwriting and Nat-Cat Pricing

Insurers have a more direct commercial reason: property and business interruption cover is priced against the actual probability of a payout, and insurers increasingly use geospatial hazard data — flood zone maps, wildfire risk layers, storm surge models — to price or decline commercial policies at the site level rather than the postcode level. Solvency II's climate scenario requirements also push insurers to understand the aggregate physical risk sitting across their entire commercial book, which means asking policyholders for the same site-level detail banks want, just for underwriting rather than lending.

The practical effect for an SME is the same regardless of which counterparty is asking: a bank, an insurer, or both may now want a concrete answer about flood, storm, wildfire, heat, and water stress exposure for every site you operate, not a general statement that you "take climate risk seriously."

The Framework Underneath It: Hazard × Exposure × Vulnerability

Every credible physical climate risk assessment methodology, including the approach set out in ISO 14091 (Adaptation to climate change — vulnerability, impact and risk assessment guidelines), breaks the question into three components rather than asking for a single yes/no rating:

• Hazard — what climate-related events could plausibly occur at this location: is it in a flood plain, a wildfire-prone region, a coastal area exposed to storm surge, or a zone projected to see significant heat stress or water scarcity.
• Exposure — what you actually have at that location that could be affected: the building itself, equipment, inventory, and whether operations there are business-critical or easily relocated.
• Vulnerability — how much damage a given hazard would actually cause given the specifics of the site: building age and construction standard, existing flood defences or drainage, backup power, and how quickly operations could resume afterward.

A site can score high on hazard but low on overall risk if exposure and vulnerability are both low — a rarely-used storage unit in a flood zone is a different risk than a primary production site in the same location. This is why banks and insurers ask for site-specific detail rather than accepting a company-wide statement.

Putting Together a Basic Assessment Yourself

A first-pass physical climate risk assessment does not require an expensive consultancy report. For most SMEs with a handful of sites, this is achievable with free public data:

• 1. List every site with its precise geolocation — the same coordinates most sustainability disclosure standards already ask for as a baseline data point, since geolocation is what any hazard-mapping tool needs as an input.
• 2. Check each site against a public hazard-mapping tool. National flood risk maps (most EU countries and the UK publish these free of charge), the EU's Risk Data Hub, and the Copernicus Climate Change Service all provide site-level or regional hazard data without a paid subscription.
• 3. Record exposure honestly for each site — what's actually there, and how critical it is to the business, not just whether the building exists.
• 4. Note vulnerability factors you already know: flood defences, backup generators, building age, insurance already in place, and any past incidents at that location.
• 5. Document sites with no material exposure explicitly, with the tool and date you checked, rather than leaving them blank — an explicit "checked, low risk" is more credible to a bank or insurer than an assessment that simply omits a site.

This produces a genuinely useful, defensible first assessment. It won't match the granularity of a paid catastrophe-modelling report, but for the level of detail a bank or insurer is asking an SME for, it's usually sufficient — and it's a foundation you can hand to a specialist later if a specific site turns out to need deeper analysis.

Where This Fits Into What You Already Report

If you already report under the VSME standard, the geolocation of every site you own, lease, or manage is already one of the standard's data points, specifically because it feeds exactly this kind of climate and biodiversity risk assessment. Our VSME Basic Module guide covers that disclosure alongside the other 45 data points most banks and customers actually ask for.

Physical risk assessment isn't only an SME concern, either — it's one of the required disclosures under ESRS for companies in CSRD scope, which means large customers and banks who themselves have to report it are the same ones now asking their smaller counterparties for site-level input to complete their own picture. Our guide to CSRD scope after the Omnibus reforms explains which companies that obligation currently falls on directly, and why it still reaches SMEs indirectly through exactly this kind of request.

Sustainly's workflow includes site geolocation as part of the same data set used for VSME and customer ESG reporting, so the groundwork for a physical climate risk assessment — knowing exactly where every site is — is something you only have to establish once, not rebuild every time a different bank or insurer asks.