India's BRSR Core Now Covers the Top 1,000 Listed Companies. The Word 'Assurance' Became Optional.

India’s sustainability reporting rules reach any supplier that accounts for 2% or more of an Indian listed company’s purchases or sales by value. That threshold is written into the rulebook, and it does not ask where the supplier is incorporated.

Two things changed in the same SEBI circular, and both are now live. The number of companies that must have their BRSR Core verified went up. The standard of verification they must obtain moved sideways, into a second option that did not exist before.

The glide path reached the top 1,000 on 1 April 2026

The Securities and Exchange Board of India issued circular SEBI/HO/CFD/CFD-PoD-1/P/CIR/2025/42 on 28 March 2025. It amends the LODR Regulations master circular, and it carries a four-row table that decides who is in scope.

Listed entities “shall mandatorily undertake assessment or assurance of the BRSR Core, as per the glide path specified in the following table”. The table reads: FY2023-24, top 150 listed entities by market capitalisation. FY2024-25, top 250. FY2025-26, top 500. FY2026-27, top 1,000.

India’s financial year runs from 1 April. FY2026-27 began on 1 April 2026, which puts roughly 500 companies that had never been required to have BRSR Core verified inside the requirement now, for a year that is already more than half gone.

BRSR Core itself is the verified subset of the wider BRSR: a set of key performance indicators under nine ESG attributes, including intensity ratios computed on revenue adjusted for purchasing power parity, and indicators SEBI describes as relevant to the Indian and emerging-market context such as job creation in small towns and gross wages paid to women.

‘Assessment’ is a different thing from ‘assurance’, and SEBI defined it

The older framework required assurance. The March 2025 circular replaced that with a choice, and it was explicit about why: to “decrease cost and effort for listed entities and their value chain partners for verifications of sustainability reporting, as well as make the process profession agnostic”.

Assurance is the audit profession’s product, and SEBI wanted the work available from outside that profession, so it created a defined alternative.

The circular says that “assessment” means “third-party assessment undertaken as per the standards developed by the Industry Standards Forum (ISF) in consultation with SEBI”. Those industry standards are the reference point, not an international assurance standard.

A company can therefore say its BRSR Core was verified without an assurance opinion existing anywhere, and the two routes are not interchangeable as evidence, because one produces an opinion under an assurance standard and the other produces a conclusion against an industry standard.

SEBI did not name an assurance standard, and it did name who cannot do the work

For companies that choose assurance, SEBI’s FAQ on the LODR Regulations is direct: the master circular “does not mandate or recommend the use of any specific assurance standard”. A provider may use a globally accepted standard such as ISAE 3000, ISSA 5000, or the Indian standards SSAE 3000 and SAE 3410 on greenhouse gas statements. The standard used must be disclosed.

The independence rules are firmer than the standard-setting is. The circular requires the board to ensure the provider has the necessary expertise, and that there is no conflict of interest: the provider and its associates must not “sell its products or provide any non-audit / non-assessment / non-assurance related service including consulting services, to the listed entity or its group entities”.

SEBI’s FAQ closes the obvious question. The internal auditor of a listed entity or its group “cannot be appointed as the assurance provider for the BRSR Core”. The statutory auditor can, subject to competence and independence requirements.

ISSA 5000 assumes the same separation between building a reporting system and verifying it, and we wrote about what that means for machine-drafted reports in ISSA 5000: An AI Can Draft the Report, Not the Evidence.

The value chain provision moved twice, later and voluntary

The second half of the circular is the part that reaches companies with no Indian listing at all.

SEBI deferred value chain disclosure and its verification by one year, “to facilitate ease of doing business, provide additional time to listed entities and their value chain partners for setting up measurement and reporting systems and avoid unintended impact on small businesses”.

ESG disclosures for the value chain now apply “to the top 250 listed entities (by market capitalization), on a voluntary basis from FY 2025-26”. Assessment or assurance of those disclosures is voluntary from FY2026-27.

India’s 250 largest listed companies are now being asked, with a year of warning and no penalty, to report BRSR Core indicators for their suppliers and customers. Large Indian groups with index weight and an ESG rating to defend have an incentive to do it early, and a company that reports it must also disclose the percentage of total sales and purchases its covered partners represent, which makes thin coverage visible.

2% and 75% are the two numbers a supplier should know

The circular sets the boundary precisely. Value chain “shall encompass the top upstream and downstream partners of a listed entity, individually comprising 2% or more of the listed entity’s purchases and sales (by value) respectively”. The entity “may limit disclosure of value chain to cover 75% of its purchases and sales (by value) respectively”.

If you sell 2% or more of an Indian listed customer’s purchases by value, you are inside its named value chain, and whether you get asked depends on where you sit in the 75% it chooses to cover.

For the first year of value chain reporting, prior-year comparatives are voluntary, so a supplier asked in FY2025-26 is being asked for one year of data rather than two. That concession does not repeat.

This is the same dataset the EU already asks you for

A supplier that already answers ESRS S2 questionnaires from European customers is not starting from zero. BRSR Core is a different form over a largely overlapping dataset: emissions and intensity, energy, water, waste, wages, workforce composition, safety.

We mapped that overlap on the European side in Four EU Filings Need the Same Supplier Data. None of Them Ask for It the Same Way., and the market-by-market picture across the region is in ESG Reporting in Asia-Pacific: 2026 Rules by Market.

What costs a supplier organisation money is not the form itself but answering the same water question five times on five templates with five different boundaries.

Where to start

If you are an Indian listed entity newly inside the top 1,000, the decision to make this quarter is assessment or assurance, and it is a decision about evidence rather than cost. Ask what each route produces and who will read it: an ESG rating agency, a European customer and a lender do not weigh an industry-standard assessment and an ISSA 5000 opinion the same way.

If you are a supplier to an Indian listed entity, work out whether you cross 2% of its purchases or sales. If you do, assume the request arrives and build the dataset once, because the Indian form will not be the only one.

If you are already reporting under CSRD or ISSB, the India request is a mapping exercise, not a new collection.

Socious Report takes one dataset and drafts audit-ready reports against CSRD, SSBJ and ISSB from it, with an independent Socious Verify credential on the result. The collection happens once.

Start with a free readiness check: socious.io/csrd-check