Under EU Omnibus I (Directive 2026/470, in force 18 March 2026), mandatory reporting applies to groups exceeding both 1,000 employees and €450M turnover. cobank gives your controllers, sustainability team, and external assurance provider one ledger built around ESRS E1, ISSA 5000 limited assurance, and Swiss OR 964a-c — deployable without tripping procurement or security review.
EU Omnibus I lifted Wave 2 thresholds and pushed mandatory reporting to FY2027. Move the dials below to check your group against the active criteria — published EU Directive 2026/470, Swiss OR 964a, and listing status.
Four bodies govern your reporting: the EU CSRD, the ESRS standards, IAASB's ISSA 5000 assurance framework, and Swiss OR 964. Below: what each requires, and the surface in cobank where it lives today.
inputs_hash.When you close a reporting period, cobank generates a deterministic evidence package — every line, every factor, every workpaper assertion — sealed with a SHA-256 hash chain. Your audit firm logs in, samples, asserts, exports. Limited and reasonable assurance follow the same workflow on the same ledger.
0x9a4f…c2eb1d
Same line-item ledger, same versioned factor library — wrapped in the controls, contract terms, and assurance surfaces that pass security review at a Swiss listed group.
requireTenantMember authorization. Cross-tenant reads return zero rows — verified in the April 2026 security audit.Designed around your audit firm's expectations and your procurement calendar — not ours. Most groups start the conversation 12 to 18 months before their first mandatory reporting period.
Founding team walks through your reporting scope, entity tree, audit firm, and first in-scope period. No deck.
Live walk-through of the ledger, audit surface, and evidence export against our reference dataset. Optional: invite your assurance provider to shadow.
Single entity or single reporting quarter. Real data, real factor library, real period close. Dedicated onboarding lead; audit firm in the room.
Full deployment across all in-scope entities. Signed DPA, named account manager, SLA in force. ARR locked for 12 months; price certainty during Wave 2.
Enterprise pricing is sales-led because your contract drivers — entity count, FTE headcount, Scope 3 breadth — vary too much for a public sticker. The ARR band, though, is consistent.
Most groups land near the band's mid-point in year one and renew at a similar level. Ecoinvent is licensed separately at pass-through cost plus a 20% integration margin — invoiced only if your methodology requires it.
Our auditor wanted invoice-line evidence with frozen factors and a chain we could re-verify offline. cobank had the surface ready. We sealed our first sandbox period in nine weeks.
The ones that come up in every discovery call. If yours isn't here, raise it on the call — there's no SDR pipeline you have to clear first.
1,000 FTE and €450M turnover, both required. If you exceed both, mandatory CSRD reporting applies — FY2027, first publication 2028. Below either threshold, voluntary plans cover the workflow at a fraction of the price.
Tell us your scope, your audit firm, and your first in-scope period. The founding team writes the proposal. No SDR pipeline.