SB 253 penalties: the $500,000 maximum, the Scope 3 safe harbor, and what CARB can actually fine you for

SB 253 penalties are capped by statute at $500,000 per reporting entity per reporting year. The California Air Resources Board sets them through regulation, and the law requires it to weigh two things before assessing anything: your past and present compliance, and whether you took good faith measures to comply. For the first report, due November 10, 2026, CARB has said it will exercise enforcement discretion for companies making a good faith effort.

That is the headline. The part that changes what you should actually do is buried further down the statute, and it is the reason a lot of the panic about Scope 3 exposure is misplaced. Between 2027 and 2030, Scope 3 penalties can only be assessed for one thing: not filing.

What is the penalty for not complying with SB 253?

Up to $500,000 per reporting year. The Climate Corporate Data Accountability Act, codified at Health and Safety Code section 38532, directs CARB to adopt regulations authorizing administrative penalties for non-filing, late filing and other failures to meet the requirements. The statutory language is specific about the ceiling: "The administrative penalties imposed on a reporting entity shall not exceed five hundred thousand dollars ($500,000) in a reporting year."

Two things about that number are commonly misread. It is a maximum, not a schedule, so it is the top of a range CARB sets by regulation rather than the fine for a missed filing. And it is per reporting year, which means the exposure does not compound within a year no matter how many separate failures sit inside it.

What does CARB have to consider before issuing a penalty?

The statute constrains CARB's discretion. In assessing a penalty, "the state board shall consider all relevant circumstances," and it names two in particular: "(i) The violator's past and present compliance with this section. (ii) Whether the violator took good faith measures to comply."

This is the sentence that should shape your compliance strategy, because it makes documented effort a statutory mitigating factor rather than a hope. A company that filed something imperfect, kept a record of the methodology it used, and can show what it did to close the gaps sits in a different position from one that filed nothing. The evidence of effort is itself part of the defence, which is an argument for keeping a written trail from the beginning.

Is SB 253 being enforced for the 2026 report?

Not in the ordinary sense. CARB issued an Enforcement Notice on December 5, 2024 stating that for the first report it would exercise its enforcement discretion under section 38532 and not take enforcement action against a reporting entity for incomplete reporting of Scope 1 and Scope 2 emissions, provided the entity makes a good faith effort. The notice went further and said companies may report Scope 1 and Scope 2 figures for the prior fiscal year determined from information they already possess or are already collecting.

Read that last clause carefully, because it is unusually generous and it has an expiry. It means the 2026 filing can be built from data already sitting in your systems rather than from a purpose-built collection program. Accounts payable, utility invoices and purchase order records are typically where that data already lives, and for a first Scope 1 and Scope 2 filing they are usually enough. The concession does not extend to later years.

How does penalty exposure change year by year?

The exposure is not flat. Scope coverage, assurance and the safe harbor all phase in on different schedules, so the realistic risk in any given year depends on which obligations are actually live. The table below is the current position as of August 2026.

The 2030 row carries a real caveat. CARB's current rulemaking round covers 2027 and beyond and does not settle the 2030 requirements, so treat that line as statutory direction rather than a final rule. The assurance ladder itself, and which standards CARB accepts, are covered in SB 253 assurance requirements.

What is the Scope 3 safe harbor under SB 253?

It is the provision almost no summary explains properly, and it materially changes the risk of reporting Scope 3. The statute states that "Penalties assessed on scope 3 reporting, between 2027 and 2030, shall only occur for nonfiling." Separately, reporting entities "shall not be subject to an administrative penalty under this section for any misstatements with regard to scope 3 emissions disclosures made with a reasonable basis" and disclosed in good faith.

Put plainly: for those years you cannot be fined for getting Scope 3 wrong. You can be fined for not filing it. That is a deliberate legislative acknowledgement that value chain emissions are estimated rather than measured, and that a company acting reasonably should not be penalized for the inherent uncertainty in a spend-based screen or a supplier average.

The practical consequence runs against most people's instinct. The safe harbor rewards filing an imperfect Scope 3 number early over withholding one until it is defensible, because the penalty attaches to the silence, not the error. What it does require is a reasonable basis, which means a method you can name and evidence rather than a figure with no working behind it. If you are screening from spend, the mechanics are in calculating Scope 3 emissions from spend, and the category by category obligations are on Scope 3 categories.

What counts as a good faith effort?

Neither the statute nor the Enforcement Notice defines it exhaustively, which is normal for a standard of this kind. What both make clear is that it is demonstrated by evidence of process rather than by the quality of the final number. In practice that means being able to show, on paper, what you did and why.

• A documented reporting boundary: which legal entities are consolidated, under which consolidation approach, and from what date.
• A named methodology and a named emission factor set, with the version and publication date recorded against the figures they produced.
• A record of the data you used and where it came from, including the systems it was pulled from.
• An explanation for anything excluded. An explained exclusion is a boundary decision; an unexplained gap is an omission.
• Evidence of remediation: a written plan for the gaps you know about, with dates.
• Internal review sign off, showing a figure was checked by someone before it was filed.

None of that is exotic. It is the same documentation an assurance provider will sample from 2027, which is the useful part: work done to demonstrate good faith in 2026 is not throwaway compliance theatre, it is the first draft of the evidence trail that has to survive limited assurance a year later. Carbon audit software exists largely to make that trail a by-product of the calculation rather than a separate project.

How do SB 253 and SB 261 penalties differ?

They are separate laws with separate thresholds and separate ceilings, and companies frequently conflate them. SB 261 applies at a lower revenue threshold and carries a much smaller maximum penalty, because it asks for a climate risk narrative rather than a measured emissions inventory.

Both apply to entities doing business in California regardless of where they are headquartered, which is why they catch companies with no California operations beyond customers. Whether the revenue test captures you at all is a question worth answering before anything else, and we walk through it in do I need SB 253 under $1 billion.

What should you do before November 10, 2026?

File something, and keep the working. The single largest risk in this first cycle is not an inaccurate number, it is a missed filing, because that is the one failure the enforcement discretion and the Scope 3 safe harbor do not cover. Everything else is mitigated by evidence that you tried.

1. Confirm whether you are in scope, in writing, with the revenue figure and the reasoning recorded.
2. Fix the reporting boundary and the consolidation approach before you calculate anything.
3. Pull Scope 1 and Scope 2 from data you already hold, which the Enforcement Notice expressly permits for this report.
4. Record the emission factor set and version against every figure it produced.
5. Write down what you excluded and why.
6. File by November 10, 2026, even if the inventory is incomplete.
7. Keep the whole trail, because a 2027 assurance engagement will sample the 2026 records.

If you are working to that date now, the sequencing is laid out in the SB 253 90 day plan, and the platform side of it is on SB 253 reporting software. If the question in front of you is what a compliance program costs to run rather than what it costs to skip, we break the budget down on carbon accounting software cost.