An Investor Is Asking About Our ESG Policy. We’re a 10-Person Startup. Now What?

Nothing in Kenyan law requires a ten-person startup to have an ESG policy. The Nairobi Securities Exchange’s ESG Disclosures Guidance Manual, published in November 2021, is addressed to listed companies, and the Capital Markets Authority’s Code of Corporate Governance Practices for Issuers of Securities to the Public, 2015 applies to public issuers. Neither reaches an early-stage private company. If an investor is asking for an ESG policy anyway, it is the investor asking, not the law, and the two call for different responses.

Why investors ask for an ESG policy even when the law does not

Development finance institutions, impact funds and increasingly ordinary venture funds carry their own ESG commitments to their own backers, and those commitments get pushed down the chain to every company they invest in, regardless of size. A fund that has promised its limited partners it screens for ESG risk cannot skip that screening because your company is small. The request is real even though the underlying legal obligation is not.

What a proportionate answer looks like

Investors evaluating an early-stage company are not expecting a listed-company sustainability report. They are looking for evidence that you have thought about the obvious risks for a business your size: how you treat employees, whether you handle customer or user data responsibly, whether there is exposure to corruption in how you win business, and whether your operations create any environmental impact worth naming, even if the honest answer for a software company is very little. A one or two page ESG policy that answers these plainly, rather than a document copied from a much larger company’s sustainability report, is usually exactly what is expected.

What to put in your ESG policy

A workable starting policy for a small company covers, in plain terms:

• Employment. A statement on fair employment practices and non-discrimination. Section 5 of the Employment Act, 2007 already requires an employer to promote equal opportunity and prohibits direct or indirect discrimination against an employee or prospective employee.
• Data. A privacy commitment tied to your actual obligations under the Data Protection Act, 2019, not a generic promise.
• Anti-bribery. A short statement that reflects section 9 of the Anti-Bribery Act (Cap. 79B), which requires a public or private entity to put in place bribery prevention procedures appropriate to its size and the nature of its operations. This is a legal duty regardless of ESG, and under section 9(2) a director or senior officer can commit an offence where the failure was committed with their consent or connivance.
• Environment. A brief, honest statement of environmental impact appropriate to what you actually do.

Do not overstate what you cannot substantiate

Overstating environmental commitments you cannot substantiate is worse than a short, accurate paragraph. It creates a claim that an investor or a later acquirer can hold you to, and it can be tested in due diligence or in a warranty claim after a sale. If you have no environmental programme, say so and say what you do instead.

Treat it as a living document

The version you write to close a seed round will not be adequate by the time you raise a Series A with a larger, more formal investor. Build the policy so it can grow with the company rather than treating it as a one-off document produced to satisfy a single due diligence request. Revisiting it at each funding round, rather than only when someone asks, keeps it accurate and saves you from scrambling the next time it comes up. Name an owner for the policy, usually a founder, and record when it was last reviewed.

When the request becomes a contract term

Some investors write ESG undertakings into the investment agreement, for example a covenant to adopt a policy within a fixed period after closing, to report serious incidents, or to allow the investor to audit compliance. These bind the company contractually even though no statute requires them. Read them as you would any other covenant: check the deadline, who has to certify compliance, what counts as a breach, and whether a breach triggers a consent right, a remedy period or a more serious consequence. Agree what you can realistically deliver at your size, because a covenant you cannot meet is a liability, not a courtesy.