CD Consulting R&D

KB-FIN · Entry 2 · Published 2026-09-23 · Version 1

BCBS 239, thirteen years on: what the Basel principles on risk data asked banks to see, why so few got there, and what supervisors expect in 2026

What did the Basel Committee ask banks to see in 2013, why has almost none of them got there, and what do supervisors expect now?

If you own risk data at a bank, this is what supervisors now expect you to see, and how fast — from the 2013 principles to the ECB guide of 2024.

Synthesis note compiled on 23 September 2026. It rests on the Basel Committee's 2013 principles and its six progress reports (2013-2023), on the European Central Bank's thematic review of 2018 and guide of 2024, taken from the publishers' own websites, and on official pages consulted on 23 September 2026. Figures are quoted with their source; no number in this note was computed by its author.

Contents

1. 1. Why the Committee wrote fourteen principles in 2013
2. 2. The fourteen principles in four groups
3. 3. The radar: what a bank must be able to see, and how fast
4. 4. Thirteen years of progress reports: what moved, what did not
5. 5. The ECB guide of 2024 and what supervisors now expect
6. 6. What this means for a data function in 2026
7. 7. Sources

1. Why the Committee wrote fourteen principles in 2013

The principles open with a diagnosis rather than a rule. One of the most significant lessons of the crisis that began in 2007, the Committee wrote, was that banks' information technology and data architectures could not support the broad management of financial risks: many banks were unable to aggregate their exposures and identify concentrations "quickly and accurately" at group level, across business lines and between legal entities [S1]. Some of them could not manage their risks properly for that reason alone, with consequences for the banks and for the financial system as a whole [S1].

Three motives run through the introduction: faster and better decisions by the board and senior management; easier resolution, since a bank whose risk data can be assembled by legal entity and business line is easier to rescue or wind down; and memory. The Committee warned that, as the crisis faded, investment in data and systems, whose benefits arrive only over the long term, would risk being pushed back [S1]. The rest of this entry is, in a sense, a test of that warning.

The scope was narrow and the deadline firm. Banks named global systemically important banks (G-SIBs) by the Financial Stability Board in November 2011 or November 2012 had to meet the principles by January 2016, at group level and on a solo basis; banks designated later would have three years, and national supervisors were strongly encouraged to apply them to domestic systemically important banks on the same basis [S1]. They cover risk management data, key internal risk models and outsourced processes, and define risk data aggregation as defining, gathering and processing risk data according to the bank's reporting needs, so that it can measure its performance against its risk appetite [S1].

The 2013 text is not a directive or a regulation but a supervisory standard: the Committee agrees on expectations, and national and European authorities make them bite through their own law and supervisory review. In December 2019 the principles were folded into the consolidated Basel Framework as chapter SRP36, inside the supervisory review process [S8]. In the euro area, the European Central Bank reads them through the governance and risk-management articles of the Capital Requirements Directive and uses them as its benchmark of good practice [S11].

2. The fourteen principles in four groups

The principles are organised under four headings [S1]. Eleven are addressed to banks and three to supervisors.

• Overarching governance and infrastructure. Principle 1, governance: risk data aggregation and reporting are subject to strong governance, with the board overseeing senior management's ownership of the programme. Principle 2, data architecture and IT infrastructure: the bank designs, builds and maintains an architecture that supports aggregation and reporting not only in normal times but also in stress or crisis.
• Risk data aggregation capabilities. Principle 3, accuracy and integrity, with aggregation on a largely automated basis to minimise errors. Principle 4, completeness: all material risk data across the group, available by business line, legal entity, asset type, industry and region. Principle 5, timeliness: up-to-date aggregates, at a pace that depends on how volatile and how critical the risk is. Principle 6, adaptability: the capacity to answer on-demand and ad hoc requests, including in a crisis and from supervisors.
• Risk reporting practices. Principle 7, accuracy, with reports reconciled and validated. Principle 8, comprehensiveness: all material risk areas. Principle 9, clarity and usefulness: concise, understandable, tailored to the reader. Principle 10, frequency, set by the board and senior management according to how fast the risk can change. Principle 11, distribution to the right people, with confidentiality preserved.
• Supervisory review, tools and cooperation. Principle 12, review of each bank's compliance; Principle 13, remedial actions and supervisory measures, including capital measures under the supervisory review process; Principle 14, home/host cooperation between supervisors of cross-border groups.

Two ideas in the text explain how the groups fit together, and most of what went wrong afterwards. Governance, architecture and infrastructure are described as preconditions for compliance with all the other principles [S1]. And aggregation and reporting, although treated separately, are inseparable in practice: good reports rely on strong aggregation, and governance carries the flow from one to the other [S1]. The principles are to be met simultaneously; trade-offs between them are tolerated only in exceptional cases, must not materially affect risk decisions, and must be known to the board [S1].

One practical warning for readers who come from capital regulation: these four groups are not the three pillars of the Basel capital framework (minimum requirements, supervisory review, market discipline). BCBS 239 lives inside the second of those pillars [S8]; its own "groups" describe a data chain, not a capital structure.

3. The radar: what a bank must be able to see, and how fast

Say the acronym of the subject aloud, RDARR for risk data aggregation and risk reporting, and it sounds like "radar". The pun is useful because it describes the job exactly. A radar is judged on what it can detect, how far, how sharply and how often the picture refreshes; a bank's risk data are judged on the same things.

Read that way, the aggregation principles describe the performance of the instrument. Accuracy and integrity are its resolution: a blurred echo that must be corrected by hand is not a measurement. Completeness is its range and coverage: a blind sector over one legal entity or one asset class is where the next surprise will come from. Timeliness is its sweep rate: a screen that refreshes once a month shows where the risk was, not where it is. Adaptability is the ability to point the antenna at a new target on request, including in a crisis and when a supervisor asks for a view of the exposures that no standard report provides [S1]. The reporting principles describe the screen and the operator: the picture must be accurate, cover every material risk, be readable at a glance, arrive at the right frequency and reach the people who must act on it [S1]. Governance and infrastructure are the mast and the power supply. The three supervisory principles are the periodic inspection of the installation.

The image also explains a pattern that the progress reports kept finding. Banks scored themselves best on the screen and worst on the mast: in the first self-assessment of 2013, the three principles with the highest reported compliance concerned reporting (distribution, comprehensiveness, clarity), while the three lowest were data architecture, adaptability and accuracy [S2]. The Committee called the result difficult to interpret, since the weakest principles were the preconditions of the strongest [S2]. A well-drawn screen fed by an unreliable antenna is exactly the failure mode the principles were written to prevent.

The European Central Bank has since put a number on the sweep rate. Its 2024 guide reports that supervisors had observed production times of forty working days or more for monthly risk reports, and states that a bank generally cannot react in time if a monthly or quarterly risk report takes more than twenty working days to produce [S11]. For stress situations it expects aggregation to adapt to ad hoc requests with enough granularity, at entity and group level, without being hampered by fragmented systems or manual steps [S11].

4. Thirteen years of progress reports: what moved, what did not

The Committee committed in 2013 to track the G-SIBs' progress and to report to the Financial Stability Board at least once a year from the end of 2013 [S1]. It has published six progress reports since. Read in sequence, they tell a consistent story.

2013 and 2015 — the banks assess themselves. Thirty G-SIBs answered a questionnaire of 87 requirements in 2013; on a scale from 1 (worst) to 4 (fully compliant) the average across the eleven bank principles was 2.8, and nearly half of the banks reported material non-compliance on architecture, adaptability and accuracy [S2]. The second questionnaire, answered in 2014, showed only minor improvement, with averages ranging from 2.43 for data architecture to 3.33 for distribution, and a worrying shift in expectations: 14 G-SIBs now said they would miss the January 2016 deadline on at least one principle, against 10 a year earlier [S3]. The Committee added that self-assessed compliance dates might be "overly ambitious" [S3].

2017 — the deadline passes. The first report based on supervisors' own ratings covered the 30 banks subject to the 2016 deadline and found compliance "unsatisfactory": only one bank fully complied with all the principles, and half of the banks were materially non-compliant with Principle 2 on architecture and infrastructure [S4].

2018 — marginal progress, sliding plans. Three G-SIBs were rated fully compliant, and most banks had made at best marginal progress [S5]. The reasons were named plainly: the complexity and interdependence of IT projects, underestimated legacy problems, and higher supervisory expectations as supervisors looked more closely [S5]. The same report recorded a design choice that shapes every later debate: the Committee had decided not to prescribe objective or quantitative benchmarks for judging compliance [S5].

2020 — none. As of end-2018, none of the 34 G-SIBs assessed was fully compliant, with data architecture and IT infrastructure still the main obstacle; the Committee nonetheless saw tangible progress in governance, aggregation and reporting, and noted that many banks had widened their programmes to regulatory and financial reporting and resolution planning [S6]. The drop from three to zero should not be read as pure regression: the sample and the supervisory bar had both moved [S5] [S6].

2023 — two out of thirty-one. Nearly ten years after publication, only two of the 31 banks assessed in 2022 were fully compliant, and not a single principle was fully implemented across all banks [S7]. The diagnosis had shifted from technology to management: adoption programmes were "often underfunded, limited in scope" and short of attention from boards and senior management, and several banks still lacked a common taxonomy and complete data lineage [S7]. The pandemic and other stress events had exposed banks with fragmented IT landscapes [S7]. For the first time, the Committee asked supervisors to consider more forceful measures for long-standing deficiencies, naming capital add-ons, restrictions on capital distributions and fines, alongside more intensive tools such as on-site inspections, deep dives and fire drills [S7].

What moved, then, is governance and awareness: programmes, roadmaps and board attention exist where they did not. What did not move is the hard core the Committee flagged in its very first report, the architecture that lets a group assemble one consistent number from many systems. No report has been published since November 2023. In January 2026 the Committee issued an informational newsletter drawn from exchanges with supervisors and industry, which lists the same obstacles, governance, end-to-end lineage, ad hoc reporting in a crisis and alignment across borders, and describes the use of artificial intelligence and automation in this field as still at an early stage; the newsletter states that it is not new supervisory guidance [S9].

5. The ECB guide of 2024 and what supervisors now expect

In the euro area, the European Central Bank took the subject into its own supervisory programme early. Its thematic review, launched in 2016 on 25 significant institutions, concluded in May 2018 that implementation was unsatisfactory and that none of them, including those that were G-SIBs, had fully implemented the principles; the root weakness was a lack of clarity about who is responsible and accountable for data quality across business, control and IT functions [S10]. A letter to all significant institutions followed in 2019 [S11].

The Guide on effective risk data aggregation and risk reporting, published in May 2024, is blunter still. The ECB judged progress "generally insufficient", recorded that risk data aggregation and reporting was the worst-rated sub-category of internal governance in its 2023 supervisory review, and observed large-scale miscalculations of key ratios caused by reconciliation errors and manual adjustments [S11]. The guide does not create new requirements; it sets minimum supervisory expectations in seven areas [S11]:

1. The management body owns the subject: sufficient knowledge of data and IT, approval of the data governance framework with detailed data-quality requirements and indicators, and oversight of remediation.
2. A sufficient scope: all material legal entities, risks and reports, starting from the key risk indicators and the critical data elements that feed them, and extending to financial and supervisory reporting.
3. A data governance framework with named data owners responsible from capture to report, a central data governance function and a validation function independent of both.
4. An integrated data architecture: a group-wide dictionary, a metadata repository and complete, current data lineage down to the level of the data attribute.
5. Group-wide data quality management, with reconciliations (automated where appropriate) and indicators for accuracy, completeness and timeliness.
6. Timely internal risk reporting: frequency matched to how fast the risk moves, production time short enough to act on (the twenty-working-day benchmark above), and capabilities for stress situations.
7. Effective implementation programmes, adequately resourced, with one or two members of the management body personally responsible for delivery.

The guide also spells out escalation. Missed milestones or material shortcomings, such as inaccurate reporting of key risk indicators, can lead to enforcement measures, sanctions and capital add-ons, and deficiencies in governance can prompt a reassessment of the suitability of the responsible board members and, in severe cases, their removal [S11].

The years since have confirmed the direction rather than the destination. In February 2025 the ECB reported, from its 2024 targeted reviews, that many banks still lacked a recent gap analysis against the principles or credible timelines, and that the number of institutions without fully adequate capabilities was still too high; it announced an escalation process with interim milestones and binding measures where needed [S12]. Its annual report on 2025 describes an approach applied to all supervised banks, with clear timelines and interim milestones, and gradual progress over three years [S14]. Its supervisory priorities for 2026-28 keep the subject among the vulnerabilities to remedy and report that the 2025 supervisory review showed "no improvement in the relevant average sub-score" compared with the previous year [S13]. None of these official pages reports a penalty imposed specifically for risk data deficiencies; the periodic penalty payments the ECB announced in 2025 concerned climate-related risk management [S14].

6. What this means for a data function in 2026

For a chief data officer, a risk data team or an IT architect in a bank, the texts converge on a short list of practical consequences.

• Start from the board's numbers, not from the data lake. The ECB's scope runs top-down: the key risk indicators in internal, financial and supervisory reports, then the critical data elements that feed them [S11].
• Lineage is an expectation, not an aspiration. Supervisors ask for complete, current lineage at attribute level, from capture to report [S11], and Basel still names incomplete lineage as a persistent obstacle [S7] [S9].
• Measure the sweep rate. Report production time is now a supervisory metric, with twenty working days as the ECB's threshold [S11]; the fire drill under stress is the test of adaptability [S7] [S11].
• Name owners, and give them teeth. Reviews since 2018 trace the failure to blurred responsibility for data quality [S10] [S11]; the guide expects data owners from capture to report, a central governance function and board members personally accountable [S11].
• Fund the mast before the screen. Architecture, adaptability and accuracy were the weakest principles in 2013 [S2], and fragmented, legacy infrastructure was still the leading obstacle in 2023 [S7].
• Treat automation and artificial intelligence as consumers of data quality, not substitutes for it. Many banks still lack the quality data such projects require [S7] [S9].

The principles themselves have not changed a word since 2013. What has changed is the posture of the supervisors who apply them: from self-assessment questionnaires to on-site inspections, fire drills, named board members and the explicit possibility of capital consequences.

7. Sources

All sources were consulted on 23 September 2026 at the publishers' own websites. The Basel Committee's reports were read from their PDF editions; the older bis.org addresses now redirect to the publication pages given below.

1. S1 Official (standard-setter). Basel Committee on Banking Supervision, Principles for effective risk data aggregation and risk reporting, January 2013 (published 9 January 2013). https://www.bis.org/publ/bcbs239.htm — consulted 23 September 2026.
2. S2 Official (standard-setter progress report). Basel Committee on Banking Supervision, Progress in adopting the principles for effective risk data aggregation and risk reporting, 18 December 2013. https://www.bis.org/publ/bcbs268.htm — consulted 23 September 2026.
3. S3 Official (standard-setter progress report). Basel Committee on Banking Supervision, Progress in adopting the principles for effective risk data aggregation and risk reporting, 23 January 2015. https://www.bis.org/bcbs/publ/d308.htm — consulted 23 September 2026.
4. S4 Official (standard-setter progress report). Basel Committee on Banking Supervision, Progress in adopting the "Principles for effective risk data aggregation and risk reporting", 28 March 2017. https://www.bis.org/bcbs/publ/d399.htm — consulted 23 September 2026.
5. S5 Official (standard-setter progress report). Basel Committee on Banking Supervision, Progress in adopting the "Principles for effective risk data aggregation and risk reporting", 21 June 2018. https://www.bis.org/bcbs/publ/d443.htm — consulted 23 September 2026.
6. S6 Official (standard-setter progress report). Basel Committee on Banking Supervision, Progress in adopting the Principles for effective risk data aggregation and risk reporting, 29 April 2020. https://www.bis.org/bcbs/publ/d501.htm — consulted 23 September 2026.
7. S7 Official (standard-setter progress report). Basel Committee on Banking Supervision, Progress in adopting the Principles for effective risk data aggregation and risk reporting, 28 November 2023. https://www.bis.org/bcbs/publ/d559.htm — consulted 23 September 2026.
8. S8 Official (consolidated standard). Basel Committee on Banking Supervision, Basel Framework, chapter SRP36 "Risk data aggregation and risk reporting", version in force from 15 December 2019. https://www.bis.org/basel_framework/chapter/SRP/36.htm — consulted 23 September 2026.
9. S9 Official (standard-setter newsletter). Basel Committee on Banking Supervision, Implementation of the Principles for effective risk data aggregation and risk reporting (BCBS 239 Principles), newsletter, 6 January 2026. https://www.bis.org/publications/implementation-principles-effective-risk-data-aggregation-and-risk-reporting-bcbs-239-principles — consulted 23 September 2026.
10. S10 Official (supervisory report). European Central Bank, Banking Supervision, Report on the Thematic Review on effective risk data aggregation and risk reporting, May 2018. https://www.bankingsupervision.europa.eu/ecb/pub/pdf/ssm.BCBS_239_report_201805.pdf — consulted 23 September 2026.
11. S11 Official (supervisory guide). European Central Bank, Banking Supervision, Guide on effective risk data aggregation and risk reporting, May 2024. https://www.bankingsupervision.europa.eu/ecb/pub/pdf/ssm.supervisory_guides240503_riskreporting.en.pdf — consulted 23 September 2026.
12. S12 Official (supervisory newsletter). European Central Bank, Banking Supervision, "Sound risk data reporting: key to better decision-making and resilience", Supervision Newsletter, 19 February 2025. https://www.bankingsupervision.europa.eu/press/supervisory-newsletters/newsletter/2025/html/ssm.nl250219.en.html — consulted 23 September 2026.
13. S13 Official (supervisory priorities). European Central Bank, Banking Supervision, Supervisory priorities 2026-28, November 2025. https://www.bankingsupervision.europa.eu/framework/priorities/html/ssm.supervisory_priorities202511.en.html — consulted 23 September 2026.
14. S14 Official (annual report). European Central Bank, ECB Annual Report on supervisory activities 2025. https://www.bankingsupervision.europa.eu/press/other-publications/annual-report/html/ssm.ar2025~6ee989dc7e.en.html — consulted 23 September 2026.

Limits. This entry rests on official texts only: the Basel Committee's principles, its six progress reports and one newsletter, and the European Central Bank's review, guide and supervisory pages; consultancy and vendor literature was left aside, and so were national transpositions outside the euro area. The long reports were read through their summaries, results sections and the passages cited, not line by line; the newsletter, the 2025 and 2026 ECB pages and the SRP36 chapter were read in their web versions. Compliance ratings are self-assessments until 2014 and supervisors' judgements afterwards, on a four-point scale without quantitative benchmarks, and the sample of banks changes from one report to the next; comparisons across years are indicative only. The radar reading of the principles is an interpretation offered for teaching purposes, not the Committee's own language. No figure in this entry was computed by us: each is quoted from its source, and the reader is invited to check the originals before relying on any of them.