BCBS 239: the unfinished work of risk data

A credit committee convenes at short notice during a period of market volatility. The head of risk requests a consolidated view of exposures across counterparties, geographies, and legal entities by the following morning. What arrives is a patchwork: some figures drawn directly from the core banking system, others manually compiled from spreadsheets of uncertain vintage, a third set still pending from an overseas subsidiary running on a separate platform. The numbers are reconciled overnight by a team of analysts. By the time the committee reconvenes, the market has moved and the consolidated figure is already outdated.

The Basel Committee on Banking Supervision (BCBS) documented exactly this pattern in the aftermath of the 2008 financial crisis. Its review of major banks found that many could not produce accurate, timely, consolidated risk data when it mattered most. Boards and senior management lacked the information needed to make sound decisions while supervisors lacked the visibility to assess true exposures. In January 2013, the Committee published BCBS 239, formally titled Principles for effective risk data aggregation and risk reporting, setting out 14 principles intended to address this.¹

BCBS 239 became binding for global systemically important banks (G-SIBs) on 1 January 2016. The 2013 text also reached domestic systemically important banks (D-SIBs) from the start. Paragraph 15 “strongly suggested” that national supervisors apply the Principles to D-SIBs three years after designation, which is a recommendation to supervisors rather than a rule binding the banks.¹

The standard is still in effect and has not been replaced. What has shifted is how supervisors apply it. In Europe, the European Central Bank (ECB) launched a supervisory programme in 2022, written up as its May 2024 guide on risk data aggregation and reporting.² It has since linked poor risk data aggregation directly to worse Supervisory Review and Evaluation Process (SREP) outcomes. The SREP overall score runs from 1, the lowest risk, to 4, the highest, so weak aggregation pushes a bank’s score up rather than down.³ In the UK, the Prudential Regulation Authority (PRA) has pressed the same point through thematic supervision rather than a dedicated data standard.⁴

What are the fourteen BCBS 239 principles?

BCBS 239 organises its 14 principles into four categories:

• Governance and infrastructure: the board and senior management must review and approve the firm’s risk data framework and ensure adequate resources are deployed to it. IT systems must be able to pull together all risk data at any time, including during periods of stress, not just at quarter-end.
• Risk data aggregation capabilities: data must be accurate, complete, timely, and adaptable. These requirements apply across the whole group and each legal entity.
• Risk reporting practices: reports must be accurate, thorough, and clear, and delivered at a frequency that matches the risk involved.
• Supervisory review: regulators assess G-SIB compliance as part of routine supervision and feed the results into their Pillar 2 (firm-specific capital) reviews.

Governance and infrastructure underpins all the other principles. A bank must establish integrated data taxonomies and a group-wide architecture, down to single identifiers for legal entities, counterparties and accounts, and a dictionary of the concepts used so that a term means the same thing across the group.

The common failure point under BCBS 239 is completeness under stress. A bank may achieve accuracy for data sourced from its core system while relying on manual processes for exposures held in overseas branches, the end user computing estate our companion piece examines.⁵

The reporting principles compound the completeness gap under stress. Reports must enable the board to form a view on whether the firm’s overall risk profile is within its appetite. A fancy presentation built on unreliable data does not satisfy BCBS 239. The standard is about the data infrastructure, not the dashboard that sits on top of it.

How banks have responded

The BCBS’s November 2023 progress report on adoption of the principles found that of the 31 G-SIBs assessed, only two were fully compliant with all 14 principles. That assessment used data as of June 2022, six years after the expected date of compliance.⁶

The Basel Committee’s November 2023 progress report is blunter still on how little had changed: “there is not a single Principle that has been fully implemented across all banks”.⁶ The Committee attributes that to “lack of prioritisation, insufficient ownership by the board and senior management”, and to programmes that were “often underfunded, limited in scope”, which is a governance failure rather than a technical one.

What good looks like under pressure

The value of sound data aggregation becomes clearest when conditions deteriorate rapidly. During the COVID-19 pandemic, the ECB reports that banks with mature aggregation capabilities could monitor how payment moratoria were phasing out and refine their risk appetite indicators accordingly. During the Russia-Ukraine conflict, the same banks adapted their country risk exposure assessments rapidly.³ In both cases, the ECB reports, the advantage was speed: new risk indicators, recalibrated limits and more frequent reporting, put in place while the stress was still developing.³

The regulatory expectation now is that data aggregation is a question of accountability, not architecture. What reviewers look for is a gap analysis, a remediation plan, and visible progress against it. Firms that have built that habit, not just the architecture, are the ones ready when the market moves again.

Frequently asked questions