On 26 August 2026, the European Banking Authority (EBA) published a consultation Paper proposing draft Regulatory Technical Standards (RTS) on operational risk management frameworks under Article 323 of the Capital Requirements Regulation (CRR), as amended by the EU Banking Package implementing the final Basel III reforms.
Background
The RTS are intended to establish a harmonised minimum framework for operational risk management across EU institutions, ensuring that firms of different sizes and business models maintain robust, effective and proportionate arrangements for identifying, assessing, monitoring, controlling, mitigating and reporting operational risks.
Summary
The draft RTS have three core interrelated components:
- Governance: Institutions must establish clear governance arrangements for operational risk. The management body will be responsible for approving the operational risk management framework, defining the institution’s operational risk appetite and overseeing the firm’s risk profile against that appetite. Senior management must implement the framework and translate risk appetite into operational limits and controls. The RTS reinforce the traditional three lines of defence model:
- Business and operational units as the first line;
- An independent operational risk management function in the second line; and
- Internal audit as the third line.
- Operational Risk Management Process: The RTS emphasise that firms must maintain processes covering the full operational risk lifecycle, including:
- Risk identification;
- Risk assessment;
- Risk monitoring;
- Risk control and mitigation;
- Risk reporting.
The framework is intended to ensure that operational risk management is integrated into wider risk management and business decision-making processes, rather than operating as a stand-alone compliance exercise.
- Operational Risk Assessment System: The RTS introduce detailed expectations for operational risk assessment systems, including:
- Calculation of the Business Indicator Component (BIC);
- Collection and analysis of operational risk losses;
- Use of forward-looking assessment tools;
- Structured operational risk data and taxonomy arrangements.
Institutions with a business indicator of EUR 750 million or more will be subject to additional obligations, including calculation of annual operational risk losses and collection of a more extensive operational risk dataset.
Data, Controls and Assurance
In addition, the draft RTS also contain detailed requirements relating to:
- Operational risk data collection and governance;
- Risk taxonomies and classification systems;
- Internal reporting arrangements;
- Compliance processes;
- Internal validation procedures;
- Audit reviews of the framework;
- Transparent and accessible data flows supporting operational risk assessments.
The EBA emphasises that reliable data and strong challenge mechanisms remain essential even though operational risk capital requirements are now based on a standardised methodology rather than internal models. The RTS also set out that that institutions may leverage arrangements developed under the Digital Operational Resilience Act (DORA) such that rather than creating a separate operational risk regime, firms can integrate DORA-related governance, monitoring and control arrangements into their broader operational risk framework where appropriate.
Proportionality
The EBA set out that has sought to ensure the framework is proportionate. While all CRR institutions must maintain an operational risk management framework, the intensity of requirements will vary according to size and complexity. Proportionality is reflected in:
- Frequency of framework reviews;
- How operational risk appetite is expressed;
- The volume of operational risk data that must be collected;
- The granularity of risk taxonomies;
- Reporting frequency to management bodies.
Smaller institutions, particularly those with a business indicator below EUR 750 million, benefit from simplified requirements and are not required to collect the expanded dataset or provide more frequent operational risk reporting.
Next steps
The consultation closes on 31 December 2026. The EBA will consider the feedback received to this consultation in finalising the draft RTS. The final draft RTS will then be submitted to the European Commission for adoption.
Recent Comments