Risk data aggregation principles

BCBS 239

Principles for effective risk data aggregation and risk reporting.

Published January 2013 Issued by the Basel Committee on Banking Supervision (BCBS) Scope Systemically important banks (G-SIB, D-SIB) Complemented by the ECB's RDARR Guide, May 2024

Born of the shortcomings revealed by the 2007-2008 financial crisis, this standard requires large banks to have strong governance, data architecture and aggregation capabilities, so that senior management and the board of directors can identify and steer risks quickly — including during periods of stress. More than ten years after its publication, the ECB (the European banking supervisor) finds that no significant institution examined yet fully applies these principles, and published a guide in May 2024 detailing its minimum supervisory expectations.

This site brings together, in English, the 14 BCBS 239 principles detailed pillar by pillar, the ECB's RDARR Guide (May 2024) and its seven supervisory expectations, a timeline of the standard, and sourced articles on risk data aggregation and risk reporting. Every statement is tied back to its original paragraph — Basel Committee (January 2013) or ECB (May 2024) — so it can be verified. Depending on your role (board, IT and data, audit and control), the reading path by profile leads directly to the principles, articles and the compliance self-assessment relevant to you.

14
BCBS 239 Principles
04
BCBS 239 Pillars
2013
BCBS Publication
07
Areas — ECB Guide 2024
The four pillars
I
Overarching governance and infrastructureThe foundation: board responsibility and data architecture.
II
Risk data aggregation capabilitiesData accuracy, completeness, timeliness and adaptability.
III
Risk reporting practicesReports that are accurate, comprehensive, clear, frequent and well distributed.
IV
Supervisory review, tools and cooperationThe role of supervisors and cooperation between authorities.
In addition
§
The ECB's RDARR Guide (May 2024)Seven minimum supervisory expectations from the ECB, distinct from the Basel Committee's 14 principles — see the "RDARR Guide" page.
◷
Timeline — from 2008 to the 2024 GuideTwo threads converge: the Basel Committee's standard (2011-2016) and European supervision by the ECB (2016-2024).
Go deeper and assess yourself
→
Where to start? Choose your profile — board, IT & data, or audit & risk — and follow the recommended path.
→
Glossary 39 key terms defined from BCBS 239 and the RDARR Guide — G-SIB, D-SIB, data lineage, SREP, ICAAP…
→
Articles Sourced analysis: why the ECB, ten years on, still considers BCBS 239 insufficiently applied.
→
2023 ECB Consultation 308 comments, 186 blocks, 70 amendments: the request, the ECB's response, and the outcome.
→
Frequently asked questions 9 frequently asked questions: who must comply, what deadlines, how it differs from the RDARR Guide…
→
Quiz — 44 questions Test your knowledge by theme: governance, data aggregation, reporting, supervision.
→
Compliance self-assessment An indicative tool to gauge your institution's maturity against the BCBS 239 principles and RDARR.
→
Resources Direct links to the official source documents from the Basel Committee and the ECB.