What does an RDARR remediation plan look like? What the ECB expects

Six of the RDARR Guide's seven areas describe what a bank must achieve: governance, scope, architecture, quality, timeliness. The seventh and last — implementation programmes — is about something else: how to concretely steer the project that gets you there.

Who must have an implementation programme?

The idea that implementation must be steered and monitored over time is not unique to the 2024 Guide: it goes back to BCBS 239 itself. As early as 2013, the Basel Committee specified that G-SIBs subject to the January 2016 deadline were expected to start making progress towards effective implementation of the principles from early 2013 — with that progress to be monitored and assessed jointly by national supervisors and the Basel Committee. (BCBS 239, "Scope and initial considerations" section)

The ECB's RDARR Guide makes this monitoring logic much more concrete and detailed. Institutions not yet following the best practices described in the BCBS 239 principles must put in place implementation measures accordingly. An implementation programme must cover identified gaps and address weaknesses detected, whether through internal or external reviews — including on-site inspections (OSIs) and remote reviews conducted by ECB banking supervision. This is not a minor point: it means that supervisory inspection findings directly feed into the expected content of the remediation plan. (ECB Guide, section 3.7)

What the plan must contain

The Guide sets precise expectations for the form of the programme itself. It must be supported by adequate project management governance, including measures and indicators to control project execution risks, as well as sufficient material, financial and human resources. Implementation plans must clearly define: remedial actions, targets, milestones, roles, responsibilities — and, where appropriate, interim actions to mitigate weaknesses that require a longer implementation timeframe to be fully addressed. (ECB Guide, section 3.7)

Anticipating side effects

The Guide explicitly requires implementation activities to take into account their potential effect on three elements: (i) internal models, (ii) the interactions and interdependencies between risk data aggregation and the integration of financial reporting frameworks, and (iii) overall business and ICT strategies. The Guide sums up the expected ambition in one phrase: implementation programmes must be "ambitious but achievable". (ECB Guide, section 3.7)

Periodic monitoring, not a launch-and-forget project

Periodic reporting on programme progress must be in place, including an analysis of obstacles encountered, delays and other relevant factors. This monitoring is not merely an internal formality: as with the Guide's other areas, it feeds into the supervisory dialogue with the ECB. (ECB Guide, section 3.7)

Who steers, at the top

As with the rest of the RDARR framework, the management body remains ultimately responsible: it bears responsibility for the implementation timetable and milestones. Good project management practice provides for one or two members of the management body, in its management function, to be designated responsible for programme execution, reporting to the management body in its supervisory function. The latter requests and receives regular progress updates, and assesses and responds to any delays found. (ECB Guide, section 3.7)

A clarification from the consultation: can execution be delegated?

The EBF asked whether delegation from the management body could be permitted, given that the number of programmes to steer could be significant at a large institution. The ECB first restates the basis in the text: paragraph 31 of BCBS 239 specifies that "the board should also be aware of the bank's implementation of, and ongoing compliance with the Principles set out in this document." On the question of delegation, the ECB's position is nuanced: it considers that board committees should support the supervisory function on specific areas, provided there is a clear division of tasks between specialised committees — but this delegation to committees does not release the management body, in its supervisory function, from its obligation to collectively fulfil its duties and responsibilities. An institution must also be able to demonstrate that, following its internal prioritisation and budgeting process, the necessary resources are available on a case-by-case basis. (ECB consultation feedback statement, May 2024 — Table 8, comment 1)

A second, more subtle but telling point shows how the consultation tightened the text: the EBF suggested replacing, in paragraph 2 of section 3.7, the verb "decides" with "is responsible for". The ECB accepted this rewording — a semantic shift that strengthens the management body's accountability on this specific point. (ECB consultation feedback statement, May 2024 — Table 8, comment 4 — amendment made)

What the ECB does with these programmes, on the supervisory side

The Guide does not stop at describing expectations: it also specifies how the ECB intends to enforce them. ECB banking supervision commits to using the full range of its supervisory tools and powers if the measures and deadlines set are not met — within the SREP, ongoing supervisory activities, on-site inspections or internal model investigations. It is stepping up its intrusiveness in annual SREP assessments and more targeted engagement, with a stronger focus on the data quality of supervisory reporting. If the qualitative requirements and their deadlines are not met, or if material gaps are found (for example inaccurate information on key risk indicators), the matter can be taken further — up to the imposition of enforcement measures, penalties and capital add-ons. Governance deficiencies can also lead to a fit-and-proper reassessment of the responsible members, and, in the most serious cases, to their removal. (ECB Guide, section 4)

The ECB also mentions a specific supervisory tool: the "Management Report on Data Governance and Data Quality", a report consolidating data quality measurement, in which institutions answer open questions — signed off by at least one member of the management body, further reinforcing accountability at the top. (ECB Guide, section 4)

Key takeaway

An RDARR implementation programme is therefore not a mere statement of intent. It is something the Guide governs almost as tightly as RDARR capabilities themselves: dedicated project governance, documented milestones, an identified owner within the management body, periodic reporting — and an explicit reminder that delegation to committees never dilutes collective responsibility at the top.

This article is based on three documents: the Basel Committee's 14 BCBS 239 principles (January 2013), the ECB's RDARR Guide (May 2024), and the ECB's feedback statement on the RDARR Guide's public consultation (May 2024).