The European Banking Authority has launched a public consultation on draft Regulatory Technical Standards specifying the operational risk management framework institutions must establish under the updated Capital Requirements Regulation. The proposed rules aim to introduce harmonised requirements across the European banking sector while incorporating proportionate standards based on firm size and complexity.
Framework Structure and Core Components
The draft Regulatory Technical Standards set out requirements for governance, management processes, and risk assessment systems used by institutions to identify, monitor, and manage operational risk. Developed under Article 323 of the Capital Requirements Regulation, as amended by Regulation (EU) 2024/1623, the framework replaces previous measurement options, including advanced measurement approaches, with a single standardised approach linked to an institution’s business indicator.
The draft standards cover three main structural pillars: governance arrangements, the operational risk management process, and the operational risk assessment system. The text clarifies the specific duties of the management body, senior management, and the independent operational risk management function. Detailed requirements are also set for operational risk data, taxonomy, reporting, validation, and audit procedures. Specific risks related to information and communication technology are addressed separately under the Digital Operational Resilience Act.
Proportionality and Implementation Context
Proportionality forms a key element of the proposed framework. Institutions maintaining a business indicator below EUR 750 million will be eligible for reduced review and reporting frequencies, as well as a lower level of granularity regarding operational risk data, loss thresholds, and risk taxonomies.
The draft standards build upon the Basel Committee’s Principles for the Sound Management of Operational Risk and align with existing EBA Guidelines on internal governance. Following the consultation period, the European Banking Authority will finalise the draft standards and submit them to the European Commission for formal adoption under Regulation (EU) No 1093/2010.
Consultation Timeline and Hearing
The consultation process remains open for four months, closing on 31 December 2026. Interested parties can submit feedback through the EBA consultation portal, and submitted comments will be published at the end of the period unless confidentiality is requested.
The authority will host a virtual public hearing on 29 September 2026 between 10:00 and 12:00 CEST. Stakeholders intending to attend must complete registration by 25 September 2026 at 16:00 CEST.
| Framework Component | Key Covered Areas |
|---|---|
| Governance Arrangements | Responsibilities of the management body, senior management, and independent operational risk function |
| Operational Risk Management Process | Operational risk data, taxonomy, business indicator component, and reporting rules |
| Operational Risk Assessment System | Validation procedures, audit requirements, and loss thresholds |
Domande frequenti
What is the deadline for submitting comments on the EBA draft standards?
The public consultation on the draft Regulatory Technical Standards is open until 31 December 2026.
How does the draft RTS address smaller institutions?
Institutions with a business indicator below EUR 750 million benefit from lower frequencies for reporting and reviews, alongside reduced data granularity requirements.
