BCBS 239 compliance, measured on the numbers your board saw: traced, reconciled and cited hop by hop
Each board figure traced to source, reconciled at every hop, every rating cited.
See one case, screen by screen ↓BCBS 239 compliance means a bank can show it meets the Basel Committee's Principles for effective risk data aggregation and risk reporting (RDARR), published in January 2013. This solution measures it on real numbers: agents follow each board-report figure back to its source hop by hop, reconcile it at every hop, time it in the last stress drill and draft the self-assessment principle by principle, every rating citing its findings. A steward confirms each hop, the Head of Risk Reporting submits, the Chief Data Officer approves and Internal Audit validates.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
BCBS 239 compliance is usually evidenced the slow way. The data office lists critical data elements in a spreadsheet that drifts from the reports within months. Stewards interview system owners and draw lineage that stops where the catalog scanners stop, at the first spreadsheet or file share, which is usually where the risk is. Report owners tie a sample of elements to the general ledger at the end of the chain only, so a difference in the middle stays invisible, and they attest that an ad hoc request can be produced in stress without anyone timing the last drill hop by hop.
Then comes the BCBS 239 assessment itself: a questionnaire worked principle by principle, with ratings argued in meetings and evidence attached as folders. Supervisors now ask for the finding behind each rating and the lineage behind each finding. In its November 2023 review the Basel Committee found only 2 of 31 global systemically important banks fully compliant with all the principles. And the assessment starts to age the day it is signed: one source system release can break a hand-kept mapping long before the next cycle.
Estimated split of one annual cycle at the demo bank, by hand and with the solution. The before column follows the calendar the bank runs today: inventory in January and February, lineage from March to June, the self-assessment from August to October, approval and validation in November and December. Not measured.
Six agents trace, reconcile and time each board figure and draft the self-assessment; a steward confirms each hop, the CDO approves and Internal Audit validates.
Corvane National Bank, a $92 billion regional bank, sent its September 2026 Board Risk Report to the Board Risk Committee on October 15. Page 7, table 3.2, shows commercial real estate exposure (committed) of $14.86B: critical data element CRE-EXP-001, one of 312 across 41 risk reports fed by 9 source systems. Here is what happens on Thursday, October 22, screen by screen, in the working solution.
The agents start from the number as the board saw it and trace it down seven hops: the board portal, the risk reporting platform's template BRR-2026-09, the risk mart RM.CRE_CONC, a workbook called CRE_concentration_v12.xlsx, the staging table STG.CRE_LOANS, the core banking system's commercial loan ledger and the loan origination system. Each hop shows its owner, its control, the time it added and the amount it holds. Principle chips appear only where a gap sits: P2 on the risk mart, which runs a schema check only, and P3, P5 and P6 on the workbook.
Next step: “Hop 4 needs a steward: a workbook adds $212.0M and 2.5 days with no reconciliation control.”
Hop 5 holds $14,648.0M; the workbook uploads $14,860.0M. The Accuracy agent splits the $212.0M in two: $187.4M of sold participations counted as held, on tab Participations, rows 14–61, at 0.93 confidence, and $24.6M of six manual overrides on tab Adj, cells F18:F23, last edited September 29, 2026. It marks the second amount unexplained rather than guessing at it.
How the hop was found: the data catalog lists this input only as “manual upload”, so the Lineage agent joined the upload to the warehouse export by file name, time and account, at 0.94 confidence.
The citation opens the workbook's Participations tab with rows 14 to 62 highlighted: 48 participations sold to other banks, pasted on June 30, 2026, with the “Sold %” column blank, so the full commitment counts as held. The workbook is read only, and borrower names stay masked.
The workbook has 9 tabs, 1,840 formulas, 61 hard-coded values and 6 manual overrides. Its only version control is “v12” in the file name; there is no reviewer sign-off and no reconciliation control. It feeds 6 elements in 3 reports and was edited on 23 days in 2026 by 3 analyst accounts. The agent rates it High and pins Principles 3, 5 and 6 to the hop.
“A rating is a proposal; the owner attests the controls.”
Three steps, in order. Nadia confirms hop 4 (LN-01) and accepts finding F-26-031 (FD-01), which feeds Principle 3. She then opens the two items the Assessor proposed for Derek Lomax: RDA-26-041, retire the workbook into a governed transformation reconciled at every load, due March 31, 2027; and RDA-26-042, an interim reconciliation before each upload signed by a second analyst, due November 13, 2026. Both land in the issue register as ISS-26-1187 and ISS-26-1188.
On June 18, 2026 at 08:00 the Board Risk Committee asked for CRE exposure by property type and state within one business day. The agent read the drill record, matched the scheduler and report-platform logs to the seven hops and measured each one. The figure arrived on June 21 at 17:36, 81.6 hours after the request, and 60 of those hours (74%) sat at the workbook. 33 of 41 reports met the 24-hour target.
Flipping from One element to Self-assessment shows the 11 principles the bank rates, drafted by the Assessor from 312 elements, 44 findings and 1,284 evidence items, each beside last year's rating. Principle 3, accuracy and integrity, was re-drafted at 07:52 from 3 to 2, materially non-compliant. Principle 6, adaptability, also drops to 2, and Principle 11, distribution, rises to 4. Principles 12 to 14 are addressed to supervisors: the bank prepares their evidence and does not rate them.
Principle 3 opens on the Assessor's draft, at 0.92 confidence on prompt v2.4, with a rationale citing the $212.0M, the 13 of 312 elements with an unexplained difference and the 9 of 27 workbooks rated high. Below it are the findings behind the rating, each with “Open the hop”, and the OCC heightened-standards paragraph it also answers: 12 CFR Part 30, Appendix D, II.J(1) and (2). Graham can accept the rating, edit it with a reason or reject the draft. He accepts it (RT-01).
Graham decides all 11 ratings and submits (SA-01). Celeste Marchetti, the Chief Data Officer, approves the self-assessment for the Board Risk Committee on December 10, 2026 (SA-02). Owen Pritchard of Internal Audit validates it independently (IA-01), with the agent's draft and every human change side by side.
The Head of Risk Reporting “cannot approve what he submitted”: approval is the Chief Data Officer's step.
The audit trail records who did what, when, why and on which evidence, for people and agents alike. One export gathers the self-assessment with the Assessor's draft and every human change, each rating's findings with hop, amount and citation, the lineage of all 312 elements with who confirmed and countersigned it, the reconciliations, the drill replay, the spreadsheets, the remediation items and the agent and prompt versions.
Borrower names, account numbers and employee IDs are redacted when the pack leaves; SAR-related elements appear as counts only.
The same board figure, seen by the five people it passes: what their assessment cycle looked like, and what it looks like now.
Six agents trace, reconcile and time each board figure and draft the self-assessment; a steward confirms each hop, the CDO approves and Internal Audit validates.
Rebuilds each critical data element's path from report to source from the data catalog, the ETL scheduler's job logs, the report specifications and file-share access logs, so it finds the workbooks the catalog scanners miss. Each hop gets its system or file, owner, control and the time it added.
Reconciles the element's amount at every hop to the hop before it and breaks any difference down to the row, tab and cell, with a confidence on each part and a citation to the extract or workbook behind it.
Replays the last stress drill from the scheduler and report-platform logs and measures each hop's elapsed time against the target, so Principle 5 is a measurement rather than an attestation.
Finds end-user computing in the lineage and risk-rates each workbook on materiality, complexity, controls and change history, naming the elements and reports it feeds.
Drafts each principle's rating and rationale from the findings, cites every finding and its hop, maps the principle to the OCC heightened standards, paragraph II.J, and proposes remediation with an owner and a due date.
Watches system releases, schema and job changes and report template versions, and re-traces only the elements a change touches. When a system does not answer, it pauses the re-trace and says which one.
Confirms every hop; the CDO approves, Internal Audit validates. The agents propose; a named person decides.
Ask the assistant in plain words. Every answer cites the extract, workbook, log or finding it came from, and opens the screen it is about.
Why is CRE exposure $212M above the loan system?
Two things in one workbook, at hop 4. $187.4M is 48 participations the bank sold to other banks, pasted onto tab Participations on June 30 with the “Sold %” column blank, so they count as held. $24.6M is six hard-coded overrides on tab Adj, cells F18:F23, with no comment. The loan origination system holds $14,648.0M; the board saw $14.86B. Nothing between the warehouse export and the upload reconciles the two.
Which principles moved since last year, and why?
Three. Principle 3, accuracy and integrity, from 3 to 2: re-drafted today on the CRE finding, with 13 elements carrying an unexplained difference. Principle 6, adaptability, from 3 to 2: six of the eight reports that missed the June drill build their cut in a spreadsheet. Principle 11, distribution, from 3 to 4: board and ALCO packs now carry a portal distribution log since RDA-26-012 closed.
How long did CRE exposure take in the June stress drill?
81.6 hours against a 24-hour target: requested June 18 at 08:00, on the board portal June 21 at 17:36. 60 hours were at the workbook: 31 waiting for the analyst, 22 refreshing and mapping by hand, 7 reviewing and uploading. Every other hop took 21.6 hours together. 33 of 41 reports met the target.
Which elements did the October 12 loan system release affect?
Release 26.4 renamed prop_type_cd to property_type_code. The Change agent re-traced the 14 elements that read it: 13 are unchanged, and CRE-OOR-002, office CRE exposure, changed. 112 office loans now come out unmapped on tab Map of the same CRE workbook, so office exposure is understated until the mapping is fixed. Nadia confirms the re-trace.
13 screens from the working solution, on its sample data. Pick one to see it large.
Every value below is the bank's to set. Each change is versioned and waits for a second person before it takes effect; in the working solution, the Chief Data Officer approves what the administrator proposes.
| Setting | Default | Choose from |
|---|---|---|
| What makes an element critical | A figure on a board, regulatory or supervisory report, or used in a risk limit | add management reports above materiality (about 140 more elements) |
| Materiality for a hop difference | $5M, or 0.1% of the element if lower | $1M · $5M · $25M; 0.05–0.5% |
| Timeliness target in stress | 24 hours, request to board | 12 · 24 · 48 hours |
| Agent confidence threshold | 0.90 | 0.80 to 0.95 |
| Escalate overdue remediation | to the CDO after 30 days; to the Board Risk Committee report at twice that | 15 · 30 · 60 days |
| Keep assessment records | 7 years | 5 · 7 · 10 years |
| Mask loan-level rows outside the steward's domain | On | on · off |
| SAR-related elements | Counts only, BSA officer | on · off |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate of one assessment cycle's weeks at the demo bank · “typical” = published figures (Basel Committee on Banking Supervision, Principles for effective risk data aggregation and risk reporting, January 2013: 14 principles in four groups; BCBS progress report, November 2023: 2 of 31 G-SIBs fully compliant with all the principles; 12 CFR Part 30, Appendix D, II.J: OCC heightened standards for banks with $50 billion or more in assets). People named on this page are characters in the working solution; the bank, its systems, files, references and figures are fictional sample data.
BCBS 239 compliance means a bank can show it meets the Basel Committee's Principles for effective risk data aggregation and risk reporting (RDARR), published in January 2013. This solution measures it on real numbers: agents follow each board-report figure back to its source hop by hop, reconcile it at every hop, time it in the last stress drill and draft the self-assessment principle by principle, every rating citing its findings. A steward confirms each hop, the Head of Risk Reporting submits, the Chief Data Officer approves and Internal Audit validates.
They fall into four groups: overarching governance and infrastructure (Principles 1 and 2), risk data aggregation capabilities (3 to 6: accuracy and integrity, completeness, timeliness, adaptability), risk reporting practices (7 to 11) and supervisory review, tools and cooperation (12 to 14). Banks assess themselves on 1 to 11; 12 to 14 are addressed to supervisors, so the solution prepares their evidence without rating them.
Global systemically important banks were to comply from January 2016, and the Basel Committee recommends that national supervisors apply the principles to domestic systemically important banks three years after their designation. In the US, the OCC's heightened standards for banks with $50 billion or more in assets (12 CFR Part 30, Appendix D, II.J) call for risk data aggregation and reporting policies. In the working solution, each principle shows the heightened-standards paragraph it also answers.
The Lineage agent rebuilds each element's path from the data catalog, the ETL scheduler's job logs, the report specifications and file-share access logs. That is how it finds the workbook the catalog lists only as “manual upload”. It never confirms a hop itself: a steward confirms or corrects each one with a reason code, and the Head of Risk Reporting countersigns the lineage.
By replaying the last stress drill rather than attesting to it. The Timeliness agent matches the scheduler and report-platform logs to each hop and measures its elapsed time against the target the bank sets: 24 hours in the working solution. In the June 18 drill, CRE exposure took 81.6 hours, 60 of them in one workbook.
The Change agent watches releases, schema and job changes and report templates, and re-traces only the elements a change touches. When the loan origination system renamed one field, it re-traced the 14 elements that read it and found one changed. It never changes a rating; it reopens one for a person, and a re-trace that cannot reach a system pauses and says which one.
Yes. Agents trace, reconcile, measure, rate and draft; they never confirm a hop, adjust a figure, edit a workbook or set a final rating. Stewards confirm hops and findings, the Head of Risk Reporting decides each rating and submits, the Chief Data Officer approves and Internal Audit validates, each with a reason code. The agent's draft and every human change are kept side by side.
The Agentic Solution Engine builds and deploys it from your requirements, your documents and your rules: the critical data element criteria, the materiality and timeliness targets, the reason codes, the approvers and the roles. It goes live once every quality gate has passed, connected to your data catalog, scheduler, source systems and reporting platform.
A cited answer in under a minute, with the bank’s own precedent beside the instruction.
1-min demoCall Report PreparationHalf the close back, and every figure opens to its ledger and its instruction paragraph.
1-min demoCall Report AnalysisEvery failed edit explained in plain words, tied to the ledger, approved before filing.
1-min demoWe'll run BCBS 239 Compliance on one of your own board figures and the systems behind it.