BCBS 239 principles in plain words: 14, in four groups

The BCBS 239 principles are the Basel Committee's fourteen Principles for effective risk data aggregation and risk reporting, published in January 2013 after the financial crisis showed that many banks "lacked the ability to aggregate risk exposures and identify concentrations quickly and accurately at the bank group level". They fall into four groups: governance and infrastructure (Principles 1 and 2), risk data aggregation (3 to 6), risk reporting (7 to 11) and supervisory review (12 to 14). The first eleven are written for banks; the last three tell supervisors how to check them. The work is hard because each principle is a property of the whole chain from a loan system to a board page, so it cannot be shown on a policy document alone. Botminds' BCBS 239 Compliance exists to test the principles on the figures a board actually saw: agents trace each figure back to its source, reconcile it at every step and time it, and people decide every rating.

The examples below come from a fictional sample bank, Corvane National Bank, a $92 billion regional lender, as it runs through the solution. Every regulatory quotation links to the regulator's own text.

What are the 14 BCBS 239 principles? Four groups with one logic

The fourteen principles follow the path a number travels: first the structures that must exist, then how data is gathered, then how it is reported, then how supervisors check. The Committee's own summary lists them as "Overarching governance and infrastructure", "Risk data aggregation capabilities", "Risk reporting practices" and "Supervisory review, tools and cooperation" (BCBS 239, Annex 2).

The groups are not independent. The Committee calls governance and infrastructure "preconditions to ensure compliance with the other Principles", and says banks "should meet all risk data aggregation and risk reporting principles simultaneously". Trade-offs are accepted only "in exceptional circumstances such as urgent/ad hoc requests of information on new or unknown areas of risk", and the board must know about them. A bank that buys speed by dropping accuracy has not met Principle 5; it has broken Principle 3.

Principles 1 and 2: governance and architecture come before any number

Principle 1 asks that risk data aggregation and reporting be "subject to strong governance arrangements". In practice that means three things the text spells out: the board and senior management "should review and approve the bank’s group risk data aggregation and risk reporting framework"; the capabilities should be "fully documented and subject to high standards of validation", and that validation "should be independent"; senior management should "identify data critical to risk data aggregation and IT infrastructure initiatives". The ECB later made that idea explicit as critical data elements, and critical data elements in banking explains how to choose and measure them.

Principle 2 asks a bank to "design, build and maintain data architecture and IT infrastructure which fully supports" aggregation and reporting "not only in normal times but also during times of stress or crisis". Its paragraphs ask for integrated data taxonomies, metadata, and single identifiers or unified naming conventions "for data including legal entities, counterparties, customers and accounts", and for "roles and responsibilities" covering who owns risk data and answers for its quality, in both business and IT (data owner vs data steward quotes the paragraph). Banks need not run one data model; where several are in use, the Committee expects robust automated reconciliation between them.

Principles 3 to 6: aggregation is judged on accuracy, completeness, timeliness and adaptability together

Principle 3 carries the most weight in an examination of data, because every other aggregation principle assumes the numbers are right. It reads: "A bank should be able to generate accurate and reliable risk data to meet normal and stress/crisis reporting accuracy requirements. Data should be aggregated on a largely automated basis so as to minimise the probability of errors." Its guidance sets the bar at accounting: controls over risk data are expected to match those over accounting data, risk data should be reconciled with the bank's sources, and where a bank leans on spreadsheets or desktop databases it needs mitigants such as end-user computing policies. That last expectation is why a workbook in the middle of a lineage becomes a finding; end user computing controls covers what those mitigants look like.

Principle 4 asks for "all material risk data across the banking group", available "by business line, legal entity, asset type, industry, region and other groupings", including off-balance sheet exposures. Principle 5 asks for aggregate, up-to-date data "in a timely manner" but deliberately leaves the clock to the bank: the right timing depends on how volatile the risk is and how critical it is to the bank. Principle 6 asks for "a broad range of on-demand, ad hoc risk management reporting requests". The Committee's own example of adaptability is concrete: a bank "should be able to aggregate risk data quickly on country credit exposures as of a specified date based on a list of countries".

Paragraph 46 names the "critical risks" that must be available rapidly in stress: large corporate credit exposures, counterparty credit risk including derivatives, trading exposures and limits, liquidity indicators such as cash flows and funding, and time-critical operational risk indicators. Those are the places to start testing Principle 5, because they are the figures a supervisor asks for first; the BCBS 239 timeliness principle shows how to measure the clock rather than attest to it.

Principles 7 to 11: what reaches the board, and how often

The reporting principles move from the data to the page. Principle 7 asks that reports "accurately and precisely convey aggregated risk data" and be "reconciled and validated"; the Committee expects senior management to set accuracy requirements "analogous to accounting materiality". Principle 8 asks for coverage of "all material risk areas", with forward-looking forecasts and stress results rather than "current and past data" alone. Principle 9 asks for reports that are "easy to understand yet comprehensive enough to facilitate informed decision-making", and expects a bank "to confirm periodically with recipients" that what it sends is relevant.

Principle 10 gives the board and senior management the job of setting report frequency, which "should be increased during times of stress/crisis". Its guidance also asks banks to test, routinely and particularly in stress, whether accurate reports can be produced within the timeframes they have set. Principle 11 asks that reports reach "the relevant parties while ensuring confidentiality is maintained", with receipt confirmed periodically.

Banks should meet all risk data aggregation and risk reporting principles simultaneously.

Basel Committee on Banking Supervision, BCBS 239, paragraph 22

Principles 12 to 14 bind supervisors, not banks

The last three principles are instructions to supervisors, which is why a bank's self-assessment rates eleven principles, not fourteen. Principle 12 says supervisors "should periodically review and evaluate a bank’s compliance with the eleven Principles above", and paragraph 75 adds that they "may test a bank’s compliance with the Principles through occasional requests for information to be provided on selected risk issues ... within short deadlines". A supervisory fire drill is that test: the 2023 progress report describes fire drills as a way "to test banks’ ability to aggregate and report risk data under simulated stress scenarios or events".

Principle 13 gives supervisors the tools: requiring remedial action, "increasing the intensity of supervision", requiring an independent review, and "the possible use of capital add-ons" under Pillar 2. Paragraph 80 goes further: supervisors "should be able to set limits on a bank’s risks or the growth in their activities" where deficiencies cause "significant weaknesses in risk management capabilities". Principle 14 covers cooperation between home and host supervisors of cross-border groups. A bank cannot rate itself on these, but it can prepare for them: the evidence a supervisor would ask for under Principle 12 is the same evidence the bank's own Principles 1 to 11 need.

When did BCBS 239 take effect, and for whom?

BCBS 239 took effect for the first global systemically important banks at the start of 2016. Banks "identified as G-SIBs by the FSB in November 2011 or November 2012 must meet these Principles by January 2016", and G-SIBs designated later "will need to meet the Principles within three years of their designation". The Committee also "strongly suggested" that national supervisors apply the principles to domestic systemically important banks three years after designating them, and that supervisors "may nevertheless choose to apply the Principles to a wider range of banks, in a way that is proportionate".

The principles are a Basel standard, not a law. The Committee says so plainly in its 2023 progress report: "not all jurisdictions actually require compliance with the Principles since certain jurisdictions did not transpose them into their national framework" (BCBS, November 2023). Whether they bind a given bank depends on its supervisor. As of October 2026 the January 2013 text is still the current version on the Bank for International Settlements' site (BIS publication page), and the Committee's January 2026 newsletter on implementation says the principles still apply while the way banks meet them has moved on (BCBS Newsletter 36; quoted in the BCBS 239 progress report). The newsletter sets no new supervisory guidance or expectations.

Does BCBS 239 apply to US banks? The OCC's heightened standards are the closest counterpart

No U.S. regulation adopts BCBS 239 by name, but the OCC's heightened standards for large national banks carry a paragraph on the same subject. Under 12 CFR Part 30, Appendix D, section II.J, a covered bank's risk governance framework "should include a set of policies, supported by appropriate procedures and processes, designed to provide risk data aggregation and reporting capabilities appropriate for the size, complexity, and risk profile of the covered bank, and to support supervisory reporting requirements" (eCFR, current through October 23, 2026). It lists three things those policies should provide for: a data architecture and IT infrastructure that support aggregation "during normal times and during times of stress"; capturing and aggregating risk data and reporting material and emerging risks "in a timely manner to the board of directors and the OCC"; and distribution of risk reports "at a frequency that meets their needs".

The guidelines apply today to banks with "average total consolidated assets equal to or greater than $50 billion". That threshold may change. On December 30, 2025 the OCC proposed raising it to $700 billion, which it said "would reduce the number of covered banks to which the Guidelines apply from 38 institutions to eight institutions" (Federal Register, 90 FR 61084). Comments closed on March 2, 2026, and as of October 27, 2026 no final rule has been published; the eCFR still reads $50 billion. A bank between the two thresholds, such as the $92 billion sample bank, should plan for both outcomes: its risk data policies remain good practice either way, but whether II.J binds it depends on the final rule.

How the ECB turned the principles into expectations

In the euro area the principles arrive through the ECB's Guide on effective risk data aggregation and risk reporting, published in May 2024 and still the guide the ECB points to in its supervisory priorities for 2026–28. The Guide names seven areas of concern: the responsibilities of the management body, the scope of application, an effective data governance framework, integrated data architecture, group-wide data quality management, timeliness of internal risk reporting, and implementation programmes.

Several expectations go beyond the Basel wording. The management body should select "one or two members" to be responsible for the data governance framework. Scope should cover internal risk reports, published financial reports and supervisory reports, with the critical data elements behind each key risk indicator named. End-user computing should sit inside the bank's data quality management policies rather than beside them. And the Guide sets a clock the Basel text never did: a monthly or quarterly risk report that needs more than 20 working days to produce leaves a bank unable to react in time.

The ECB has not relaxed since. Its priorities for 2026–28 report that the 2025 supervisory review found persistent deficiencies, with no improvement in the average RDARR sub-score on the year before, and that supervisory efforts will intensify. The BCBS 239 progress report reads those findings alongside the Basel Committee's own.

Testing a principle on one figure with BCBS 239 Compliance

A principle is easiest to judge on one number. In the sample bank's September 2026 Board Risk Report, page 7 shows commercial real estate exposure of $14.86 billion. BCBS 239 Compliance follows that figure down seven hops to the loan origination system, reconciles it at each hop and finds $212.0 million added at the fourth, a spreadsheet: $187.4 million of participations sold to other banks but counted as held, and $24.6 million of manual overrides nobody has explained. That one finding answers Principle 3 (the figure does not reconcile), Principle 5 (the workbook took 60 of the 81.6 hours the figure needed in the June stress drill) and Principle 6 (the stress cut depends on one analyst and one file).

One finding, cited into the Principle 3 rating in BCBS 239 Compliance

The self-assessment then shows all eleven bank principles side by side, each with last year's rating, its findings and its evidence count. Principles 12 to 14 appear too, with their evidence prepared, but unrated: they belong to the supervisor. The Head of Risk Reporting decides each rating, the Chief Data Officer approves the whole, and internal audit validates it independently, which is what Principle 1's call for independent validation asks.

Eleven principles rated, three left to the supervisor

Where to go next depends on the gap. If the board wants to know how its bank compares, start with what the 2023 progress report really says. If the question is evidence, a BCBS239 assessment run on one board report sets out a two-week test. The BCBS 239 Compliance page shows the agents and the people who decide.

Questions people ask

What is BCBS 239?

BCBS 239 is the Basel Committee on Banking Supervision's standard number 239, the Principles for effective risk data aggregation and risk reporting, published in January 2013. It sets fourteen principles for how banks gather risk data and report it to their boards, and how supervisors check. It is also called RDARR, the abbreviation the ECB uses.

What are the four groups of BCBS 239 principles?

Overarching governance and infrastructure (Principles 1 and 2), risk data aggregation capabilities (3 to 6), risk reporting practices (7 to 11), and supervisory review, tools and cooperation (12 to 14). The first eleven apply to banks; the last three tell supervisors how to review compliance, require remediation and cooperate across borders.

What is Principle 3 of BCBS 239?

Principle 3, accuracy and integrity, asks a bank to "generate accurate and reliable risk data" in normal and stress conditions, aggregated "on a largely automated basis so as to minimise the probability of errors". Its guidance holds risk data controls to the standard of accounting controls and asks for mitigants, such as end-user computing policies, where spreadsheets are used.

Does BCBS 239 apply to US banks?

Not by name. The nearest U.S. requirement is section II.J of the OCC's heightened standards, which asks covered national banks for risk data aggregation and reporting policies; it applies at $50 billion in average assets today. The OCC proposed raising that threshold to $700 billion in December 2025, and the proposal was not final as of October 2026.

What is the ECB RDARR guide?

It is the ECB's Guide on effective risk data aggregation and risk reporting, published in May 2024, which sets minimum supervisory expectations for significant institutions in seven areas, from the management body's responsibilities to implementation programmes. It uses the BCBS 239 principles as its benchmark and adds specifics such as attribute-level lineage and a 20-working-day ceiling for monthly or quarterly risk reports.

When did BCBS 239 take effect?

For banks designated global systemically important in November 2011 or November 2012, January 2016. Later G-SIBs have three years from designation, and the Committee strongly suggested that national supervisors apply the principles to domestic systemically important banks three years after designating them.