BCBS 239 progress report: what “2 of 31” really says

The most recent BCBS 239 progress report, published by the Basel Committee on 28 November 2023 and still its latest as of October 2026, found that "Of the 31 banks assessed, only two banks are fully compliant with all the Principles" and that "there is not a single Principle that has been fully implemented across all banks" (BCBS, Progress in adopting the Principles). The assessment used data as of June 2022, nearly a decade after the principles were published and six and a half years after the January 2016 deadline. BCBS 239 covers how a bank gathers risk data and reports it to its board, and it is hard because every principle is a property of a chain of systems, files and people. Botminds' BCBS 239 Compliance was built for the gap this report keeps finding: it rates each principle from evidence traced figure by figure, so a bank's view of itself can be checked against what its data actually does.

Product examples come from a fictional sample bank, Corvane National Bank, as it runs through the solution. Everything else on this page is quoted from the Basel Committee, the ECB, the Federal Reserve or the OCC, with a link on each claim.

What did the 2023 BCBS 239 progress report find?

It found that "banks are at different stages in terms of aligning with the Principles" and that "Additional work is required at all banks to attain and/or sustain full compliance" (BCBS, November 2023, executive summary). The sample was 31 G-SIBs designated between 2011 and 2021, from Canada, Finland, France, Germany, Italy, Japan, the Netherlands, Spain, Switzerland, the United Kingdom and the United States. Supervisors in each jurisdiction completed a common template, and the Committee added an outreach session with subject-matter experts from selected G-SIBs in March 2023.

Each principle was rated on a four-point scale: 4 means "The Principle is fully complied with", 3 "largely complied with", 2 "materially non-compliant" and 1 "The Principle has not been adopted". Most banks reached 3 or 4 on most principles. That is the first thing a board should notice: the "2 of 31" is about full compliance with all eleven bank principles at once, which the principles themselves require, since banks are to meet all of them at the same time (BCBS 239 principles in plain words quotes paragraph 22).

Compared with 2017, ratings improved overall. Compared with 2019, the report says, "The improvements since 2019, however, are mixed", and "for some Principles the aggregated compliance rating has even deteriorated from 2019 to 2022". The Committee offers one caveat in fairness to the banks: some of the variation "might also be explained by changes in the intensity of supervisory activities", since tougher inspections find more.

Which BCBS 239 principle is hardest to comply with? Timeliness and report accuracy slipped

The report names two principles whose average rating fell between 2019 and 2022: Principle 5, timeliness, and Principle 7, the accuracy of risk reports. Three more stood still, and Principle 1 slipped slightly despite more banks reaching full compliance on it. The direction of each is in the text; the averages behind them are shown only in the report's chart, so the table below gives directions, not scores.

Timeliness and accuracy are both tested hardest when a supervisor asks for something new at short notice, and the report notes that during the pandemic and other recent stress events "some banks encountered difficulty adapting their reporting processes in response to regulators’ requests for granular, ad hoc information at an increased frequency". Measuring the timeliness principle on a replayed stress drill shows how a bank can find out which hop costs it the hours before a supervisor does.

Why are banks not compliant with BCBS 239? The reasons the report gives

The report puts the delay down to "lack of prioritisation, insufficient ownership by the board and senior management, as well as challenges with implementing data architecture and IT Infrastructure improvements". It describes "persistent challenges with fragmented IT landscapes, legacy systems and manual processes that are not fit for purpose", and adds a sentence every data office should read twice: "Several banks still lack a common taxonomy and complete data lineage, which further complicates banks’ ability to harmonise systems and detect data defects."

Scope has also grown under the programmes. "Many banks have expanded the scope of their adoption programs beyond risk data aggregation to include more entities and emerging risks, as well as financial and supervisory reporting activities", and the report says those changes "have led to extended implementation timelines". New technology had not yet helped: "New technologies such as artificial intelligence have not yet materially impacted banks’ risk data aggregation and risk reporting processes", partly because "many banks still lack quality data, which is a prerequisite for embarking on any digitalisation project". The BCBS 239 implementation challenges guide turns those reasons into a programme budget and the indicators that show whether it is working.

Do supervisors agree with bank self-assessments? Often not

No: the 2022 assessment "reflects some divergence with banks’ perception of their adoption of the Principles, which tended to be more positive than that of their respective supervisor". The report's sharpest sentence describes the pattern: "certain banks consider themselves to be “fully compliant” with the Principles (in some cases, several cycles ago) while they continue to struggle with systemic data quality issues with multi-year remediation programs underway to address them."

It also explains why the views part. "In those cases, most banks viewed the Principles as being narrowly defined compared to the broader data issues that they experience." A bank that reads Principle 3 as a statement about its risk engine can rate itself fully compliant; a supervisor who traces one board figure through a spreadsheet will not. The ECB reported the same pattern from the other side in 2025: among 105 banks completing its Management Report on data governance and data quality, "banks’ self-assessments indicate that they do not yet view themselves as fully aligned with supervisory expectations" (ECB Supervision Newsletter, February 2025).

What the report asks of boards, and of supervisors

For banks, the earlier recommendations stand and four are added. Boards "should prioritise and intensify their oversight of data governance". Banks should "foster a culture of ownership and accountability for data quality", which the report spells out as "designating data owners", independent units "for validating risk data and risk reporting" and "a standard set of key performance indicators (KPIs) to the board". They should apply the principles across "all main risk reports for all material risks", with "the full data lifecycle from data origination, capture, and aggregation to reporting". And they should "ensure sound data quality as the foundation for digitalisation projects".

For supervisors, the report recommends "more targeted and intensive activities such as onsite inspections, deep dive exercises or fire drills", and "more forceful supervisory measures (eg capital add-ons, restrictions on capital distributions or business activities, other penalties/fines)" where remediation of long-standing deficiencies is insufficient. Its survey of measures explains why: the heavier ones "are only very rarely utilised, despite the lack of progress by several banks".

What did the ECB thematic review find, and what has the ECB found since?

The ECB ran its own review from 2016 on 25 significant institutions and reported in May 2018 that "the implementation status of the BCBS 239 principles within the sample of significant institutions is unsatisfactory" and that none "have fully implemented the BCBS 239 principles" (ECB, Report on the Thematic Review). It added a data lineage exercise on two selected data points and a fire drill. Its 2024 Guide says progress since then "has been generally insufficient", that RDARR "was the worst-rated sub-category of internal governance in the 2023 SREP cycle", and that monthly risk reports had been seen taking "40 or more working days" to produce (ECB Guide, May 2024).

The most recent ECB documents point the same way. The supervisory priorities for 2026–28 state that "The SREP 2025 outcomes point to persistent deficiencies in banks’ RDARR frameworks, with no improvement in the relevant average sub-score as compared with last year." The ECB's annual report for 2025, published in March 2026, says "insufficient progress in banks’ RDARR capabilities was still observed in 2025" and describes an escalation process built on binding measures "which also include periodic penalty payments as potential enforcement measures". It also records "gradual progress": RDARR capabilities "now fall under the remit of banks’ senior management".

Is BCBS 239 still relevant in 2026?

Yes. The Basel Committee has not published a newer progress report as of October 2026, but its January 2026 newsletter on implementation says "While its principles still apply, its implementation has evolved over the years", and names data lineage as one of the themes from its latest outreach (BCBS Newsletter 36). The newsletter adds no new expectations: it is "for informational purposes only".

In the United States the subject reaches enforcement through data quality rather than the Basel label. On 10 July 2024 the Federal Reserve fined Citigroup $60.6 million, for too little progress in fixing its data quality management and for failing to put compensating controls around the risk in the meantime (Federal Reserve, July 2024). The OCC assessed a $75 million penalty on Citibank in part because it had no way to track how data quality problems affected its regulatory reports (OCC, July 2024; both orders are quoted in regulatory reporting challenges, read from the enforcement orders). The OCC terminated that July 2024 amendment to its order in December 2025 (OCC termination order); the Federal Reserve's release put the two agencies' 2024 penalties at about $135.6 million together.

Reading your own bank against the report with BCBS 239 Compliance

The report's central problem is a rating that cannot be followed to evidence. In BCBS 239 Compliance each draft rating cites its findings, and each finding opens the hop where it sits. On the sample bank, last year's Principle 3 rating was 3, largely compliant, approved by the Chief Data Officer and validated by internal audit with no exception. This year the Assessor agent re-drafted it to 2, materially non-compliant, because one board figure, commercial real estate exposure of $14.86 billion, carries $212.0 million more at a spreadsheet hop than the loan system holds. Its rationale says why the old rating held: it "rested on end-of-chain tie-outs, which did not see a mid-chain difference".

Last year's rating beside this year's, and the finding that moved it

That is the divergence the Basel Committee describes, closed inside the bank before a supervisor finds it. The same evidence goes to examiners as one pack: the self-assessment with the agent's draft and every human change, each rating's findings with hop, amount and citation, the lineage of all 312 critical data elements, the reconciliations, the stress-drill replay and the remediation items. A BCBS239 assessment on one board report shows how to produce the first version of that evidence in two weeks.

One examiner pack instead of folders of attachments

Questions people ask

How many banks comply with BCBS 239?

In the Basel Committee's latest assessment, two of 31 global systemically important banks were fully compliant with all the principles, on data as of June 2022. Most banks were rated largely compliant on most principles, but no single principle was fully implemented at every bank.

When was the last BCBS 239 progress report published?

On 28 November 2023. It was the Committee's seventh report on banks' progress since 2013, after reports in December 2013, January 2015, December 2015, March 2017, June 2018 and April 2020. As of October 2026 no later progress report has been published; a January 2026 newsletter summarised outreach themes without new expectations.

Which banks were assessed in the BCBS 239 progress report?

The 31 G-SIBs designated between 2011 and 2021, listed in the report's appendix: from Canada, Finland, France, Germany, Italy, Japan, the Netherlands, Spain, Switzerland, the United Kingdom and the United States. The report anonymises individual results, so it does not say which two were fully compliant.

Why are banks not compliant with BCBS 239?

The report cites fragmented IT landscapes, legacy systems and manual processes, incomplete taxonomies and data lineage, and insufficient board and senior management ownership. Programmes that widened to financial and supervisory reporting also extended their timelines.

What happens if a bank does not comply with BCBS 239?

Consequences come from the bank's own supervisor, since the principles are a Basel standard. Principle 13 lists tools from remedial action to Pillar 2 capital add-ons, and the 2023 report urged supervisors to use more forceful measures; the ECB's escalation process can lead to periodic penalty payments.

What did the ECB thematic review find?

That none of the 25 significant institutions in its sample had fully implemented the BCBS 239 principles, and that implementation was "unsatisfactory". The review, reported in May 2018, added a data lineage exercise on two data points and a fire drill testing aggregation under time pressure.