The BCBS 239 timeliness principle, Principle 5 of the Basel Committee's principles for risk data aggregation and reporting, asks that "A bank should be able to generate aggregate and up-to-date risk data in a timely manner while also meeting the principles relating to accuracy and integrity, completeness and adaptability" (BCBS 239, January 2013). It deliberately sets no number: the timing "will depend upon the nature and potential volatility of the risk being measured" and on the bank's own frequency requirements "under both normal and stress/crisis situations". The test comes in Principle 10, which says a bank "should routinely test its ability to produce accurate reports within established timeframes, particularly in stress/crisis situations". That is hard because a report's production time is spread across systems, jobs, spreadsheets and people, and most banks attest to it rather than measure it. Botminds' BCBS 239 Compliance measures it: its Timeliness agent replays the last stress drill from scheduler, report-platform and file-share logs and times every hop against the bank's target.
The drill below is from a fictional sample bank, Corvane National Bank, a $92 billion regional lender; the regulatory clocks are quoted from the Basel Committee and the ECB.
One stress request, hop by hop: where 81.6 hours went against a 24-hour target
- Hops 6 and 5: core banking, staging10 h
- Hop 4: the workbook60 h
- Hops 3 to 1: mart, platform, portal11.6 h
- One business day24 h
What is the BCBS 239 timeliness principle?
It is a requirement to produce aggregate, current risk data fast enough to manage risk, judged by the bank's own clock and checked by the supervisor. Paragraph 44 asks that the bank be "able to produce aggregate risk information on a timely basis to meet all risk management reporting requirements". Paragraph 45 accepts "that different types of data will be required at different speeds" and that "certain risk data may be needed faster in a stress/crisis situation", and asks banks to build their systems to produce aggregated data "rapidly during times of stress/crisis for all critical risks".
The critical risks are listed: the aggregated credit exposure to a large corporate borrower, counterparty credit risk exposures including derivatives, trading exposures and limits, liquidity indicators "such as cash flows/settlements and funding", and time-critical operational risk indicators. Paragraph 47 tells banks how they will be judged: "Supervisors will review that the bank specific frequency requirements, for both normal and stress/crisis situations, generate aggregate and up-to-date risk data in a timely manner." In other words, set the clock, and expect to show that it is met.
What is principle 5 of BCBS 239, and why does Principle 10 matter as much?
Principle 5 is about producing the data; Principle 10 is about how often reports are produced and whether the bank can prove its timing. Principle 10 makes the board and senior management set the frequency of risk reports, and expects that frequency to rise in stress. Its guidance holds the sentence that turns timeliness from a statement into a test: banks should "set requirements for how quickly the reports need to be produced in both normal and stress/crisis situations", and "routinely test" their ability to meet them. Paragraph 71 sets the expectation for stress: "all relevant and critical credit, market and liquidity position/exposure reports are available within a very short period of time", and "Some position/exposure information may be needed immediately (intraday)".
Timeliness cannot be bought at the expense of the other principles. Principle 5 is satisfied only "while also meeting" accuracy, completeness and adaptability, so a fast figure that is wrong fails twice. That is why a drill must check the answer as well as the clock. The Basel Committee's 2023 progress report found the average rating for Principle 5 had deteriorated between 2019 and 2022; the BCBS 239 progress report guide covers what else it found.
How fast must risk reports be produced in stress?
There is no universal deadline, but supervisors have published markers. For normal conditions the ECB's Guide is explicit: "it is generally understood that institutions will not be able to react to changes in a timely manner if a monthly or quarterly risk report needs more than 20 working days to produce" (ECB Guide on RDARR, May 2024, section 3.6). It found some monthly risk reports taking twice that. Its 2018 thematic review saw cases where credit risk and interest rate risk reports arrived "around 60 days in normal situations and around 30 days even in stress test situations" after the reference period (ECB Thematic Review, 2018).
For stress, the same review recorded what the better banks did: they "endeavoured to be able to take most decisions within 24 hours in times of stress, with impact assessments being carried out within the same time frame wherever possible", and some had "identified a specific set of metrics to be generated during periods of stress", normally monthly, "generated on a weekly or daily basis during such periods". Those are observed good practices, not rules; the sample bank's 24-hour stress target is its own choice, informed by them.
The BCBS 239 timeliness markers supervisors have published
20days
working days: the ECB’s ceiling for a monthly or quarterly risk report, normal conditions
60days
around this long after the reference date for some risk reports, normal conditions (2018)
30days
around this long even in stress test situations, in the same cases
24h
better banks aimed to take most stress decisions within this
What did the ECB fire drill test, and what is a liquidity fire drill?
A fire drill is a timed request for risk data under simulated pressure. The ECB ran one as part of its thematic review of 25 significant institutions, launched in 2016. Its aim was "to assess credit institutions’ ability to aggregate and report a number of selected data points in an accurate, comprehensive and timely manner under time pressure", and each bank's internal audit or validation unit was asked for "an independent validation report" on the procedures followed. The ECB ran its drill on liquidity risk, where figures can change within a day; a liquidity fire drill asks for liquidity positions, cash flows or funding by entity at short notice.
The findings read like a checklist of what fails. "Not all institutions were able to submit the data requested at group level within a short period of time." In liquidity, "not all subsidiaries were capable of producing figures by the requested deadline". And some banks "were also unable to demonstrate their ability to aggregate data more frequently during periods of stress, in the absence of specific procedures for that purpose". The ECB's remedy was concrete: "dedicated protocols – one for each risk metric or risk report – in order to establish production processes in case of stress/crisis".
How do you perform a BCBS 239 fire drill?
Write the request as a supervisor would, start the clock when it is sent, and record every hop until the answer reaches the person who asked; then check the answer. The Basel Committee's 2023 report says banks found regular drills useful "concerning how to strike an appropriate balance between timeliness, accuracy, and comprehensiveness of required risk data where ad hoc data may be required within a shorter timeframe and with higher frequency" (BCBS, November 2023). Its January 2026 newsletter adds that "Conducting ad hoc reports during good times to test risk data aggregation capabilities can help banks prepare for distributing such reports during times of stress" (BCBS Newsletter 36).
Eight steps for a BCBS 239 fire drill that produces a measurement, not an attestation
- Ask for a new cut, at short notice
An exposure by a dimension the standard report does not carry, by a set deadline.
- Start the clock at the request
Not when the team begins work: waiting is part of the time.
- Name the critical risks first
Large exposures, counterparty, trading, liquidity: the risks paragraph 46 lists.
- Record every hop from logs
Scheduler, reporting platform and file-share timestamps, not recollection.
- Separate waiting from working
Hours waiting for a person are a different fix from hours of manual work.
- Check the answer
Reconcile the drilled figure to its sources; a fast wrong number fails Principle 3 too.
- Compare to your own target
Per report and in total, for normal and stress conditions.
- Have it validated independently
As the ECB asked of internal audit or the validation unit.
How do you measure risk report production time? Replay the drill from the logs
Measure it from what the systems recorded, hop by hop, and split each hop into waiting and working. The sample bank's drill record gave the request and the delivery; the scheduler and report-platform logs gave each job's start and end; the file-share log gave the times a workbook was opened and saved. Matched to the seven hops of the figure's lineage, they turned one number, 81.6 hours, into seven, and showed that 60 of them sat at one hop: a spreadsheet on a file share between the staging table and the risk mart.
The 60 hours were not all work. The drill replay splits them into 31 hours waiting for the analyst who maintains the workbook, 22 hours refreshing and re-mapping it by hand for the new cut by property type and state, and 7 hours reviewing and uploading. Each part has a different remedy: a backup owner for the first, a governed transformation for the second, an automated check for the third. Every other hop together took 21.6 hours, which alone fits inside the target.
The 60 hours at the workbook, by what was happening
Hop 4, the workbook: 60 hours
- Waiting for the analyst · 52%
- Refreshing and mapping by hand · 37%
- Review and upload · 11%
What the replayed drill changed in the sample bank's ratings
The replay is evidence, not a verdict. Across the drill, 33 of the bank's 41 reports met the 24-hour target and eight missed it. The Assessor agent's draft kept Principle 5 at 3, largely compliant, with 33 of 41 reports on time, and moved Principle 6, adaptability, from 3 to 2: six of the eight reports that missed build their stress cut in a spreadsheet. The same workbook carries findings pinned to Principles 3, 5 and 6, and the remediation item that retires it is filed against Principles 3 and 6. The Head of Risk Reporting decides each rating; the agent only drafts.
The BCBS 239 timeliness principle, measured: the June stress drill replayed
What a drill record should hold
A drill is only reusable as evidence if its record lets someone re-perform the measurement. The table lists what the sample bank's drill record holds, and why each field matters to a reviewer.
Fields of a BCBS 239 stress drill record, and what each lets a reviewer check
| Field | Example from the sample drill | What it lets a reviewer check |
|---|---|---|
| Request, requester and time | Board Risk Committee, June 18, 2026, 08:00 | When the clock started, and that it was a real decision-maker’s request |
| The cut asked for | CRE exposure by property type and state | Whether the request tested adaptability, not a standard report |
| Target | 24 hours, request to board | That the bank’s own frequency requirement was applied |
| Hop timings from logs | Seven hops; 60 hours at the workbook | Where the time went, from evidence rather than recollection |
| Waiting and working split | 31 waiting, 22 manual, 7 review and upload | Which remedy fits: people, process or automation |
| Accuracy check of the output | The figure reconciled hop by hop | That speed was not bought with a wrong answer |
| Reports in and out of target | 33 of 41 met the target | Breadth: one slow figure or a pattern |
| Findings and owners | Workbook findings under Principles 3, 5 and 6 | That the drill led to remediation with dates |
Timeliness in BCBS 239 Compliance, and its limits
In BCBS 239 Compliance the Timeliness agent reads the drill record, matches scheduler and report-platform logs to each hop of each traced figure, and measures elapsed time against the bank's target, which can be set at 12, 24 or 48 hours with a second approver for any change. It measures only. It never re-runs a production job, so a replay cannot disturb a live reporting cycle, and it can time only what the scheduler, platform and file-share logs record. The workbook that held 60 hours is the subject of end user computing controls, and the principles the drill feeds are set out in the BCBS 239 principles in plain words. For a first measurement on your own reports, a BCBS239 assessment on one board report includes replaying the last drill.
Questions people ask
What is the BCBS 239 timeliness principle?
Principle 5: a bank should be able to generate aggregate, up-to-date risk data in a timely manner while still meeting accuracy, completeness and adaptability. The bank sets its own timing by risk type and for normal and stress conditions, and supervisors review whether it is met.
How do you perform a BCBS 239 fire drill?
Issue a realistic ad hoc request with a deadline, start the clock at the request, record each hop's time from system logs, check the accuracy of the answer, compare against your target and have the result validated independently. Repeat it in calm periods so the process exists before a crisis.
How fast must risk reports be produced in stress?
No rule sets a universal number. The ECB considers more than 20 working days too slow for a monthly or quarterly report in normal conditions, BCBS 239 expects critical reports within a very short period in stress and some information intraday, and the ECB observed better banks aiming to take most stress decisions within 24 hours.
What is a liquidity fire drill?
A timed request for liquidity data, such as positions, cash flows and funding by entity, under simulated stress. The ECB ran one in its thematic review and found that not all subsidiaries could produce figures by the deadline.
Is Principle 5 the same as Principle 10?
No. Principle 5 covers producing aggregate risk data in time; Principle 10 covers how often reports are produced and distributed, set by the board and senior management, increased in stress, and routinely tested against established timeframes.
How often should a bank run a BCBS 239 fire drill?
BCBS 239 says routinely, without a number. Many banks tie drills to their stress-testing or board calendar; what matters is that each drill is recorded well enough to compare with the last, and that findings get owners and dates.