A BCBS239 assessment is a bank's own evaluation of how far its risk data aggregation and risk reporting meet the eleven bank-facing BCBS 239 principles, rated principle by principle and usually approved by the board before supervisors see it. Most banks still run it as a questionnaire: ratings argued in meetings, evidence attached as folders. That is why supervisors so often rate banks lower than banks rate themselves. A sounder method starts at the other end, with one page of the board risk report, and follows each figure on it back to its source, reconciling and timing it hop by hop; the ratings are then drafted from what the trace found. Botminds' BCBS 239 Compliance does that tracing with agents and leaves every confirmation and rating to named people, and a two-week pilot on one board report is the honest way to judge it, or any alternative.
The worked example is a fictional sample bank, Corvane National Bank, a $92 billion regional lender, and page 7 of its September 2026 Board Risk Report. The two-week plan is our recommendation, not a regulatory timetable.
One board figure, assessed from the report back to the source
Agent
Lineage agentStarts from $14.86B on page 7 and traces seven hops to the loan origination system, using the catalog, scheduler logs, report specifications and file-share access logs.
Never: confirms a hop
Agent
Accuracy agentReconciles each hop to the one before and splits the $212.0M difference at the workbook hop into what it can cite and what it cannot.
Never: adjusts a figure
Agent
Timeliness agentReplays the June stress drill from the logs: 81.6 hours from request to board, 60 of them at the workbook.
Never: re-runs a production job
Agent
Spreadsheet agentRates the workbook High: 1,840 formulas, no version control, no reviewer sign-off, no reconciliation.
Never: edits or locks a workbook
A person decides
Risk Data StewardConfirms the hop, accepts the finding and opens two remediation items for the data owner, each with a reason code.
Agent
AssessorDrafts each principle’s rating from the findings, citing every finding and its hop.
Never: rates finally
A person decides
Head of Risk Reporting, CDO, Internal AuditDecides and submits the ratings, approves them, and validates them independently: three different people.
What is a BCBS 239 self-assessment, and why do supervisors expect one?
A BCBS 239 self-assessment is the bank's rating of itself against Principles 1 to 11, with the evidence behind each rating. The Committee built it into the timetable from the start: supervisory approaches were "likely to include requiring self-assessments by G-SIBs against these expectations in early 2013, with the goal of closing significant gaps before 2016" (BCBS 239, paragraph 88). Supervisors still use them. The 2023 progress report lists self-assessments among their ongoing tools and adds a condition: "Banks’ self-assessments, while needing to be validated, provide a basis for the supervisory assessment and remediation activities" (BCBS, November 2023).
Banks also run them for their own reasons. The Committee's January 2026 newsletter notes that "some banks find it helpful to conduct periodic assessments of in-scope data to observe alignment with the principles" (BCBS Newsletter 36). In the euro area the ECB's annual Management Report on data governance and data quality adds a signature: at least one member of the management body signs the bank's answers. In the United States, a bank covered by the OCC's heightened standards will want the same evidence for section II.J of 12 CFR Part 30, Appendix D, which the OCC proposed in December 2025 to apply only from $700 billion in assets; the proposal was not final as of October 2026.
What is a BCBS 239 gap analysis, and why do so many fall short?
A gap analysis compares the bank's current practice with the principles and the supervisor's expectations and lists what must change; it is the self-assessment's to-do list. The ECB's 2024 targeted reviews found the analyses missing or weak: "many banks do not provide proper recent or regular gap analyses where they compare against the BCBS 239 and relevant supervisory expectations. Even when such analyses have been conducted, their relevance for effective steering often remains unclear" (ECB Supervision Newsletter, February 2025).
Questionnaire assessments age for three reasons. The evidence is indirect: a policy shows that a control is required, not that it runs. The scope is chosen by the people being assessed, so the spreadsheet in the middle of a lineage is often outside it. And the result is frozen on the day it is signed, while source systems keep changing. The Basel Committee's picture of banks that rated themselves fully compliant years earlier while still running multi-year data quality remediation is what that produces. The BCBS 239 progress report sets the divergence out in detail.
Two ways to run a BCBS239 assessment
A questionnaire assessment: The fourteen principles, as questions to each function.
An assessment from one board figure: A figure on a page the board has read.
A questionnaire assessment: Drawn from interviews; stops where the catalog stops.
An assessment from one board figure: Rebuilt hop by hop from logs and specifications, including file shares.
A questionnaire assessment: A sample tied to the general ledger at the end of the chain.
An assessment from one board figure: A reconciliation at every hop, with the unexplained part shown.
A questionnaire assessment: An attestation that ad hoc requests can be met.
An assessment from one board figure: The last drill replayed and measured hop by hop.
A questionnaire assessment: Argued in a meeting.
An assessment from one board figure: Drafted from findings, each finding cited to its hop, decided by a named person.
A questionnaire assessment: Until the next annual cycle.
An assessment from one board figure: Re-traced when a system or report the figure passes through changes.
How do you do a BCBS 239 assessment on one board report?
Choose one page and treat every figure on it as a critical data element. Page 7 of the sample bank's Board Risk Report holds commercial real estate exposure, concentration and top-obligor figures: material, used in limits, and seen by the board each month. Tracing those figures exercises every aggregation principle, because each passes through source systems, staging, a mart, sometimes a spreadsheet, a reporting platform and a portal.
For each figure, collect four things: the path (every hop, with its system or file, owner and control), the amounts (the figure as held at each hop, reconciled to the hop before), the clock (each hop's elapsed time in the last stress drill) and the exceptions (manual steps, overrides and spreadsheets). Then draft each principle's rating from what those four show. On the sample bank this produced one finding big enough to move a rating: $212.0 million added at a workbook hop, of which $187.4 million is cited to 48 participations sold to other banks but counted as held, and $24.6 million is six manual overrides nobody has explained.
The board figure traced to source, hop by hop
How long does a BCBS 239 assessment take? A two-week pilot plan
A full annual assessment by hand takes months: Botminds' estimate for the sample bank is about 46 weeks of effort across the data office, from inventory to approval. A pilot on one board report should take two weeks, and it should be judged on whether it produces evidence a supervisor could re-perform. The plan below assumes read access to the systems listed later, a named steward and an hour a day from the report owner.
A two-week BCBS239 assessment on one board page, working day by working day
- Scope the page, name owners, connect read-onlyDays 1–2
- Trace every figure to sourceDays 3–4
- Reconcile every hop, explain differencesDays 5–6
- Replay the last drill; rate the spreadsheetsDay 7
- Steward confirms hops and findingsDay 8
- Draft ratings; decide, approve, validateDays 9–10
What evidence does a BCBS 239 assessment need?
It needs evidence a reviewer can re-perform, tied to a principle. One board figure, traced properly, yields evidence for most of the eleven bank principles. The table shows what the sample bank's commercial real estate figure provided, and what it could not.
What one traced board figure gives each principle
| Principle | Evidence from one figure | On the sample bank |
|---|---|---|
| 1 Governance | Named owner and steward per hop; who confirmed and who countersigned | Seven hops, each with an owner; one waiting for a steward |
| 2 Architecture | Controls at each system hop; hops the catalog does not list | Risk mart runs a schema check only; the workbook appears in the catalog only as a manual upload |
| 3 Accuracy and integrity | Reconciliation at every hop; explained and unexplained parts | $212.0M at hop 4: $187.4M cited, $24.6M unexplained |
| 4 Completeness | Rows and entities lost or added between hops | A later re-trace found 112 office loans unmapped |
| 5 Timeliness | Elapsed time per hop in the last drill, against target | 81.6 hours against 24; 60 at the workbook |
| 6 Adaptability | Whether the stress cut depends on a manual step | By property type and state, built by one analyst in one workbook |
| 7 to 11 Reporting | Report-to-mart tie-out, sign-off, distribution log | Automated tie-out at hop 2; four-eyes sign-off at hop 1 |
| 12 to 14 | Not rated by the bank; evidence prepared for the supervisor | Prepared, unrated |
Who performs a BCBS 239 assessment, and who should sign it off?
The first line prepares it, a second-line function validates it, and the board approves it; no one should approve what they prepared. The Basel text asks for validation that is "independent" and notes that "Common practices suggest that the independent validation of risk data aggregation and risk reporting practices should be conducted using staff with specific IT, data and reporting expertise", kept separate from audit work (BCBS 239, paragraph 29 and footnote 14). The ECB expects "A validation function within the second line of defence that is independent from the units involved in data governance", and an internal audit function that "periodically provides independent reviews" (ECB Guide, section 3.3).
In the sample bank the chain has four links. The Assessor agent drafts. Graham Ashdown, Head of Risk Reporting, decides each of the eleven ratings and submits. Celeste Marchetti, Chief Data Officer, approves for the Board Risk Committee. Owen Pritchard of Internal Audit validates independently, with the agent's draft and every human change side by side. The screen enforces the separation: the Head of Risk Reporting cannot approve what he submitted.
Drafted, submitted, approved, validated: four different signatures
What to ask of any tool or partner for a BCBS 239 assessment
Ask to see each of these on your own board page during the pilot, not on a vendor's sample. A product that cannot show them on your data in two weeks will not show them to a supervisor either.
Nine questions to put to BCBS 239 assessment software before you buy
- Does it start from the figure the board saw?
Lineage that starts at the catalog misses what was added after it.
- Does it find hops the catalog does not list?
Manual uploads and file shares are where the sample bank’s difference sat.
- Does it reconcile every hop, not just the ends?
An end-of-chain tie-out cannot see a mid-chain difference.
- Does it show the unexplained remainder?
A tool that forces every difference to an explanation is guessing.
- Is timeliness measured from logs?
Principle 5 asks for timely data; an attestation is not a timing.
- Does every rating cite its findings, and every finding its hop?
That is what lets a reviewer re-perform it.
- Who decides?
An agent should never confirm a hop or set a final rating.
- What happens when a system changes or stops answering?
Re-trace only what changed; pause, and say so, when a source is silent.
- What does it read, and can it write?
Read-only access, masking of loan-level rows, and an audit trail of every action.
Where BCBS 239 Compliance fits, and where it does not
BCBS 239 Compliance fits a bank that already reports to its board from systems that leave logs: a data catalog, an ETL scheduler, a risk reporting platform and file shares with access logs. From those, its agents rebuild lineage, reconcile, time and rate, and the Assessor drafts the self-assessment with each rating citing its findings, mapped to the OCC heightened-standards paragraph each one also answers. Thresholds, targets and approvers are the bank's own settings, each change versioned and approved by a second person.
It fits less well where a hop leaves no trace. If a figure is re-keyed from an email or produced by a provider that shares no logs, the Lineage agent marks the hop "needs evidence" below its 0.90 confidence threshold, and a steward must supply it. It does not certify compliance, replace the independent validation the principles require, or fix what it finds: retiring a workbook remains the data owner's remediation item. And a pilot on one page is a sample; the full assessment extends the same method to every critical data element, which in the sample bank means 312 elements across 41 reports.
What to bring to a two-week pilot
- One board page
The latest board, regulatory or supervisory risk report page, with its report specification.
- Catalog and scheduler logs
The data catalog and the ETL scheduler’s job logs for the reporting period.
- Source extracts
Loan origination, core banking and general ledger extracts for the same date.
- File-share logs
Access logs for the shares the reporting workbooks live on, read-only.
- The last stress drill
The request, and the scheduler and report-platform logs for the days it ran.
- Your rules
Risk data policy, materiality, the stress timing target and who approves what.
The pilot's output should be an examiner-ready pack for one page: lineage with confirmations, reconciliations, the drill replay, spreadsheet ratings, draft ratings with their citations, and remediation items with owners. If the method holds, naming an owner and steward for every hop and comparing data lineage tools on the same element are the natural next steps. The BCBS 239 principles in plain words covers what each rating means.
Questions people ask
How do you do a BCBS 239 assessment?
Rate each of the eleven bank principles from evidence: lineage to source for each critical figure, a reconciliation at every hop, timings from the last stress drill and an inventory of manual steps and spreadsheets. Starting from one board page and tracing its figures is the fastest way to build that evidence and test the method.
What is a BCBS 239 self-assessment?
The bank's own rating of its compliance with Principles 1 to 11, often on the same four-point scale the Basel Committee's assessments use, from fully compliant to not adopted. The Committee expected G-SIBs to self-assess from early 2013, and supervisors use self-assessments as a basis for their own review once validated.
Who should sign off a BCBS 239 self-assessment?
The person who prepares the ratings should not approve them. A common chain is the head of risk reporting deciding and submitting, the chief data officer approving for the board risk committee, and an independent validation by a second-line function or internal audit.
How long does a BCBS 239 assessment take?
A full annual cycle done by hand runs for months; Botminds' estimate for its sample bank is about 46 weeks of effort across the data office. A pilot on one board page can be done in two weeks if read access to logs and a named steward are in place.
What evidence does a BCBS 239 assessment need?
Evidence a reviewer can re-perform: lineage with owners and controls at each hop, reconciliations with differences explained or marked unexplained, measured timings in stress, the spreadsheets in each lineage with their controls, and findings cited behind each rating.
Is a BCBS 239 assessment the same as an audit?
No. The self-assessment is management's view; internal audit's job is to review it independently, and the Basel text keeps validation separate from audit work. Supervisors then form their own view, often by fire drills, deep dives or on-site inspections.