The difference between a data owner and a data steward is accountability against care. A data owner answers for a set of data: its definition, its quality and the controls around it, and usually sits in the business that creates or depends on it. A data steward does the day-to-day work of keeping that data right: maintaining definitions, checking quality, tracing and confirming lineage, and raising and chasing issues. The distinction matters under BCBS 239, the Basel principles for risk data aggregation and reporting, because a single board figure crosses several systems and spreadsheets with different owners, and a gap at any one of them is a finding. The regulators' texts name owners, not stewards, so each bank must write the split down itself. Botminds' BCBS 239 Compliance makes that split concrete: every hop of every critical figure has a named owner, a steward confirms each hop with a reason code, and the people who decide ratings are never the people who prepared them.
The roles below come from a fictional sample bank, Corvane National Bank, as it runs through the solution; the regulatory expectations are quoted from the ECB, the Basel Committee and NIST.
Who answers for each hop of one board figure: owner, control and the steward’s confirmation
System: Board Risk Report, board portal
Owner: Head of Risk Reporting
Control: Four-eyes sign-off of the report
Steward: Confirmed
System: Risk reporting platform template
Owner: Risk Reporting
Control: Automated tie-out of report to risk mart
Steward: Confirmed
System: Risk mart and its load job
Owner: Enterprise Data Office
Control: Schema check only
Steward: Confirmed, gap noted
System: CRE concentration workbook
Owner: Credit Risk Analytics (data owner)
Control: None between export and upload
Steward: Waiting for the steward
System: Staging table and its load job
Owner: Enterprise Data Office
Control: Row count and amount checksum
Steward: Confirmed
System: Core banking commercial loan ledger
Owner: Loan Servicing
Control: Daily balancing to the general ledger
Steward: Confirmed
What is the difference between a data owner and a data steward?
The owner decides and answers; the steward maintains and checks. In most banks the owner is a business head or senior manager whose function creates or relies on the data, and who can approve a change to its definition, accept a data quality risk or fund a fix. The steward is a specialist, often in the data office or the risk function, who keeps the definitions, monitors quality indicators, traces lineage and brings problems to the owner with evidence. One owner may rely on several stewards; one steward may serve several owners.
Do not expect a standard definition to settle it. The NIST glossary carries several, from different sources, and they disagree. One describes data stewards as people who "enforce policies", while "functional data managers implement the policies and manage day-to-day quality"; another, from the U.S. intelligence community's data lexicon, makes data stewards "legally accountable across the data lifecycle" for governance, definitions and quality (NIST CSRC glossary, data steward). NIST's own "information steward" is "An agency official with statutory or operational authority for specified information", which is what most banks would call the owner (NIST, information steward). The words travel; the duties must be written down.
Data owner vs data steward, as the roles usually divide in a bank
Data owner: The data set and its controls: definition, quality requirements, acceptance of residual risk.
Data steward: Keeping the data right day to day: definitions current, quality checked, lineage confirmed.
Data owner: Business or function head who creates or relies on the data.
Data steward: Data office or risk function specialist, close to the systems.
Data owner: Owns the remediation, its budget and its date.
Data steward: Finds and sizes the issue, decides whether it is a finding, opens the item for the owner.
Data owner: Attests the controls of what they own; requests closure of their own items.
Data steward: Confirms or corrects each hop of a lineage, with a reason.
Data owner: Approve the closure of their own remediation.
Data steward: Decide the principle rating the finding feeds.
What does the ECB expect from data owners?
The ECB expects "Data owners responsible for key risk indicators and critical data elements throughout the complete aggregation process (front to end)", and says delegation of that responsibility "is generally considered to be adequate" (ECB Guide on RDARR, May 2024, section 3.3). It lists what the responsibility includes: contributing to "the definition of data quality controls and the classification of key risk indicators and underlying critical data elements"; "ensuring the accuracy, integrity, completeness and timeliness of data"; "ensuring the monitoring and reporting of data quality"; "ensuring the remediation of insufficient data quality"; and "managing metadata relating to the data lineage and data dictionary".
Two phrases carry the weight. "Front to end" means an owner cannot stop at the edge of their system: the owner of commercial real estate exposure answers for it from capture to the board page. And "delegation" is where the steward lives: a bank can hand the daily duties to stewards, provided the owner's accountability does not move with them. The ECB adds three more parties around the owners, and the table sets out all four.
The four parties the ECB names in an effective data governance framework
| Party | Line of defence | What the ECB Guide asks of it |
|---|---|---|
| Data owners | First | Responsible for key risk indicators and critical data elements front to end: controls, quality, remediation, lineage metadata |
| Central data governance function | Usually second | Issues data quality policies, oversees the framework, evaluates and monitors quality, takes part in material change: mergers, outsourcing, new products and tools |
| Validation function | Second | Independent of the units involved in data governance; regular assessments of RDARR capabilities for all material entities and risk types |
| Internal audit | Third | Periodic independent reviews of the validation function, the framework, the capabilities and the data used to quantify risk |
What is a data custodian?
A data custodian runs the systems that hold and move the data: the database administrator, the platform team, the team that operates the scheduler. The custodian answers for availability, access and the technical controls, not for what the data means. BCBS 239 covers the role without the word: "Roles and responsibilities should be established as they relate to the ownership and quality of risk data and information for both the business and IT functions", and the owners, "(business and IT functions)", should ensure "adequate controls throughout the lifecycle of the data and for all aspects of the technology infrastructure" (BCBS 239, paragraph 34).
The ECB's 2018 review found the better banks keeping "a clear division of responsibilities between data owners and IT staff" (ECB Thematic Review, 2018). In a hop-by-hop view, the custodian of hop 3 is whoever runs the risk mart's load job; the owner is whoever answers for the figure the mart holds. When the mart runs a schema check but no reconciliation, both have a question to answer.
Who is accountable for risk data?
Ultimately the board, or management body, with daily responsibility delegated to management. The ECB's first expectation of the management body is "Accepting accountability and exercising full responsibility for risk data quality and governance as a part of the overall risk management framework". The Basel Committee's January 2026 newsletter draws the line between the two: boards have "broad oversight" of risk data aggregation, while "Management, on the other hand, has the responsibility for day-to-day RDA activities and for keeping the board informed of key developments" (BCBS Newsletter 36).
Accountability fails most often in the gaps between owners. The ECB's 2018 review traced weaknesses "mainly" to "a lack of clear roles and responsibilities in the area of data quality, as well as a lack of ownership of data quality for business, control and IT functions", and noted that "clear data governance structures are not embedded in institutions’ organisational charts". A hop whose owner does not know what is expected of it is exactly such a gap: in the sample bank, the workbook at hop 4 had an owner but no reconciliation control, and its owner had heard that the spreadsheet was a risk without ever being told which cells.
Every time a data point is used, any doubts about its meaning are resolved by directing the data user to the respective data owner.
Basel Committee, progress report case study, November 2023
Who owns critical data elements, and who owns each hop?
Both, and they are often different people. The element has an owner and a steward for its whole path: in the sample bank, the steward for commercial real estate exposure is a risk data steward in credit risk. Each hop has an owner of its own, who answers for the control at that hop: the Enterprise Data Office for the mart and staging tables, Loan Servicing for the core banking loan ledger, the Head of Risk Reporting for the board report, and an analyst team in credit risk analytics for the workbook. The Basel Committee's 2023 report describes one bank's version as "a network of end-to-end data owners", in which "if a data quality problem is detected, the data owner will be responsible for remediation".
The practical test is simple: for every hop of every critical data element, can you name the owner, the control and the person who last confirmed it, and when? Critical data elements in banking covers how the elements are chosen, and end user computing controls what the owner of a spreadsheet hop should attest to.
What does a risk data steward do?
A risk data steward keeps a set of critical data elements traceable, reconciled and owned. Before agents, much of the job was archaeology: interviewing system owners, drawing lineage that stopped at the first spreadsheet, and tying a sample to the general ledger at the end of the chain. With the tracing and reconciling done by agents, the steward's job becomes judgement: confirming or correcting each traced hop with the job log and the numbers on both sides in view, deciding whether a difference is a finding, and opening remediation for the owner.
Five roles around one board figure, before and after agents take the tracing
Today
Interviews system owners and draws lineage that stops at the first spreadsheet; ties a sample to the general ledger at the end.
With agents
Confirms each traced hop with the job log and both amounts in view; records a reason code for every finding.
Still theirs: Confirms hops and findings
Today
Hears that a spreadsheet is a risk, without being told which cells.
With agents
Gets a question naming the tab and cells; owns the item that retires the workbook.
Still theirs: Requests closure, never approves it
Today
Argues each principle rating in meetings, evidence attached as folders.
With agents
Decides each drafted rating with its findings cited; countersigns lineage; submits.
Still theirs: Cannot approve what he submitted
Today
Signs ratings that cannot be followed to a finding.
With agents
Sees the finding behind each rating and who owns each fix; overdue items escalate to her.
Still theirs: Approves or returns the self-assessment
Today
Re-performs a sample months after sign-off.
With agents
Validates with the agent’s draft and every human change side by side.
Still theirs: No first-line decision
How BCBS 239 Compliance records owners, stewards and their decisions
In BCBS 239 Compliance the lineage thread shows each hop's owner and control beside its amount and the time it added, and each confirmation carries the steward's name, the date and a reason code: LN-01 for a confirmed hop, FD-01 for an accepted finding. The data owner of the workbook gets a question that names the tab and cells and owns the remediation items, but cannot approve their closure. The Head of Risk Reporting countersigns lineage and decides ratings, but cannot confirm a hop he countersigns or approve what he submitted. A control a role may not use is disabled on screen, with the reason beside it.
Each hop with its owner, its control and the steward’s confirmation
Separation of duties, stated on the screen
That record is what an examiner asks for when testing Principle 1. A BCBS239 assessment on one board report is the quickest way to find out which of your hops already have an owner who knows they own them. The BCBS 239 Compliance page lists every role and what it may decide.
Questions people ask
Can the data owner and the data steward be the same person?
In a small function they can, but it weakens the check: the person who maintains the data also accepts its quality. Where they are the same, put the confirmation of findings or the approval of fixes with someone else, as the ECB expects segregation of duties where validation sits with the function it validates.
What is data ownership in banking?
Accountability for a set of data, its definition, quality and controls, held by a named person in the business that creates or relies on it. Under the ECB's Guide, owners of key risk indicators and critical data elements answer for them front to end, from capture to report, including remediation of poor quality.
Does BCBS 239 require data stewards?
No. Neither BCBS 239 nor the ECB Guide uses the word. They require clear roles and responsibilities for the ownership and quality of risk data, named owners, a central governance function, independent validation and internal audit. Stewards are how many banks staff the owners' daily duties.
Who owns critical data elements?
A data owner named for each element, end to end, usually in the business that relies on the figure. Each system or file the element passes through also has an owner for its controls, and a steward typically confirms the lineage hop by hop.
What is the difference between a data custodian and a data steward?
A custodian operates the technology that holds and moves data, answering for availability, access and technical controls. A steward answers for the data's meaning and quality day to day. A custodian can tell you a job ran; a steward can tell you whether its output agrees with the hop before.
Who is accountable for risk data quality?
The board or management body, which the ECB expects to accept accountability and full responsibility for risk data quality and governance, with one or two of its members responsible for the framework. Management runs it day to day, and data owners answer for their elements.