COREP validation rules pass; the return can still be wrong

COREP validation rules are the published checks a return must pass before a supervisor accepts it: a total must equal the sum of its parts, an amount must not be negative, CET1 capital must equal the total risk exposure amount multiplied by the CET1 ratio. The EBA publishes them with every framework release as part of the data point model, and changes them between releases. They test whether the return is consistent. They do not test whether a cell reflects the bank's exposures, and a mortgage booked to the wrong exposure class passes every one of them. Botminds' COREP & FINREP Reporting runs the published rules on every draft and explains each failure in plain words, and because every cell drills to its exposures, mapping and source, a reviewer can check what a number means as well as whether it adds up.

This guide sets out what the rules are, how many there are and how often they move, what a failure and a deactivated rule mean, and the checks a reporting team needs on top of them.

What are COREP validation rules?

They are formulas over the cells of the COREP templates, written by the EBA and shipped with each reporting framework release. The EBA's data point model is "a structured representation of the data, identifying all the business concepts and its relations, as well as validation rules", and its XBRL taxonomies present those rules "in the technical format of an XBRL taxonomy" (EBA reporting frameworks). Each rule has a code, the tables it reads, an expression and the reference dates it applies to. The legal basis for the templates themselves is Implementing Regulation (EU) 2024/3117, which sets their formats, frequencies and dates (EUR-Lex).

A typical rule, v0218_m, reads: {tC_01.00, r0020} = {tC_02.00.a, r0010, c0010} * {tC_03.00, r0010}. In words, Common Equity Tier 1 capital in C 01.00 must equal the total risk exposure amount in C 02.00 multiplied by the CET1 capital ratio in C 03.00. It is a good rule. It catches a ratio typed by hand or a template filled from a stale extract. It cannot tell whether the total risk exposure amount is right.

What do EBA validation rules check?

Mostly arithmetic and presence. The EBA's validation rules file sorts each rule by source: hierarchy rules (a total equals its components), sign rules (a value is not negative), existence rules (a required cell is filled) and user-defined rules, which carry everything else, from identities like v0218_m to conditions on when a cell must be filled. Counting the distinct rule codes active for a 30 September 2026 reference date in the file the EBA published on 12 October 2026 gives the picture below.

The last bar matters most. Not one of the 14,164 rows in the file reads both a COREP table and a FINREP table. The two returns describe the same balance sheet, and the EBA's rules never compare them; that check belongs to the bank. Where COREP and FINREP meet, and why they legitimately differ, is set out in COREP vs FINREP: two returns, one balance sheet.

How often do EBA validation rules change?

Every quarter, and at every release. The EBA says the rules for a framework release "can be subject to change as part of an 'updated validation rules package' (published around two months before the first reference date of a framework release) or as part of a 'small validation rules package' (published every quarter)" (EBA). The small packages are published "roughly 20 days before the reference date of the end of the quarter (i.e. around 10 March, 10 June, 10 September and 10 December)" and "can include deactivations of validation rules, reactivations of validation rules and changes to their severity status" (EBA validation rules packages).

The six small packages listed since June 2025 came on 12 June, 15 September and 12 December 2025, and on 16 April, 10 June and 14 September 2026; the full rules file was last updated on 12 October 2026 with release 4.4. For a team, that means the rule set used on the first draft of a quarter may not be the one in force at remittance. The rules file is versioned by date for this reason, and the run on each draft should state which version it used.

What is a deactivated validation rule?

It is a rule the EBA has switched off, usually because it was found to be wrong or to fire on legitimate data, without removing it from the file. In the October 2026 file, 245 COREP rule codes and 99 FINREP rule codes that cover the 30 September 2026 reference date are marked inactive (our count). A deactivation is not an all-clear: whatever the rule was meant to protect is now unprotected until it is fixed and reactivated, and a bank that relied on it needs its own check in the meantime.

Do validation rules guarantee an accurate return?

No. A rule can only compare cells with other cells; accuracy means comparing cells with the bank's books, exposures and the rules of the CRR. The PRA's enforcement cases are mostly about the second kind of error. Metro Bank's COREP returns from 2016 to January 2019 carried "the incorrect risk weighting to certain commercial loans", and its £5,376,000 fine cited weak controls over how it interpreted the rules (PRA, December 2021). Citi's £43.9 million fine in 2019 cited six substantive errors with a material or potentially material effect on its returns, and a weak approach to technical interpretations (PRA, November 2019). Neither was a validation failure; both were valid returns that were wrong.

The PRA's 2021 letter generalises the point. Its skilled persons found weak controls over models, spreadsheets and reconciliations, and interpretations built into firms' systems long after anyone had last checked them (PRA, 2021). A hard-coded interpretation produces a consistent return, which is exactly the kind the rules pass.

What happens if a COREP validation rule fails?

Before submission, the bank investigates and fixes the cause: a mapping, a source feed, a manual adjustment. The wrong fix is to adjust the cell until the rule passes, which turns a visible inconsistency into an invisible error. After submission, the obligation is to correct. The UK rule says that where audited figures differ from the unaudited ones submitted, "the revised, audited figures shall be submitted without undue delay", and "other corrections to the submitted reports shall also be submitted to the competent authorities without undue delay" (PRA Rulebook, Reporting (CRR) Article 3(4)–(5)); the EU text is the same in substance (Implementing Regulation (EU) 2024/3117, Article 3).

The PRA's 2021 letter adds the threshold: "When errors are identified for any reason after submission of the returns, firms should review the impact and resubmit where there are material errors." And the bank must say so promptly. Notifications Rule 6.1 requires reasonable steps to make what the PRA receives accurate and complete (PRA Rulebook), and Standard Chartered was fined £46.55 million in 2021 partly because it investigated a liquidity reporting error for four months before telling the PRA (PRA, December 2021).

How the Validation agent explains a failed rule

In COREP & FINREP Reporting, the Validation agent runs every published rule on every draft, for the framework in force and for the Basel 3.1 parallel run, and writes each failure as a sentence with its formula, the amount it fails by and the likely cause. Take the solution's sample bank, a fictional UK lender, through its third quarter of 2026. Its sample rule set has 1,140 rules: 642 for the taxonomy in force and 498 for the Basel 3.1 parallel run. Draft 1 on 16 October failed 41 of them, Draft 2 on 19 October failed 9, and Draft 3 on 22 October failed 3.

Three failing rules, one cause, in plain words

The three failures were one problem. A buy-to-let product family of 5,614 exposures, £1,302.7 million, had no Basel 3.1 mapping, so the breakdown rows of the parallel credit risk template fell short of row 0010 by that amount, and the own funds requirements template fell short of the credit risk template's total by £359.5 million. The agent named the cause and the fix, a pending mapping change. A manager approved the mapping with a reason code; the agents remapped the exposures, repopulated two templates, reran all 1,140 rules on Draft 4 and every one passed.

That pass is the start of review, not the end. The same drill that found the unmapped family lets a reviewer open any cell, see the exposures behind it, the mapping rule that placed each one and the source data, and check that the buy-to-let loans now sit where the policy says they should.

After the approval: remapped, repopulated, every rule rerun

Checks that catch what the published rules cannot

The rules are necessary and cheap; accuracy needs tests that reach outside the return. The list below is what a reporting team should run alongside them each quarter. Several are named in the PRA's letters; the rest follow from the enforcement cases.

How a buyer should test a solution against these, rather than against the rule count, is covered in regulatory reporting solutions for COREP and FINREP: 10 questions.

Questions people ask

Where can I find the EBA validation rules?

On the EBA's validation rules packages page, as an Excel file for framework releases from 4.0 onwards and another for releases up to 3.5, with the date of the last update in the file name. The file for 4.0 onwards was last updated on 12 October 2026, with release 4.4.

What is a small validation rules package?

A quarterly EBA publication that deactivates, reactivates or changes the severity of existing rules without a new framework release. It is published around 20 days before quarter end, and since release 4.0 it comes with a micro taxonomy package and scripts to update the data point model.

Do UK banks use the EBA validation rules?

UK banks file on the Bank of England Banking XBRL taxonomy, which carries its own taxonomy validations; version 4.1.1 was published on 27 August 2026 for rules taking effect on 1 January 2027. The Bank implements EBA validation changes only for EBA taxonomy 3.0 and earlier, for as long as those packages are used.

Why would a COREP return pass validation but still be wrong?

Because the rules test consistency between cells, not the cells against the bank's exposures. A loan in the wrong exposure class, or a risk weight applied in error, produces totals, ratios and signs that still agree, as in the Metro Bank case, where the correction moved risk-weighted assets by about £900 million.

What is the difference between COREP and FINREP validation rules?

COREP rules check own funds, risk exposure amounts, large exposures, leverage and liquidity templates; FINREP rules check the financial statement templates. In the EBA's October 2026 file, about 2,070 COREP and 2,390 FINREP rule codes are active for 30 September 2026, and none links the two frameworks.