Turning BCBS 239 compliance into a competitive advantage for banks

BCBS 239, a global banking framework introduced in the aftermath of the financial crisis, is re-emerging as an important guideline for how banks across the continent manage, control and trust their risk data. That is according to a new whitepaper from FIRMC, which highlights how compliance can naturally lead to competitive advantage.

A lot has happened in the banking industry since BCBS 239 was introduced in January 2013. Developed by the Basel Committee on Banking Supervision, BCBS 239 sets out 14 principles covering governance, risk data aggregation, risk reporting and supervisory review.

The framework was introduced in response to weaknesses exposed by the 2008 global financial crisis, when many large banks struggled to aggregate risk data across business units and systems. In some cases, senior management and regulators could not obtain an accurate, consolidated view of a bank’s exposures quickly enough. The principles aim to ensure that banks can collect, aggregate and report risk data accurately, completely and consistently.

For banks, BCBS 239 has represented a significant compliance exercise, requiring them to establish stronger data governance, improve data quality, and strengthen the systems and controls underpinning risk reporting.

More than a decade after its introduction, the FIRMC whitepaper asserts that many banks still face “fundamental challenges” in their data governance, architecture and reporting. At the same time, developments such as increased supervisory scrutiny and the rapid growth in the volume and importance of data have made effective risk data management both more important and more complex.

New regulatory developments are also reshaping the landscape. For example, the ECB’s 2024 Guide on Effective Risk Data Aggregation and Risk Reporting (RDARR) is shifting the focus from policy-based compliance towards outcome-driven and evidence-based supervision.

“These developments taken together mean that BCBS 239 remains one of the most influential and demanding regulatory frameworks in the financial sector,” said Anouar Zian, Senior Consultant at FIRMC and lead author of the report.

BCBS 239: Turning policies into operational impact

In the whitepaper, the authors explore the challenges surrounding BCBS 239 in greater depth. The report also provides practical guidance: the 14 principles for risk data aggregation and reporting stipulated by BCBS 239 are examined and translated into practical operational requirements.

Building on these insights, Zian said banks can establish a stronger foundation for risk management, whether through targeted interventions or broader RDARR transformation initiatives. The key, according to him, is not to focus solely on operational or tactical fixes, but instead to pursue long-term transformation that turns data management into a lever for competitive advantage.

“Institutions that succeed will not only meet regulatory expectations; they will gain a competitive advantage through resilient, trusted and automated data capabilities that support superior decision-making, forecasting and risk management,” he said.

In one case in the Netherlands, FIRMC was engaged to remediate supervisory findings related to data lineage, transparency and governance. Although the bank had adopted BCBS 239 policies, it lacked complete and consistent business lineage for its KRIs and CDEs. Supervisory reviews highlighted insufficient visibility into data transformations, unclear ownership and fragmented documentation.

The company led a process to implement a tactical business data lineage framework. In addition, the consultants developed structured business data requirements that harmonised definitions and rules across functions. This contributed to a centralised repository containing metadata, lineage steps and associated controls.

“The remediation significantly improved supervisory confidence,” said Zian, “and addressed approximately 90% of their findings. More importantly, it laid the groundwork for benefits that are reaped every day now, as the bank has reporting that is timely, consistent and explainable, enabling its leaders to make sound and forward-looking decisions.”

“BCBS 239 should not be viewed as a one off compliance exercise,” concluded Zian, “but as the development of a sustainable risk data capability that supports reliable information and better decision making every day.”