EBA opens consultation on operational risk standards

The European Banking Authority has launched a consultation on draft regulatory technical standards under Article 323 of the Capital Requirements Regulation, with comments due by 31 December 2026. The draft RTS would specify the operational risk management framework institutions must have in place under CRR3. They are not adopted requirements: after considering responses, the EBA will finalise the draft and submit it to the European Commission under Article 10 of Regulation (EU) No 1093/2010.

A four-month consultation

The draft covers governance arrangements, the operational risk management process and the operational risk assessment system. It sets out roles for the management body, senior management and the independent operational risk management function, alongside requirements for operational risk data, taxonomy, the business indicator component, reporting, validation and audit.

ICT risk requirements remain addressed through the Digital Operational Resilience Act. The EBA’s source does not identify a date for submitting the final draft to the Commission or for subsequent Commission adoption.

The EBA will hold a virtual public hearing on 29 September 2026 from 10:00 to 12:00 CEST. Registration is due by 25 September 2026 at 16:00 CEST, with dial-in details to be sent to registered participants.

Comments must be submitted through the ‘send your comments’ function on the EBA consultation page. The EBA said responses will be published after the consultation unless confidentiality is requested.

A threshold for proportionate treatment

Institutions with a business indicator below EUR750 million would receive a lower frequency of reviews and reporting, together with less granular requirements for operational risk data, loss thresholds and the operational risk taxonomy.

The draft was developed under Article 323(2) of Regulation (EU) No 575/2013, as amended by Regulation (EU) 2024/1623. That provision requires the EBA to develop standards specifying the obligations in Article 323(1), points (a) to (h), taking account of an institution’s size and complexity.

The proposed RTS support the revised prudential framework for operational risk under the EU Banking Package, which replaces previous approaches, including advanced measurement approaches, with a single standardised approach based on the business indicator.

Institutions considering a response can first identify whether the EUR750 million threshold applies to them and assign responsibility for submitting comments. Responses can address the draft’s provisions on governance, data and taxonomy, reporting, validation and audit.

The next identified legal step is EBA finalisation after the consultation closes and submission of the draft RTS to the Commission under Article 10. The source identifies no date for either event.