The pressure is on EU banks to rapidly improve their risk data capabilities

Following the 2007-08 global financial crisis, substantial deficiencies were identified in many banks’ risk data aggregation capabilities and risk reporting practices globally. This impacts banks’ ability to make timely risk decisions, creating risks not only for themselves but for the stability of the global financial systems. The Basel Committee responded by developing in 2013 the BCBS 239 policy, comprising 14 key principles for effective Risk Data Aggregation and Risk Reporting (RDARR). Banks are still seriously lagging with their implementation.

The European Central Bank (ECB) has clearly stated that EU banks must urgently take the RDARR more seriously. In response, the ECB published in May 2024 the final version of its long-awaited final guide on effective risk data aggregation and risk reporting.

As the Single Resolution Board (SRB) is entering a new phase of banks testing and operationalisation of resolution plans, it is also increasing its pressure on banks to rapidly improve their risk data capabilities and information management systems. The principles set out in the ECB Guide on RDARR are therefore of the upmost relevance.

We discuss below some of the main ECB expectations for RDARR, as well as potential challenges and possible quick wins when implementing the principles.

“The persistent lack of progress in improving RDARR capabilities is an example of where banks are falling short of supervisory expectations. The ECB is stepping up pressure on banks to improve by drawing on the full range of its supervisory tools to require compliance.”

Elizabeth McCaul, Member of the supervisory board of the ECB

Compliance with the BCBS 239 principles remains disappointing

The Basel Committee uncovered in its BCBS 239 progress report of November 2023  that compliance across G-SIBs was still disappointing, with only two of the 31 G-SIBs assessed in 2022 being fully compliant with all principles. Several reasons were identified for the delays, including a lack of prioritisation, insufficient board and senior management ownership, and challenges improving data architecture and IT infrastructure. Our Forvis Mazars USA colleagues discussed this progress report in our previous article.

“Implementing the BCBS 239 principles brings value through streamlined reporting and data processes, so banks can better understand and manage their risks, especially during a time of crisis.”

Chris Carpenter, Managing Director, Forvis Mazars in Canada

Similarly, ECB-supervised banks continued to fall short of expectations.  As a result, the ECB reinforced its stance and made RDARR one of its key supervisory priorities for 2024-2026. The ECB Guide on RDARR published in May 2024 now sets clear expectations from banks, which in turn will be the basis for future supervisory assessment of banks on the topic.

“The ECB guide on RDARR is a clear statement that banks must accelerate their adherence to the BCBS 239 principles, including planning the adequate level of resources and investments needed to comply with the supervisory expectations.”

Gregory Marchat, Group Head of Financial Services Advisory, Forvis Mazars in the UK

Understanding the seven main ECB expectations for RDARR

The ECB Guide on RDARR aggregates core BCBS 239 principles into seven ECB supervisory expectations.

These ECB expectations underscore the essential role of robust data management in risk governance within financial institutions. They also highlight the economic and operational benefits that can arise from high-quality data, including improved risk management, strategic decision-making, and compliance with supervisory requirements.

A deeper dive into each of the ECB expectation areas:

1. Responsibility of the management body
   -Board members shall have sufficient expertise in RDARR topics and processes.
   -Board members shall be responsible for RDARR capability building and remediation.
   -Sufficient resources shall be allocated to ensure full implementation.
   
2. Scope of application.
   -Banks shall have complete coverage across entities and through the data cycle.
   -The ‘risk-related’ data will include core internal risk reports including risk appetite indicators, financial external reports, and supervisory reports.
   
3. Data governance framework
   -Banks shall define and document clear roles and responsibilities for data.
   -Banks shall create a central data function supported by an independent validation unit and internal audit (3LODs.)
   -Banks shall leverage data owners responsible for the quality and control of their data elements.
   
4. Data architecture.
   -The data structure should be organised through dictionaries and metadata.
   -Data definitions and glossaries shall depend on an established ownership.
   -Data shall be validated with validation rules and data lineage.
   
5. Group-wide data standards and quality management.
   -Data shall have standards for accuracy, integrity, completeness, and timeliness.
   -Banks shall create indicators and perform efficient, regular controls.
   -They shall register quality issues.
   
6. Efficient reporting system
   -An adequate reporting frequency must be defined.
   -An adequate production time with a T+20 rule for internal risk reporting.
   -A resilient reporting framework, including for ad-hoc requests, is necessary.
   
7. Effective implementation programmes
   -Banks shall ensure adequate prioritisation of RDARR topics, with sufficient resources allocated to RDARR projects.
   -Banks shall develop robust implementation plans.
   -Banks shall finally consider risk stemming from the implementation on ICT, risk assessments and reporting.

A broad range of supervisory activities are anticipated related to RDARR

The ECB already communicated in its supervisory priorities 2024-2026 the following work programme for RDARR, aimed to put more pressure on firms to speed up their remediation plans and correct deficiencies.

The ECB already conducted in 2023 on-site inspections on 23 institutions, resulting in a broad range of qualitative and quantitative measures. Significant deficiencies remain in many banks, such as insufficient oversight of their management bodies, weaknesses in data architecture, fragmentation of IT systems, issues with data aggregation, and ineffective governance frameworks.

The ECB mentioned it will intensify its intrusiveness in the context of the annual SREP assessments, as well as in more targeted engagements for RDARR. The ECB work programme for the coming months will include:

• OSI campaign on RDARR, including assessing management bodies for governance and execution oversight and assessing IT infrastructures.
• Targeted review on RDARR practices and data management.
• Annual management report on data governance and data quality.
• Horizontal benchmarking of findings from off-site and on-site activities against expectations expressed in the RDARR Guide.

For non-compliant institutions, the ECB will use the escalation techniques available in its supervisory toolkit, which can consist of enforcement and sanctions, such as periodical financial penalties for the most severe cases, and capital add-ons.

The ECB underscored the importance of prioritisation of the topic by the management body, as well as its accountability for the implementation of effective and prudent governance arrangements. For severe cases of deficiency, it may lead to reassessing the suitability of the responsible members and their possible removal.

“We observe heightened scrutiny from supervisors across EU banks regarding RDARR, starting with management being accountable for sound data governance. This directive goes beyond significant institutions supervised by the ECB; it is also a priority for National Competent Authorities and the Single Resolution Board.”

Eric Cloutier, Global Head of Banking Regulations, Forvis Mazars in the UK

Navigating the new landscape: potential challenges and our recommendations

The ECB will now expect banks to invest adequately to achieve these objectives and remediate gaps. Banks will need to take a pragmatic approach and careful planning to overcome the remaining obstacles while avoiding the pitfall of undertaking unnecessary large and costly technological programmes.

Some quick wins can be achieved along the way. We provide below some of our thoughts and recommendations.