RDARR and BCBS 239: What applies to less significant institutions?

Editorially reviewed: 22 October 2026 · Legal status checked up to: 22 October 2026. Time-bound statements are dated; legal acts that are announced but not yet published are marked as such.

For whom: Banks (SI) Banks (LSI) The ECB guide addresses significant institutions; the section “Austria” sets out what applies to LSIs.

The one number to remember: in the 2025 EU-wide stress test, the ECB's quality assurance increased the system-wide CET1 depletion in the adverse scenario by a net 88 basis points – from 308 to 396. Quality assurance examines data, models and assumptions together; an isolated price of poor data quality cannot be derived from it. But it shows that insufficiently substantiated submissions are corrected in the result – with effect on the Pillar 2 guidance.

How did BCBS 239 become the RDARR regime?

In January 2013 the Basel Committee published the “Principles for effective risk data aggregation and risk reporting” – 14 principles, eleven addressed to banks and three to supervisors. The lesson from the financial crisis was simple: in the acute phase, institutions could not aggregate their group exposures to individual counterparties quickly enough. The last full progress report (d559 of 28 November 2023, data as of 2022) assessed 31 global systemically important banks: only two met all principles, and no principle was fully implemented across all banks. The report recommended that supervisors consider “more forceful measures”.

That is exactly what happened. The ECB guide of 3 May 2024 formally creates no new legal obligations – it sets out how the ECB understands Art. 74 CRD and the EBA guidelines – and raises the bar materially in three places: one or two named members of the management body are responsible for the data governance framework; the scope expressly covers FINREP, COREP, stress test submissions, Pillar 3 and key models such as IRB and IFRS 9; and for the first time the text contains a verifiable time figure – a monthly or quarterly risk report that takes more than 20 working days is not considered timely.

Which seven areas of expectation does the ECB set?

Management body, scope, data governance, data architecture, data quality, timeliness and implementation programmes, each with expectation and typical finding.

Where do institutions stand according to supervisors?

Only 2 of 31 G-SIBs fully comply with BCBS 239; only 25 % of significant institutions have a group-wide framework approved by the management body.

The percentages are shares of the significant institutions surveyed, not shares of individual data errors. The ECB has condensed the individual findings into three clusters that recur verbatim in the supervisory priorities 2026–2028: deficiencies in data governance frameworks including the involvement of management bodies, weaknesses in data infrastructure and IT architecture, and shortcomings in data accuracy and integrity. The main driver is the interpretation of reporting requirements, not technology alone – in 2024 three quarters of institutions attributed their data quality issues to it, in 2025 still 58 %; IT-related causes rose slightly over the same period.

What happens in case of non-compliance?

Four steps, from informal discussions through binding requirements and capital add-ons to sanction proceedings, periodic penalty payments and a reassessment of management suitability.

What is certain: in 2024 the ECB addressed decisions with binding qualitative RDARR requirements to seven institutions and has, since 2025, used measures under Art. 16 SSM Regulation that include periodic penalty payments. Equally certain: as at 30 July 2026 no RDARR penalty payment against a named institution had been published – the two published penalty payments concerned climate and environmental risks. The ECB publishes penalty payments only once final; the absence of a publication therefore does not mean none were imposed.

What is binding in Austria, and what is not?

A clear delineation is needed here, because consultancy literature often suggests a degree of legal binding force that the guide does not have. The ECB guide is addressed to significant institutions under direct ECB supervision; less significant institutions are not mentioned. There is no RDARR-specific ECB guideline to national supervisors, and in Austria there is neither an FMA nor an OeNB guide on risk data aggregation for LSIs.

Germany shows where the development is heading for smaller institutions: the 9th MaRisk amendment of 30 June 2026 removes significant institutions entirely from the scope of the MaRisk; the module AT 4.3.4 on risk data aggregation had addressed only them since 2021 anyway. German LSIs are subject to the general requirements on data generation and data quality – a minimum core corresponding to Austria's section 3 KI-RMV.

What changes in 2026 and 2027?

The ECB guide is being revised by the fourth quarter of 2026, and RDARR enters the SREP from 1 January 2027.

• The ECB guide is being revised. Announced on 26 June 2026, expected in the fourth quarter of 2026, with clarifications on the scope of the data governance framework and on integrated data architecture. Whoever sets up a programme now should cut the target architecture so that it can absorb these clarifications.
• RDARR is anchored in the SREP EU-wide. EBA/GL/2026/06 from 1 January 2027 – the decisive lever for LSIs, described on the page SREP 2027.
• There is no EBA stress test in 2026, but the ECB's thematic reverse stress test on geopolitical risks across 110 banks; strengthening aggregation and reporting capabilities is an explicit assessment objective. In its results of 31 July 2026 the ECB found gaps in the granularity and sensitivity of risk assessments – in substance a data capability finding.

Which measures are proportionate for LSIs?

A three-stage plan: immediate steps by end-2026, steps in the first half of 2027 and structural measures by end-2027.

Immediately, by end-2026

1. Document a gap analysis against the seven areas of expectation in reduced scope – missing gap analyses are an explicitly named ECB finding.
2. Anchor responsibility for data quality in the allocation of duties and committee mandates; one member of the management board is usually sufficient.
3. Set up a register of data quality issues in simple form: severity, cause, impact, owner, deadline, evidence of remediation.
4. Inventory manual workarounds and end-user computing in the reporting process, with four-eyes control.
5. Measure the production time of risk reports – not binding, but the best self-diagnosis for manual steps.

Medium term, first half of 2027

1. Formalise the interpretation process for reporting requirements: central interpretation desk, documented decisions, change history – the largest single lever of all.
2. Tighten requirements for external reporting software and providers contractually and in audits; 55 % of IT-related issues were attributed to limitations of external vendors.
3. Name data owners per central reporting position in simplified form – across the whole chain, not only per system.
4. Prepare for the SREP assessment under section 5.7.

Structurally, by end-2027 and beyond

Tool-supported lineage derived from the processing chains instead of manually maintained diagrams; automation of data quality controls from the source system to the reporting layer; consideration of data quality risks in the ICAAP; and – expressly recommended by the Basel Committee in Newsletter No 36 of 6 January 2026 – regular exercises of ad-hoc reporting capability in calm times. The ability to deliver a new analysis within hours in a crisis cannot be documented, only demonstrated.

Which pitfalls are typical?

Five, including a programme without an end date, lineage as a pure documentation project and the IT explanation for a business problem.

• The programme without an end date. Rolling planning without a target date for full compliance is read as a lack of ambition.
• Lineage as a documentation project. Manually documented lineage is outdated from the day it is finished; the requirement reads “complete and up-to-date”.
• The scope that is too narrow. A framework that covers only internal reports but not FINREP, COREP and stress test submissions is incomplete under the guide.
• Governance without steering effect. A committee that takes note of metrics but influences neither budget nor prioritisation does not meet the expectation.
• The IT explanation for a professional problem. The largest cause block is the interpretation of regulatory requirements. Programmes set up purely as IT projects attack the wrong spot.

Frequently asked questions

Does an Austrian LSI have to meet the 20-working-day expectation?

No, it is not binding. It stems from the ECB guide for significant institutions. As a self-diagnosis it is nevertheless useful: the production time of a risk report is the best available indicator of manual steps in the aggregation process.

Which legal basis applies to data quality in Austria?

Section 39 BWG in conjunction with section 3(4) KI-RMV (consistency and validity of data in risk identification) and section 3(6) KI-RMV (traceable documentation). National law contains no lineage, ownership or metrics obligations.

Has the ECB already imposed penalty payments for risk data aggregation?

None had been published by the end of July 2026; the two published penalty payments concerned climate and environmental risks (ABANCA, Crédit Agricole). The ECB has explicitly named RDARR penalty payments as an instrument since 2024 and publishes penalty payments only once final.

When will the revised ECB guide arrive?

Announced for the fourth quarter of 2026, focusing on the scope of the data governance framework and integrated data architecture. A public consultation is envisaged for substantial changes.