SREP 2027: How do supervisors assess data capability?

Editorially reviewed: 22 October 2026 · Legal status checked up to: 22 October 2026. Time-bound statements are dated; legal acts that are announced but not yet published are marked as such.

For whom: Banks (SI) Banks (LSI) The SREP does not apply to insurers; for them data capability becomes relevant through DORA and the Solvency II review.

Data quality is not an examination topic only from 2027 – section 39 BWG and the KI-RMV already require consistency and documentation today, and the ECB has examined RDARR at significant institutions for years. What is new is the bundling: from 2027, next to the report, the institution's ability to bring data together completely, with verified provenance and in time is explicitly assessed. Under section 7, point 1, of the Austrian DORA Enforcement Act, what is sanctioned is not the incident but the absence of an adequate, documented framework. Implementation, effectiveness and evidence are three separate questions.

What does EBA/GL/2026/06 change?

On 26 June 2026 the EBA published the revised Guidelines on common procedures and methodologies for the supervisory review and evaluation process as a Final Report. They replace the SREP Guidelines EBA/GL/2022/03 and dissolve the stand-alone ICT Guidelines EBA/GL/2017/05; ICT risk is classified as a component of operational risk. The title on internal governance contains a new subsection 5.7 entitled “ICT systems, risk data aggregation and risk reporting”. The rationale names the integration of the DORA framework and third-party risk management into overall risk management in the same breath as the importance of risk data aggregation capabilities and refers to the 2013 Basel principles where applicable (footnote 4 and para 18 of the Final Report). DORA-related indicators are to be integrated into the competent authorities' monitoring systems.

Who do the guidelines apply to, and with what proportionality?

The Guidelines are addressed to the competent authorities, including the FMA and OeNB. The assessment of risk data aggregation capabilities thus formally becomes part of the SREP governance block EU-wide – regardless of whether an institution is significant. Since 2022 there has also been a joint LSI SREP methodology of the ECB and national authorities, modelled on the methodology for significant institutions. Proportionality works through the SREP categories: category 4 comprises small and non-complex institutions under Art. 4(1)(145) CRR; for them the minimum assessment cycle can be extended from three to five years if the risk profile is stable and low. In practice: lower assessment frequency, but the same assessment dimension; proportionality also concerns how requirements are designed and judged. And a clarification on their nature: guidelines are not a directly applicable regulation. The direct obligation falls on the competent authorities; they affect institutions through supervisory practice, applicable law – in Austria section 39 BWG and the KI-RMV – and, where applicable, concrete supervisory measures.

What already applies in Austria today?

Above all Section 39 BWG with section 3(4) and (6) KI-RMV. For less significant institutions there is no dedicated FMA or OeNB guide on risk data aggregation; the FMA's ICAAP minimum standards of December 2024 contain no section on data management or data governance either. The national legal basis remains section 39 of the Banking Act (BWG) in conjunction with the Credit Institutions Risk Management Regulation (KI-RMV), issued under section 39(4) BWG. Two provisions carry the core of the BCBS 239 idea:

The supervisory priorities for 2026 published by the FMA and OeNB on 15 December 2025 name five topics: resilience and reduction of non-performing loans, ICT security, artificial intelligence, ESG risks, and regulatory and supervisory efficiency. Risk data aggregation is not a separate priority; what is notable is rather the counter-movement – the FMA has declared the reduction of reporting obligations a goal for 2026. The lever for data capability therefore comes not from Vienna but, via the SREP Guidelines, from Paris.

What will supervisors actually examine in 2027?

From the documents of the Hypo-Verband session of 23 September 2026 and from supervisory publications, the 2027 examination focus can be named:

• Register of information and subcontracting chains. The ESAs have announced an examination focus for 2027 with automated evaluations of the registers of information and are embedding AI-related risks into the oversight examinations of critical ICT third-party providers (JC 2026 25, 31 July 2026). The register is also the data input for designating critical providers – data quality defects feed directly into a supervisory outcome.
• ICT incidents as an operating figure. In January 2026 the FMA and OeNB reported 103 major ICT incident reports for 2025, around 63 % of them related to external ICT service providers. EU-wide, the ESAs' Joint Committee counted 3,383 major incidents for 2025, 29 % caused by a failure on the side of a third-party provider (JC 2026 16).
• Data capability in the governance block. Through section 5.7 the quality of reporting data feeds into the LSI SREP; national supervisors plausibility-check bank calculations in ongoing analysis. An explicit RDARR assessment dimension for less significant institutions cannot be found in any published document – the assessment runs through governance.
• AI in the supervisory dialogue. The FMA and OeNB intend to develop and communicate their supervisory approach to AI applications in 2026 and to enter into dialogue with banks on concrete applications. Whoever reacts only once the approach is set does not negotiate.

How do implementation, effectiveness and evidence differ?

As three separate review questions. A successful attack or an OeNB query is not in itself a breach of duty. Exposure arises where the framework is missing or does not work, and it becomes visible where it cannot be evidenced. Three questions must therefore be answered separately: Is the requirement implemented? Does it work? Can it be evidenced? A complete dossier does not cure inadequate implementation, and good implementation without evidence is worthless in an examination. Documentation is itself an obligation in several places – Art. 6(5) and (6) and Art. 8(6) DORA – but it does not replace substantive implementation.

Self-diagnosis: Which six questions should be answered before SREP 2027?

1. Is there a written, delineated asset inventory – ICT assets, critical data elements, legal entities, provider contracts – with named owners? (Art. 8 DORA; RDARR expectation 3.4)
2. For the central reporting positions – FINREP, COREP, AnaCredit/GKE, VERA – can you say which source they come from and through which derivation they arise? (section 3(4) and (6) KI-RMV)
3. How long does the monthly and quarterly risk report take from reference date to sign-off? The ECB guide's 20-working-day expectation is not binding for LSIs, but readable as an indicator of the degree of automation.
4. Is there a register of data quality issues with cause, impact, owner, deadline and evidence of remediation – or do the OeNB query lists sit in mailboxes?
5. Which manual corrections and end-user computing intervene in the reporting process, and are they logged and controlled under the four-eyes principle?
6. Was the 2026 register of information accepted without rejection – and if not, why? From the October 2025 dialogue the FMA reported rejections because of a blank after the LEI and because of copying errors from the Excel format.

Frequently asked questions

Does section 5.7 also apply to less significant institutions?

Yes. The Guidelines are addressed to the competent authorities, in Austria the FMA and OeNB, and apply from 1 January 2027 – regardless of whether an institution is classified as significant. Proportionality works through the SREP categories and the assessment cycle, not through the assessment dimension.

Does EBA/GL/2026/06 require data lineage or data owners?

Not in those terms. The Guidelines create the assessment dimension for ICT systems, risk data aggregation and risk reporting and refer to the Basel principles; the concrete expectations – lineage at attribute level, data owners per critical data element, 20 working days – are in the ECB guide, which addresses significant institutions only.

What is the national legal basis for data quality in reporting?

Section 39 BWG in conjunction with section 3(4) KI-RMV (consistency and validity of the data used in risk identification) and section 3(6) KI-RMV (appropriate and traceable documentation). For network and information systems, section 39(2) BWG has referred to DORA since 17 January 2025.

What penalties apply for a missing ICT risk framework?

Under section 7, point 1, DORA-VG up to EUR 150,000 for responsible persons, under section 8 up to EUR 500,000 or 1 % of total annual net turnover for legal persons. In setting the penalty under section 9, the FMA first considers culpability and then further circumstances such as materiality, duration, financial strength and willingness to cooperate.