EBA consults on new technical standards for operational risk management

The European Banking Authority (EBA) has initiated a public consultation on the draft Regulatory Technical Standards (RTS) that define the operational risk management framework for entities covered by the Revised Capital Requirements Regulation (CRR3). The consultation period will be open until December 31, 2026, aiming to harmonize governance requirements and processes in operational risk management as stipulated by Article 323 of CRR3.

Scope of the RTS project for operational risk

The draft RTS prepared by the EBA outlines three essential components that financial institutions subject to CRR3 must implement:

• Governance arrangements: defined responsibilities for management bodies, senior management, and the independent operational risk management function.
• Operational risk management process: identifies, assesses, monitors, and manages operational risks under unified criteria.
• Operational risk assessment system: establishes reporting, validation, and auditing criteria, along with taxonomy and collection of relevant data.

The EBA clarifies that specific management and control obligations for risks associated with Information and Communication Technology (ICT) will fall under the Digital Operational Resilience Regulation (DORA), which is in force within the European Union regulatory framework.

Proportionality and key thresholds in the EBA's approach

A central element of the proposed RTS is proportionality based on the size of the entity. Institutions with a business indicator of less than €750 million will benefit from:

• Reduced frequency in audits and reports.
• Lower granularity required in operational risk data.
• Specific thresholds for loss reporting and taxonomy structure.

This reflects a regulatory burden adapted to the size and complexity of the entities, as required by CRR3 and in line with the EBA's internal governance guidelines.

Public consultation process and participation

The public consultation will last for four months. Interested parties can submit comments until December 31, 2026, using the corresponding button on the EBA's consultation portal. The institution has also announced a virtual public hearing on September 29, 2026, from 10:00 to 12:00 CEST (Paris time). Participants should register their attendance before September 25, 2026, at 16:00 CEST. Access details will be sent to registrants.

Upon completion of the consultation, the EBA will publish all received comments, except if a confidentiality request is expressly made.

Legal framework and alignment with international standards

The EBA is developing this regulatory project under Article 323(2) of Regulation (EU) No 575/2013, modified by Regulation (EU) 2024/1623 (CRR3). According to the mandate, it must consider the size and complexity of the entities when defining the standards for the components established in Article 323(1), paragraphs (a) to (h).

The RTS seek to support the implementation of the EU banking package, which introduces a revised prudential approach by eliminating advanced measurement schemes and opting for a single standardized approach based on the so-called business indicator. Additionally, the project is grounded in the Principles for Effective Operational Risk Management published by the Basel Committee on Banking Supervision and maintains consistency with DORA and the EBA's internal governance guidelines.

"The RTS reinforce harmonization and proportionality in operational risk management according to the mandate of CRR3," highlights the EBA in the published documentation.

Once contributions are received and analyzed, the EBA will finalize the draft RTS and submit it to the European Commission for adoption pursuant to Article 10 of Regulation (EU) No 1093/2010.

Implications for the sector and next steps

The implementation of these RTS will entail significant adjustments in the internal control structure, data, and processes of entities subject to CRR3, especially for those with higher activity volumes. For payment operators, platforms, and banks providing services related to the casino, payments, and b2b sectors, early alignment to the proposed taxonomy and reporting can mitigate compliance risks when the standards are formally adopted.

Complete documentation of the process and the text of the draft RTS are available on the EBA website. The timeline and detailed procedures ensure the participation of all relevant stakeholders before the final adoption phase.