EBA Opens Consultation on Draft Technical Standards for Operational Risk Management

The European Banking Authority (EBA) has announced a four-month public consultation on draft Regulatory Technical Standards (RTS) concerning operational risk management for EU financial institutions. This consultation, open until 31 December 2026, aims to define a harmonised yet proportionate framework under Article 323 of the Capital Requirements Regulation (CRR3) that specifies governance, management processes, and systems for operational risk oversight.

Structure and Purpose of the EBA Draft Technical Standards

The draft RTS address the operational risk management obligations introduced by CRR3, which revises the EU's prudential framework for operational risk. The proposed standards outline the three central components every institution's risk framework must cover:

• Governance arrangements
• The operational risk management process
• Operational risk assessment systems

The document clarifies the division of responsibilities between the management body, senior management, and an independent operational risk management function. This ensures that accountability is maintained throughout all levels of an institution.

Proportionality and Thresholds in Operational Risk Management

A key feature of the draft RTS is the principle of proportionality. Institutions whose business indicator is below EUR 750 million will be subject to:

• Less frequent reviews and reporting
• Reduced granularity in operational risk data collection
• Higher loss thresholds for escalation
• Simpler operational risk taxonomies

This tiered approach is designed to reduce the compliance burden on smaller institutions while maintaining high standards among larger participants.

Detailed Requirements and Exclusions

The RTS specify several obligations for institutions:

• Establish clear and robust governance arrangements
• Document operational risk taxonomy and data requirements
• Define clear business indicator components
• Maintain systematic processes for reporting, validation, and audit

Requirements for ICT and digital risks are not defined in these draft standards, as they are governed separately under the Digital Operational Resilience Act (DORA). The EBA has ensured alignment with both its internal governance guidelines and the broader EU digital resilience framework.

"Institutions with a business indicator below EUR 750 million will benefit from reduced requirements, reflecting the EBA's commitment to proportionality in regulatory obligations." — EBA consultation paper

Public Consultation Procedures and Timeline

Stakeholders have until 31 December 2026 to submit feedback on the draft RTS. Comments can be provided through the EBA’s consultation platform. All comments will be published at the end of the consultation unless confidentiality is specifically requested by the respondent.

The EBA will host a virtual public hearing on 29 September 2026, from 10:00 to 12:00 CEST, offering stakeholders an opportunity to discuss the draft with the authority directly. Interested parties must register for the session by 25 September 2026 at 16:00 CEST, after which dial-in details will be sent to those confirmed.

Legal Foundations and Next Steps

The authority drew up the draft RTS pursuant to Article 323(2) of Regulation (EU) No 575/2013, as amended by CRR3 (Regulation (EU) 2024/1623). This mandates the EBA to issue technical standards that specify, in detail, the operational risk management obligations set by Article 323(1), while factoring in the size and complexity of each institution.

These standards mark a shift from previous risk measurement methodologies—most notably the replacement of advanced measurement approaches with a single standardised approach based on a business indicator. The draft also references the Basel Committee’s Principles for Sound Management of Operational Risk.

Upon conclusion of the consultation period and review of received feedback, the EBA intends to finalise the technical standards and submit them to the European Commission for adoption according to Article 10 of Regulation (EU) No 1093/2010.

Impact on EU Financial Institutions

The consultation affects all institutions subject to CRR3 across the European Union. Larger operators and groups will need to update their internal risk frameworks to meet the new standardised requirements. Smaller entities will benefit from the EBA’s tailored approach, reducing the regulatory burden proportionate to their business scale and complexity. Final adoption by the European Commission is expected following completion of the statutory review and implementation process.

Further details and the official consultation paper are available via the EBA’s press release. For broader trends in regulation and banking risk management, see our dedicated coverage.