BCBS 239 is the Basel Committee on Banking Supervision’s Principles for effective risk data aggregation and risk reporting, published on 9 January 2013. It sets out principles requiring banks to aggregate risk data accurately and report it quickly, and it exists because during the 2007 crisis many banks, including global systemically important banks, could not aggregate their risk exposures fully or quickly enough to see what they were holding.
Fourteen principles across four sections, addressed to banks and to the supervisors who examine them. The principles are short. The capability they ask for, reconciling any figure in a risk report back to source at attribute level, is where the work actually is.
Primary source: Basel Committee on Banking Supervision, Principles for effective risk data aggregation and risk reporting, January 2013.
The basics
What is BCBS 239?
BCBS 239 is a set of supervisory principles published by the Basel Committee on Banking Supervision covering how banks aggregate risk data and report it. Its formal title is Principles for effective risk data aggregation and risk reporting.
What does BCBS 239 stand for?
BCBS is the Basel Committee on Banking Supervision; 239 is the publication number in the Committee’s series. The number is not an acronym and carries no meaning of its own.
When was BCBS 239 published?
9 January 2013.
When was BCBS 239 introduced?
It was published in January 2013 and the compliance deadline differed by cohort. The standard states that banks identified as G-SIBs by the FSB in November 2011 or November 2012 “must meet these Principles by January 2016”, and that G-SIBs designated in subsequent annual updates “will need to meet the Principles within three years of their designation”.
Is BCBS 239 a regulation?
Strictly it is a set of principles, not a regulation. In practice national supervisors incorporate it into their own supervisory expectations and examine against it, which makes the distinction academic for a bank in scope.
Is BCBS 239 mandatory?
For banks in scope, yes in effect. Compliance is assessed by national supervisors, and shortfalls attract supervisory findings and remediation programmes.
Is BCBS 239 part of Basel III?
No. It is a separate Basel Committee publication from the same post-crisis reform period, and it is frequently discussed alongside Basel III because both respond to the same failures.
Who it applies to
Who does BCBS 239 apply to?
Global systemically important banks, as designated by the Financial Stability Board. The Committee also states that it is “strongly suggested that national supervisors also apply these Principles to banks identified as D-SIBs by their national supervisors three years after their designation as D-SIBs”.
Who do BCBS 239 principles apply to?
Most of the principles apply to banks. The final group applies to supervisors, covering how they review, enforce and cooperate across jurisdictions.
What do BCBS 239 principles apply to?
Risk data aggregation capabilities and risk reporting practices, across all material risk types. Scope is not limited to credit risk or to any single reporting line.
The 14 principles
How many principles are in BCBS 239?
Fourteen.
How many basic principles are defined in BCBS 239?
Fourteen, organised into four sections. The section and principle titles used here are the Committee’s own.
What are the BCBS 239 principles?
They are grouped into four sections: overarching governance and infrastructure; risk data aggregation capabilities; risk reporting practices; and supervisory review, tools and cooperation.
I. Overarching governance and infrastructure 1. Governance 2. Data architecture and IT infrastructure
II. Risk data aggregation capabilities 3. Accuracy and integrity 4. Completeness 5. Timeliness 6. Adaptability
III. Risk reporting practices 7. Accuracy 8. Comprehensiveness 9. Clarity and usefulness 10. Frequency 11. Distribution
IV. Supervisory review, tools and cooperation 12. Review 13. Remedial actions and supervisory measures 14. Home and host cooperation
What are the 14 principles of BCBS 239?
Fourteen, grouped as governance and infrastructure; risk data aggregation capabilities; risk reporting practices; and supervisory review. Principles 1 to 11 are directed at banks; 12 to 14 are directed at supervisors.
What it is for
What does BCBS 239 primarily aim to improve?
A bank’s ability to aggregate risk data accurately and report it quickly, particularly under stress. The underlying goal is that senior management and the board can see the firm’s real risk position in time to act on it.
What is the objective of BCBS 239?
To strengthen risk data aggregation and reporting so that decision-makers get accurate, complete and timely risk information. It is a data capability standard in service of risk governance.
What is the purpose of BCBS 239?
To close the gap the 2007 crisis exposed, when banks could not identify concentrations or aggregate exposures fast enough. The principles turn that failure into a set of testable expectations.
Why is BCBS 239 important?
Because the capability it asks for is the same capability every other risk and regulatory obligation quietly assumes. A firm that cannot trace a reported figure back to source cannot reliably satisfy any regime that asks it to explain a number.
Reporting and compliance
What is BCBS 239 reporting?
The risk reporting side of the principles, covering accuracy, comprehensiveness, clarity, frequency and distribution of risk reports. It is the half of the standard concerned with what reaches the board, not only with what the data warehouse can produce.
What are BCBS 239 reports?
There is no prescribed report format. The principles govern the qualities a firm’s risk reports must have and the aggregation capability behind them.
What is BCBS 239 compliance?
Demonstrating to a supervisor that the firm’s risk data aggregation and reporting meet the principles, including the ability to reconcile reported figures to source. Compliance is assessed by supervisors, not self-certified.
What is BCBS 239 in banking?
It is the reference point for how a bank’s risk data has to be assembled and reported. In practice it is the standard cited whenever an examiner asks how a number in a risk report was produced.
Implementing it
How to implement BCBS 239?
Two capabilities do most of the work: attribute-level, end-to-end data lineage, and a reconciliation path from any reported figure back to source. Governance and architecture work follows from those, because you cannot govern a flow you cannot describe.
What is BCBS 239 regulation?
It is a principles-based supervisory standard applied through national supervisors.
What is the hardest part in practice?
Producing attribute-level lineage across an estate where the transformation logic predates the current team. Catalogs store lineage well; the difficulty is generating it from ETL that nobody can read, which is where most programmes stall.
That last point is worth sitting with, because it is where the standard meets the estate. A twenty-year-old ETL job usually does not name the systems it touches. It names a variable, which resolves from a properties file, which is set somewhere upstream. Reconciling a regulatory figure to source means resolving that chain, field by field, and no catalog does that on its own.
At one Fortune 200 financial services firm, lineage work that used to take weeks of analyst time now completes in minutes, for the estate in scope. The obligation did not move. The cost of evidencing it did.