What Changed
- EBA published draft RTS under Article 323 of CRR3 detailing operational risk governance, process, and system requirements.
- Inclusion of proportionality relief for institutions with a business indicator below EUR 750 million.
- Transition of the EU prudential framework to a single standardised approach based on the business indicator.
The European Banking Authority (EBA) has initiated a public consultation on draft Regulatory Technical Standards (RTS) detailing the operational risk management framework required for credit institutions under the EU Capital Requirements Regulation (CRR3). Mandated under Article 323(2) of Regulation (EU) No 575/2013, as amended by Regulation (EU) 2024/1623, the draft standards specify obligations under Article 323(1), points (a) to (h), taking into account an institution's size and complexity.
**Who Is Affected and Core Framework**
The proposed framework affects EU banking institutions, setting harmonised and proportionate requirements for governance, management processes, and systems used to identify, assess, monitor, and manage operational risk. The draft RTS clarify the specific roles and responsibilities of the management body, senior management, and the independent operational risk management function. They set requirements for operational risk data and taxonomy, the business indicator component, reporting, validation, and audit. ICT-related risk obligations are addressed separately through the Digital Operational Resilience Act (DORA).
**Proportionality Provisions**
Proportionality is a key feature of the proposed standards. Institutions with a business indicator below EUR 750 million will benefit from reduced review and reporting frequencies, as well as lower granularity for operational risk data, loss thresholds, and operational risk taxonomy.
**Regulatory Context and Transition**
These draft RTS support the implementation of the EU Banking Package. The package introduces a revised prudential framework for operational risk, replacing previous approaches—such as advanced measurement approaches—with a single standardised approach based on the business indicator. The draft standards build on the Basel Committee's Principles for the Sound Management of Operational Risk and align with EBA Guidelines on internal governance and DORA.
**Consultation Timeline and Hearing**
The public consultation deadline for submitting comments is 31 December 2026. The EBA will host a virtual public hearing on 29 September 2026 from 10:00 to 12:00 CEST, with stakeholder registration required by 25 September 2026 at 16:00 CEST. All comments will be published post-consultation unless requested otherwise. Following feedback evaluation, the EBA will finalise the draft RTS and submit them to the European Commission for adoption under Article 10 of Regulation (EU) No 1093/2010.
Who May Be Affected
EU banking institutions, management bodies, senior management, independent operational risk management functions, and financial sector stakeholders.
Cross-Border Context
Applies to credit institutions within the EU banking framework, establishing single-rulebook technical standards for operational risk management.
What to check next
- Registration for the EBA virtual public hearing by 25 September 2026
- Submission of consultation responses via the EBA portal by 31 December 2026
- Subsequent submission of finalized RTS to the European Commission
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.
Prepared automatically with AI assistance from the official sources linked on this page. Translations and explanations do not replace the official text.