​The EBA consults on draft technical standards on institutions’ operational risk management

​The European Banking Authority (EBA) today launched a public consultation on draft Regulatory Technical Standards (RTS) specifying the operational risk management framework that institutions must have in place as per Article 323 of the Capital Requirements Regulation (CRR3). The draft RTS set out harmonised, proportionate requirements for the governance, management process and systems institutions should use to identify, assess, monitor and manage operational risk. The consultation runs until 31 December 2026.

​The draft RTS specify the three main components of the framework: 

• ​governance arrangements
• ​the operational risk management process
• ​the operational risk assessment system.

​They clarify the roles and responsibilities of the management body, senior management and the independent operational risk management function. They also set requirements for operational risk data and taxonomy, the business indicator component, reporting, validation and audit. Requirements relating to ICT risk are addressed through the Digital Operational Resilience Act (DORA).

​A key feature of the draft RTS is proportionality. Institutions with a business indicator below EUR 750 million will benefit from a lower frequency of reviews and reporting, a lesser level of granularity for their operational risk data, loss thresholds, and operational risk taxonomy. ​

Consultation process

The public consultation is open for four months.

Comments to the consultation paper can be sent by clicking on the “send your comments” button on the EBA's consultation page. The deadline for the submission of comments is 31 December 2026.

The EBA will hold a virtual public hearing on 29 September 2026 from 10:00 to 12:00 CEST (Paris time). The EBA invites interested stakeholders to register using this link by 25 September 2026 (16:00 CEST). The dial-in details will be communicated to those who have registered for the meeting.

All comments received will be published following the end of the public consultation, unless requested otherwise.

Legal basis and background

The EBA has developed these draft RTS under Article 323(2) of Regulation (EU) No 575/2013 (Capital Requirements Regulation – CRR), as amended by Regulation (EU) 2024/1623 (CRR3), which mandates the EBA to develop draft regulatory technical standards specifying the obligations under Article 323(1), points (a) to (h), of that Regulation, taking into consideration the size and complexity of the institution. 

The draft RTS support the implementation of the EU Banking Package, which introduces a revised prudential framework for operational risk and replaces the previous approaches, including advanced measurement approaches, with a single standardised approach based on the business indicator.

They build on the Basel Committee's Principles for the Sound Management of Operational Risk and are consistent with the EBA Guidelines on internal governance as well as the EU framework on digital operational resilience established by DORA.

Following the feedback received to this consultation, the EBA will finalise the draft RTS and submit them to the European Commission for adoption in accordance with Article 10 of Regulation (EU) No 1093/2010.