Consultation Paper on Revisions to the ITS on supervisory reporting (Commission Implementing Regulation (EU) 2024/3117) - Module on operational risk losses reporting

1. Recent revision to the Regulation (EU) 575/2013 (Capital Requirements Regulation, CRR) introduces significant revisions to the way institutions shall record and report operational risk losses, notably Article 317 mandates the EBA to develop regulatory technical standards (RTS) establishing risk taxonomy on operational risk that complies with international standards and a methodology to classify the loss events included in the loss data set based on that risk taxonomy on operational risk. The EBA has developed the draft RTS setting out such taxonomy and submitted it for adoption to the EU Commission^[1].
2. The draft RTS establish a risk taxonomy that includes Level 1 event types in line with those envisaged in the previous 2019 version of the CRR (CRR2) (7 event types), Level 2 categories that specify in greater detail the corresponding event types (26 Level 2 categories), and a list of attributes that increase the flexibility of the framework and the level of information available to supervisors (15 attributes). The new taxonomy, whilst maintaining a degree of continuity with the previous taxonomy used in CRR2, is much more detailed and granular, in particular for Level 2 categories, as it reflects recent international industry development and followed the development in the fields of ESG and digital operational resilience, notably Regulation (EU) 2022/2554 (DORA).
3. The new operational risk taxonomy is expected to start to apply in 2026, once the EU Commission adopt the draft RTS. Institutions shall be expected to apply the new taxonomy for the purposes of recording of operational risk losses in their data sets in accordance with Article 317 of CRR.
4. The revision of the operational risk taxonomy has also direct implications on the operational risk loss reporting requirements under Article 430 of CRR. In particular, the operational risk loss reporting requirements should be updated, as the current COREP templates C 17.01 ‘Operational risk: losses and recoveries by business lines and event types in the last year’ and C 17.02 ‘Operational risk: large loss events’ are not fit for purpose and are not aligned with the CRR 3 operational risk framework and the new operational risk taxonomy.

1.1 Simplification and proportionality

1.1.1 Transition towards granular reporting

5. Should the traditional approach to designing reporting requirements based on reporting of various aggregated values be preserved, the more granular and detailed taxonomy would necessitate a significant revision and expansion of the operational risk reporting templates and significant increase of the reported data points compared to the existing reporting.
6. In order to update the reporting requirements on operational risk losses in the most efficient way both for reporting institutions and for supervisors, and as advised by the EBA drive for simplification, the update will focus on information that is only strictly necessary for the competent authorities to carry out their supervisory tasks and essential for the assessment of the compliance with the underlying regulatory requirements and effective risk assessment.
7. The simplification proposal for the operation risk loss reporting centres on the move from reporting of aggregates and various breakdowns to reporting individual operational risk losses above the regulatory loss thresholds. The move towards granular reporting of loss events in simpler open table on a loss-by-loss basis should serve as a use case in the task to explore the possibility to increase the level of granularity for the reporting requirements, where feasible, in the context of an integrated reporting system, as a way to further increase the efficiency of the reporting process, but not as a pre-condition to having such a system, as suggested in the 2021 EBA Feasibility Study on integrated reporting^[2]. This approach may result in ‘bigger in volume but simpler’ reporting of data as already recorded in the banks’ operational risk loss databases without creating aggregate data solely for reporting purposes. Such granular reporting approach would also allow for the multi-use of data both for internal risk management and supervisory reporting purposes.
8. From the supervisory perspective, the granular reporting of individual loss events and their evolution over time, would allow supervisors to gather insider view on the operational risk loss evolution for the institutions that calculate annual operational risk loss in accordance with Article 316 of CRR (and are therefore subject to the reporting obligation) and have a data set necessary for the assessment of the level of the operational risk institutions are exposed to and the operational risk management framework.
9. The proposal put forward in this consultation paper leads to the repeal of the current reporting templates C 17.01 and C 17.02 and their replacement with the new open table C 17.01 allowing for the granular reporting of operational risk losses on a semi-annual basis.

1.1.2 Proportionality

10. The introduction of the granular reporting will respect all existing proportionality arrangements and thresholds set in CRR (notably in Article 316 as regards the scope of the institutions required to report operational risk losses and in Article 319 as regards the types of operational risk loss events to be reported), as well as evolution of such loss events in terms of recoveries, including from insurance.
11. Whilst the granular reporting of the operational risk loss events shall be mandatory for the institutions meeting the threshold set in Article 316 of CRR, the consultation paper introduces a general provision allowing for a voluntary reporting of the required by data by other institutions, in particular small and non-complex institutions (SNCIs), medium-sized institutions that are likely to fall below that threshold and also large institutions that do not meet the threshold set out in Article 316(1) of Regulation (EU) 575/2013 (proposed Article 21a to be incorporated into he ITS on supervisory reporting). The possibility of such voluntary reporting is also available for the one-off reporting of historical losses (see below) allowing the institutions to voluntary report both the granular losses and the aggregate historical losses.

1.2 One-off reporting of historical losses

12. In addition to the granular reporting of the operational risk losses, Article 318(1) of CRR requires institutions to maintain aggregate data on net and gross operational risk losses over a 10 financial years.
13. Whilst with the application of the regular granular reporting of operational risk losses on the basis of the templates proposed in this consultation paper, running update of the 10-year window will be possible using the granular reported data, it is important to establish basis for the first 10-year window reporting. To this end, the EBA suggests a one-off collection of data using an aggregate template proposed in this consultation paper. This template for the one-off reporting will not be part of the regular reporting and therefore will not be included as part of the revised ITS on supervisory reporting. Instead, this template will be implemented based on the EBA decision operationalising transitional arrangements for the introduction of the new reporting as explained below.
14. The one-off reporting of 10-year historical losses should be performed upon the first implementation of the semi-annual reporting of granular losses meaning that at the first reporting institutions will submit both C 17.01 and C17.02 templates.

1.3 Transitional arrangements

15. New granular reporting of operational risk losses will start to apply following the entry into force of the RTS establishing new operational risk taxonomy, which is expected to be adopted by the EU Commission already in 2026. To this end the first recording of the operational risk losses using a more detailed loss event taxonomy set in that RTS is expected to apply already in 2026.
16. The revised reporting templates supporting new operational risk taxonomy and granular reporting of operational risk losses introduced on the basis of this consultation paper will start to apply for reporting with first reference date of 30 September 2027, which would for semi-annual reporting of operational risk losses would mean first reference date of 31 December 2027. This leaves a gap for the operational risk reporting in 2026-2027 until the revised ITS on supervisory reporting will start to apply.
17. To cover this gap and ensure that supervisors have at least the basic information on operational risk losses, whilst minimising implementation efforts and burden for institutions, the EBA is suggesting that the current operational risk reporting templates are maintained until repealed by the revised ITS on supervisory reporting and the institutions report only the data points that are not affected by the new operational risk taxonomy, i.e. report information only in relation to Level 1 event types and do not report data in relation to new more granular Level 2 categories. This simplified reporting would be put in place on the basis of the EBA decision for the period from the application of the RTS on operational risk taxonomy and until the application of the new reporting requirements based on the revised ITS on supervisory reporting.
18. H2 2027 reporting will be based on the new templates in conformity with the new loss event taxonomy. To cover for the gap caused by the delayed implementation of the new reporting templates, for the first reporting in H2 2027, institutions will be requested to report retroactively loss events for the period starting from time when the RTS on operational risk taxonomy starts to apply.
19. Such delayed reporting with the longer reference period will ensure that the competent authorities have all necessary data to monitor operational risk loss trends, albeit with the delay in reporting. At the same time from the institutions perspective, the proposed approach seems to be the least burdensome as the institutions would need to make minimum adjustments for the interim period and the first reporting of the bigger data set (longer reference period) should be also manageable considering that the institutions are obliged by the CRR3 to maintain internal records of operational risk losses in accordance with new operational risk taxonomy from as soon as the RTS on operational risk taxonomy starts to apply in 2026.

As per Article 15 of Regulation (EU) No 1093/2010 (EBA Regulation), any draft implementing technical standards (ITS) developed by the EBA shall be accompanied by an Impact Assessment (IA), which analyses ‘the potential related costs and benefits’.

This analysis presents the IA of the main policy options included in this Consultation Paper on the draft ITS amending Commission Implementing Regulation (EU) 2024/3117 on supervisory reporting (‘the draft ITS’). The analysis provides an overview of the identified problem, the proposed options to address this problem as well as the potential impact of these options. The IA is high level and qualitative in nature.

A. Problem identification and background

New operational risk taxonomy introduced in the RTS on operational risk taxonomy in accordance with Article 317 of CRR 3 introduces new classification of operational loss events and requires institutions to classify them using: Level 1 classification (7 different types); Level 2 classification within the Level 1 types (in total 26 Level 2 categories) and Defined attributes (15 in total), each loss event shall be assigned to all the applicable attributes. The new taxonomy is significantly more detailed in terms of classification of operational risk losses compared to the current approach. This necessitates the revision and update of the templates for the operational risk loss reporting as the current reporting templates are not compatible with the new taxonomy. Article 318 of CRR also introduces the requirements of keeping a 10-year aggregate data on annual overview of operational loss history.

Institutions are required to assign loss events to Level 1 event types from the 10 years preceding the date of entry of the RTS and assign loss events to Level 2 event types and attributes from at least one year preceding the date of entry of the RTS.

The traditional way of reporting (with structured templates with z-axis) would end up with large templates with many z-axis items, resulting in a significantly increased reporting burden for institutions and complex use of data. This approach, however, is not in line with the ongoing EBA objectives of the simplification and streamlining of the supervisory reporting and reducing reporting costs for institutions.

The revision of the operational risk loss reporting templates is incorporated into the comprehensive consultation paper on amendments to the ITS on supervisory reporting, and its finalisation has been delayed in order to take into account the overall simplification work. This delay couples with the EBA commitment to improving change management framework and batching of the reporting requirements, in practice means that there will be a gap in operational risk loss reporting from the moment of application of the RTS on operational risk taxonomy in 2026 until the new reporting templates  introduced in the revised ITS on supervisory reporting start to apply in Q4 2027. Pragmatic solution needs to be found to ensure that the competent authorities are able to perform their supervisory tasks in this gap period.

B. Policy objective

The operational risk loss reporting should be designed balancing the need to introduce granular loss event taxonomy whilst minimising the reporting burden for institutions.

C. Options considered, assessment of the options and preferred options

For the regular reporting of operational risk losses under the new operational risk taxonomy the following options have been considered:

Option 1a. revise the reporting templates using traditional approach to the template design and aggregate reporting approach.

Option 1b. Require institutions to report granular data on operational risk losses using simpler open template.

Considering the higher granularity of the new operational risk taxonomy the traditional way of reporting (with structured templates with z-axis) would end up with large templates with many z-axis items, resulting in a significantly increased reporting burden for institutions and complex use of data. An alternative solution, which is to require granular reporting of operational risk losses that would lead to the design of a much smaller open template but may lead to more data points being reported in practice.

Reporting of granular data in simpler, open table would follow EBA ongoing work on integrated reporting in a move towards more granular reporting also considering past feedback from institutions to reconsider ‘aggregate template approach’. Whilst open template would potentially lead to bigger (in volume). However, higher volumes but much simpler design building on what institutions need to prepare for the aggregate reporting and have in their own operational risk loss dataset ensures multi-use of data and facilitates integration of reporting.

Based on the above, Option 1b has been chosen as the preferred one, and the draft ITS will request granular data on individual operational risk losses meeting the thresholds and reporting criteria set out in CRR3.

For the transitional arrangements during 2026-2027 the following options have been considered:

Option 2a. Not to require any reporting of operational risk losses during the transitional period until a new ITS on supervisory reporting starts to apply.

Option 2b. Require institutions for early adoption of the revised templates for the operational risk reporting ahead of the revised ITS on supervisory reporting implementation.

Option 2c. Require institutions to use existing reporting templates and report only the data that has not been affected by the changes to the operational risk taxonomy.

Having access to the information on operational risk losses is an important element for the ability of competent authorities to perform supervision of operational risk and operational risk management framework, therefore not having any reporting for the transitional period in 2026-2027 is not feasible. To cover this gap and ensure that supervisors have at least the basic information on operational risk losses, whilst minimising implementation efforts and burden for institutions, the EBA is suggesting that the current operational risk reporting templates are maintained until repealed by the revised ITS on supervisory reporting and the institutions report only the data points that are not affected by the new operational risk taxonomy, i.e. report information only in relation to Level 1 event types and do not report data in relation to new more granular Level 2 categories.

To cover for the gap caused by the delayed implementation of the new reporting templates, for the first reporting in Q4 2027, institutions will be requested to report loss events for the period starting from time when the RTS on operational risk taxonomy starts to apply. Such delayed reporting with the longer reference period will ensure that the competent authorities have all necessary data to monitor operational risk loss trends, albeit with the delay in reporting. At the same time from the institutions perspective, the proposed option seems to be the least burdensome as the institutions would need to make minimum adjustments for the interim period and the first reporting of the bigger data set (longer reference period) should be also manageable considering that the institutions are obliged by the CRR3 to maintain internal records of operational risk losses in accordance with new operational risk taxonomy from as soon as the RTS on operational risk taxonomy starts to apply in 2026.

Based on the above, Option 2c has been chosen as preferred one, and the EBA will adopt a separate decision allowing institutions until the revised ITS on supervisory reporting starts to apply  to use for the reporting of operational risk losses and report the data Level 1 categories only and report all losses retrospectively once the ITS will start to apply.

2.1 Overview of the questions for consultation

Question 1. Do the respondents agree with the proposed switch to granular operational loss reporting considering the granularity of the new operational risk taxonomy?

Question 2. Do the respondents agree that the move to the granular reporting of operational risk losses will help reducing reporting costs and increase efficiency of the reporting framework?

Question 3. Do the respondents agree that the proposed granular reporting template is clear and fit for purpose of the underlying regulation?

Question 4. Do the respondents agree that the instructions for the regular reporting template C 17.01 are clear and fit for purpose?

Question 5. Do the respondents agree that, in case that the Loss adjustments refer to a loss event that was not previously reported, as accounted for the first time in previous financial years, such loss event should be reported regardless of when the original loss event has been accounted for the first time (column 0050)?

Question 6. Do the respondents agree with the proposed approach to one-off reporting of 10-year operational loss history for the starting point?

Question 7. Do the respondents agree that the one-off reporting template is clear and fit for purpose of the underlying regulation?

Question 8. Do the respondents agree that the instructions for the one-off reporting template are clear and fit for purpose?

Question 9. Do the respondents agree with the proposed approach to the transitional arrangements for reporting operational risk losses in 2026 and 2027 until the application of the revised ITS on supervisory reporting?