The European Banking Authority (EBA) has launched a public consultation on draft technical standards for institutions’ operational risk management, open until December 31, 2026.
The European Banking Authority (EBA) has initiated a public consultation on draft Regulatory Technical Standards (RTS) that specify the operational risk management framework required under Article 323 of the Capital Requirements Regulation (CRR3).
The draft RTS outline harmonised and proportionate requirements for governance, management processes, and systems to identify, assess, monitor, and manage operational risk. The consultation period runs until December 31, 2026.
The RTS specify three main components of the framework:
They clarify roles and responsibilities of the management body, senior management, and the independent operational risk management function. The standards also address requirements for operational risk data, taxonomy, reporting, validation, and audit. ICT risk is addressed under the Digital Operational Resilience Act (DORA).
A key feature of the draft RTS is proportionality. Institutions with a business indicator below EUR 750 million will have reduced review and reporting frequency, lower data granularity, loss thresholds, and risk taxonomy requirements.
The consultation is open for four months. Comments can be submitted via the EBA consultation page until December 31, 2026. A virtual public hearing will be held on September 29, 2026, from 10:00 to 12:00 CEST. Interested stakeholders must register by September 25, 2026. Comments received will be published unless confidentiality is requested.
The draft RTS are developed under Article 323(2) of Regulation (EU) No 575/2013 (CRR), as amended by Regulation (EU) 2024/1623 (CRR3). They support the EU Banking Package and align with Basel Principles, EBA guidelines, and DORA framework.
