The EBA consults on draft technical standards on institutions’ operational risk management

The European Banking Authority (EBA) launched a public consultation on draft Regulatory Technical Standards (RTS) specifying the operational risk management framework that institutions must have in place as per Article 323 of the Capital Requirements Regulation (CRR3). The draft RTS set out harmonised, proportionate requirements for the governance, management process and systems institutions should use to identify, assess, monitor and manage operational risk. The consultation runs until 31 December 2026.

​The draft RTS specify the three main components of the framework: governance arrangements, the operational risk management process and the operational risk assessment system.

​They clarify the roles and responsibilities of the management body, senior management and the independent operational risk management function. They also set requirements for operational risk data and taxonomy, the business indicator component, reporting, validation and audit. Requirements relating to ICT risk are addressed through the Digital Operational Resilience Act (DORA).

​A key feature of the draft RTS is proportionality. Institutions with a business indicator below EUR 750 million will benefit from a lower frequency of reviews and reporting, a lesser level of granularity for their operational risk data, loss thresholds, and operational risk taxonomy. ​