BCBS 239

Why risk data became a regulatory problem

Data generated by banks was historically treated as a by-product of core banking activity. Ownership was ill-defined, rarely managed as part of enterprise performance, and the capability itself was underinvested. When the financial crisis exposed how slowly risk exposures could be aggregated, the Basel Committee responded with BCBS 239.

The principles ask banks to govern risk data inside the risk function, invest in data management capability across systems, people and processes, and raise the standard of risk reporting. In practice that means being able to aggregate exposures accurately and quickly, across business lines and legal entities, and to show the workings.

What we bring

A structured, proven methodology, tailored to your size, your business lines and the capability already sitting inside your risk function. It runs through the compliance lifecycle:

• Risk data compliance assessment — where you stand against each principle, using a standardised questionnaire and established minimum standards
• Risk data foundation — policy and standards statements, frameworks, taxonomies, metadata definitions, and business and data quality rules
• Risk data technology enablement — the systems and processes needed to aggregate and report
• Compliance execution — evidencing accuracy, completeness and timeliness on an ongoing basis
• Change management — so compliance holds after the programme ends

Our rule specifications map to the critical data sources and targets named under the principles, so the assessment produces a remediation list rather than a rating.

Awareness runs alongside delivery

BCBS 239 expects the board to understand its risk data. We run regular board awareness sessions in line with that expectation, and train stakeholders at every level, because controls that only the project team understands do not survive the project.

Compliance that pays for itself

Data is no longer a by-product; it is the enabler of a bank’s digital strategy. Banks that fail to invest in the capability are constrained in their ability to modernise. The same investment that satisfies a supervisor also gives risk managers evidence-based decisions, improves back-office efficiency and reduces the cost of every downstream report. We structure the work so compliance can be demonstrated to the regulator, while the capability keeps earning after the audit.

Our teams combine deep risk, data and technology experience, and where it helps we perform the risk subject-matter or senior business role on behalf of the risk function.