ECB Guide on effective risk data aggregation and risk reporting (2024)

General Information

This document is a guide published in May 2024 by the European Central Bank (ECB) - Banking Supervision (Single Supervisory Mechanism, SSM). It addresses best practices for effective aggregation of risk data and risk reporting (RDARR) in supervised financial institutions. The guide is based on the BCBS 239 principles of the Basel Committee, the European regulatory framework (notably the CRD IV Directive), and observations from ECB supervisory activities, including thematic reviews, on-site inspections, and stress analyses. The scope covers significant banks under direct SSM supervision, focusing on governance, data quality, data architecture, reporting processes, and regulatory compliance, over the recent period up to 2024.

Executive Summary

The guide deals with the crucial importance for financial institutions to have effective risk data aggregation and reporting (RDARR) capabilities for sound risk management and robust governance. This topic is essential because poor quality data can lead to material losses, errors in key risk indicators, and an inability to react quickly in crisis situations, as observed during the 2008 financial crisis and the COVID-19 pandemic (p. 1-2). The ECB notes that despite efforts since 2016, progress made by significant banks remains insufficient, with persistent weaknesses in governance, data architecture, and IT infrastructures, and incomplete compliance with BCBS 239 principles (p. 2). The guide defines minimum supervisory expectations, notably clear board responsibility, an integrated data governance framework covering all entities and material risks, robust data quality control processes, reporting deadlines adapted to risk dynamics, and ambitious but realistic implementation programs (p. 3-13). The ECB intensifies intrusive supervision, with possible coercive measures in case of non-compliance, including reassessment of board members’ competence (p. 14-15). The objective is to ensure that institutions have reliable information for effective decision-making and robust risk management, in compliance with European regulation and international standards.

Context and Objectives

The guide was developed to address persistent gaps identified in the RDARR capabilities of significant banks supervised by the ECB. Since the 2008 financial crisis, the ECB has highlighted the importance of reliable and effectively aggregated risk data for risk management and regulatory compliance. A thematic review conducted in 2016 revealed that no major institution fully complied with BCBS 239 principles, with insufficient progress despite strengthened supervisory measures, including a letter sent in 2019 to banks demanding substantial improvements (p. 1-2). The guide aims to clarify the ECB’s minimum expectations regarding governance, data quality, architecture, and reporting, emphasizing management responsibility and the need for concrete and measurable actions. It is part of the 2023-2025 supervisory strategy, with a more intrusive and targeted approach to remedy structural deficiencies (p. 3-4, 14). The guide’s limitations are explained: it does not create new regulatory requirements but specifies existing expectations and does not cover all possible aspects of RDARR.

Summary of Key Points by Theme

Board responsibilities: Management must assume full responsibility for data quality and risk governance, allocating resources and priorities, supervising remediation programs, and ensuring internal reports are relevant and balanced. It must appoint one or two members responsible for implementing the data governance framework and ensure continuous training of members on risks, IT, and reporting requirements (p. 5-7).

Scope of the governance framework: The framework must cover all legal entities, material risks, business lines, and financial and prudential reporting processes, including internal reports, external financial reports, regulatory reports (FINREP/COREP, stress tests, Pillar 3), as well as key internal models (IRB, IFRS9, VaR) and key risk indicators (p. 7-8).

Data governance framework: It must clearly define roles and responsibilities, with data owners for key indicators and critical elements, a central governance function, an independent validation function as the second line of defense, and an internal audit function as the third line. These functions must have the necessary resources and skills and ensure regular review of RDARR capabilities (p. 8-10).

Integrated data architecture: A group-level integrated and documented data architecture is required, including uniform taxonomies, dictionaries, metadata repositories, validation rules, and full traceability (data lineage) of critical data, to ensure the quality and consistency of data used (p. 10-11).

Data quality management: Group-wide policies and processes must ensure data quality control (accuracy, integrity, completeness, timeliness), monitoring via key indicators, documentation and remediation of issues, management of end-user developed applications, and consideration of data quality risks in ICAAP/ILAAP (p. 11-12).

Reporting timeliness: Internal reports must be produced with a frequency adapted to risk volatility and within delays allowing rapid reaction (e.g., production of a monthly report in less than 20 business days). RDARR capabilities must also be robust and adaptable under stress to meet ad hoc requests (p. 12-13).

Implementation programs: Institutions must establish improvement programs covering identified gaps, with project governance, adequate resources, clear action plans, milestones, and regular reporting to the board. One or two management members must be designated responsible for execution, with close monitoring (p. 13).

Main Findings and Lessons Learned

Findings: Significant institutions exhibit persistent structural deficiencies in RDARR, notably in governance, data quality, architecture, and reporting, despite efforts since 2016 and strengthened requirements (p. 2). Report production delays are often too long (more than 40 days for some monthly reports), and major errors in key indicators have been observed (p. 2).

Assumptions: The guide assumes that effective implementation of BCBS 239 principles, combined with strengthened governance and well-managed implementation programs, will significantly improve data quality and institutions’ responsiveness.

Interpretations: Board responsibility is central to driving and supervising improvements. The ECB interprets that without strong involvement and rigorous management, structural weaknesses will persist.

Uncertainties: The scale of necessary investments, the complexity of remediation projects, and technical or legal constraints may limit institutions’ ability to quickly achieve objectives. The ECB applies proportionality in its expectations according to institution size and complexity (p. 3, 5).

Conclusions and Author’s Recommendations

The ECB concludes that RDARR capabilities remain a major vulnerability in the European banking sector. It recommends that significant institutions:

- Strengthen board responsibility and commitment in data governance and risk reporting.

- Establish a comprehensive data governance framework covering all entities, risks, and critical processes.

- Develop an integrated data architecture with full traceability and uniform taxonomies.

- Implement robust data quality management and control processes, including documentation and incident remediation.

- Ensure internal reports are produced within deadlines compatible with risk dynamics, including in crisis situations.

- Launch and manage ambitious and realistic implementation programs, with regular monitoring and adequate resource allocation.

The ECB intensifies intrusive supervision, with possible coercive measures (sanctions, capital add-ons, reassessment of board members’ competence) in case of non-compliance with expectations. It stresses that these actions are essential to ensure effective risk management and financial stability (p. 14-15).