EBA: new standards for operational risk management for banks and investment firms

On 26 August 2026, the European Banking Authority (EBA) launched a public consultation on new draft Regulatory Technical Standards (RTS) setting out how institutions should manage operational risk under the Capital Requirements Regulation (CRR). The consultation is open until 31 December 2026.

The proposed rules will apply to institutions subject to the CRR and are intended to introduce a harmonised minimum operational risk management framework across the European Union.

Operational risk management: New EBA requirements

The draft RTS focus on three key areas: governance, the operational risk management process and the operational risk assessment system.

Institutions will be expected to maintain a documented, institution-wide framework for identifying, assessing, monitoring, controlling, mitigating and reporting operational risk. The framework should form part of day-to-day management rather than operate solely as a separate compliance process.

The draft rules also clarify responsibilities within the organisation. The management body will approve the operational risk framework and risk appetite, while senior management will be responsible for managing exposures within defined limits. Institutions must also maintain an independent operational risk management function within the second line of defence. Additional requirements cover operational risk data, risk taxonomy, internal reporting, internal validation, audit and data governance.

Operational risk management: Simplifications for institutions with assets of up to 750 million EUR

The EBA proposes a proportionate approach based primarily on the institution’s business indicator. Institutions with a business indicator below EUR 750 million will benefit from simplified requirements, including less frequent framework reviews and management reporting and a reduced level of detail for certain operational risk data.

For example, such institutions would generally review the effectiveness of their operational risk framework at least every two years and report their operational risk profile to the management body at least annually. Larger institutions would generally be subject to annual reviews and quarterly reporting.

EBA: How to prepare an institution for the new operational risk standards?

Banks and other institutions within the CRR framework should assess whether their existing operational risk arrangements are consistent with the proposed standards.

In particular, they should review:

• the allocation of responsibilities between the management body, senior management and control functions;
• the independence and resources of the operational risk management function;
• operational risk appetite, limits and escalation procedures;
• operational risk data collection, taxonomy and reporting;
•  internal validation and audit arrangements; and
• the integration of operational risk management into product governance, outsourcing, change management and everyday decision-making.

ICT-related risk remains primarily governed by the Digital Operational Resilience Act (DORA). The draft RTS seek to avoid duplication by allowing institutions to rely on DORA-compliant policies, processes and controls where they also satisfy the new operational risk requirements.

Stakeholders may submit comments to the EBA until 31 December 2026. The EBA will also hold a virtual public hearing on 29 September 2026. Institutions should use the consultation period to identify potential gaps in their current operational risk frameworks and assess the operational impact of the proposed requirements.

EBA, RTS, and Operational Risk Management: Prepare Your Institution for the Changes

The proposed RTS may require changes in operational risk management, organizational governance, and internal documentation. Our regulatory team assists banks and investment firms in analyzing the proposed requirements and identifying potential gaps in their current practices. Contact us to discuss the impact of the new EBA standards on your institution.