Operational risk rules set €750 million threshold for EU banks
European banks face harmonised operational risk management standards under draft technical standards open for consultation until December 31, 2026. The framework mandates independent second-line oversight and sets specific loss-tracking thresholds scaled to institution size.
Independent oversight across three lines
The draft standards establish minimum operational risk requirements under Article 323 of the Capital Requirements Regulation following the revised Basel III framework.
Institutions must maintain a documented framework covering governance, management processes, and assessment systems.
The management body must approve the operational risk appetite at least annually, while senior management translates it into quantitative limits.
To prevent conflicts of interest, institutions must establish an operational risk management function in the second line of defence, independent from operational units and audit.
The technical standards also integrate digital operational resilience by permitting banks to rely on existing ICT risk mechanisms established under DORA.
The 750 million euro dividing line
Proportionality hinges on a €750 million business indicator threshold.
Institutions at or above this level must conduct annual framework reviews, report operational risk profiles quarterly, and map loss data below €20,000 to standard taxonomies.
Smaller institutions review frameworks every two years, report annually, and assess relevance and materiality for losses below €20,000. These smaller entities may also use the business indicator as their sole risk appetite proxy.
Pragmatic relief, heavy data friction
The €750 million threshold provides sensible relief by sparing smaller institutions from rigid modelling requirements.
Yet tracking sub-€20,000 losses will create unnecessary reporting friction for larger lenders.
Success depends on whether supervisors enforce these data rules pragmatically.