BCBS 239 is the Basel Committee's standard for risk data aggregation and risk reporting. Its eleven principles for banks cover governance, data architecture, the quality of risk data and the quality of risk reports. Supervisors assess progress principle by principle, so a bank needs evidence for each.
This checklist turns the principles into actions you can certify and document. It is a practical guide, not legal advice.
Who BCBS 239 applies to
The principles were written for global systemically important banks, and national supervisors apply them to domestic systemically important banks as well. Many other banks use them as a benchmark for good practice, because the underlying expectations are the same ones examiners raise in any data governance review.
The full standard has fourteen principles. Principles 1 to 11 apply to banks. Principles 12 to 14 concern supervisory review and sit outside a bank's own self-assessment, so this checklist covers Principles 1 to 11.
Governance and infrastructure (Principles 1 and 2)
- Senior management and the board own risk data aggregation, with responsibility assigned.
- Data governance policies cover risk data, with named owners for critical data.
- A documented data architecture shows how risk data flows and where it is stored.
- Critical risk data assets are registered and certified, not just listed.
- The architecture supports aggregation in both normal times and stress or crisis conditions.
Risk data aggregation capabilities (Principles 3 to 6)
- Accuracy and integrity. Controls check that aggregated risk data is accurate, with reconciliations documented and exceptions tracked to resolution.
- Completeness. You can show that all material risk data across entities and portfolios is captured, and you know where gaps exist.
- Timeliness. Data is available quickly enough for normal and stress conditions, with measured turnaround.
- Adaptability. You can produce ad hoc and new reports as needs change without manual rework.
Risk reporting practices (Principles 7 to 11)
- Accuracy of reports. Reports reconcile to source data and carry documented validation.
- Comprehensiveness. Reports cover all material risk areas and their relationships.
- Clarity and usefulness. Reports are understandable by their audiences and highlight what matters.
- Frequency. Reporting cadence matches risk and business needs, including stress periods.
- Distribution. Reports reach the right people securely and on time.
Evidence that makes the checklist real
Each item above needs proof. For every principle, keep:
- The owner responsible.
- The policy and control that applies.
- Test or reconciliation results.
- Lineage from report back to source systems.
- A dated approval or attestation.
Certifying the critical data assets behind your risk reports gives you this evidence in one place. Learn how in our guide to what data certification is and our critical data element article.
A worked example
Take Principle 3, accuracy and integrity, for a credit exposure figure used in a risk report.
- Register the exposure measure as a critical data asset and name its owner.
- Document its definition and the source systems it comes from.
- Map the policy requiring reconciliation, and the control that performs it.
- Record the reconciliation results each reporting cycle, with exceptions and fixes.
- Show the lineage from the report back to the source systems.
- Record the approval and a review date.
The same pattern repeats for each principle. What changes is the control and the evidence, not the method.
Test yourself against the principles
A self-assessment shows which principle is holding you back, because supervisors tend to emphasize the weakest. Our BCBS 239 readiness assessment scores each of Principles 1 to 11 and your overall rating by your weakest principle.
Common gaps to look for
- Ownership that exists on paper but not in practice.
- Manual spreadsheets between source systems and risk reports.
- Lineage that stops at a team boundary.
- Evidence scattered across email and shared drives.
- Stress-time reporting that has never been tested.
- Reconciliations performed but not recorded.
Closing these gaps is largely a matter of making evidence continuous rather than periodic. A live certification pipeline is one way to do it, and data lineage tooling helps with the traceability principles.
Pulling it together for the board
Senior management and the board are expected to own this area, so summarize progress in terms they can act on: how many principles are fully evidenced, which are weakest, what is being done and by when. Track the remediation plan to completion and report on it regularly.
If you would like help building BCBS 239 evidence, get in touch.