For more background, see What Is BCBS 239? and BCBS 239 and Data Flow Lineage.
Thirteen years after the Basel Committee published BCBS 239, regulators have stopped asking banks whether they plan to comply. They're asking banks to prove they already have.
The shift is measurable, and it's happening on both sides of the Atlantic. In the US, the OCC and Fed have enforced BCBS 239 substance through safety & soundness authority for over a decade, producing billions of dollars in penalties and the longest asset cap in modern banking history. In Europe, the ECB published a prescriptive guide with attribute- level lineage expectations and standardized quality indicators. By early 2026, both jurisdictions had reached the same operating premise: compliance is not about verifying reports. It's about demonstrating that the processes producing those reports are sound, traceable, and governed.
If you're building a board case for investment, this timeline is the argument. Not because any single event is alarming, but because the cumulative trajectory is unambiguous. Every year, the distance between supervisory expectations and "we're making progress" gets more expensive.
The timeline
Each row represents an escalation in specificity, enforcement tooling, or both. The 2013–2016 era was directional. By 2023, only 2 of 31 assessed G-SIBs were fully compliant, and the Basel Committee concluded that "significant work still remains." The supervisory response has been progressively sharper tools: consent orders and asset caps in the US, prescriptive guides and escalation frameworks in Europe.
US enforcement trajectory
The United States never formally adopted BCBS 239 as binding regulation. It didn't need to. US regulators enforce the same substance (data governance, risk data aggregation, accuracy, timeliness) through different instruments: the OCC's Heightened Standards (12 CFR 30, Appendix D, §II.J), the Fed's LFI Rating System (SR 19-3), and safety & soundness orders under 12 U.S.C. § 1818(b).
The enforcement record speaks for itself. Three cases tell the story.
Citigroup
A 2020 OCC consent order with a $400M civil money penalty cited deficiencies in data governance. A July 2024 amendment added $75M more. Then, in December 2025, withdrawal of that amendment, while the original 2020 order remained in force. Citi stated that "Most of our programs are at or nearly at target state" (Citi press statement, Dec 2025; PYMNTS coverage), but cumulative penalties on these two actions alone exceed $535.6M, and broader remediation spend has been reported as substantially higher.
The lesson is structural, not cautionary. Late, partial, or uneven remediation stays under supervisory scrutiny for years. Progress gets recognized (the amendment withdrawal shows that), but foundational orders persist until the supervisor is satisfied that the underlying capability is durable, not just the most recent deliverable.
JPMorgan Chase
In March 2024, the OCC and Fed fined JPMC $348.2M for trade surveillance failures. The OCC found that the bank "failed to surveil billions of instances of trading activity on at least 30 global trading venues." That is a data aggregation failure, precisely the kind of gap BCBS 239 Principle 2 was designed to prevent. The bank couldn't demonstrate completeness of its own trading data across venues, and the regulators treated it as a safety & soundness violation.
Wells Fargo
In February 2018, the Fed imposed a $1.95 trillion asset cap on Wells Fargo for risk management failures. The cap constrained the bank's growth for more than seven years across 13 consent orders before it was lifted in June 2025. The total economic cost (lost growth, constrained lending, sustained executive distraction) is incalculable but plainly in the tens of billions.
For board purposes: these three cases represent different failure modes (data governance, data aggregation, enterprise risk management) and different enforcement tools (consent orders, civil money penalties, asset caps). What they share is a common root: the inability to demonstrate that risk data processes were sound, governed, and complete.
OCC Heightened Standards threshold proposal
In December 2025, the OCC proposed raising the Heightened Standards applicability threshold from $50 billion to $700 billion in total assets, a change that would reduce the number of covered banks from approximately 38 to approximately 8. This is a deregulatory signal, and it has not been finalized. But it does not eliminate risk data obligations. Safety & soundness authority under 12 U.S.C. § 1818(b) applies regardless of size thresholds, and the enforcement cases above demonstrate that the OCC and Fed use that authority aggressively. What changes is the regulatory instrument, not the regulatory expectation.
How the ECB changed the game
In Europe, the shift has been even more explicit. Three transitions define the current supervisory posture. Understanding them is the difference between a board presentation that says "regulators are getting serious" and one that says "here is exactly how the enforcement model has changed and what it means for our program."
From self-assessment to direct evidence
For years, many institutions approached BCBS 239 through internal maturity models and governance attestations. That worked when supervisors were checking tone and trajectory. It doesn't work now. The ECB's 2024 RDARR Guide introduced standardized Data Quality Indicators (DQIs) and Corrective and Improvement Requests (CIRs), mechanisms designed to test control performance, not control design.
The guide is explicit about what evidence looks like:
"Institutions should have comprehensive data lineage documentation at data attribute level." (ECB RDARR Guide, p.16)
Not process-level mapping. Not architecture diagrams. Attribute-level traceability from source system to submitted figure. Institutions that still rely on manual reconciliations or undocumented transformations are exposed, even when reported outputs happen to be accurate, because the supervisor's question has changed from "is the number right?" to "can you prove why it's right?"
From principles to prescriptive measurement
BCBS 239 remains principles-based. But European supervision is now operationally prescriptive in how it tests those principles. By February 2025, the ECB had 105 banks in a Management Report process with DQIs, CIRs, and a defined escalation framework. That's operational supervision at scale, not policy signaling.
Capco's 2025 analysis frames this in context: the ECB has prioritized RDARR within SSM supervisory priorities for 2025– 2027, while banks continue to struggle with full compliance.
"ECB prioritized RDARR in line with SSM supervisory priorities for 2025-2027... Banks continue to face challenges in fully complying." (Capco, May 2025)
And ECB leadership has not been ambiguous about consequences. Elizabeth McCaul stated in March 2024 that adequate capabilities were "still the exception", and the available escalation tools include periodic penalty payments, binding qualitative decisions, and capital impacts.
"Adequate RDARR capabilities that support steering and decision-making are still the exception." (ECB blog, Mar 2024)
From recommendations to enforcement posture
Then came 2026. As SAVE Consulting Group summarized from ECB messaging, the framing shift is now complete:
"Prudential compliance is no longer a downstream verification on reporting, but a significant assessment of the processes that generate regulatory information." (SAVE CG summary of ECB position, Feb 2026)
Banks must document the path from original data to submitted figure. Data quality is treated as ex-ante and verifiable. The compliance question has moved upstream, past reports, past aggregation, into the production process itself.
Regulatory convergence: why BCBS 239 investment compounds
This is the strategic argument for the board. BCBS 239 is no longer a standalone compliance program. The capabilities it requires are now load-bearing infrastructure for at least three other regulatory streams. Every dollar invested in attribute-level lineage, automated controls, and governed data pipelines pays dividends across the stack.
DORA
The Digital Operational Resilience Act, effective January 2025, requires financial entities to govern ICT risk with testing, incident handling, and third-party oversight. BCBS 239 programs that depend on brittle manual controls or opaque vendor pipelines create dual exposure: prudential data risk and resilience risk. Under DORA, critical reporting data flows must be resilient under disruption, control execution must be demonstrable under stress, and technology dependencies must be auditable. A well-architected BCBS 239 operating model already provides this.
EU AI Act
The EU AI Act, including Article 10's data governance provisions, sets expectations for data quality, representativeness, and governance controls in high-risk AI systems. Banks deploying AI in risk, finance, or control functions need lineage and provenance for dataset accountability, quality controls for model input integrity, and governance artifacts for supervisory explainability. These are BCBS 239 capabilities by another name. A weak data foundation is no longer just a reporting weakness. It's a multiplier for AI governance risk.
SR 11-7
The Federal Reserve's SR 11-7 guidance on model risk management is inseparable from data quality. If a model can't evidence input lineage, transformation controls, and quality thresholds, validation conclusions are fragile. BCBS 239 and SR 11-7 are converging operationally: one governs data trustworthiness, the other governs the trustworthiness of decisions built on that data.
The convergence argument is concrete: an institution investing in BCBS 239 capabilities (attribute-level lineage, automated quality controls, governed metadata) is simultaneously building its DORA resilience posture, its AI Act compliance foundation, and its model risk evidence base. A board should evaluate BCBS 239 spend not as a regulatory tax, but as shared infrastructure across the emerging control stack.
What a 2026 program looks like
The strategic mistake is treating RDARR as a reporting workstream owned by one function. Supervisors are evaluating whether institutions can produce trustworthy numbers consistently, quickly, and under pressure. That is an enterprise capability question, and the program design should reflect it.
Re-baseline against attribute-level lineage. Most programs overstate maturity based on architecture diagrams. The supervisory bar is now attribute-level traceability (ECB RDARR Guide, p. 16): each critical reported value traced to source attributes, all transformations versioned, control evidence producible on demand. If that capability is inconsistent across portfolios or legal entities, residual supervisory risk is higher than internal reporting suggests.
Shift from control design to control performance. Supervisors expect proof that controls execute in production, not just that they've been designed. Automated DQIs tied to material data elements, exception workflows with ownership and SLAs, immutable evidence trails. These are the building blocks of the ECB's management reporting and escalation framework.
Unify across regulatory streams. Don't run separate remediation programs with separate taxonomies. A common data element inventory, shared lineage standards, an integrated issue taxonomy across prudential, resilience, and model risk domains, and a unified evidence model for supervisors and internal audit. This reduces duplication and makes remediation durable.
Quantify manual intervention. Manual steps aren't automatically unacceptable, but ungoverned manual steps are. Establish thresholds, require rationale, trend usage over time. Where manual dependence is high, the fix is root-cause engineering, not another procedure document.
Rehearse supervisory scenarios. Test response capability: same-day reproduction of regulatory metrics, end-to-end lineage evidence packs, explanation of material variances, clear accountability from data owner to report owner. The objective isn't presentation polish. It's demonstrable operational command.
The board case
BCBS 239 in 2026 is not about whether an institution can eventually produce a correct number. It's about whether it can prove, continuously and credibly, that its data, controls, and governance produce trustworthy risk information by design.
US regulators have demonstrated the cost of failure: $535.6M+ for Citi, $348.2M for JPMC, and seven years of constrained growth for Wells Fargo. The ECB has moved from principles to prescriptive measurement. And the capabilities required for BCBS 239 are now shared infrastructure for DORA, the AI Act, SR 11-7, and model risk governance.
That changes the investment calculus. This isn't a compliance cost to minimize. It's enterprise infrastructure that either exists or creates compounding risk across every regulatory surface the institution touches.
