Proportionate does not mean less: what the EBA asks of smaller institutions on operational risk

On 26 August 2026 the European Banking Authority (EBA) opened a consultation on draft technical standards for the management of operational risk. One number sits at the centre of it: a business indicator of EUR 750 million, below which proportionate relief applies. Smaller institutions do not get off more lightly, however. Quite the opposite.

Two points repay a closer reading. The first concerns where the threshold comes from. The second concerns what happens below it.

The threshold is not the authority's

The 750 million euro threshold is not an EBA invention. They sit in Article 316(1) of the CRR: institutions with a business indicator at or above that level must calculate their annual operational risk loss. The EBA says so in the consultation paper itself, noting that the level 1 text obliges these institutions to maintain a loss data set. The authority inherits the legislator's dividing line and layers its own gradations on top of it.

Two features of the definition are routinely underestimated. What counts is not the current business indicator but the highest value across the last eight reporting reference dates, so a single outlier binds an institution to the stricter regime for two years. And between 750 million and EUR 1 billion there is a grey area: supervisors may exempt an institution from the loss calculation where it would be unduly burdensome.

Notably, the EBA itself puts the threshold up for discussion. Question 16, the last of the sixteen, asks whether differentiation by business indicator is appropriate or whether different but equally simple and consistent metrics should be introduced. That is not a rhetorical question.

Below the line, a duty appears that was never there

The legislation is clear on smaller institutions: an institution that need not calculate an annual operational risk loss has no duty to maintain a loss data set either. Article 319(1) of the CRR expressly ties the recording of losses at or above EUR 20,000 to the calculation under Article 316. Firms below the threshold are not caught.

The draft changes that. In its impact assessment the EBA writes that it also requires institutions with a business indicator below EUR 750 million to record losses above EUR 20,000, together with material losses below that figure. The operative text says the same: the reduced data set for smaller firms covers material loss data below EUR 20,000 where relevant, “and in any case above EUR 20,000”. A further duty is easily missed. These institutions must document the criteria by which a loss below the threshold counts as relevant.

The draft also goes beyond the regulation in the other direction. Institutions above the threshold are also to record losses below EUR 20,000 where relevant; for precisely that band, mapping them to the EBA taxonomy becomes mandatory. Above the threshold the mapping requirement already arises under the regulation.

The EBA considers the additional burden modest and defends this on practical grounds: most institutions already collect this data, it says, and merely use the portion above EUR 20,000 for the loss calculation. Whether that holds for smaller firms is exactly what Question 8 asks. Anyone minded to object has an opening there.

The proportionality mandate sits in the empowerment itself

Anyone asking whether this draft overburdens small institutions needs no external yardstick. The yardstick sits in the provision from which the draft draws its authority. Article 323(2) CRR instructs the EBA to specify the obligations in paragraph 1, and expressly instructs it to do so “taking into consideration the size and complexity of the institution”. Proportionality here is not an industry demand made after the fact. It is the condition on which the legislator handed over the power to regulate at all.

The old regime shows how much changes for a small institution. Before CRR3, three approaches sat alongside one another. The basic indicator approach, which small institutions typically used, derived the own funds requirement from a three-year average of the relevant indicator and required no loss data whatsoever. The standardised approach required, under Article 320 of the old text, a documented assessment and management system that also tracked material loss data, but with no de minimis threshold, no observation period and no reporting duty. Only the advanced measurement approaches carried a full loss database, and they were subject to approval and in practice confined to large institutions.

CRR3 abolished that choice and carried the wording of the old standardised approach (TSA) over into Article 323(1)(a), which now applies to every institution. The qualitative obligation to track losses therefore applies regardless of size, and this draft places the EUR 20,000 collection threshold on top of it. An institution that kept no loss data at all under the basic indicator approach will now have to maintain a data set with its own materiality criteria for losses below that threshold.

The figure itself is not the problem. The EUR 20,000 figure comes from the Basel framework, which sets it as the minimum threshold for including a loss event in the loss data collection and allows supervisors to raise it to EUR 100,000 for larger banks. Basel requires loss data as a capital input only above a business indicator of EUR 1 billion; the Union drew that line at EUR 750 million in Article 316, so it bites a quarter earlier than the global minimum requires. What is contested is therefore not the level of the threshold but its scope. The question is not whether the EBA may do this. It is whether this draft honours the mandate it rests on.

Governance, yes. But not without capital

The draft sets no own funds requirement. That can be read in the regulation, and more briefly than one might expect: Article 312 of the CRR consists of a single sentence stating that the own funds requirement for operational risk is the business indicator component. The European Union did not set the Basel internal loss multiplier to one; it removed it from the formula altogether. Historical losses therefore do not raise a European institution's capital requirement.

It would be too easy to conclude that the draft has nothing to do with capital. The assessment system it governs expressly includes the calculation of the business indicator component, and that component is the capital requirement. As a result, its calculation falls under internal validation and internal audit. The draft is therefore not a pure governance exercise, at least not to a risk controller who has read the provisions on validation and audit. Disclosure adds to this: institutions that calculate the annual operational risk loss must disclose their losses for the last ten financial years.

Dropping the internal models did not remove the data work

The pattern is not new to operational risk. It is the same exercise one regulatory generation earlier. Until the banking package reform, firms could choose between three routes to their own funds requirement, one of them the advanced measurement approach built on internal models. Recital 45 of Regulation (EU) 2024/1623 gives relief as the express reason for abolishing them: what had been observed was a “lack of comparability arising from a variety of internal modelling practices”, and in order “to simplify the operational risk framework” every existing approach was replaced by a single non-model-based method.

The Union then went further than international rules required. The Basel framework leaves jurisdictions a choice over whether loss history feeds into the capital calculation; Recital 46 exercises that choice so that historical operational loss data is disregarded for all institutions. For the purposes of the calculation, the losses a firm has painstakingly collected therefore count for nothing.

They still have to be collected. The regulation continues to require that a firm can map its historical internal loss data to the relevant event type when the competent authority asks, and it prescribes that IT systems and infrastructure carry the “soundness, robustness and performance” needed to maintain and update the loss data set. What was simplified was the formula, not the data work behind it. Anyone reading the current consultation in the hope of relief should hold that episode alongside it: it shows where easements in operational risk tend to stop.

One provision worth noting in the agentic context

The draft draws artificial intelligence into model validation. The article on internal validation covers models used for decision-making purposes and names “artificial intelligence applications” alongside product pricing. The consultation paper adds that institutions must identify risks arising from the increasing use of artificial intelligence and other new technologies, alongside environmental, social and governance risks and geopolitical risk.

That matters because of where it sits. Anyone tracking the supervisory treatment of AI systems looks to the AI Act and to the guidelines on outsourcing and third-party risk. A governance standard on operational risk pulls AI applications into scope here, by way of model validation. For firms running agentic systems in decision processes, that is the more concrete exposure.

A second clarification concerns compliance risk. The draft defines the framework expressly to include the risk of non-compliance. For compliance officers it settles the question of whether they sit inside operational risk management or beside it.

Ten days

On timing, the draft contains an oddity that only surfaces when you do the arithmetic. Article 323(2) of the CRR obliges the EBA to submit the finished standards to the European Commission by 10 January 2027. The consultation closes on 31 December 2026. Ten days separate the last response from the statutory delivery date.

The sister mandate from the same legal family provides the yardstick. For the standards on operational risk losses the EBA consulted until 6 September 2024 and submitted its final report on 4 August 2025: close to eleven months for assessment, revision and adoption. By choosing its consultation window, the EBA has in practice abandoned the statutory deadline for this framework.

Consistent with that, the chapter on next steps gives no date. It says only that the EBA will consider the responses and then submit the draft to the Commission, without naming a quarter and without reference to January. There is also a pointer to what may follow: the standards submitted in August 2025 have still not been adopted. The Commission announced amendments in March 2026 and the EBA responded formally in April 2026.

Recommendations

Glossary