EBA versus the Commission: On Operational Risk, Brussels Overrules Its Own Banking Authority

It is rare for the EU Commission to publicly overrule its own banking authority. That is exactly what happened in May: in its opinion EBA/Op/2026/04, signed in Paris on 22 April 2026 by its Chair François-Louis Michaud, the EBA had explicitly objected to two substantive amendments the Commission had made to the Regulatory Technical Standards (RTS) on operational risk. On 28 May 2026, the Commission adopted Delegated Regulation C(2026)3200 final regardless – with both contested points. The Explanatory Memorandum does not mention the EBA opinion with a single word. Anyone working as Chief Risk Officer (CRO), in capital management or in regulatory reporting at a bank should not dismiss the episode as Brussels institutional theatre. Behind it sits a new option that can directly move the own funds requirement for operational risk – and a catalogue of obligations that will put early demands on governance, IT and reporting.

The dispute revolves around a technical but capital-relevant question: how is the financial component of the new business indicator calculated – along accounting boundaries or along the prudential trading book boundary? And above all: may a bank combine the two?

What is at stake: an option with capital impact

With the CRR 3 reform, a single standardised approach replaces the previous three operational risk methods – the basic indicator approach, the standardised approach and the advanced measurement approaches (AMA). The own funds requirement will in future be determined solely by the Business Indicator Component (BIC): the Business Indicator (BI) multiplied by tiered coefficients of 12, 15 and 18 per cent. The BI itself consists of three building blocks – the interest, leases and dividend component (ILDC), the services component (SC) and the financial component (FC), which captures trading results. Put simply: the larger the BI, the higher the own funds requirement for operational risk.

The FC is the contested part. Under the accounting approach (AA), the bank adds the absolute three-year averages of the results of the trading book and the banking book – along accounting boundaries. That penalises a common business pattern: whoever hedges a banking book position with a trading book derivative sees both profit and loss contributions added in absolute terms, even though they largely offset each other economically. The prudential boundary approach (PBA) corrects this by applying the prudential trading book boundary of the CRR. Affected are institutions with cross-book hedging and structured issuances; recital 16 of the adopted act explicitly names the hedging of "structured issuances" – a business that in Germany is conducted above all by Pfandbrief and Landesbanken, to add a classification the act itself does not make. Classic retail banks without cross-book hedging are barely touched by the option.

How large the lever can be is shown by a stylised calculation that expressly only illustrates the mechanics: a bank with a BI of EUR 5 billion – of which EUR 1 billion is FC – carries a BIC of EUR 720 million (12 per cent on the first billion, 15 per cent on the further four). If the PBA reduces the FC to EUR 0.5 billion because offsetting hedge results no longer count twice, the BIC falls to EUR 645 million. The difference of EUR 75 million in own funds requirements explains why this seemingly technical detail is being read very carefully inside the institutions.

How the EBA was overruled

The chronology is remarkable. The EBA submitted its final drafts in two tranches – on 16 June 2025 on the business indicator, on 4 August 2025 on operational risk losses. On 8 October 2025, the Commission announced it would merge both into a single legal act. On 2 March 2026, the formal notification followed that it intended to adopt the draft with amendments – which under Article 10(1) of the EBA Regulation 1093/2010 triggers a six-week period for an opinion. The EBA used it and objected to both substantive amendments in no uncertain terms. The combination of PBA and AA, it argued, is not envisaged in the Basel framework, increases complexity, opens the calculation to "cherry-picking" and carries the risk of an "unlevel playing field", because each bank would make its own materiality assessment.

What is remarkable is how completely the Commission set the opinion aside. The EBA had not merely formulated its primary position – exclusive use of either the AA or the PBA for the entire balance sheet. For the event that the Commission stuck to the combination model, it had presented a fallback drafting with three safeguard clauses in Annex I of its opinion: banks should at least anchor their materiality definition in internal documents and make it available to supervisors, the materiality concept should be removed from the offsetting condition in Article 9(b)(iv), and the reporting obligations in Article 13(2)(i) should be specified more precisely. The adopted act takes up none of the three clauses. The Commission has thus rejected not only the EBA's primary position but also all of its fallback safeguards. Legally, this is permissible: the EBA opinion does not bind the Commission. The EBA Regulation itself states, however, that amendments to draft RTS should occur only in very restricted and extraordinary circumstances.

The consequence for practice is a genuine regulatory gap: the act obliges banks to notify "material changes" to the PBA scope – but leaves open what a material change is. Even the EBA's fallback demand to at least anchor the definition in internal documents was not adopted. Each bank thus effectively defines materiality itself, and each supervisor must assess that self-assessment individually – exactly the scenario the EBA had warned against.

What awaits the PBA user

Anyone wishing to exercise the option should first read the procedural side of the act, because it is more demanding than the headline suggests. Article 13(1) requires advance notification to the competent authority at least 90 days before first use – for significant institutions, it goes to the European Central Bank (ECB) or the Joint Supervisory Team. The notification comprises an eleven-part documentation catalogue: among other things, the approval of the management body, the description of the operations causing the unwarranted increase in the FC, the affected portfolios including nominal, notional and market values, a full impact analysis on the trading book component, the banking book component, the FC, the BI and the operational risk own funds requirement, as well as an independent review report by the risk control function or by internal or external audit.

Three procedural details deserve particular attention. First, under Article 13(3) the 90-day clock only starts once the documentation is complete – an incomplete submission pushes the start date back. Second, Article 13(4) requires annual updates of the core of the documentation. Third, the way back is more barred than the way in: if any of the conditions of use ceases to be met, the bank must revert to the AA under Article 14 – and may not use the PBA again during the following three financial years. The reversal itself must also be notified 90 days in advance under Article 15. Added to this is the consistency requirement of Article 12(4): the PBA must be applied across all three calculation years of the financial component; selectively opting in and out in individual years is ruled out. Anyone who understands the PBA as a tactical instrument for short-term capital optimisation will fail against these rules – and that is precisely their intention.

The Commission's rationale

An honest assessment must acknowledge that the Commission's side has a legitimate rationale – and that the EBA itself recognises it. In its opinion, the EBA expressly notes that the Commission wants to make the PBA accessible to more institutions, and acknowledges that the conditions in the Commission's draft are aimed at reducing the potential for regulatory arbitrage. Indeed, the adopted act contains two substantive anti-arbitrage requirements: banks must demonstrate to their supervisor that the selection of the PBA scope is not made to engage in regulatory arbitrage, and the three-year consistency rule prevents opportunistic switching between the approaches. From the Commission's perspective, the combination model opens up a sensible instrument for groups in which only individual entities or types of operations – such as the hedging of structured issuances – would report a distorted FC under the AA. The EBA's objections concern the price rather than the goal: more complexity, harder comparability, higher demands on supervisors. Both positions are defensible; the question has now been decided by the legislative process, not by the technical debate.

What institutions should do now

Four work packages follow from the episode – regardless of whether an institution ends up using the PBA or not.

Risks and open questions

Four caveats belong to the assessment. First, the act is not yet final: the European Parliament and the Council can object during the ongoing scrutiny period – three months from transmission on 28 May 2026, extendable by a further three. An objection is considered unlikely but is not ruled out; until publication in the Official Journal, every implementation decision remains a bet on the most probable outcome. Second, the materiality question remains unregulated – it is quite possible that the EBA or national supervisors will later close the gap through Q&As or supervisory practice, then possibly more strictly than some internal definition provides for today. Third, the deliberate deviation from the Basel framework creates a flank in international comparisons: institutions using the combined PBA must expect analysts and rating agencies to adjust capital ratios for the effect. And fourth, the reversal rule is an operational risk of its own kind – whoever breaches the conditions of use loses the PBA for three years and must abruptly unwind the capital effect.

The sober summary: the Commission has created an option that can release real capital for a limited number of institutions, and has accepted open dissent with its own banking authority in the process. For the institutions concerned, this is an opportunity with a package insert: the capital benefit is real, and so are the governance requirements. Whoever reads both together has the advantage – whoever reads only the headline will end up signing the package insert unread.

Christian Schablitzki

Strategy & Management Consultant · Agentic AI expert for financial institutions

More than 20 years in investment banking and derivatives trading, followed by more than 10 years as a consultant for financial institutions. Currently Partner at Infosys Consulting in Germany. Certified in Google AI, Generative AI Leader (Google Cloud) and IBM RAG and Agentic AI.

LinkedIn profile →