EU publishes binding operational risk standards for credit institutions

The European Commission has published two regulations that complete the operational-risk framework of the Capital Requirements Regulation, setting out how EU credit institutions must calculate and report their operational risk capital requirements. Both texts appear in the Official Journal of the European Union (L series) of 3 September 2026 and were adopted in Brussels on 28 May 2026 under the signature of Commission President Ursula von der Leyen.

The package consists of Commission Delegated Regulation (EU) 2026/1167, which lays down regulatory technical standards specifying operational risk requirements, and Commission Implementing Regulation (EU) 2026/1166, which maps the components of the business indicator to the corresponding supervisory reporting cells. Both supplement Regulation (EU) No 575/2013 (the CRR) and carry EEA relevance, making them directly applicable in all Member States.

A financial-statement proxy for operational risk

The delegated regulation defines the business indicator, a financial-statement-based proxy for operational risk that replaces the old gross-income approach. It specifies which income and expense items must be included in, or excluded from, the indicator and its components, aligning the EU rules with international regulatory standards.

• Interest, leases and dividend component — includes interest income and expenses, lease items aligned with IFRS 16, and dividend income from non-consolidated investments.
• Service component — fee and commission income and expenses, including outsourcing fees for financial services.
• Financial component — trading and banking book profit and loss, with a “prudential boundary approach” to avoid unwarranted increases from economic hedging.

The regulation also sets out how operational risk events are to be reflected in other operating expenses, and how loss events are classified into Level 1 event types and Level 2 categories, including new attributes for legal risk and model risk.

Linking the indicator to FINREP reporting

The implementing regulation connects the business indicator to the FINREP templates laid down in Annex I to Commission Implementing Regulation (EU) 2024/3117. Each business-indicator item is mapped to a specific reporting cell, for example interest income from financial assets held for trading to cell F02.00_r0020_c0010.

Where there is no perfect correspondence between the indicator items and the template cells, institutions must adjust the reported values to ensure adherence to the components defined in the delegated regulation. Both texts are based on draft standards submitted to the Commission by the European Banking Authority, which conducted open public consultations and analysed the related costs and benefits.

Entry into force and impact

Both regulations enter into force on the twentieth day following their publication in the Official Journal, and are binding in their entirety and directly applicable in all Member States. Institutions must apply the prudential boundary approach consistently across the three financial years used for the calculation, and must notify their competent authorities of any material change in scope.

For Europe’s credit institutions, the package closes a key gap in the CRR by turning the operational-risk framework into concrete, reportable figures. Banks will now have a harmonised, auditable link between their financial statements and their operational risk capital charges, reducing divergence across national supervisors and giving regulators a consistent basis for comparing risk across the single market.

Source: Official Journal of the European Union, L series, 3 September 2026 (official references: Commission Delegated Regulation (EU) 2026/1167 and Commission Implementing Regulation (EU) 2026/1166, ELI reg_del/2026/1167 and reg_impl/2026/1166).