Skip to content

FRM Exam Part I · Principles for Effective Data Aggregation and Risk Reporting

BCBS 239 Overview and Governance Principles Explained

Updated 11 October 2026 · Fact-checked

BCBS 239 is the Basel Committee's set of principles for effective risk data aggregation and risk reporting, issued in 2013 after the 2008 crisis exposed weak bank data. It applies to G-SIBs and is encouraged for D-SIBs. Governance and infrastructure are covered by Principles 1 and 2. To answer questions, match each scenario to the principle it breaches.

Understand BCBS 239 Overview and Governance

The 2007-2009 crisis showed that many large banks could not quickly and accurately work out their total exposure to a counterparty, product or region. Their risk data sat in separate systems, with manual fixes and no clear owner. Management could not see the risks it was running, so it could not act in time.

The Basel Committee on Banking Supervision responded with BCBS 239, titled Principles for effective risk data aggregation and risk reporting, published in January 2013. Risk data aggregation means defining, gathering and processing risk data so a bank can measure its performance against its risk tolerance. The aim is to improve decision making, not to add a new capital charge.

The document has 14 principles in four groups: overarching governance and infrastructure (Principles 1-2), risk data aggregation capabilities (3-6), risk reporting practices (7-11), and supervisory review, tools and cooperation (12-14). This topic covers the purpose, scope and the first group.

Scope: the principles were designed for global systemically important banks (G-SIBs), which were expected to comply by January 2016. National supervisors are encouraged to apply them to domestic systemically important banks (D-SIBs), usually within three years of the bank's designation. The principles apply to group-wide risk data, including material entities, and they hold in normal times and in stress or crisis.

Principle 1, Governance: a bank's data aggregation and reporting must be subject to strong governance. The board and senior management are responsible. They must ensure the framework is in place, that it is reviewed independently and that it fits the bank's group structure. Any reliance on third-party providers must not weaken it. Principle 1 also requires the bank to be fully aware of data limitations that affect decisions.

Principle 2, Data architecture and IT infrastructure: the bank should design, build and maintain data architecture and IT infrastructure that fully support its aggregation and reporting capabilities in normal times and in times of stress or crisis, while still meeting the other principles. Supervisors check that this does not depend on ad hoc manual work.

Key formulas to remember

Purpose of BCBS 239
Strengthen risk data aggregation and risk reporting to improve decision making
No numeric formula. Know the aim, and that it is about data quality and governance, not capital.
Structure of the 14 principles
1-2 Governance and infrastructure | 3-6 Aggregation capabilities | 7-11 Reporting practices | 12-14 Supervisory review
Principles 1 and 2 are the overarching group tested on this topic.
Principle 1 (Governance)
Board and senior management own the framework; independent validation; group-wide fit
Bank is aware of data limits; outsourcing does not remove responsibility.
Principle 2 (Data architecture and IT)
Integrated data taxonomies and architecture across the group, working in normal and stress times
Includes clear data ownership and classification.
Scope
G-SIBs first (by January 2016); D-SIBs encouraged, typically within 3 years of designation
Applies at group level and across material entities.

How to solve BCBS 239 Overview and Governance questions

Most questions give a short scenario or statement and ask which principle applies, or whether a statement is true. Use this method.

  1. 1Identify the topic cue: purpose, scope, governance, or infrastructure.
  2. 2If it is about purpose, link it to the 2008 crisis weakness: banks could not aggregate risk data quickly and accurately.
  3. 3If it is about scope, check the bank type. G-SIBs are required first; D-SIBs are encouraged by national supervisors.
  4. 4If a scenario mentions board oversight, independent review, outsourcing or awareness of data limits, choose Principle 1.
  5. 5If it mentions systems, data taxonomy, data ownership, manual workarounds or stress-time capability, choose Principle 2.
  6. 6Check the conditions: group-wide coverage, normal and stress times, and responsibility staying with the bank.
  7. 7Eliminate options that call the principles a capital rule, a numeric limit or something only for IT.

Quickest way: Two-word cue sorting

When to use it: When you have under 90 seconds and the options look similar.

  1. Governance = who is accountable: board, senior management, independent validation.
  2. Infrastructure = what the systems can do: integrated data, architecture, stress-time operation.
  3. Scope = who must comply: G-SIBs required, D-SIBs encouraged.
  4. Pick the option that is consistent with all three cues and drop any that claim capital charges or exemptions in stress.

Common mistakes in BCBS 239 Overview and Governance

  • Treating BCBS 239 as a capital requirement.

    Most Basel documents deal with capital ratios.

    Fix: Remember it is about data and reporting quality. It sets no capital ratio.

  • Saying it applies only to G-SIBs.

    G-SIBs were the initial target and had the first deadline.

    Fix: State that G-SIBs were the initial target and supervisors are encouraged to apply it to D-SIBs.

  • Believing outsourcing moves responsibility to the vendor.

    Operational tasks can be delegated, so accountability seems to go too.

    Fix: Under Principle 1, third-party reliance must not weaken governance. The bank stays responsible.

  • Thinking the principles only need to work in normal times.

    Day-to-day reporting feels like the main use.

    Fix: Principle 2 and the overall text require capability in stress and crisis too.

  • Mixing up principle numbers and groups.

    There are 14 principles with similar wording.

    Fix: Memorise the groups 1-2, 3-6, 7-11, 12-14 and link Governance and Infrastructure to the first group.

Worked examples

Example 1

A G-SIB's board approves a risk data framework but relies on a third-party vendor for aggregation and says the vendor is now accountable for data quality. Which statement best matches BCBS 239?

Show the solution
  1. The scenario is about accountability and outsourcing, so it points to Principle 1 (Governance).
  2. Principle 1 puts responsibility on the board and senior management.
  3. It also says reliance on third parties must not weaken the framework.
  4. So the bank cannot pass accountability to the vendor.

Answer: The bank remains accountable; outsourcing does not transfer responsibility under Principle 1.

Example 2

A D-SIB during a market stress event can produce group-wide exposure reports only after several days of manual spreadsheet work. Which principle is most clearly weak, and why?

Show the solution
  1. The issue is system capability, not board accountability, so look at Principle 2.
  2. Principle 2 requires architecture and IT infrastructure that support aggregation and reporting in normal times and in stress or crisis.
  3. Heavy reliance on manual work and slow stress-time output shows the infrastructure does not meet this.
  4. D-SIB status does not remove the concern, because supervisors are encouraged to apply the principles to D-SIBs.

Answer: Principle 2 (data architecture and IT infrastructure) is weak, because the bank cannot deliver group-wide risk data quickly in stress.

Exam tips

  • Know the four groups of principles and which numbers belong to each.
  • Expect scenario questions that ask you to match a weakness to Principle 1 or 2.
  • Watch for options that call BCBS 239 a capital rule or limit it to normal market conditions; these are usually wrong.
  • Remember the crisis link: the cause was poor risk data aggregation, not a lack of data entirely.
  • Keep G-SIB (required first) and D-SIB (encouraged) straight.

Practice questions from Principles for Effective Data Aggregation and Risk Reporting

BCBS 239 Overview and Governance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

BCBS 239 Overview and Governance: frequently asked questions

What is BCBS 239 in simple terms?

It is a Basel Committee set of 14 principles that tell banks how to collect, aggregate and report risk data accurately and quickly. It was published in 2013 after the 2007-2009 crisis showed weak data at large banks.

Why was BCBS 239 introduced after the financial crisis?

Many banks could not quickly identify their total exposures across business lines and legal entities. This slowed decisions and increased losses. The principles aim to fix data aggregation and reporting weaknesses.

Who must comply with BCBS 239?

G-SIBs were the initial target and had a January 2016 deadline. National supervisors are encouraged to apply the principles to D-SIBs, typically within three years of designation.

Which BCBS 239 principles cover governance and infrastructure?

Principle 1 covers governance and Principle 2 covers data architecture and IT infrastructure. Together they form the overarching group that supports the other principles.