Skip to content

FRM Exam Part I · Principles for Effective Data Aggregation and Risk Reporting

BCBS 239 Supervisory Review, Tools and Cooperation

Updated 11 October 2026 · Fact-checked

BCBS 239 Principles 12, 13 and 14 are aimed at supervisors, not banks. Principle 12: supervisors periodically review a bank's compliance with Principles 1-11. Principle 13: they use tools to require timely remedial action. Principle 14: home and host supervisors cooperate. To answer questions, first identify which principle the scenario tests.

Understand Supervisory Review, Tools and Cooperation

BCBS 239 is the Basel Committee's set of principles for effective risk data aggregation and risk reporting. It has 14 principles in four groups. Overarching governance and infrastructure covers Principles 1-2. Risk data aggregation capabilities cover Principles 3-6. Risk reporting practices cover Principles 7-11. Supervisory review, tools and cooperation covers Principles 12-14. This topic is the last group.

The first 11 principles tell the bank what to do. The last three tell supervisors what to do. This is the first thing to remember in the exam. If a question asks who is responsible for an action, banks own Principles 1-11 and supervisors own Principles 12-14.

Principle 12 (review and evaluation): supervisors should periodically review and evaluate a bank's compliance with Principles 1-11. They can use on-site reviews, off-site reviews and discussions with management. They can also use work by independent external reviewers. They should review whether the bank can produce accurate risk data quickly in stress or crisis conditions. They should also look at what happens when the bank changes, for example after an acquisition, a restructuring or a new business line.

Principle 13 (remedial actions and supervisory measures): supervisors should have, and use, appropriate tools and resources to require effective and timely remedial action when a bank falls short. The tools can include requiring an independent review of the bank's data and reporting. They can also include restrictions on business growth or new activities, and additional capital charges under the supervisory review (Pillar 2) process where appropriate. The key words are effective and timely.

Principle 14 (home/host cooperation): supervisors should cooperate with relevant supervisors in other jurisdictions on the review and implementation of the Principles. Global banks operate across borders. The home supervisor and host supervisors should share information and coordinate so that review work is not duplicated and gaps are not missed.

On timing, the Committee published the Principles in January 2013. Global systemically important banks (G-SIBs) were expected to comply from January 2016. Domestic systemically important banks (D-SIBs) were expected to comply within three years after being designated as such. The Committee's progress reports since then have found that implementation has been slow. Banks have found it hard to fully meet the Principles. The recurring problem areas are data architecture, fragmented IT systems, inconsistent data definitions and heavy reliance on manual workarounds. Governance and senior management ownership have also been recurring weaknesses.

Key formulas to remember

Principle 12: Review and evaluation
Supervisors periodically review and evaluate bank compliance with Principles 1-11
Tools include on-site and off-site review, discussion with management and independent external reviews. Includes testing ability to aggregate data in stress and after business changes.
Principle 13: Remedial actions and supervisory measures
Supervisors have and use tools and resources to require effective and timely remedial action
Examples: independent review, restrictions on growth or new business, Pillar 2 capital add-ons where appropriate.
Principle 14: Home/host cooperation
Supervisors cooperate with relevant supervisors in other jurisdictions on review and implementation
Aim: share information and coordinate so cross-border banks are reviewed consistently without gaps or duplication.
Grouping of the 14 principles
1-2 governance and infrastructure | 3-6 data aggregation | 7-11 risk reporting | 12-14 supervisory review, tools and cooperation
Use this map to place any scenario quickly.
Implementation timeline
Published January 2013 | G-SIBs: from January 2016 | D-SIBs: within three years of designation
Know the sequence. Progress reports since then have found incomplete compliance.

How to solve Supervisory Review, Tools and Cooperation questions

Use this method for any question on supervisory review, tools, cooperation, timeline or implementation challenges.

  1. 1Identify who acts in the scenario: the bank or the supervisor. Supervisor actions point to Principles 12-14. Bank actions point to Principles 1-11.
  2. 2Match the action to the principle. Evaluating compliance is 12. Requiring fixes or applying measures is 13. Working with other jurisdictions is 14.
  3. 3For Principle 12 questions, look for the review tools: on-site, off-site, external reviewers, stress or crisis testing of data aggregation, and review after business changes.
  4. 4For Principle 13 questions, check that the answer is a tool that forces effective, timely remediation, such as independent review, business restrictions or Pillar 2 capital measures.
  5. 5For Principle 14 questions, look for cross-border words: home, host, information sharing, coordination, avoiding duplication.
  6. 6For timeline questions, check the group: G-SIBs from January 2016, D-SIBs within three years of designation.
  7. 7For implementation challenge questions, pick the answer about data architecture, IT fragmentation, inconsistent definitions, manual processes or governance ownership.
  8. 8Eliminate options that claim banks alone decide compliance, or that treat the Principles as only advisory with no follow-up.

Quickest way: Who, what, where

When to use it: Use when you have under 90 seconds for a conceptual MCQ on Principles 12-14.

  1. Who: supervisor or bank? Supervisor means 12-14.
  2. What: assess (12), force a fix (13), coordinate across borders (14).
  3. Where: single jurisdiction means 12 or 13. Multiple jurisdictions means 14.
  4. Pick the option that matches the verb and discard options that misassign the actor.

Common mistakes in Supervisory Review, Tools and Cooperation

  • Assigning Principles 12-14 to banks

    Candidates remember BCBS 239 as a bank data standard and forget the last three principles address supervisors.

    Fix: Link 1-11 to banks and 12-14 to supervisors. Check the actor in every question.

  • Confusing Principle 12 review with Principle 13 remediation

    Both involve supervisors and compliance, so the verbs blur.

    Fix: Review and evaluate means 12. Require action or apply measures means 13. Finding the gap is 12, fixing it is 13.

  • Saying Principle 14 only applies to the home supervisor

    Candidates read home/host as meaning the home supervisor leads and alone acts.

    Fix: Remember it is cooperation among relevant supervisors in different jurisdictions, home and host.

  • Mixing up the implementation dates

    Candidates confuse the January 2013 publication with the January 2016 G-SIB compliance date, and forget D-SIBs have a different rule.

    Fix: Publication 2013, G-SIBs 2016, D-SIBs three years after designation.

  • Claiming the review covers only normal conditions

    Candidates think of review as a routine check of reports.

    Fix: Remember supervisors should also test whether banks can aggregate data in stress or crisis and review after business changes.

  • Naming the wrong compliance challenge

    Candidates pick generic answers such as lack of staff, instead of those from the progress reports.

    Fix: Choose data architecture, fragmented IT, inconsistent definitions, manual processes and governance ownership.

Worked examples

Example 1

A regulator finds that a bank's risk reports cannot be reconciled to its accounting data. It orders an independent review of the bank's data and reporting and requires a fix by a set date. Which BCBS 239 principle is the regulator mainly applying?

A. Principle 3, accuracy and integrity
B. Principle 12, review and evaluation
C. Principle 13, remedial actions and supervisory measures
D. Principle 14, home/host cooperation

Show the solution
  1. Identify the actor: a regulator, so Principles 12-14 apply. Option A is a bank principle and is eliminated.
  2. Identify the action: the regulator orders an independent review and requires a fix by a set date. That is forcing remediation.
  3. Principle 12 would be assessing compliance. The finding is already made, so the new action is a measure.
  4. Principle 14 requires a cross-border element. None is mentioned, so it is eliminated.
  5. Principle 13 covers tools to require effective and timely remedial action, including independent review.

Answer: C. Principle 13

Example 2

A bank headquartered in one country has large subsidiaries in three other countries. Which action best reflects Principle 14?

A. The home supervisor alone reviews group-wide data aggregation and ignores host findings
B. Each host supervisor reviews its subsidiary independently without sharing information
C. Supervisors share findings and coordinate their review of the bank's implementation across jurisdictions
D. The bank selects which supervisor reviews its data aggregation

Show the solution
  1. Principle 14 is about cooperation among relevant supervisors in different jurisdictions.
  2. Option A ignores host supervisors, so there is no cooperation.
  3. Option B has no information sharing, so it is not cooperation and risks gaps and duplication.
  4. Option D gives the bank control over its own review, which contradicts the role of supervisors.
  5. Option C describes information sharing and coordinated review.

Answer: C. Supervisors share findings and coordinate their review across jurisdictions

Exam tips

  • Start every question by asking whether the actor is a bank or a supervisor. This eliminates two options quickly.
  • Memorise the grouping 1-2, 3-6, 7-11, 12-14 so you can place a scenario in seconds.
  • Know the verbs: review and evaluate (12), require remedial action (13), cooperate (14).
  • Do not memorise progress report numbers. Questions are more likely to test the themes: slow progress, data architecture and IT issues, and governance.
  • Learn the timeline in order: 2013 publication, 2016 for G-SIBs, three years after designation for D-SIBs.

Practice questions from Principles for Effective Data Aggregation and Risk Reporting

Supervisory Review, Tools and Cooperation: frequently asked questions

What does BCBS 239 Principle 12 require?

It requires supervisors to periodically review and evaluate a bank's compliance with Principles 1-11. They can use on-site and off-site reviews and independent external reviewers. They should also test the bank's ability to aggregate data in stress or crisis and review changes such as acquisitions.

What can supervisors do under Principle 13?

They should have and use appropriate tools and resources to require effective and timely remedial action. Examples include requiring an independent review, restricting growth or new business, and applying Pillar 2 capital measures where appropriate.

When did banks have to comply with BCBS 239?

The Principles were published in January 2013. G-SIBs were expected to comply from January 2016. D-SIBs were expected to comply within three years after being designated.

What have BCBS 239 progress reports found about banks?

They have found that implementation has been slow and compliance incomplete. Common challenges are data architecture, fragmented IT systems, inconsistent data definitions, manual processes and weak governance ownership.

How is BCBS 239 tested in FRM Part I?

Expect conceptual multiple-choice questions. They usually ask you to match a scenario to a principle, identify the supervisor's role, or pick a typical implementation challenge. There is no calculation.