​The EBA consults on draft technical standards on institutions’ operational risk management

RegCanary interpretation

This is RegCanary analysis, not source text. Check material statements against the original publication.

The EBA's consultation on draft RTS under Article 323 of CRR3 marks a significant step toward harmonised operational risk management across the EU. For RegCanary clients, this signals the need to reassess existing operational risk frameworks against the proposed governance, process, and system requirements. While the consultation runs until the end of 2026, proactive engagement is advisable. Compliance teams should begin gap analysis now, particularly around risk identification, assessment, monitoring, and management processes. The draft standards emphasise proportionality, so smaller institutions may face lighter obligations, but all firms will need to demonstrate robust governance and clear accountability. Action is required on multiple fronts: reviewing current policies, assessing system capabilities, engaging with the consultation to shape final rules, and preparing for phased implementation. Early movers can align their operational resilience strategies with likely regulatory expectations, reducing future remediation costs and gaining stakeholder confidence. The consultation also creates an opportunity to influence the final technical standards, so firms should consider submitting responses that reflect practical challenges and data availability.

RegCanary impact assessment

RegCanary impact score: 10/10