- The European Commission adopts Delegated Regulation (EU) 2026/1167, specifying operational risk requirements under the CRR (Regulation 575/2013).
- The business indicator is calculated using three components: interest/leases/dividend, services, and financial, with two calculation options for the financial component.
- A new two-level taxonomy classifies operational loss events into 7 event types and 24 sub-categories, with attributes including ICT risk, ESG, and third-party risk.
- Institutions with a business indicator of EUR 750 million or more must calculate the annual operational risk loss; exemptions apply for M&A and bridge institutions.
- The prudential boundary approach for economic hedging requires 90 days' prior notification, documented hedging relationships, and consistent application over three financial years.
Background
The European Commission has adopted Delegated Regulation (EU) 2026/1167 of 28 May 2026, supplementing Regulation (EU) No 575/2013 (the Capital Requirements Regulation, CRR) with regulatory technical standards specifying operational risk requirements. The regulation is based on a draft submitted by the European Banking Authority (EBA) and entered into force on the twentieth day following its publication in the Official Journal of the European Union. It is binding in its entirety and directly applicable in all Member States.
The regulation was signed by Commission President Ursula von der Leyen and is based on open public consultations conducted by the EBA, along with a cost-benefit analysis incorporating input from the Banking Stakeholder Group.
The Business Indicator: Three Components
The business indicator is a financial statement-based proxy for operational risk and constitutes the central element in calculating capital requirements. The regulation specifies three components:
| Component | Content |
|---|---|
| Interest, leases and dividend | Interest income/expenses, lease income/expenses (incl. IFRS 16), dividend income from equities and funds, plus an asset component summing balance sheet assets |
| Services | Other operating income/expenses, fee and commission income/expenses (securities, corporate finance, asset management, custody, payment services, etc.) |
| Financial | Net profit/loss from trading book and banking book, hedge accounting, and exchange differences |
The financial component can be calculated using two methods:
- Accounting approach: Calculation based on the applicable accounting framework, summing the trading book and banking book.
- Prudential boundary approach: Permitted in cases of economic hedging of fair-value positions or bifurcation of embedded derivatives where the accounting approach produces an unwarranted increase. Requires 90 days' prior notification to the competent authority, documented hedging relationships, and consistent application over three financial years.
"Institutions intending to adopt the prudential boundary approach shall be able to calculate the profit and loss of all positions held in the prudential trading book and the prudential non-trading book over the three financial years envisaged for the calculation of the financial component."
Exclusions from the Business Indicator
The regulation clarifies which items must NOT be excluded:
- Income and expenses from the distribution of insurance or reinsurance products or services must not be excluded
- Outsourcing fees for financial services, lease expenses, and administrative expenses (including staff costs) arising from operational risk events must not be excluded
- Depreciation, amortisation, and impairment related to lease assets or resulting from operational risk events must not be excluded
Operational risk events shall be included gross of insurance/reinsurance but net of other recoveries.
Mergers, Acquisitions, and Disposals
Following an acquisition or merger, institutions must include the acquired or merged entities in the business indicator based on historical audited financial statements. Alternatively, an M&A factor may be used where historical data are not available:
The M&A factor is calculated as: (NOI of the acquired/merged entity) / (NOI of the acquiring institution)
For disposals, the competent authority may grant permission to exclude the business indicator amounts of the disposed entity, provided that:
- The contribution to operational risk losses over at least five financial years has been analysed
- Contractual compensation/indemnity arrangements are documented
- The impact on the operational risk management structure is assessed
- The application is submitted at least 90 days before the intended adjustment
For low-impact disposals (NOI of disposed entities ≤ 5% of the institution's NOI), permission is deemed granted where the competent authority does not object within 90 days.
Taxonomy of Operational Risk Losses
Institutions with a business indicator of EUR 750 million or more must, in addition to the business indicator, compile data on operational risk losses and calculate their annual operational risk loss. The regulation establishes a two-level taxonomy:
Level 1: Seven Event Types
| Event Type | Description |
|---|---|
| 1. Internal fraud | Losses due to acts intended to defraud, involving at least one internal party |
| 2. External fraud | Fraudulent acts committed by an external party without internal involvement |
| 3. Employment practices and workplace safety | Losses from breaches of employment, health, or safety laws |
| 4. Clients, products and business practices | Losses from failure to meet professional obligations, business practices, or product design |
| 5. Damage to physical assets | Losses from natural disasters, accidents, war, terrorism, civil disturbance |
| 6. Business disruption and system failures | Losses from business disruption or system failures |
| 7. Execution, delivery and process management | Losses from failed transaction processing, data management, counterparties, and regulators |
Level 2: Detailed Categories
Each Level 1 event type is subdivided into Level 2 categories (24 categories in total), following international standards and industry best practices. Examples:
- Internal fraud: Bribery and corruption (1.1), Internal fraud against the institution (1.2), Internal fraud against other stakeholders (1.3)
- External fraud: Fraud by clients (2.1), Fraud not by clients (2.2), Data theft and manipulation (2.3), Robbery/burglary (2.4)
- Clients/products: Client mistreatment (4.1), Data privacy breach (4.2), Market abuse/anti-competition (4.3), Improper distribution (4.4), Financial crime (4.5), Breaches of statute (4.6), Improper product design (4.7), Model methodology (4.8)
Attributes for Loss Events
In addition to Level 1 and Level 2, institutions must assign one or more attributes to each loss event, including:
- Legal risk (misconduct / other than misconduct)
- Model risk
- ICT risk (cyber-related / not cyber-related)
- Credit risk, market risk
- Third-party risk
- ESG risk and greenwashing risk
- Business continuity
- Business line: Retail, Trading and sales, Commercial banking, Other
Loss events related to ICT third-party service providers shall be assigned both the 'ICT risk' and 'Third-party risk' attributes.
Retroactive Application and Reporting Requirements
| Level | Earliest Assignment |
|---|---|
| Level 1 (event types) | 1 January 2016 |
| Level 2 (categories) | 1 January 2025 (best effort/voluntary) |
| Attributes | 1 January 2025 (best effort/voluntary) |
Losses fully recovered within five working days are not included in the loss data set.
Exemptions for 'Unduly Burdensome' Calculation
The calculation of the annual operational risk loss shall be deemed unduly burdensome:
- For up to three financial years following a merger or acquisition where the business indicator exceeds EUR 750 million but does not exceed EUR 1 billion (reduced to two years if at least one party already calculated the operational risk loss)
- For up to four consecutive reporting dates (or eight of the preceding twenty) for institutions with a business indicator of EUR 750 million to EUR 1 billion
- For bridge institutions in the context of resolution
Consequences for the Banking Sector
The regulation harmonises the EU's operational risk requirements with international standards from the Basel Committee on Banking Supervision and IFRS. Key consequences include:
- Consistent calculation of the business indicator across all EU institutions
- Availability of the prudential boundary approach for economic hedging, subject to strict documentation requirements
- Standardised two-level taxonomy for operational loss events
- Clearer rules for M&A transactions to prevent regulatory arbitrage
- Integration of ICT third-party risk and ESG risk in loss classification
- 90-day notification requirement when switching between calculation methods
The regulation forms part of the broader CRR 3 reform and ensures that capital requirements for operational risk reflect institutions' effective risk profiles.