Operational Risk Banking CRR3 2026: What Changes and How It Affects Capital

Key data

Banks operating in the European Union face a first-order regulatory obligation: to adapt their internal operational risk management systems to the new regulatory technical standards (RTS) established by the Delegated Regulation (EU) 2026/1167, published on September 3, 2026. This regulation completes the Regulation (EU) No. 575/2013 (CRR) within the framework of the reform known as CRR3, and it is not merely a matter of formal compliance: it directly affects how much capital each entity must immobilize.

Risk, compliance, and capital departments must act before the regulation becomes effective. Those who fail to do so in time risk having the supervisor impose additional capital requirements.

What does this regulation establish?

Delegated Regulation EU 2026/1167 develops the technical specifications of the new Standard Approach for operational risk introduced by CRR3. Specifically, it regulates two central elements of regulatory capital calculation:

The CRR3 Standard Approach replaces previous methods (Basic, Standard, and Advanced — AMA) with a single mandatory model. The key is that the adjustment for loss history (ILM) means that each bank's past operational losses have direct consequences for its future capital: a bank with many historical loss events will pay more capital; one with a clean history potentially less.

Economic and operational impact

The impact of this regulation is not homogeneous: it depends on each entity's historical loss profile and size. These are the concrete effects that capital and risk teams must anticipate:

• Variation in regulatory capital requirement: the adjustment for loss history can increase or reduce capital requirements. Entities with significant operational loss events in their history will see increases; those with a clean history could benefit from a reduction.
• Cost of adapting internal systems: systems for collecting, classifying, and reporting operational loss data must be adjusted to the criteria defined in the regulation. This involves investment in technology, processes, and training.
• Impact on capital planning: capital departments must recalculate their internal projections (ICAAP) using the new methodology to avoid surprises in supervisory reviews.
• Supervisory risk: non-compliance with data and methodology requirements can result in additional capital requirements imposed by the supervisor (Pillar 2), with direct impact on profitability and published capital ratios.

Who does it affect?

• Credit institutions licensed in the EU: banks, savings banks, and credit cooperatives subject to the CRR.
• Operational risk departments: responsible for collecting, classifying, and reporting loss events.
• Capital and ALCO departments: must recalculate requirements and update regulatory capital projections.
• Compliance departments: responsible for verifying that internal frameworks comply with the new RTS.
• CFOs and financial directors of banking entities: the capital impact directly affects return on equity (RoE) and dividend policy.
• Internal and external auditors: must verify that data systems and calculation methodology comply with the Regulation's criteria.

Practical example

Imagine a medium-sized European bank with a high business indicator and a history of operational losses that includes several significant events over the past ten years (internal fraud, system failures, process errors).

Under the new CRR3 Standard Approach, this bank must apply the adjustment for loss history (ILM) according to the exact methodology defined in Delegated Regulation EU 2026/1167. If its historical losses exceed the threshold resulting from the business indicator calculation, the ILM will act as an upward multiplier of the capital requirement: the bank will need to immobilize more capital than it would have needed under the previous method.

Conversely, a bank with a reduced and well-documented history of operational losses may see the ILM act as a reducing factor, freeing up capital that can be allocated to business or dividends.

The practical key: if historical loss data is not correctly collected and classified according to the criteria of the new regulation, the ILM calculation will be incorrect, and the supervisor may require adjustments or impose additional capital under Pillar 2.

What should companies do now?

1. Review the internal operational risk framework: verify that systems for collecting and classifying operational loss data comply with the criteria defined in Delegated Regulation EU 2026/1167. This is the most urgent step.
2. Recalculate the business indicator using the new methodology: capital teams must apply the Regulation's precise methodology to obtain an updated regulatory capital figure and avoid surprises in the supervisory review.
3. Evaluate the impact of the adjustment for loss history (ILM): analyze whether the entity's historical loss profile acts as a factor increasing or reducing required capital, and incorporate it into capital planning (ICAAP).
4. Adapt technological data systems: if current systems do not allow classifying loss events according to the Regulation's criteria, initiate the technology adaptation project with sufficient advance notice.
5. Train risk, capital, and compliance teams: ensure that professionals responsible understand the new methodological criteria and know how to apply them correctly.
6. Document the adaptation process: in the event of a supervisory review, the entity must be able to demonstrate that it has implemented the required changes. Documentation is key to avoiding additional capital requirements under Pillar 2.

Official source

Consult the complete regulation at official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026R1167