BCBS 239
The Basel Committee's Principles for effective risk data aggregation and risk reporting (BCBS 239, January 2013; Basel Framework chapter SRP36): governance of risk data with independent validation and board oversight, data architecture and IT infrastructure that work in stress, accurate, complete, timely and adaptable risk data aggregation, and accurate, comprehensive, clear, timely and well-distributed risk reports, for systemically important banks. 11 bank-facing Principles as leaves; the three supervisory Principles, scope and the Committee's 2023 finding that only two of 31 G-SIBs fully comply are recorded as context.
BCBS 239 is a compliance framework from International with 3 domains and 11 controls that map to 8 other frameworks. The largest domains are Risk reporting practices (Principles 7 to 11) – BCBS 239 (5 controls), Risk data aggregation capabilities (Principles 3 to 6) – BCBS 239 (4 controls), Overarching governance and infrastructure (Principles 1 and 2) – BCBS 239 (2 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
Overarching governance and infrastructure (Principles 1 and 2) – BCBS 239
| Code | Title |
|---|---|
| bcbs-239::P1 | Principle 1: governance of risk data aggregation and risk reporting |
| bcbs-239::P2 | Principle 2: data architecture and IT infrastructure |
Risk data aggregation capabilities (Principles 3 to 6) – BCBS 239
| Code | Title |
|---|---|
| bcbs-239::P3 | Principle 3: accuracy and integrity of risk data |
| bcbs-239::P4 | Principle 4: completeness of risk data |
| bcbs-239::P5 | Principle 5: timeliness of risk data |
| bcbs-239::P6 | Principle 6: adaptability of aggregation |
Risk reporting practices (Principles 7 to 11) – BCBS 239
| Code | Title |
|---|---|
| bcbs-239::P10 | Principle 10: frequency of risk reports |
| bcbs-239::P11 | Principle 11: distribution of risk reports |
| bcbs-239::P7 | Principle 7: accuracy of risk reports |
| bcbs-239::P8 | Principle 8: comprehensiveness of risk reports |
| bcbs-239::P9 | Principle 9: clarity and usefulness of risk reports |
Your Compliance Coverage
If you comply with BCBS 239, you already cover:
Basel III International Banking Framework
84%
21 controls mapped
Compare →EDM Council DCAM - Data Management Capability Assessment Model
24%
6 controls mapped
Compare →Basel Core Principles for Effective Banking Supervision (2024)
8%
2 controls mapped
Compare →+ 5 more: ISO/IEC 42001:2023 (4%), ISO 27018:2019 (4%)
See all 8 mapped frameworks ↓Maps to 8 other frameworks
Coverage is not the same as your position
This page shows what BCBS 239 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is BCBS 239 and who does it apply to?
BCBS 239 is a compliance framework from International with 3 domains and 11 controls. The Basel Committee's Principles for effective risk data aggregation and risk reporting (BCBS 239, January 2013; Basel Framework chapter SRP36): governance of risk data with independent validation and board oversight, data architecture and IT infrastructure that work in stress, accurate, complete, timely and adaptable risk data aggregation, and accurate, comprehensive, clear, timely and well-distributed risk reports, for systemically important banks. 11 bank-facing Principles as leaves; the three supervisory Principles, scope and the Committee's 2023 finding that only two of 31 G-SIBs fully comply are recorded as context. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does BCBS 239 actually require?
BCBS 239 has 11 controls organised across 3 domains. The largest domains are Risk reporting practices (Principles 7 to 11) – BCBS 239 (5 controls), Risk data aggregation capabilities (Principles 3 to 6) – BCBS 239 (4 controls), Overarching governance and infrastructure (Principles 1 and 2) – BCBS 239 (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of BCBS 239 do I already cover?
BCBS 239 maps to 8 other compliance frameworks. The top mapping partners are Basel III International Banking Framework (84% coverage), EDM Council DCAM - Data Management Capability Assessment Model (24% coverage), Basel Core Principles for Effective Banking Supervision (2024) (8% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement BCBS 239?
Start your BCBS 239 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about BCBS 239 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 11 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required