What is BCBS 239?
A Summary of Key Principles
& Compliance

Adaptable, Accurate and Fast BCBS239 Reporting

Trust in the accuracy of your data and prove outcomes to regulators and senior management with visualized data lineage.

Are you aware of how BCBS239, a key regulation for financial institutions, requires you to ensure the accuracy of the data that underpins your business? And to demonstrate intent to control where exactly your data comes from and how precisely it changes, before it is used in key business activities, such as board-level decision making, AI recommendations and more?

If you don’t know, you need to, as not complying with BCBS 239 regulations could result in fines in the millions for your company.

What Are the 14 Key Principles of BCBS 239?

BCBS 239 outlines 14 principles across four main areas:

• Governance & Architecture – setting the foundation for strong oversight, data architecture, and IT infrastructure.
• Risk Data Aggregation – ensuring data is accurate, complete, timely, and adaptable.
• Risk Reporting – focusing on accuracy, comprehensiveness, clarity, frequency, and distribution of reports.
• Supervisory Review – covering independent reviews, remedial actions, and cooperation between home and host supervisors.

Together, these areas guide banks in building reliable data frameworks that improve decision-making, compliance, and financial stability.

Who do BCBS 239 Principles Apply to?

The BCBS 239 Principles apply to all Global Systemically Important Banks (G-SIBs) and are also recommended to be applied to Domestic Systemically Important Banks (D-SIBs) by national supervisors. Banks are required to be compliant with the BCBS 239 principles and a key component which drives compliance is the documentation of data lineage.

BCBS 239 Data Lineage: Why is it a Challenge for Banks?

Achieving BCBS 239 compliance requires banks to implement complete, granular and transparent data lineage across all critical systems. This has been a key challenge as it is among the most time-consuming and resource-intensive activities demanded by the regulation. Whilst this is the case, there are strong benefits to implementing a robust and consistent framework, summarized as follows:

Data Journey

Provides transparency of definitions of data and an understanding of the manipulation, transformation and aggregation of critical data as it travels through its journey into reporting. Supports a strong understanding of architecture in place.

Data Quality (DQ)

Provides clarity on the required data quality framework to be put in place, ensuring that DQ controls and supporting rules are placed in the correct place in the process, in the context of the potential risks and issues that could arise throughout the data journey.

Data Governance

Underpins a strong data ownership and data governance framework driving consistency, definitional alignment, and control across the critical data in scope.

Key Benefits

• Administer a common language across functions, while still allowing everyone to speak their own.
• Point-in-time system of record  – to be able to show exactly what knowledge was available and when.
• Ability to simulate change within  the models – demonstrate to all involved the impact of change based on the facts known at the time.
• Enterprise-scale modeling  and visualization – the ability to model complete flows is critical to BCBS 239 compliance.
• Reduce risk of non-compliance  – by identifying gaps – extent of knowledge is clear and demonstrable.
• Centralized repository, de-centralized collection – always use the subject matter experts to collect and validate the metadata and lineage.

Once you have data lineage that suits BCBS 239 data governance and compliance, you will have a foundation for other regulations – as there is some overlap between requirements. It will be easier then to add the requirements for other regulations around personal data, AI and more, keeping you proactive and up-to-date with regulations.

Penalties for BCBS 239 non-compliance

Banks that fail to comply with BCBS 239 may face supervisory actions ranging from lighter measures to more forceful penalties. These can include:

• Supervisory follow-up letters
• Mandatory independent reviews
• Capital add-ons (Pillar 2 requirements)
• Restrictions on business activity
• Restrictions on capital distributions
• Revisions to recovery and resolution plans
• Fines and penalties
• Other supervisory measures

In practice, regulators decide on a case-by-case basis, with severe breaches leading to heightened scrutiny and corrective action orders.

Download the Fact Sheet for more Detailed Information