BCBS 239 and data lineage: what supervisors expect from bank data platforms

BCBS 239, the Basel Committee’s Principles for effective risk data aggregation and risk reporting, was published in January 2013 after the financial crisis showed that many banks could not quickly and accurately add up their risk exposures. More than a decade on, supervisors still find gaps, and data lineage is at the centre of most of them.

Not legal advice. Confirm your obligations with your compliance team and supervisor.

The 14 principles in four groups

Group	Principles
Overarching governance and infrastructure	1 Governance · 2 Data architecture and IT infrastructure
Risk data aggregation capabilities	3 Accuracy and integrity · 4 Completeness · 5 Timeliness · 6 Adaptability
Risk reporting practices	7 Accuracy · 8 Comprehensiveness · 9 Clarity and usefulness · 10 Frequency · 11 Distribution
Supervisory review, tools and cooperation	12 Review · 13 Remedial actions and supervisory measures · 14 Home/host cooperation

Why lineage carries so much weight

Look at what the highlighted principles ask:

• Data architecture (2): an integrated architecture with defined data taxonomies and ownership. Lineage shows how data actually moves through it.
• Accuracy and integrity (3): risk data reconciled to sources, with controls. You cannot reconcile what you cannot trace.
• Completeness (4): all material risk captured across the group. Lineage reveals sources that never made it into the aggregate.
• Adaptability (6): produce ad-hoc aggregations quickly in a stress or crisis. Knowing which sources and transformations feed each measure makes new cuts fast and safe.
• Report accuracy (7): reports reconciled and validated. Lineage links each reported number to the controls applied on the way.

The European Central Bank’s guide on effective risk data aggregation and risk reporting (May 2024) sets out its expectations in seven key areas, including complete and up-to-date data lineage for key indicators and reports. In practice, supervisors expect lineage from the source system to the final report, including the manual adjustments and spreadsheets that sit in between.

What good lineage looks like for BCBS 239

1. Scope from the reports backwards. Start with the key risk reports and their critical data elements (for example exposure at default, risk-weighted assets, liquidity measures), then trace each back to source.
2. Column level for critical data elements. Table-level lineage shows that a report reads from a table; column-level lineage shows which source fields and which transformations produce the number.
3. Include the manual steps. End-user computing, overrides and spreadsheet adjustments are where lineage usually breaks and where supervisors look first. Record them, then reduce them.
4. Capture automatically where possible. Platform lineage (for example Unity Catalog on Databricks, access history and lineage views on Snowflake, Microsoft Purview with Fabric) stays current as code changes. Hand-drawn diagrams go stale within a quarter.
5. Attach controls and owners. Each critical data element should have an owner, data quality checks and reconciliation points visible alongside its lineage.
6. Keep it current. Treat lineage as part of the change process: a new pipeline or report is not done until its lineage and controls are recorded.

Where modern platforms help, and where they do not

Cloud data platforms capture lineage for the work they run, which covers a large part of a modern risk data flow. They do not see what happens in source systems, external tools, or spreadsheets outside the platform. Most banks need a catalog that stitches platform lineage together with lineage from ETL tools and documented manual steps. A migration to a lakehouse or cloud warehouse is a good moment to move risk calculations into governed, lineage-tracked pipelines.

The short version

BCBS 239’s principles on architecture, accuracy, completeness, adaptability and report accuracy all rely on knowing where risk data comes from and what happened to it. Supervisors expect complete, current lineage for key risk reports, including manual steps. Scope from the reports backwards, capture lineage automatically at column level, attach controls and owners, and keep it current through change management.

Related: what is data lineage, what is Unity Catalog, DORA for bank data platforms, our data quality and governance service and our financial services page.

Sources

• Principles for effective risk data aggregation and risk reporting (BCBS 239), Basel Committee on Banking Supervision, January 2013
• Guide on effective risk data aggregation and risk reporting, ECB Banking Supervision, May 2024