BCBS 239 explained: How banks can prove data integrity to regulators

When a regulator asks where a number came from, “Let me check with the team” is not the answer anyone wants to give.

For banks, risk reporting depends on confidence in the data behind every figure, calculation and disclosure. The number matters, and the evidence behind the number matters just as much.

• Who owns it?
• Which system produced it?
• How did it change?
• Which controls were applied?
• Which policies govern it?
• Can the bank prove the full path from source to report?

These questions are at the heart of BCBS 239.

What is BCBS 239?

BCBS 239 is a set of principles from the Basel Committee on Banking Supervision that guides how banks aggregate risk data and report risk accurately, completely and quickly. It exists because fragmented data, inconsistent definitions and manual reporting processes make it harder for banks to understand exposure, respond to stress and satisfy supervisory expectations.

For Chief Risk Officers and Chief Compliance Officers, BCBS 239 tests whether the institution can trust its risk data under pressure. And pressure is the point. When the market moves, the regulator asks or the board needs answers, the data has to hold.

Why BCBS 239 still matters

Banks have spent years improving risk data aggregation and reporting. Yet many still rely on manual reconciliation, spreadsheet-based controls and institutional knowledge spread across teams.

That approach may work on a quiet Tuesday. It starts to wobble when reporting cycles tighten, products change, systems multiply or regulators ask for evidence.

The problem is rarely one missing report. The problem is the operating model behind the report.

Risk data lives in many locations:

• Trading systems
• Lending platforms
• Finance systems
• Customer records
• Data warehouses
• Regulatory reporting tools
• Local business processes

Each system may use different definitions, ownership models and quality checks. One team may define exposure one way. Another may apply a slightly different calculation. A third may manually adjust the result before submission.

The pain is familiar: no central repository for critical data elements, limited ability to document business and technical lineage and assess downstream impact when data changes, inconsistent or manual data quality controls and unclear guardrails for data usage and access controls. For a bank, those gaps don’t stay technical for long. They become regulatory exposure.

BCBS 239 asks banks to demonstrate more than reporting output. It asks them to show governance, accuracy, completeness, timeliness, adaptability and traceability across the data lifecycle.

In plain language: prove your numbers, prove your process and prove you can keep proving them when conditions change.

The core areas of BCBS 239

The BCBS 239 principles cover several expectations, but banks often operationalize them across four connected areas.

Governance and infrastructure

Banks need clear ownership, defined accountability and a data architecture that can support risk data aggregation and reporting. This means identifying who owns critical data, who approves definitions, who resolves quality issues and which systems support the reporting process.

Governance can’t live in a policy binder. It needs to operate inside the data environment. When ownership, policies and controls are disconnected from the systems that produce risk data, accountability becomes a scavenger hunt.

Risk data aggregation

Banks need to aggregate risk data accurately and completely across business lines, legal entities, asset types and regions. This requires consistent definitions, strong data quality, reliable metadata and visibility into how data moves.

This is where data lineage becomes essential. Risk teams need to see how data travels from source systems through transformations, calculations and reporting layers. Without data lineage tracking, teams can’t quickly understand whether a number is complete, current or compromised.

Risk reporting

Banks need risk reports that are accurate, clear, useful and delivered on time. That sounds straightforward until a report depends on dozens of upstream systems and a collection of manual handoffs.

Strong reporting depends on trusted critical data elements, or CDEs. A CDE is a data element that plays a material role in business operations, risk management, financial reporting or regulatory obligations. For BCBS 239, CDEs help teams focus controls where they matter most.

Supervisory review and remediation

Banks need to respond to supervisors, document issues and remediate gaps. Regulators want to know that a problem was fixed. They also want to know how the institution found it, who owned it, what controls changed and how the bank will prevent the issue from recurring.

That requires durable evidence. Evidence that does not depend on someone finding the right spreadsheet from last quarter.

Manual reconciliation is the slow lane

Today, manual reconciliation is one of the biggest obstacles to BCBS 239 maturity. Every manual check may feel reasonable in isolation. A spreadsheet here. A control signoff there. A few emails to confirm data ownership. A recurring meeting to resolve definition conflicts. But across a global bank, those small manual steps create delay, inconsistency and risk.

Manual processes also make it harder to scale automated compliance. If evidence has to be gathered by hand, every audit or supervisory request becomes a fire drill. If lineage has to be reconstructed manually, teams lose time when they most need clarity. If controls live outside the data lifecycle, teams may discover issues after the report is already in motion. This is how compliance monitoring becomes reactive. Teams spend too much time proving what happened and too little time improving the controls that determine what happens next.

A stronger approach connects data ownership, definitions, policies, quality rules, lineage and reporting controls in one governed operating model.

Where better governance creates measurable value

Regulatory reporting does not improve because teams work harder at the end of the process. It improves when control is built into the data lifecycle.

Many institutions still struggle with fragmented data environments, inconsistent ownership and manual controls that slow risk aggregation and reduce confidence in submissions. KPMG notes that weaknesses persist in fragmented IT landscapes and deficient risk data aggregation and reporting capabilities, which continue to draw supervisory attention and reinforce the need for stronger governance foundations.

These same governance gaps also show up in how banks support emerging data-driven initiatives. Gartner found that 63% of organizations lack the right data management practices, and predicts that 60% of AI projects will be abandoned without AI-ready data, reinforcing that governance is not only a regulatory requirement but a foundational capability for any data-dependent use case.

For banks, the impact is direct. Poor data quality and limited traceability slow down risk aggregation, increase reconciliation effort, and reduce confidence in regulatory submissions. Stronger governance changes that equation: faster reporting cycles, clearer ownership of critical data elements, fewer manual interventions, more trusted submissions and evidence that is ready before supervisors ask for it.

Those improvements come from the same foundation: trusted data, clear ownership, automated controls, transparent lineage and evidence that is ready before the regulator asks.

Why data lineage is central to regulatory evidence

For BCBS 239, data lineage helps answer the regulator’s most important question: show me how this number came to be.

Good data lineage should reveal where data originated, how it moved, how it changed and where it appeared in the final report. It should connect technical movement to business meaning, so risk and compliance teams can understand both the mechanics and the impact.

That is especially important for CDEs. If a CDE supports a capital calculation, liquidity report or credit risk exposure metric, teams need to know which systems feed it, which transformations affect it, which controls apply and who owns remediation when quality slips.

A data lineage solution gives teams the visibility to trace risk data from input to output. Data lineage best practices include documenting critical data flows, connecting lineage to business definitions, assigning ownership, monitoring quality and linking controls to the data elements they govern.

The goal is simple: reduce the distance between a regulatory question and a defensible answer.

What banks need to prove data integrity

To strengthen banking data governance and meet BCBS 239 expectations, banks need a foundation that supports clear ownership for CDEs, common business definitions across risk and finance teams, automated data lineage tracking, data quality monitoring tied to regulatory priorities, policy management, evidence capture and workflows for issue management and remediation.

This is how banks move from “we believe the number is right” to “we can prove how the number was produced, governed and approved.”

Build regulatory defensibility by design

Collibra helps banks replace reactive compliance with automated control, creating regulatory defensibility by design. Collibra connects data assets to business definitions, ownership, lineage, policies, quality signals, access controls and reporting processes.

That foundation helps risk and compliance teams prove data integrity with less manual effort. Teams can identify CDEs, trace data from source to report, document ownership, apply policies and monitor quality in a unified environment. Instead of assembling evidence after the fact, banks can build accountability into the way data moves.

For institutions managing complex regulatory obligations, this creates a more defensible operating model. It supports enterprise risk management, strengthens automated compliance and gives teams a clearer path from regulatory requirement to evidence of control.

Banks don’t need more disconnected documentation. They need a governed foundation that makes every critical number easier to trust, explain and defend.

For teams focused on building that foundation, Collibra helps organizations comply with regulations by connecting the data, controls and evidence behind trusted reporting.

See how Collibra can help your organization move from compliance chaos to complete control.

• 

  Collibra

  Collibra

  Unified governance for data and AI