RDARR and the ECB’s May 2024 guide, preparing evidence for supervisory review

The 2024 guide clarifies supervisory expectations

On 3 May 2024, ECB Banking Supervision published its guide on effective risk data aggregation and risk reporting, following a public consultation in 2023. It sets out the ECB’s supervisory expectations for RDARR. ECB, consultation and final guide.

The guide introduces no new regulatory requirements. It explains the ECB’s interpretation of the existing legal framework and complements the January 2013 BCBS 239 principles. Its publication does not extend deadlines for remediation already requested by supervisors. ECB, consultation feedback, responses 12, 15 and 20.

For UK readers, the distinction matters. This is an ECB guide, not a PRA rule. A UK bank should assess the requirements and supervisory expectations applicable to its own entities. The PRA has separately stated that it expects the UK’s globally systemically important banks, in particular, to adhere to BCBS 239. Bank of England and PRA, DP5/22, paragraph 4.31.

When preparing for a review, I recommend linking each identified gap to evidence that the correction works. A completed milestone in a project plan does not establish that the figure in a risk report is now accurate.

Persistent weaknesses attract closer scrutiny

The ECB had announced stronger supervision before publishing the guide. Its priorities for 2024-2026 highlighted insufficient progress, including weak management body oversight and fragmented IT architecture. They also announced greater use of supervisory escalation from 2024. ECB, supervisory priorities for 2024-2026.

The guide provides a common reference for assessing these weaknesses. In February 2025, the ECB confirmed its use across on-site inspections and targeted reviews. ECB, review of RDARR supervisory work.

A manually maintained catalogue may be out of date when an auditor opens it. Lineage prepared for the previous review may no longer reflect the code in production. If locating one transformation takes several weeks, the bank needs to establish why the answer is so difficult to obtain.

Management body decisions need a traceable record

Overall accountability remains with the management body. Assigning responsibility for implementation to a named individual does not transfer that collective accountability. The ECB distinguishes management and supervisory functions according to the bank’s governance arrangements. ECB guide, section 3.1.

Consider a decision about a data issue affecting a prudential return. A useful record would show the impact presented to the relevant governing body, the decision taken and the resources allocated. It would also retain the control results after remediation.

That sequence becomes difficult to demonstrate when Risk understands the impact, Finance adjusts the return and IT changes the programme, with no shared record. Bring those records together around the same incident. A reviewer can then follow the decision through to its outcome.

Scope includes internal models and their data

The scope extends beyond internal risk reports. The guide names COREP/FINREP and submissions for European Banking Authority and SREP stress tests. It also covers key internal risk management models, including model development inputs and resulting outputs. ECB guide, section 3.2.

The ECB had already communicated the inclusion of financial and supervisory reporting in 2019. Each institution defines its precise scope according to materiality and its circumstances, taking the guide’s expectations into account. ECB, consultation feedback, response 19.

Start with a return the bank actually submits. For a COREP credit risk cell, identify the contributing data and processing steps. Then check whether the same data feeds a stress test or an internal model. Include the model’s development data and the outputs used downstream. Differences in coverage or transformation should be explainable.

For a group operating across the UK and the EU, record which entity and reporting framework each example concerns. This helps avoid treating one return as evidence for every part of the group.

Data lineage needs to show the transformations

Section 3.4 sets out the expectation for complete, current lineage at data attribute level. It starts at data capture and includes transformations for the risk indicators and critical data elements within scope. ECB guide, section 3.4.

Take a currency conversion applied to an outstanding balance across two Cobol programmes. An arrow from a DB2 table to a report does not show where the exchange rate enters the calculation. A reviewer needs to identify the column used and understand the order of the transformations.

For the next review, I recommend starting with a submitted reporting cell. Trace it back to the source tables and open the relevant code. Separate relationships recovered from code from those documented by staff. Record the version examined and any links still awaiting confirmation. This is a practical demonstration format, rather than one prescribed by the guide.

Connect a data issue to the affected report

The guide expects controls across the data chain within scope, tolerance levels and a register of data quality issues. That register should support assessment of severity and tracking of remediation. Material or severe errors call for a quantitative impact analysis. ECB guide, section 3.5.

Use a real issue to test the evidence. A balance with no currency code may be hard to spot in an aggregate quality score. Its significance for a report depends on the amount affected and how the missing value is handled.

Trace the column from the failed control to the affected reporting cell. Retain the threshold and the observed result. After remediation, rerun the relevant checks at source and report level. If a manual adjustment remains, record why it is needed and how it is controlled.

Test crisis reporting before it is needed

Reporting deadlines depend on the risk and the circumstances. BCBS 239 Principle 10 provides for more frequent reporting during stress or crisis and regular testing against established reporting deadlines. Section 3.6 of the ECB guide addresses reporting frequency and production time, including ad hoc requests during a crisis. BCBS 239, Principle 10, ECB guide, section 3.6.

A useful exercise is to request consolidated exposure to a group of counterparties using an unfamiliar breakdown. Measure the actual turnaround time. Record additional extracts and manual reconciliations. Check that controls still run when the deadline is shortened. The exercise record should show where the process struggled and what needs to change.

Prepare evidence a supervisor can examine

The following examples turn the guide’s themes into practical evidence to assemble. They are neither an exhaustive checklist nor a prescribed ECB submission format. Supervisors determine the evidence needed for the case under review. ECB, consultation feedback, Table 1, response 9.

Start with a report whose weaknesses are already understood by the teams. Ask someone outside the delivery team to review the chain for this exercise. That review does not replace independent validation of the RDARR framework or internal audit work. The guide distinguishes second-line validation from third-line internal audit. ECB guide, section 3.3.

Whenever the demonstration stops, identify the cause. Documentation may be missing, access may be unavailable, or the processing itself may be wrong. An incorrect calculation needs a processing fix followed by another test.

Vokse traces a COREP cell back to source tables and programmes, with column-level lineage and access to the actual transformations. Relationships recovered from code are distinguished from those declared by teams. Data quality controls connect issues to affected reports, with dedicated access for auditors.

The free BCBS 239 self-assessment offers 8 questions in 3 minutes, with an immediate result and no email required.

FAQ

What does RDARR mean?

RDARR stands for Risk Data Aggregation and Risk Reporting. It covers a bank’s ability to aggregate risk data and produce the associated reports. The BCBS 239 principles address governance and reliability, including under stress. Basel Committee, January 2013.

What does the ECB’s May 2024 guide cover?

It clarifies seven areas of supervisory expectations, from management body accountability to remediation programmes. These include the scope of reports and models, along with data lineage. The guide also addresses data quality and reporting timelines. ECB guide, Chapter 3.

Does the guide apply to UK banks?

The ECB states that the guide is relevant to all significant institutions under its supervision, with proportionality. It should not be presented as a PRA requirement for UK banks. For a group with operations in both jurisdictions, assess the position of each entity and the relevant group arrangements. The PRA has separately expressed its expectation that UK globally systemically important banks, in particular, adhere to BCBS 239. ECB, consultation feedback, response 18, Bank of England and PRA, DP5/22, paragraph 4.31.

What enforcement action can the ECB take?

The response depends on the breach and its legal basis. The ECB can impose binding remedial requirements and, in some cases, restrict business growth. Failure to comply with a decision can lead to enforcement measures, including periodic penalty payments where the legal conditions are met. Sanctioning proceedings may also be available for breaches within its powers. A gap against the guide does not automatically trigger a fine. ECB, RDARR escalation framework, March 2024.

What about less significant institutions?

The ECB identifies significant institutions as the guide’s audience and applies proportionality. Less significant institutions should establish the expectations of their national competent authority. BCBS 239 allows national supervisors to extend the principles to a wider range of banks. ECB, consultation feedback, response 18, BCBS 239, paragraph 13.