Although the challenge to comply with BCBS 239 is vital, the scope is immense. Now that the Jan 2016 deadline for the G-SIBs is up, the rule is expected to extend to other financial institutions and banks. The principles will also apply to all key internal risk management models including market, credit, and counterparty risk. Establishing the principle guidelines and putting core capabilities in place has its merits. The clarity that effective risk data aggregation provides will help banks streamline their businesses, and can allow banks to make better judgments through more accurate risk analysis. Aggregated information across all channels will enable to provide comprehensive support and services to existing customers. The robust data framework also helps banks supervise and anticipate future problems, giving them a clear view for data analysis. It can lead to gains in efficiency, reduce probability of losses and enhance strategic decision making, ultimate benefiting a bank’s profitability.

1. A REVIEW OF BCBS 239: HELPING BANKS STAY
COMPLIANT
Author: Prakash Jalihal
Contributor: Vedvrat Shikarpur
The Basel Committee of Banking Supervision’s (BCBS) guiding principles, titled BCBS 239: Principles for Effective
Risk Data Aggregation and Risk Reporting came into being in the aftermath of the 2008 Financial Crisis. The global
financial crisis brought to the fore how banks’ information technology (IT) and data architectures were inadequate
to deal with the management of financial risks.
In April 2009, the Financial Stability Board (FSB) was established as an international body to govern and
recommend changes to ensure financial stability of global financial system
1
. Additionally, the Basel Committee
issued the Basel II framework to enhance banks’ ability to identify and manage risks
2
. The committee also included
references to data aggregation as part of its guidelines. Stress testing exercises like Comprehensive Capital Analysis
and Review (CCAR) in the US, the Firm Data Submission Framework (FDFS) in the UK, and the European Banking
Authority (EBA) across Europe reiterate the need for banks to fill in these gaps.
In 2013, The BCBS 239 guiding principles for banks and financial institutions were established. The purpose of the
principles is to strengthen the risk data aggregation capabilities and internal risk reporting practices of banks,
thereby enhancing their risk management and decision making processes. Approximately 30 global systematically
important banks (G-SIBs) identified in 2013 were given the January 2016 deadline to get things in order to comply
with the 14 guiding principles of BCBS 239.
3
1
Knowledge Blogs: The 14 principles of BCBS 239
2
Basel Committee: Enhancements to Basel II Framework
3
Oracle: BCBS 239- Take Action to Ensure Compliance and Deliver a Competitive Advantage

2. WHAT ARE THE 14 PRINCIPLES OF BCBS 239?
Image Credits: Cognizant Solutions
PRINCIPLES FOR GOVERNANCE, DATA ARCHITECTURE AND IT INFRASTRUCTURE
Principle 1- Governance: A bank’s risk data aggregation capabilities and risk reporting practices should be subject
to strong governance arrangements consistent with other principles and guidance established by the Basel
Committee.
Principle 2 – Data Architecture and IT Infrastructure: A bank should design, build and maintain data architecture
and IT infrastructure which fully supports its risk data aggregation capabilities and risk reporting practices not only
in normal times but also during times of stress or crisis while still meeting the other Principles.
PRINCIPLES FOR ACCURACY AND INTEGRITY, COMPLETENESS, TIMELINES AND ADAPTABILITY
Principle 3 - Accuracy and Integrity: A bank should be able to generate accurate and reliable risk data to meet
normal and stress/crisis reporting accuracy requirements. Data should be aggregated on a largely automated basis
so as to minimize the probability of errors.
Principle 4 - Completeness: A bank should be able to capture and aggregate all material risk data across the
banking group. Data should be available by business line, legal entity, asset type, industry, region and other
groupings, as relevant for the risk in question, that permit identifying and reporting risk exposures, concentrations
and emerging risks.
Principle 5 - Timeliness: A bank should be able to generate aggregate and up-to-date risk data in a timely manner
while also meeting the principles relating to accuracy and integrity, completeness and adaptability. The precise
timing will depend upon the nature and potential volatility of the risk being measured as well as its criticality to the

3. overall risk profile of the bank. The precise timing will also depend on the bank-specific frequency requirements for
risk management reporting, under both normal and stress/crisis situations, set based on the characteristics and
overall risk profile of the bank.
Principle 6 - Adaptability: A bank should be able to generate aggregate risk data to meet a broad range of on-
demand, ad hoc risk management reporting requests, including requests during stress/crisis situations, requests
due to changing internal needs and requests to meet supervisory queries.
PRINCIPLES FOR ACCURACY, COMPREHENSIVENESS, CLARITY AND USEFULNESS, FREQUENT AND
DISTRIBUTION
Principle 7 - Accuracy: Risk management reports should accurately and precisely convey aggregated risk data and
reflect risk in an exact manner. Reports should be reconciled and validated.
Principle 8 - Comprehensiveness: Risk management reports should cover all material risk areas within the
organization. The depth and scope of these reports should be consistent with the size and complexity of the bank’s
operations and risk profile, as well as the requirements of the recipients.
Principle 9 - Clarity and usefulness: Risk management reports should communicate information in a clear and
concise manner. Reports should be easy to understand yet comprehensive enough to facilitate informed decision-
making. Reports should include meaningful information tailored to the needs of the recipients.
Principle 10 - Frequency: The board and senior management (or other recipients as appropriate) should set the
frequency of risk management report production and distribution. Frequency requirements should reflect the
needs of the recipients, the nature of the risk reported and the speed, at which the risk can change, as well as the
importance of reports in contributing to sound risk management and effective and efficient decision‑making across
the bank. The frequency of reports should be increased during times of stress/crisis.
Principle 11 - Distribution: Risk management reports should be distributed to the relevant parties while ensuring
confidentiality is maintained.
PRINCIPLES FOR REVIEW, REMEDIAL ACTIONS & SUPERVISORY MEASURES AND HOME/HOST
COOPERATION
Principle 12 - Review: Supervisors should periodically review and evaluate a bank’s compliance with the eleven
Principles above.
Principle 13 - Remedial actions and supervisory measures: Supervisors should have and use the appropriate tools
and resources to require effective and timely remedial action by a bank to address deficiencies in its risk data
aggregation capabilities and risk reporting Principles for effective risk data aggregation and risk reporting 15
practices. Supervisors should have the ability to use a range of tools, including Pillar 2.

4. Principle 14 - Home/host cooperation: Supervisors should cooperate with relevant supervisors in other
jurisdictions regarding the supervision and review of the Principles and the implementation of any remedial action
if necessary.
4
Read more about the report at: The Basel Committee on Banking Supervision’s “Principles for effective risk data
aggregation and risk reporting”: BCBS 239 published in Jan 2013
BCBS 239: CHALLENGES AND SCOPE
The principles of BCBS 239 underline that there is no quick short-cut to compliance. Banks have to invest in
upgrading existent systems and implement technological and reporting solutions that will prepare them for
meeting their strategic goals and make them ready to address future regulatory compliance changes.
WHY IS IT SO CHALLENGING?
SHORT TIMELINES
It was only in January 2013 that G-SIBs and later D-SIBs were identified to comply with the new guidelines. As the
compliance requirements for BCBS 239 are substantial, most banks found task of incorporating the changes
challenging.
NO EASY SOLUTION
BCBS 239 focusses on a bank’s ability to aggregate risk data and to report it in a flexible manner to improve
insights on their risks. As such, there is no shortcut or easy solution to comply, as streamlining the processes of
data aggregation and having IT systems capable of storing, processing and analyzing risk data is essential.
VARYING COMPLIANCE ISSUES AS PER SIZE
Small banks may struggle to cope with the principles due to their tight budgets. Given the situation, the technology
upgrades and compliance and reporting processes that BCBS239 hope to streamline is hard to implement.
On the other hand, large banks face excessive level of complexities, given their size and geographical reach.
Streamlining and effectively implementing the new practices across all departments’ presents a big challenge.
Simply put, size is a paradoxical factor. Although large banks have better resources and capacity to implement
changes, modifying or instituting new regulations presents its own difficulties.
5
BANKS’ OUTLOOK TOWARDS BCBS 239
KEY FINDINGS OF EY'S BCBS 239 AUTUMN 2014 INDUSTRY SURVEY OF 30 G-SIBS AND D-SIBS ON PRIORITIZING
AND MOBILIZING PROJECTS FOR 2015:
 Most respondents said a significant part of their BCBS 239 change delivery will not be complete by
January 2016
 89% of respondents viewed BCBS 239 as an enabler to shape their IT strategy and develop their IT
infrastructure.
4
Basel Committee on Banking Supervision: BCBS 239: Principles for effective risk data aggregation and risk
reporting
5
Zanders: Why is implementing BCBS 239 so challenging?

5.  78% of respondents viewed BCBS 239 as an enabler for their enterprise-wide data management
capabilities.
 67% of respondents viewed BCBS 239 as an initiative to help drive operational efficiency and other cost
reduction initiatives.
G-SIBs have been mobilized and Domestic Systemically Important Banks (D-SIBs) are now mobilizing their approach
to achieve regulatory compliance. A recent EY survey on BCBS 239 readiness shows that banks are viewing the
principles as an enabler for other strategic objectives aimed at transforming the business to survive in the new
marketplace.
6
Although the challenge to comply with BCBS 239 is vital, the scope is immense. Now that the Jan 2016 deadline for
the G-SIBs is up, the rule is expected to extend to other financial institutions and banks. The principles will also
apply to all key internal risk management models including market, credit, and counterparty risk. Establishing the
principle guidelines and putting core capabilities in place has its merits.
7
6
EY: BCBS 239: A practical path to compliance and delivering business value
7
Information Week: 8 things you probably did not know about BCBS 239
CREDITS: EY

6. The clarity that effective risk data aggregation provides will help banks streamline their businesses, and can allow
banks to make better judgements through more accurate risk analysis. Aggregated information across all channels
will enable to provide comprehensive support and services to existing customers. The robust data framework also
helps banks supervise and anticipate future problems, giving them a clear view for data analysis.
It can lead to gains in efficiency, reduce probability of losses and enhance strategic decision making, ultimate
benefiting a bank’s profitability.
8
Embed Video: Marion Leslie, Managing Director of Pricing and Reference Services at Thomson Reuters outlines
BCBS 239 requirements, challenges and discusses how banks can benefit from the compliance.
https://www.youtube.com/watch?v=wC5Ocrswews
HOW CAN BANKS STAY COMPLIANT USING HEXANIKA SOLUTIONS
Hexanika is a RegTech Big Data software company that has developed a revolutionary software
platform SmartJoin™ and a software product called SmartReg™ for financial institutions to address data sourcing
and reporting challenges for regulatory compliance.
Hexanika helps banks meet the 14 principles of BCBS 239 using its strategic enablers and advanced regulatory and
technology solutions. Our software platform SmartJoin™ uses heuristics and semantics to address core issues
related to data governance, aggregation and consolidation. It improves data accuracy and integrity, also allowing
traceability of data to its raw form. Using SmartReg™, banks can institutionalize and streamline the reporting
process, giving them additional options of reviewing, supervising and/or analyzing data using a preferred BI Tool. It
reduces the complexity, costs and time required to generate reports, helping banks meet BCBS 239 compliance.
Read more about our solutions and technology at: http://hexanika.com/company-profile/
8
Banking Technology: Breaking down BCBS 239

7. CONTACT US
USA
249 East 48 Street,
New York, NY 10017
Tel: +1 646.733.6636
INDIA
Krupa Bungalow 1187/10,
Shivaji Nagar, Pune 411005
Tel:+919850686861
Email: info@hexanika.com
FOLLOW US