On 4 August 2025, the European Banking Authority (EBA) published its final report containing draft regulatory technical standards (RTS) establishing a risk taxonomy on operational risk that complies with international standards and a methodology to classify the loss events included in the loss data set based on that risk taxonomy on operational risk. The EBA previously issued a consultation which closed on 6 September 2025.

RTS

The final report comprises final draft RTS:

  • Establishing a risk taxonomy on operational risk that complies with international standards and a methodology to classify the loss events included in the loss data set based on that risk taxonomy on operational risk under Article 317(9) of the CRR. The draft RTS establish a risk taxonomy that includes Level 1 event types in line with those envisaged in the CRR 2, Level 2 categories that specify in greater detail the corresponding event types, and a list of attributes that increase the flexibility of the framework and the level of information available to supervisors. By construction, Level 1 event types and Level 2 categories are mutually exclusive and collectively exhaustive, while multiple attributes can be assigned to a single loss event.
  • Specifying the condition of ‘unduly burdensome’ for the calculation of the annual operational risk loss under Article 316(3) of the CRR. The CRR 3 allows the competent authority to grant a derogation to an institution whose business indicator (BI) is between EUR 750 million – EUR 1 billion, when the institution proves that such calculation would be unduly burdensome. The draft RTS specify that the calculation of the annual operational risk loss should be deemed as unduly burdensome, for up to three years, when an institution has a BI higher than EUR 750 million following an operation of merger and acquisition. Institutions whose BI temporarily passes EUR 750 million should be waived from the calculation of the annual operational risk loss as should bridge institutions set up according to Article 40 of the Bank Recovery and Resolution Directive.
  • Specifying how institutions shall determine the adjustments to their loss data set following the inclusion of losses from merged or acquired entities or activities as referred to in Article 321(1) of the CRR. The draft RTS require institutions that are subject to an operation of merger or acquisition, or that acquire an activity, to incorporate the loss data set of the acquired or merged entity, or activity, in the currency of the reporting institutions. Furthermore, the loss data set of the acquired or merged entity, or activity, should be incorporated reflecting the risk taxonomy used by the reporting institution. The draft RTS also provide a formula to calculate on a temporary basis, the annual operational risk loss when the institution is not able to include the loss data set of the acquired or merged entity, or activity, into the loss data set of the reporting institution.

Next steps

The final draft RTS will be submitted to the European Commission for endorsement following which they will be subject to scrutiny by the European Parliament and the Council before being published in the Official Journal of the European Union.