Commission Delegated Regulation (EU) 2026/1167 of 28 May 2026 supplementing - 3rd September 2026 - European Commission

Read or download the official PDF of this gazette notification issued by the European Commission on 3rd September 2026.

Official Gazette Notification Text

Official Transcript

Official Journal EN of the European Union L series 2026/1167 3.9.2026 COMMISSION DELEGATED REGULATION(EU) 2026/1167 of 28 May 2026 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards specifying operational risk requirements (Text with EEA relevance) THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 of prudential requirements for credit institutions and amending Regulation (EU) No 648/2012(1), and in particular Article 314(9), third subparagraph, Article 315(3), third subparagraph, Article 316(3), third subparagraph, Article 317(9), third subparagraph, and Article 321(2), third subparagraph, thereof,

Whereas:

(1) The business indicator is a financial statement-based proxy for operational risk. The items representing ordinary banking business operations in financial statements should be included within that indicator, while the elements to be excluded from the business indicator should be those which do not represent ordinary banking business operations as listed in Article 314(7) of Regulation (EU) No 575/2013. The determination of what elements should be included in, or excluded from, the business indicator and its different components should be based on what is laid down in international regulatory standards.

(2) For some income and expenses components, it would be disproportionate to disentangle the value of their different sub-components or items. It follows that where an income or an expense element is listed among the excluded items, but also contains items that are listed among the items to be included, or vice-versa, institutions should ensure that such items are not excluded, or included, more than once.

(3) To align with international regulatory standards, institutions should include interest income and interest expenses in the interest, leases and dividend component. Article 314(2) of Regulation (EU) No 575/2013 requires institutions to include all income and expenses arising from financial and operating leases in the interest, leases and dividend component, including depreciation and impairment. The items related to leases included in the interest, leases and dividend component of the business indicator should be aligned with those in International Financial Reporting Standards (IFRS) 16. Accordingly, institutions should include all income and expenses from investment properties that generate rents, including rental income from investment properties, in the interest, leases and dividend component.

(4) To ensure consistency with international regulatory standards, institutions should calculate the asset component referred to in Article 314(2) of Regulation (EU) No 575/2013 as the sum of certain balance sheet assets. As the asset component contributes to the calculation of the interest, leases, and dividend component, institutions should also include in the asset component all the assets on the balance sheet that generate interest income or lead to interest expenses.

(5) Institutions should include dividend income in the interest, leases and dividend component. The dividend income should include the institution’s dividend income from investments in stocks and funds not consolidated in the financial statements of the institution, including dividend income from non-consolidated subsidiaries, associates and joint ventures.

(1) OJ L 176, 27.6.2013, p. 1, ELI: http://data.europa.eu/eli/reg/2013/575/oj.

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 1/28EN OJ L, 3.9.2026

(6) Institutions should include other operating income in the service component. Other operating income should include income from ordinary operations not included in other items of the business indicator but of similar nature.

(7) Pursuant to Article 314(5) of Regulation (EU) No 575/2013, institutions are to include in the other operating expenses their expenses and losses from operational risk events. Those operational risk events can take several forms in an institution’s financial statement, including expenses, losses, provisions, impairment, and depreciation.

Institutions should therefore include in their other operating expenses all the impacts of operational risk events that affect their financial statements, irrespective of how those expenses are labelled or accounted for. Because Article 314(7), point (b), of Regulation (EU) No 575/2013 specifies that premiums paid and payments received from insurance or reinsurance policies purchased are not to be included in the calculation of the business indicator, it follows that such expenses should be gross of insurance or reinsurance policies purchased. Nonetheless, those expenses should be net of recoveries other than insurance and reinsurance. Those expenses should also include exceptional losses that institutions may exclude from the calculation of their annual operational risk loss after the permission referred to in Article 320(1) of Regulation (EU) No 575/2013 has been obtained.

(8) To obtain proper and exhaustive information on where the financial impacts of operational risk events are accounted for in an institution’s financial statement, institutions should break down those financial impacts by the main items of the profit and loss statement where those impacts are accounted for.

(9) Institutions should include fee and commission income in the service component. That should include income received from providing advice and services, and income received by the institution as an outsourcer of financial services.

(10) Institutions should include fee and commission expenses in the service component. That should include expenses paid for receiving advice and services and outsourcing fees paid by the institution for the supply of financial services, but should exclude outsourcing fees paid for the supply of non-financial services, such as logistical, IT, or human resources.

(11) Certain types of operations or accounting choices, including economic hedging of fair value through profit and loss positions, and the bifurcation of derivatives embedded in host hybrid or structured financial instruments, may cause an unwarranted increase in the financial component, the formula of which envisages the sum of the absolute values of the profit and loss of the trading book component and of the banking book component. In economic hedging, such unwarranted increase is due to the presence of types of operations that are strictly related to each other and that are of opposite profit and loss sign. When recorded in accordance with the accounting standards, the amounts of those operations are accounted for in different components of the business indicator (i.e. the trading book component and the banking book component). Hence financial institutions cannot net the amounts of those operations when those amounts are calculated within the financial component. Where that is the case, institutions should be allowed to adopt the prudential boundary approach, i.e. to calculate the financial component in accordance with Part Three, Title I, Chapter 3, of Regulation (EU) No 575/2013.

(12) Institutions should include the trading component in the financial component, which contains net profit or loss on trading assets and liabilities, from hedge accounting, and from exchange differences.

(13) Institutions should include the banking component in the financial component, which contains net profit or losses on financial assets and liabilities of the non-trading book, as well as net profit or net losses from hedge accounting and from exchange differences of items in the non-trading book. Losses already accounted in the calculation of the risk weighted assets for credit risk should not be included in the banking component.

(14) To prevent the improper use of the prudential boundary approach, the concept of ‘unwarranted increase in the financial component’ in the case of economic hedging should not be extended to cover the profit and loss of hedging instruments in the trading book that are not clearly related to the profit and loss of hedged instruments in the non-trading book valued at fair value through profit and loss, or to situations where institutions do not fully comply with the rules and conditions of the prudential boundary approach set out in Part Three, Title I, Chapter 3, of Regulation (EU) No 575/2013. Furthermore, adjustments to the financial component should be limited to the amount of profit and loss related to risks effectively covered by the hedge, and materially offsetting the accounting profit and loss of the hedged items.

2/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/ojEN OJ L, 3.9.2026

(15) Institutions that intend to adopt the prudential boundary approach should be able to calculate the profit and loss of all the positions held in the prudential trading book and the prudential non-trading book, over the three financial years envisaged for the calculation of the financial component. In case of economic hedging, institutions should be able to identify the profit and loss of hedged instruments and related hedges, connecting the hedges to the hedged risks, and to document the hedging relationship in line with the risk management objectives of the institution. Those calculations are different from the calculation carried out under the accounting approach and are not based on harmonised accounting standards nor subject to periodic supervisory reports. Therefore, only institutions that have in place policies, procedures, systems and controls to carry out such calculations in a proper manner and to identify the profit and loss amounts in case of economic hedging, properly documenting them, should be allowed to adopt the prudential boundary approach.

(16) To prevent regulatory arbitrage through the selected use of the prudential boundary approach in some years of the calculation, institutions should apply the prudential boundary approach for all three financial years envisaged for the calculation of the business indicator. In addition, institutions should be allowed to use the prudential boundary approach in combination with the accounting approach for certain entities within the same group or certain types of operations or accounting choices, including those related to the hedging of structured issuances. In particular, where institutions apply the prudential boundary approach only to selected types of operations, they should use the accounting approach for the remaining part of the balance sheet.

(17) To enable competent authorities to review the adoption of the prudential boundary approach, institutions intending to adopt that approach should provide their competent authorities with adequate documentation and information prior to its implementation. Institutions that intend to use the prudential boundary approach only partially should, for the same reason, also include in the notification information on the accounting approach.

(18) Where any condition allowing for the adoption of the prudential boundary approach is no longer met, institutions should revert to the accounting approach. To prevent regulatory arbitrage, institutions should not switch between those two approaches too frequently.

(19) From an operational risk perspective, reinsurance products or services do not conceptually differ from financial products or services whose income and expenses stemming from their distribution are included within the business indicator, typically under fee and commission income or fee and commission expenses. Therefore, institution should not exclude from the calculation of the business indicator all income and expenses arising from selling or distributing insurance or reinsurance products or services.

(20) Certain financial impacts related to lease assets or resulting from operational risk events, or the outsourcing fees paid for the supply of financial services, might, in specific cases, be accounted for under the following items, listed in Article 314(7) of Regulation (EU) No 575/2013: administrative expenses, including staff expenses, as referred to in Article 314(7), point (c), of Regulation (EU) No 575/2013, depreciation of tangible assets, amortisation of intangible assets as referred to in Article 314(7), point (f), of Regulation (EU) No 575/2013, and impairment or reversal of impairment as referred to in Article 314(7), point (i), of Regulation (EU) No 575/2013. In such cases, institutions should not exclude those financial impacts from the calculation of the business indicator.

(21) In the case of acquisitions, mergers or disposals, the consideration of the period of three financial years based on financial statements for the calculation of the business indicator may lead to a potential divergence between the capital requirements for operational risk and the effective risk profile of a given institution. It is therefore necessary to lay down a method for determining the adjustment of the business indicator in the case of mergers, acquisitions or disposals, and the conditions for granting the permission to exclude from the business indicator amounts related to disposed entities or activities, thus ensuring better alignment between institutions’ capital requirements and institutions’ effective risk profile.

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 3/28EN OJ L, 3.9.2026

(22) The business indicator is a financial statement-based proxy for operational risk. Institutions should therefore in principle base their adjustment following mergers or acquisitions on the audited financial statement of the merged or acquired entities or activities. However, institutions may experience difficulties in retrieving a historical series of accurate data related to the merged or acquired entities or activities over the period of three financial years to be considered for reflecting the operation. Institutions should therefore have the possibility to use alternative calculation options where the historical data relating to the acquired or merged entity or activities are not available or accurate to cover the full period that is relevant to the calculation of their business indicator. Those alternative calculation methods should be sufficiently conservative.

(23) The disposal of a business or of an entity may not always imply that the operational risk related to the disposed entity or activities is fully transferred to the acquiring entity. The terms and conditions of the disposal may provide for an indemnity arrangement in case of new liabilities or losses arising from operational risk events occurring prior to the disposal. Therefore, in the case of disposals, the conditions under which competent authorities may grant the permission referred to in Article 315(2) of Regulation (EU) No 575/2013 should, in particular, ensure that the entity or activity disposed is no longer deemed relevant to the institution’s risk profile.

(24) Pursuant to Article 316(1) of Regulation (EU) No 575/2013, institutions with a business indicator equal to or exceeding EUR 750 million are to, in addition to the business indicator component, compile data on operational risk losses and calculate their annual operational risk losses. International standards on operational risk, including those from the Basel Committee on Banking Supervision, require loss events to be classified into seven event types. To comply with those standards, the operational risk taxonomy referred to in Article 317(9) of Regulation (EU) No 575/2013 should be based on the same event types.

(25) To obtain a sufficiently granular classification system, the operational risk taxonomy should also include a second level of classification, based on the industry best practices. Accordingly, loss events data in the operational risk taxonomy should be organised in Level 1 event types, representing the macro-events to which a loss event should be assigned, and Level 2 categories, listing in more detail the features of the corresponding Level 1 event types. To foster harmonisation in the recording of loss events, the design and description of Level 2 categories should be developed in line with international standards and industry best practices.

(26) To provide the complete picture of the losses of an institution, the construction of the operational risk taxonomy in Level 1 event types and Level 2 categories should be designed to make them mutually exclusive and collectively exhaustive, without any residual category.

(27) Though Level 1 event types and Level 2 categories should be exhaustive with reference to operational risk losses, some loss events may be attributable to a supplementary description in addition to its assignment to the relevant Level 1 event type and Level 2 category. To enrich the recording of information available on loss events, institutions should assign one or, where appropriate, more attributes to those events. Given their nature, attributes should not be designed to make them mutually exclusive and collectively exhaustive. It should therefore be possible to assign multiple attributes to a single loss event, including loss events related to ‘ICT third-party service providers’ as defined in Article 3, point (19), of Regulation (EU) 2022/2554 of the European Parliament and of the Council(2), which should be assigned both the ‘ICT risk’ and ‘Third-party risk’ attributes.

(28) To adequately describe the losses incurred by an institution, institutions should record only losses that are relevant for the calculation of the annual operational risk loss in the loss data set. However, institutions should not include in the loss data set losses that are recovered within five working days, as the losses are recognised as being rapidly recovered.

(2) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and

(EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1, ELI: http://data.europa.eu/eli/reg/2022/2554/oj).

4/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/ojEN OJ L, 3.9.2026

(29) The operational risk loss taxonomy should allow for an effective supervision of the operational risk, and should be proportionate when first applied. For that reason, historical data of Level 2 categories and attributes should be

provided on a best effort or voluntary basis for at least the full year 2025. Conversely, since Level 1 categories are unchanged compared to the existing framework, institutions should provide historical data for at least the years since 1 January 2016.

(30) Mergers and acquisitions may oblige an institution to calculate the annual operational risk loss due to the increased size of the business indicator. Furthermore, the challenges stemming from the integration of the merged or acquired entities may require institutions to calculate operational risk losses, which could be unduly burdensome. Institutions should therefore be given sufficient time to comply with the requirement to calculate the annual operational risk loss.

(31) Institutions may report a business indicator equal to or higher than EUR 750 million only temporarily, due to transitory circumstances. Therefore, it would be unduly burdensome for those institutions to calculate the annual operational risk loss when exceeding the threshold is only a temporary exception within a certain time frame.

(32) In specific circumstances, bridge institutions may be set up to manage the resolution of institutions. Given the specificity of the bridge institutions and their temporary nature, it would be unduly burdensome for those institutions to calculate the annual operational risk loss. For that reason, they should be exempt from that requirement.

(33) Acquired or merged entities or activities may record losses using a risk taxonomy which is different from the one of the reporting institution. To ensure the comparability and consistency of the data, the reporting institution should reclassify the losses of the acquired or merged entities using the risk taxonomy referred to in Article 317 of Regulation (EU) No 575/2013.

(34) The losses of the acquired or merged entities or activities may be in a currency which is different from the one of the reporting institution. Institutions should therefore incorporate those losses in the losses of the reporting institution using, for each of the ten-years window, the exchange rate used at the end of the relevant year.

(35) Merged or acquired entities or activities may not record losses, or may record losses using a risk taxonomy that is different from that referred to in Article 317(9) of Regulation (EU) No 575/2013 because those entities or activities are not required by the applicable law to build a loss data set in accordance with Article 317(2) of that Regulation. It is also possible that merged or acquired entities or activities did not fall under the scope of Article 317 of Regulation

(EU) No 575/2013 for each of the 10 years prior to the acquisition or the merger. In such cases, institutions should calculate the annual operational risk loss using the reported losses for which data are available, adjusting the result for the coverage rate or the reported losses compared to the whole institution.

(36) The provisions of this Regulation are closely linked as they all specify key aspects of operational risk requirements. To ensure coherence between those provisions, facilitate end users’ access and to enable institutions to apply those provisions in a consistent manner, they should be included in a single Regulation.

(37) This Regulation is based on the draft regulatory technical standards submitted to the Commission by the European Banking Authority.

(38) The European Banking Authority conducted open public consultations on the draft regulatory technical standards on which this Regulation is based, analysed the potential related costs and benefits and requested the advice of the Banking Stakeholder Group established under Article 37 of Regulation (EU) No 1093/2010 of the European Parliament and of the Council(3),

(3) Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12, ELI: http://data.europa.eu/eli/reg/2010/1093/oj).

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 5/28EN OJ L, 3.9.2026

HAS ADOPTED THIS REGULATION:

PART I COMPONENTS OF THE BUSINESS INDICATOR, ELEMENTS TO BE EXCLUDED FROM THAT INDICATOR, AND ADJUSTMENTS TO THAT INDICATOR TITLE I COMPONENTS OF THE BUSINESS INDICATOR

CHAPTER 1 Interest, leases and dividend component Article 1 Interest income Institutions shall calculate the interest income referred to in Article 314(2) of Regulation (EU) No 575/2013 as the sum of the following sub-items:

(a) interest income from financial assets held for trading;

(b) interest income from non-trading financial assets mandatorily at fair value through profit or loss;

(d) interest income from financial assets at fair value through other comprehensive income;

(e) interest income from financial assets at amortised cost;

(f) interest income from hedge accounting – interest rate risk derivatives;

(g) interest income on other assets;

(h) interest income on liabilities;

(i) income on operating leases, including rental income from investment property;

(j) income from changes in fair value in investment properties that generate rents and are measured using the fair value model;

(k) profits from leased assets, including gains from lease modifications.

Article 2 Interest expenses Institutions shall calculate the interest expenses referred to in Article 314(2) of Regulation (EU) No 575/2013 as the sum of the following sub-items:

(a) interest expenses from financial liabilities held for trading;

(b) interest expenses from financial liabilities designated at fair value through profit or loss;

(d) interest expenses from hedge accounting – interest rate risk derivatives;

(e) interest expenses on other liabilities;

(f) interest expenses on assets;

(g) operating leasing expenses, including direct operating expenses from investment property that generates rent;

(h) expenses from changes in fair value in investment properties that generate rent and are measured using the fair value model;

6/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/ojEN OJ L, 3.9.2026

(i) losses from operating leased assets;

(j) depreciation and impairment or reversal of impairment of operating leased assets the income or expenses of which are included in the calculation of the interest component.

The sub-items referred to in the first subparagraph shall not contain any expenses due to operational risk events.

Institutions shall instead include those expenses in the item referred to in Article 6(1), point (d)(i).

Article 3 Asset component Institutions shall calculate the asset component referred to in Article 314(2) of Regulation (EU) No 575/2013 as the sum of the following sub-items:

(a) gross carrying amount of cash balance at central banks and other demand deposits;

(b) gross carrying amount of debt securities;

(d) the fair value of derivatives classified as financial assets at the reference date for the calculation of the asset component, as long as the flows from such derivatives have been recognised during the financial year in the interest component;

(e) carrying amount of tangible assets and intangible assets subject to lease.

For the purposes of point (d), institutions shall include both trading and economic hedges, and hedge accounting.

Article 4 Dividend component The dividend component referred to in Article 314(2) of Regulation (EU) No 575/2013 shall be composed of the dividend income from both equity instruments and investments.

CHAPTER 2 Services component Article 5 Other operating income Institutions shall calculate the other operating income referred to in Article 314(5) of Regulation (EU) No 575/2013 as the sum of the following items, with the exception of the recovery of administrative expenses:

(a) income from changes in fair value in tangible assets measured using the fair value model, except income from changes in fair value in investment properties that generate rents and are measured using the fair value model;

(b) income from other income not due to leases;

(c) profit from non-current assets and disposal groups classified as held for sale not qualifying as discontinued operations.

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 7/28EN OJ L, 3.9.2026 Article 6 Other operating expenses

1. Institutions shall calculate the other operating expenses referred to in Article 314(5) of Regulation (EU) No 575/2013

as the sum of the following items:

(a) expenses from changes in fair value in tangible assets measured using the fair value model, with the exception of expenses from changes in fair value in investment properties that generate rents and are measured using the fair value model;

(b) expenses from other expenses that are not due to operational risk events and not due to leased assets;

(c) losses from non-current assets and disposal groups classified as held for sale not qualifying as discontinued operations;

(d) losses, expenses, provisions and other financial impacts that are due to operational risk events accounted for in any item of the profit and loss statement, including those losses, expenses, provisions and other financial impacts that

are accounted for in the following items:

(i) interest expenses;

(ii) other operating expenses;

(iii) staff expenses;

(iv) other administrative expenses;

(v) depreciation;

(vi) provisions or (-) reversals of provisions;

(vii) impairment or (-) reversal of impairment.

2. For the purposes of paragraph 1, point (d), the losses, expenses, provisions and other financial impacts that are due to

operational risk events:

(a) shall be net of related payments received from other than insurance or reinsurance policies purchased;

(b) shall not be net of any related payments received from insurance or reinsurance policies purchased;

(c) shall include those exceptional losses that, following the permission granted by the competent authority pursuant to Article 320(1) of Regulation (EU) No 575/2013, may be excluded from the calculation of the institution’s annual operational risk loss.

Article 7 Fee and commission income component The fee and commission income component referred to in Article 314(5) of Regulation (EU) No 575/2013 shall include income from ancillary activities to the financial services, including income from IT activities necessary to execute a financial service. Institutions shall calculate the fee and commission income as the sum of the following items:

(a) fee and commission income from securities;

(b) fee and commission income from corporate finance;

(d) fee and commission income from clearing and settlement;

(e) fee and commission income from asset management;

(f) fee and commission income from custody;

(g) fee and commission income from central administrative services for collective investment;

(h) fee and commission income from fiduciary transactions;

(i) fee and commission income from payment services;

(j) fee and commission income from customer resources distributed but not managed;

(k) fee and commission income from structured finance;

(l) fee and commission income from loan servicing activities;

(m) fee and commission income from loan commitments given;

8/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/ojEN OJ L, 3.9.2026

(n) fee and commission income from financial guarantees given;

(o) fee and commission income from loans granted;

(p) fee and commission income from foreign exchange;

(q) fee and commission income from commodities;

(r) other fee and commission income.

Article 8 Fee and commission expenses component The fee and commission expenses component referred to in Article 314(5) of Regulation (EU) No 575/2013 shall include the expenses from ancillary activities to the financial services, including expenses from IT activities necessary to execute a financial service. Institutions shall calculate the fee and commission expenses as the sum of the following items:

(a) fee and commission expenses from securities;

(b) fee and commission expenses from clearing and settlement;

(d) fee and commission expenses from custody;

(e) fee and commission expenses from payment services;

(f) fee and commission expenses from loan servicing activities;

(g) fee and commission expenses from loan commitments received;

(h) fee and commission expenses from financial guarantees received;

(i) fee and commission expenses from externally provided distribution of products;

(j) fee and commission expenses from foreign exchange;

(k) other fee and commission expenses.

CHAPTER 3 Financial component Article 9 Calculation of the financial component When calculating the financial component referred to in Article 314(6) of Regulation (EU) No 575/2013, institutions shall

use one of the following approaches:

(a) the ‘accounting approach’ under which they calculate the financial component in accordance with Articles 10 and 11 of this Regulation on the basis of the applicable accounting framework;

(b) the ‘prudential boundary approach’ under which they calculate the financial component in accordance with Article 12 of this Regulation on the basis of the prudential boundary set out in Part Three, Title I, Chapter 3, of Regulation (EU) No 575/2013, provided that all of the following conditions are met:

(i) certain types of operations performed, or accounting choices adopted, including the economic hedging of fair value through profit and loss positions or the bifurcation of derivatives embedded in host hybrid or in structured financial instruments, result in an unwarranted increase of the financial component when using the accounting approach;

(ii) the institution has in place policies, procedures, systems and controls to:

(1) identify the profit and loss of hedged instruments and related hedges, connecting those related hedges to the hedged risks;

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 9/28EN OJ L, 3.9.2026

(2) properly calculate the profits and losses of the prudential trading book and the prudential non-trading book;

(iii) the internal policies, procedures, systems and controls allow for documenting the hedging relationship and its changes over time based on risk management objectives and choices;

(iv) the adjustments to the financial component are restricted to the amount of profit and loss related to risks effectively covered by the hedge and materially offsetting the accounting profit and loss of the hedged items.

Section 1 Calculation of the financial component in accordance with the accounting approach Article 10 Trading book component When calculating the financial component in accordance with the accounting approach, institutions shall calculate the trading book component referred to in Article 314(6) of Regulation (EU) No 575/2013 as the sum of the following items:

(a) gains or (-) losses on financial assets and liabilities held for trading, net;

(b) gains or (-) losses from hedge accounting, net, where hedge accounting is used for hedging financial assets and liabilities held for trading;

(c) exchange differences [gain or (-) loss], net, where such differences originate from financial assets and liabilities held for trading.

Article 11 Banking book component When calculating the financial component in accordance with the accounting approach, institutions shall calculate the banking book component referred to in Article 314(6) of Regulation (EU) No 575/2013 as the sum of the following items:

(a) gains or (-) losses on derecognition of financial assets and liabilities not measured at fair value through profit or loss, net;

(b) gains or (-) losses on non-trading financial assets mandatorily at fair value through profit or loss;

(d) gains or (-) losses from hedge accounting, net, where hedge accounting is used for hedging financial assets and liabilities other than held for trading;

(e) exchange differences [gain or (-) loss], net, where such differences originate from financial assets and liabilities other than held for trading.

10/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/ojEN OJ L, 3.9.2026

Section 2 Calculation of the financial component in accordance with the prudential boundary approach Article 12 Prudential boundary approach

1. When using the prudential boundary approach for calculating the financial component, institutions shall adjust the items referred to in Articles 10 and 11 of this Regulation in accordance with Part Three, Title I, Chapter 3, of Regulation

(EU) No 575/2013.

2. Institutions shall apply the prudential boundary approach consistently with their strategies, policies, procedures, systems and controls, as set out in Part Three, Title I, Chapter 3, of Regulation (EU) No 575/2013.

3. Institutions may use the prudential boundary approach in combination with the accounting approach.

For the purposes of the first subparagraph, institutions may apply the prudential boundary approach to certain entities within the same group or certain types of operations. In that case, institutions shall demonstrate that the selection of the scope of the prudential boundary approach is not made to engage in regulatory arbitrage. Institutions shall apply the accounting approach to the remaining part of the balance sheet. Institutions shall notify competent authorities of any material change to the scope of the prudential boundary approach in accordance with Article 13.

4. Institutions shall apply the prudential boundary approach to all three financial years envisaged for the calculation of the financial component.

5. Where institutions apply the prudential boundary approach, competent authorities shall verify whether the conditions referred to in Article 9, point (b), are met.

Article 13

Notification procedure for the use of the prudential boundary approach

1. Institutions shall notify their competent authority of their intention to use the prudential boundary approach at least 90 days before they start using that approach.

2. The notification of the intention to use the prudential boundary approach shall contain the following:

(a) a confirmation that the use of the prudential boundary approach has been approved by the management body or by an internal committee designated by it, and the date of that approval;

(b) the date as of which the prudential boundary approach will be used;

(c) the description of the types of operations performed or accounting choices adopted which cause the unwarranted increase in the financial component and the institution’s expectations concerning their development;

(d) a description of the portfolios of the trading book component and the banking book component that are affected by the unwarranted increase;

(e) the value of those portfolios referred to in point (d) at the reference date of the notification, expressed as:

(i) notional for derivatives;

(ii) nominal for debt instruments;

(iii) market value for stocks and collective investments undertaking;

(f) when the notification is submitted by a consolidating entity, the contribution per subsidiary to the portfolios referred to in points (d) and (e);

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 11/28EN OJ L, 3.9.2026

(g) a description of the adjustments to the items referred to in in Articles 10 and 11 due to the use of the prudential boundary approach;

(h) an analysis of the impact, at the last reporting date in comparison with the accounting approach, of the use of the prudential boundary approach, on:

(i) the trading book component;

(ii) the banking book component;

(iii) the financial component;

(iv) the business indicator;

(v) the capital requirements for operational risk;

(i) where institutions apply the prudential boundary approach in combination with the accounting approach in accordance with Article 12(3):

(i) a description of the types of operations for which the accounting approach is used;

(ii) an analysis of the impact, at the last reporting date in comparison to the prudential boundary approach, of the

use of the accounting approach on:

(1) the trading book component;

(2) the banking book component;

(3) the financial component;

(4) the business indicator;

(5) the capital requirements for operational risk;

(j) a description of the policies, procedures, systems and controls referred to in Article 9, point (b)(ii);

(k) a report of the independent review of the institution’s independent risk control function, or of internal or external audit, on fulfilment of the conditions referred to in Article 9, point (b).

3. The 90-day period referred to in paragraph 1 shall start only when the information and documentation referred to in paragraph 2 is complete.

4. Institutions shall update the following documentation and provide that update to their competent authority:

(a) at least annually the documentation referred in paragraph 2, points (c) to (i) and point (k);

(b) the documentation referred to in paragraph 2, points (j), but only where there were changes during the period of use of the prudential boundary approach.

For the purposes of point (a), institutions shall provide their competent authority with the documentation referred to in paragraph 2, points (h) and (i) at the reference date of the update of the calculation of the business indicator.

Article 14 Reversal to the accounting approach

1. Institutions shall revert to the accounting approach where any condition set out in Article 9, point (b), is no longer met.

2. Institutions that have reverted to the accounting approach shall apply that accounting approach to all three financial years envisaged for the calculation of the financial component.

3. Institutions that have reverted to the accounting approach shall not use the prudential boundary approach again during the following three financial years.

12/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/ojEN OJ L, 3.9.2026 Article 15

Notification procedure for the reversal to the accounting approach

1. Institutions shall notify competent authorities of their reversal to the accounting approach at least 90 days before such reversal.

2. The notification of the reversal to the accounting approach shall contain:

(a) a confirmation that the reversal to the accounting approach has been approved by the management body or by an internal committee designated by that management body, and the date of that approval;

(b) the date as of which the accounting approach will be used;

(d) the analysis of the impact, at the last reporting date in comparison with the prudential boundary approach, of the

reversal to the accounting approach on:

(i) the trading book component;

(ii) the banking book component;

(iii) the financial component;

(iv) the business indicator;

(v) the capital requirements for operational risk;

(e) a report of the independent review of the institution’s independent risk control function, or of internal or external audit, on the points (c) and (d).

TITLE II ELEMENTS TO BE EXCLUDED FROM THE BUSINESS INDICATOR Article 16 Scope of the exclusions from the business indicator

1. For the purposes of Article 314(7), point (a), of Regulation (EU) No 575/2013, institutions shall not exclude from the calculation of the business indicator income and expenses resulting from the distribution of insurance or reinsurance products or services.

2. For the purposes of Article 314(7), point (c), of Regulation (EU) No 575/2013, institutions shall not exclude from the calculation of the business indicator the following items, where accounted for as administrative expenses:

(a) outsourcing fees paid for the supply of financial services;

(b) lease expenses;

3. For the purposes of Article 314(7), points (f) and (i), of Regulation (EU) No 575/2013, institutions shall not exclude from the calculation of the business indicator the following items, where related to lease assets or resulting from

operational risk events:

(a) depreciation of tangible assets;

(b) amortisation of intangible assets;

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 13/28EN OJ L, 3.9.2026 TITLE III ADJUSTMENTS TO THE BUSINESS INDICATOR Article 17 Calculation of the adjustments to the business indicator in case of mergers and acquisitions

1. When calculating their business indicator, institutions shall include items of acquired or merged entities or activities, based on historical audited financial statements. For acquisitions of activities for which dedicated financial statements were not historically established, institutions shall base the calculation on the historical financial information used for the final valuation of the activity acquired.

2. Institutions that can prove that the historical audited financial statements or historical financial information related to the acquired or merged activity or entity are not available or accurate, shall include acquired or merged entities or activities in the calculation of their business indicator, using the institution’s business indicator multiplied by the M & A factor, which shall be calculated in line with the following formula and on the basis of the last financial information available and accurate in relation to that entity or activity, including the annualised ongoing financial exercise:

Institution Net Operating Income + Entity=Activity Net Operating Income M & A factor ¼ Institution Net Operating Income where Net Operating Income (NOI) is calculated as in Commission Implementing Regulation (EU) 2024/3117(4) (FINREP F02.00_r355_c010).

3. Where the M & A factor approach is not feasible due to a lack of data, institutions shall include acquired or merged entities or activities in the calculation of their business indicator using financial forecasts in relation to that entity or activity based on information used for the final valuation.

4. Institutions shall use their audited financial statements for the calculation of the business indicator instead of the approach referred to in paragraph 2 as soon as the acquired or merged entity or activity is fully included in the institutions’ financial statements.

5. Institutions shall also apply any business indicator adjustments in accordance with paragraphs 1 to 4 at the level of their parent undertaking where such parent undertaking is subject to Regulation (EU) No 575/2013 pursuant to Article 11 of that Regulation.

6. Institutions shall notify their competent authority of their plan to include in the calculation of the business indicator entities or activities to be acquired or merged, in accordance with the methods referred to in paragraphs 1, 2 and 3.

Institutions shall make that notification without delay and at the latest at the time of the inclusion, in accordance with Article 315(1) of Regulation (EU) No 575/2013, of the entities or activities to be acquired or to be merged and shall present the own funds requirements for operational risk as calculated in accordance with paragraphs 1, 2 and 3 of this Article.

(4) Commission Implementing Regulation (EU) 2024/3117 of 29 November 2024 laying down implementing technical standards for the application of Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to supervisory reporting of institutions and repealing Commission Implementing Regulation (EU) 2021/451 (OJ L, 2024/3117, 27.12.2024, ELI: http://data.

europa.eu/eli/reg_impl/2024/3117/oj).

14/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/ojEN OJ L, 3.9.2026 Article 18 Timing for the adjustments to the business indicator following mergers and acquisitions Institutions shall take into account the adjustments referred to in Article 17 at the first applicable reporting submission date under Implementing Regulation (EU) 2024/3117 after the date from which the merger or acquisition takes effect.

Article 19 Procedure for granting permission to exclude from the business indicator those amounts that are related to disposed entities or activities

1. Competent authorities may grant institutions a permission as referred to in Article 315(2) of Regulation (EU) No 575/2013 after having analysed the operational risk profile of the following items:

(a) the contribution to the institution’s operational risk losses over the past at least five financial years by disposed entities or activities;

(b) any contractual arrangement whereby the institution or any other entity in its group undertakes to provide the purchaser of the disposed entities or activities with compensation or indemnification for future losses or liabilities arising from operational risk events that occurred prior to the disposal;

(c) the impact of the disposal of entities or activities on the institution’s operational risk management structure that would undermine its capacity to identify, measure and mitigate the operational risk, including changes in information technology systems, transfer of resources, and any other relevant restructuring aspects.

2. Institutions applying for the permission referred to Article 315(2) of Regulation (EU) No 575/2013 shall submit the

following to their competent authority:

(a) a description of the disposal of the entities or activities, its rationale and its implementation dates;

(b) a quantitative impact analysis of the disposal of the entities or activities on operational risk capital requirements and any supporting evidence, including audited financial statements and pro forma financial statements established by an independent auditor;

(c) the detail of operational risk losses related to the entity or activity disposed over the last ten financial years, where available;

(d) the terms and conditions of the disposal of the entities or activities, including any side agreements, and a legal analysis regarding liabilities that may be incurred from events that took place prior to the disposal;

(e) a confirmation that the management body has approved the disposal of the entities or activities, and the date of that approval;

(f) an analysis of the impact of the disposal of the entities or activities on the operational risk management structure of the institution;

(g) any additional document or information that proves that the entity or activities disposed of are no longer deemed relevant to the institution’s risk profile.

3. Institutions shall submit their complete request for the permission referred to in Article 315(2) of Regulation (EU) No 575/2013 to the relevant competent authority at least 90 days before the intended date of the adjustment of the business indicator.

4. The competent authority concerned shall respond to a request for permission referred to in Article 315(2) of Regulation (EU) No 575/2013 in writing within 90 days from having received the complete documentation supporting that request.

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 15/28EN OJ L, 3.9.2026 Article 20 Procedure for granting permission to exclude from the business indicator amounts related to disposed entities or activities where the impact of the divestments is low

1. Where the request referred to in Article 19(2) is submitted, the permission referred to in Article 315(2) of Regulation

(EU) No 575/2013 shall be deemed granted where both of the following conditions are met:

(a) the sum of the net operating income (NOI) of the disposed entities or activities throughout a financial year represents no more than 5 % of the NOI of the disposing institution over the same financial year;

(b) the competent authority does not oppose the request in writing within 90 days of receiving the complete documentation supporting a request for permission from an institution.

2. Institutions shall make the calculation referred to in paragraph 1, point (a), at the end of the preceding financial year using the amount of the NOI of the disposed entities or activities and of the disposing institution.

Article 21 Calculation of the business indicator adjustment in case of disposals Institutions that have been granted the permission referred to in Articles 19 or 20, as applicable, may exclude the business indicator amounts related to the disposed entities or activities for the most recent three financial years, based on the audited financial statements of those entities or the financial information used for the final valuation of those activities.

Article 22 Timing for business indicator adjustments in case of disposal Institutions that have been granted the permission referred to in Articles 19 or 20, as applicable, may adjust their business indicator in accordance with Article 21. Those institutions shall report the revised operational risk capital requirements at the following applicable reporting submission date as set out in Implementing Regulation (EU) 2024/3117.

PART II TAXONOMY OF OPERATIONAL RISK LOSSES, CONDITIONS UNDER WHICH THE CALCULATION OF THE ANNUAL OPERATIONAL RISK LOSS MAY BE DEEMED ‘UNDULY BURDENSOME’, CALCULATION OF THE LOSS DATA SET AND ADJUSTMENTS TO THAT LOSS DATA SET TITLE I TAXONOMY OF OPERATIONAL RISK LOSSES Article 23 Classification of loss events

1. For the purposes of Article 317(7) of Regulation (EU) No 575/2013, institutions shall classify each loss event into a single Level 1 event type in accordance with Article 24 of this Regulation and into a single Level 2 category in accordance with Articles 25 to 31 of this Regulation. Where a loss event falls under multiple Level 1 event types or multiple Level 2 categories, institutions shall classify that event into the most relevant Level 1 event type or Level 2 category.

16/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/ojEN OJ L, 3.9.2026

2. Institutions shall assign to each loss event all the applicable attributes in accordance with Article 32.

3. Institutions shall not include in the loss data set losses that are fully recovered within five working days. Where the recovery is partial, institutions shall include in the gross loss referred to in Article 318(1) of Regulation (EU) No 575/2013 only the part of the loss that is not recovered within five working days.

4. Institutions shall consider as loss events due to legal proceedings losses that are due to all legal disputes and settlements, including both mandated court settlements and out of court disputes and settlements.

Article 24 Level 1 classification Institutions shall classify each loss event in one of the following Level 1 event types:

Level 1 event type classification Description Reference number Internal fraud Losses due to acts of a type intended to defraud and 1 misappropriate property, excluding diversity/ discrimination events, which involves at least one internal party (i.e. a party with a direct relationship to the institution or for which the institution is jointly liable), including instances where the internal party is acting in collusion with external parties.

External fraud Losses due to acts of a type intended to defraud and 2 misappropriate property, committed by an external party without the involvement of an internal party.

Employment practices and Losses arising from acts inconsistent with employment, 3 workplace safety health or safety laws or agreements, from payment of personal injury claims, or from diversity/discrimination events towards employees.

Clients, products and business Losses other than fraud arising from failure to meet a 4 practices professional obligation to specific clients (including fiduciary and suitability requirements), from business practices or from the nature or design of a product.

Damage to physical Losses arising from loss or damage to physical assets, 5 assets employees or affiliates of the institution, public assets or non-affiliated people for which the institution is liable, due to natural disasters or other events, including accidents, wilful damage, war, civil disturbance, riots and terrorism.

Business disruption and system Losses arising from disruption of business or system 6 failures failures.

Execution, delivery and process Losses from failed transaction processing or process 7 management management and data management, from relations with trade counterparties, vendors and regulatory and tax authorities.

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 17/28EN OJ L, 3.9.2026 Article 25 Level 2 classification for Level 1 event type Internal fraud Institutions shall classify each loss event classified as Internal fraud in accordance with Article 24 into one of the following Level 2 categories:

Internal fraud Level 2 Description Reference number classification Bribery and corruption Bribery or corruption from an internal party of the institution. 1.1 Internal fraud committed Fraud committed by an internal party against the institution. This 1.2 against the institution category includes theft or manipulation of data and rogue trading events, including those perpetrated through insider trading and manipulation of positions, risks and profit and loss accounts.

Internal fraud committed Fraud committed by an internal party against the institution’s 1.3 against other stakeholders external parties, including clients and third parties. This category includes theft or manipulation of data and rogue trading events, including those perpetrated through insider trading and manipulation of positions, risks and profit and loss accounts.

Article 26 Level 2 classification for Level 1 event type External fraud Institutions shall classify each loss event classified as External fraud in accordance with Article 24 into one of the following Level 2 categories:

External fraud Level 2 Description Reference number classification Fraud committed by Fraudulent acts not relating to data theft or data manipulation that 2.1 institution’s clients have been committed by a client of the institution, even in collusion with another person.

Fraud not committed by Fraudulent acts not relating to data theft or data manipulation that 2.2 institution’s have not been committed by a client of the institution, including by clients means of the identity of another ignorant person.

Data theft and Data stolen from or maliciously manipulated in bank systems by any 2.3 manipulation means, including cyber-attacks. That covers all types of data, e.g. client data, employee data, and the institution’s proprietary data.

Robbery, burglary and theft of Robbery, burglary and theft of physical assets by an external party. 2.4 physical assets 18/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/ojEN OJ L, 3.9.2026 Article 27 Level 2 classification for Level 1 event type Employment practices and workplace safety Institutions shall classify each loss event classified as Employment practices and workplace safety in accordance with Article 24 into one of the following Level 2 categories:

Employment practices and workplace safety Level 2 Description Reference number classification Inadequate Losses arising from breaches of employment legislation or regulatory 3.1 employment practice requirements (including actual or perceived mistreatment of employees that can be traced to a regulatory breach like unfair dismissal, harassment); ineffective employment relations (including industrial action like strikes, court disputes, and ineffective union/ employee group relations management); diversity and discrimination events towards employees.

Inadequate Losses arising from ineffective workplace safety and breach of 3.2 workplace safety employees’ health and safety rules.

Article 28 Level 2 classification for Level 1 event type Clients, products and business practices Institutions shall classify each loss event classified as Clients, products and business practices in accordance with Article 24 into one of the following Level 2 categories:

Clients, products and business Description Reference number practices Level 2 classification Client mistreatment / Failure to Inappropriate behaviour towards customers and failure to respect 4.1 fulfil duties to customer and comply with duties to customers, either actual or potential.

Data privacy breach / Improper disclosure or misuse of confidential information. 4.2 Confidentiality mismanagement Improper market practices, Anti- Conducting business activities in breach of trading rules and 4.3 Trust / Anti-Competition standards, including all types of market abuse and manipulation.

Violations of antitrust or competition laws where the institution fails to act in accordance with clients’ best interest.

Improper distribution and Improper/inadequate means of distribution of products and 4.4 marketing, including sale Service services and improper/inaccurate direct marketing practices.

Failure Sale service failure includes both pre-sales service failure and post- sales service failure. Pre-sales failure is inadequate/improper services to clients ahead of sales, including mis-selling and failure to provide adequate advice. Post-sales failure refers to inadequate/ improper services to clients after sales, including the failure to respond to client complaints regarding poor sales services within the timelines defined by the regulator

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 19/28EN OJ L, 3.9.2026 Clients, products and business Description Reference number practices Level 2 classification Financial crime The risk of money laundering, know-your-customer (KYC) failure 4.5 and sanctions violations. This category includes:

(a) failure to comply with the restrictions imposed by sanctions, including operational risk events due to mistaken transactions involving sanctioned countries;

(b) engagement in money laundering and terrorism financing, including failures in KYC process.

Breaches of statute and Breach of any legal or regulatory obligations, other than those 4.6 regulations, other than those specifically assigned to other event types or categories, including specifically assigned to other the institution’s legal obligations and the obligations imposed by event types or categories regulatory and tax authorities.

This category includes:

(a) operating without the necessary authorisation, licence, certification or registration;

(b) tax evasion.

Where tax evasion is committed to consciously breach the tax regulation, institutions shall assign the loss event to event 1.3.

Improper product and service Flaws in design of products or services targeted at clients such that 4.7 design the design of a product/service does not meet a client’s needs.

Model methodology Losses due to errors in the model itself, including the model 4.8 design, incorrect formulae, methodology and underlying assumptions. Where Artificial Intelligence (AI) systems are components of the model, an error due to that technology could fall under the scope of model risk.

Article 29 Level 2 classification for Level 1 event type Damage to physical assets Institutions shall classify each loss event classified as Damage to physical assets in accordance with Article 24 into one of the following Level 2 categories:

Damage to physical assets Level 2 Reference Description classification number Natural disasters Losses due to natural disasters, including pandemic events. 5.1 Other external events Losses due to other events, including accidents, wilful damage, 5.2 war, civil disturbance, riots and terrorism. Business disruption events, including those stemming from workforce availability, shall not be mapped in this category.

20/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/ojEN OJ L, 3.9.2026 Article 30 Level 2 classification for Level 1 event type Business disruption and system failures Institutions shall classify each loss event classified as Business disruption and system failures in accordance with Article 24 into one of the following Level 2 categories:

Business disruption and system Reference Description failures Level 2 classification number Infrastructure and system failure Infrastructure and System failure due to Internal application failures, 6.1 internal network and information systems and support failures, utility and external support failures, infrastructure failures, ICT change programmes failures.

Business disruption Business disruption due to workforce availability, workplace 6.2 availability.

Article 31 Level 2 classification for Level 1 event type Execution, delivery and process management Institutions shall classify each loss event classified as Execution, delivery and process management in accordance with Article 24 into one of the following Level 2 categories:

Execution, delivery and process Description Reference number management Level 2 classification Processing/Execution failures Failure to process, manage and execute transactions (including fat 7.1 finger losses) or other processes (including change programmes, different from the ICT ones) correctly or appropriately.

Client account mismanagement Inadequate management of client portfolio/investments, including 7.2 unapproved access given to accounts, incorrect client records (loss incurred), negligent loss or damage to client assets.

Rights/Obligation failures Failure to follow the appropriate procedure for handling legal 7.3 processes. Failure to manage contractual and non-contractual rights/obligations correctly. This category includes all execution errors pertaining to legal procedures and processes, including in reporting to external parties, such as tax and regulatory authorities.

It does not include breaches of the organisation’s legal obligations, legal disputes and litigations.

Data management Failing to appropriately manage and maintain data, including all 7.4 types of data, for example client data, employee data, and the organisation’s proprietary data, but excluding breaches of data privacy and confidentiality mismanagement.

Model implementation and use Incorrectly implementing a model, even though that model may be 7.5 correct.

Using a model in an incorrect context, even though that model may be correct and correctly implemented.

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 21/28EN OJ L, 3.9.2026 Article 32 Attributes

1. Institutions shall assign to each loss event all the applicable of the following attributes:

Attributes Description Legal risk – Misconduct As defined in Article 4, point (52a), (d), of Regulation (EU) No 575/2013.

Legal risk – Other than Misconduct As defined in Article 4, points (52a)(a), (b), (c),(e), (f) and (g) of Regulation (EU) No 575/2013.

Model risk As defined in Article 4, point (52b) of Regulation (EU) No 575/2013.

ICT risk – not related to Cyber As defined in Article 4, point (52c) of Regulation (EU) No 575/2013, excluding losses from cyber-attacks.

ICT risk – related to Cyber Losses induced by cyber-attacks as defined in Article 3, point (14), of Regulation

(EU) 2022/2554.

Credit risk (where not included in Operational risk losses related to credit assets, including credit frauds (committed credit risk weighted assets) by the client on its own account or by a third party through identity theft), unenforceable credit contracts or collateral failures, that have been unpaid and are not accounted for in the risk-weighted exposure amount for credit risk.

Market risk The following events, and the related losses, shall be classified as operational risk

related to financial transactions and market risk:

(a) events due to operational and data entry errors, including the following:

(i) failures and errors during the introduction or execution of orders;

(ii) loss of data or misunderstanding of the data flow from the front to the middle and back offices of the institution;

(iii) errors in classification;

(iv) incorrect specification of deals in the term-sheet, including errors related to the transaction amount, maturities and financial features;

(b) events due to failures in internal controls, including the following:

(i) failures in properly executing an order to unwind a market position in case of adverse price movements;

(ii) unauthorised positions taken in excess of allocated limits, irrespective of the type of risk they relate to;

(c) events due to inadequate data quality and unavailability of IT environment, including technical unavailability of access to the market resulting in an inability to close contracts.

Third-party risk Losses that may arise for an institution in relation to its use of services provided by third-party service providers or by subcontractors of the that provider, including through outsourcing arrangements.

Those losses include losses due to failures in managing third-party relationships and risks appropriately, including developing and maintaining an adequate third- party control framework (including due diligence including selection of third- party service providers, ongoing monitoring) or defining and implementing adequate contractual arrangements / service level agreements.

22/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/ojEN OJ L, 3.9.2026 Attributes Description Environmental, social and Losses that may arise from environmental, physical, and transition risks, as governance risks defined in Article 4, points (52e), (52f), and (52g) of Regulation (EU) No 575/2013. Losses that may arise from social and governance risks, as defined in Article 4, points (52h) and (52i), of Regulation (EU) No 575/2013.

Greenwashing risk The scope of application includes greenwashing risk, with reference to the losses arising from practices whereby sustainability related statements, declarations, actions, or communications do not clearly and fairly reflect the underlying sustainability profile of an entity, a financial product, or financial services. Those practices may be misleading to consumers, investors or other market participants.

Business continuity Failure to provide and maintain appropriate business continuity management and event management framework (including ICT business continuity and ICT recovery and response aspects as referred to in Articles 11 and 12 of Regulation

(EU) 2022/2554), and in Articles 24, 25 and 26 of Commission Delegated Regulation (EU) 2024/1774(1), including inadequate business continuity plans.

Retail (including banking and retail Operational events and losses linked to retail clients, including: brokerage) (a) natural persons;

(b) SMEs (small and medium-sized enterprises) as defined in Article 5, point(9), of Regulation (EU) No 575/2013.

The list of activities for this attribute includes:

(a) retail and private banking: lending and deposits, transactional and saving accounts, ATMs services, banking services, financial leasing, guarantees and commitments, trusts and estates, investment advice, card services (debit and credit cards, merchant/commercial/corporate cards, private labels);

(b) retail brokerage: reception, transmission and execution of client orders, placing of financial instruments without a firm commitment basis.

Trading and sales Operational events and losses linked to activities including flow business and sales, brokerage, market making, treasury, position taking, and proprietary positions managed by trading desks, as defined in Article 4, point (144), of Regulation (EU) No 575/2013.

The list of products for this attribute includes:

(a) equities: equity portfolios and indices;

(b) fixed income and credit trading;

(d) commodities and energy products;

(e) money market, funding, repos and securities lending;

(f) derivatives.

Commercial banking Operational events and losses linked to activities including lending and deposits, guarantees, leasing and factoring, trade finance, project finance, real estate.

Other business lines (including This attribute includes the remaining operational events and losses linked to corporate finance, payment and activities, other than those referred to in in the Retail, trading and sales, and settlement, asset management, agency Commercial banking attributes, including the following:

services, corporate items) (a) corporate finance: mergers and acquisitions, underwriting, privatisations, securitisation, initial public offering and private placements, advisory services, municipal and government finance, merchant banking;

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 23/28EN OJ L, 3.9.2026 Attributes Description

(b) payments and settlements for external clients: payments and collections, funds transfer, cash and securities clearing and settlement; payment and settlement losses related to a institution´s own activities shall be incorporated in the affected business line;

(c) agency services for the account of clients: custody services (escrow, depository receipts, corporate actions, etc.), corporate trust and agency (issuer and paying agents);

(d) asset management: discretionary and non-discretionary fund management, including portfolio management (pooled, segregated, retail, institutional, closed, open, private equity);

(e) corporate items: for purely corporate level items, including those affecting the Board of Directors, misreporting financial statements, or other events that can only be categorised at corporate centre.

(1) Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework (OJ L, 2024/1774, 25.6.2024, ELI: http://data.europa.eu/ eli/reg_del/2024/1774/oj).

2. By way of derogation from paragraph 1, institutions shall assign to each loss event at least one attribute among ‘Retail (including banking and retail brokerage)’, ‘Trading and sales’, ‘Commercial banking’ and ‘Other business lines (including corporate finance, payment and settlement, asset management, agency services, corporate items)’.

3. By way of derogation from paragraph 1, institutions shall assign the attributes ‘Legal risk – Misconduct’, ‘Legal risk – Other than misconduct’ and ‘Model risk’ to Level 1 event types and Level 2 categories in accordance with the Annex.

Article 33 Retroactive application of the loss data set

1. Institutions shall assign loss events to the relevant Level 1 event types in accordance with Article 24 from 1 January

2016.

2. Institutions may assign loss events to the relevant Level 2 categories in accordance with Articles from 25 to 31 from 1 January 2025.

3. Institutions may assign attributes to loss events in accordance with Article 32 from at least 1 January 2025.

TITLE II CONDITIONS UNDER WHICH THE CALCULATION OF THE ANNUAL OPERATIONAL RISK LOSS IS TO BE DEEMED ‘UNDULY BURDENSOME’ Article 34 Mergers and acquisitions

1. For the purposes of Article 316(1), second subparagraph, of Regulation (EU) No 575/2013, the calculation of the operational risk loss shall be deemed to be unduly burdensome for up to three financial years following the date at which the merger or acquisition takes effect where, due to that merger or acquisition, the business indicator of an institution equals or exceeds EUR 750 million, but does not exceed EUR 1 billion.

24/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/ojEN OJ L, 3.9.2026

2. The period referred to in paragraph 1 shall be reduced to up to two financial years following the legal finalisation of the merger or acquisition where at least one, but not all, of the institutions involved in the merger or acquisition calculated the operational risk loss the year prior to the operation.

3. Where all of the institutions involved in the merger or acquisition calculated the operational risk loss the year prior to the operation, the calculation of the operational risk loss of the institution resulting from the merger or acquisition shall not be deemed to be unduly burdensome.

Article 35 Business indicator temporarily equal to or exceeding EUR 750 million and not exceeding EUR 1 billion For the purposes of Article 316(1), second subparagraph, of Regulation (EU) No 575/2013, the calculation of the operational risk loss shall be deemed to be unduly burdensome for institutions the business indicator of which is equal to or exceeding EUR 750 million, but not exceeding EUR 1 billion, for no more than four consecutive reporting dates or for no more than eight reporting dates in the preceding twenty reporting dates.

Article 36 Bridge institution referred to in Article 40 of Directive 2014/59/EU For the purposes of Article 316(1), second subparagraph, of Regulation (EU) No 575/2013, the calculation of the operational risk loss shall be deemed to be unduly burdensome f for bridge institutions as defined in Article 2, point (59), of Directive 2014/59/EU of the European Parliament and of the Council(5).

TITLE III ADJUSTMENTS TO THE LOSS DATA SET FOLLOWING THE INCLUSION OF LOSSES FROM MERGED OR ACQUIRED ENTITIES OR ACTIVITIES Article 37 Adjustments to the loss data set related to calculation of losses and risk taxonomy Institutions shall record losses stemming from merged or acquired entities or activities in the loss data set of the reporting institution with the necessary adjustments to comply with Articles 317 and 318 of Regulation (EU) No 575/2013.

(5) Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190, ELI: http://data.

europa.eu/eli/dir/2014/59/oj).

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 25/28EN OJ L, 3.9.2026 Article 38 Adjustments to the loss data set due to currency differences Where the currency of the merged or acquired entities or activities is different from the currency of the acquiring institution, institutions shall include losses stemming from merged or acquired entities or activities in the loss data set applying, for each of the ten-year window, the exchange rate used at the end of the relevant year in the institution’s financial statement.

Article 39 Calculation of the losses when the acquiring or merging institution is not able to promptly integrate the loss data set of the acquired or merged institution or activities

1. Where the merged or acquired entities or activities have not established or maintained a loss data set because they fall not under the scope of Article 317 of Regulation (EU) No 575/2013, the acquiring institution may use the following formula to calculate the annual operational risk loss referred to in Article 316 of that Regulation:

Reported Losses Annual operational risk loss¼ Coverage of Reported Losses

where: reported losses = the annual operational risk loss of the entities or activities able to report the annual operational risk loss;

Business Indicator of entities or activities able to report the annual operational risk losses coverage of reported losses = Business Indicator of the institution business indicator of the institution = the business indicator resulting from the consolidation of the acquiring institution including the acquired or merged entities, or activities.

2. The acquiring institution may use the formula set out in paragraph 1 to calculate the annual operational risk loss for up to ten financial years prior to legal finalisation of the acquisition or merger.

3. By way of derogation from paragraph 2, where the merged or acquired entities or activities fall under the scope of Article 317 of Regulation (EU) No 575/2013, but the acquiring institution is not able to promptly adjust their loss data set, that acquiring institution may use the formula set out in paragraph 1 of this Article to calculate the annual operational risk loss referred to in Article 316 of that Regulation for up to two years following the legal finalisation of the acquisition or merger.

4. Where the acquiring institution is not able to promptly allocate the annual operational risk loss for part or all of the acquired or merged institution or activities according to the mapping of historical loss data referred to in Article 317(7) of Regulation (EU) No 575/2013, that acquiring institution shall allocate, for a maximum of two years following the legal finalisation of the acquisition or merger, losses according to the distribution of losses in the reporting institution.

26/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/ojEN OJ L, 3.9.2026 PART III FINAL PROVISIONS Article 40 Entry into force This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 28 May 2026.

For the Commission The President Ursula VON DER LEYEN

ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj 27/28EN OJ L, 3.9.2026 ANNEX Attributes Mapping to Level 1 event types and Level 2 categories Legal Risk – Misconduct 1. Loss events classified into the following Level 1 event types and Level 2 categories shall always be assigned the attribute ‘Legal Risk – Misconduct’:

1.1, 1.2, 1.3, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8

2. Loss events classified into Level 1 event types and Level 2 categories different than those in point 1 shall not be assigned the attribute ‘Legal risk – Misconduct’.

Legal Risk – Other than Misconduct 3. Loss events classified into the following Level 1 event types and Level 2 categories may be assigned the attribute ‘Legal Risk – Other than Misconduct’:

2.1, 2.2, 2.3, 2.4, 3.1, 3.2, 5.1, 5.2, 6.1, 6.2, 7.1, 7.2, 7.3, 7.4, 7.5

4. Loss events classified into Level 1 event types and Level 2 categories different than those in point 3 shall not be assigned the attribute ‘Legal Risk – Other than Misconduct’.

Model Risk 5. Loss events classified into the following Level 1 event types and Level 2 categories shall always be assigned the attribute ‘Model Risk’:

4.8, 7.5

6. Loss events classified into the following Level 1 event type and Level 2 category may be assigned the attribute ‘Model Risk’:

7.4

7. Loss events classified into Level 1 event types and Level 2 categories different than those in points 5 and 6 shall not be assigned the attribute ‘Model Risk’.

28/28 ELI: http://data.europa.eu/eli/reg_del/2026/1167/oj

Commission Delegated Regulation (EU) 2026/1167 of 28 May 2026 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards specifying operational risk requirements

Official Gazette Notification Text

Explore the policy trail

Stay updated on this topic

Get daily policy updates in your inbox

Commission Delegated Regulation (EU) 2026/1167 of 28 May 2026 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards specifying operational risk requirements

Official Gazette Notification Text

Explore the policy trail

You might also want to explore

Commission Implementing Regulation (EU) 2024/2390 of 6 September 2024 renewing the approval of the active substance metrafenone in accordance with Regulation (EC) No 1107/2009 of the European Parliament and of the Council, and amending Commission Implementing Regulation (EU) No 540/2011

Commission Recommendation (EU) 2024/2395 of 2 September 2024 setting out guidelines for the interpretation of Article 26 of Directive (EU) 2023/1791 of the European Parliament and of the Council as regards the heating and cooling supply

Stay updated on this topic

Get daily policy updates in your inbox