CRR3 Operational Risk Reporting: What Changes From June 2026 for Luxembourg Banks

ByOfficer

Last updated: April 2026

If your operational risk reporting still references the Basic Indicator Approach, the Standardised Approach, or the Advanced Measurement Approach, you are filing against a framework that no longer exists. CRR3 replaced all three with a single calculation method: the Business Indicator Component. The capital requirement formula changed on 1 January 2025. The reporting templates that reflect it land with a first mandatory reference date of 30 June 2026, after Regulation (EU) 2025/2475 pushed the original March 2026 deadline back by one quarter.

For Luxembourg banks supervised by the CSSF or directly by the ECB, that means the next quarterly COREP submission is the first one where the full new operational risk template suite applies. Getting the BIC sub-components wrong does not just produce a validation error. It feeds directly into the own funds requirement. I have seen teams treat the BIC mapping as a simple relabelling exercise, only to discover that the BI sub-component breakdown does not line up with how their general ledger aggregates P&L items. That discovery is better made now than during remittance week.

This article covers what changed in the calculation, which templates are new, what the real deadlines are, and where teams are most likely to trip.

Related reading: COREP Reporting Explained

What CRR3 Actually Changed in Operational Risk

Regulation (EU) 2024/1623 (CRR3) rewrote Part Three, Title III of the Capital Requirements Regulation. Articles 312 to 315 now contain the entire operational risk own funds framework. The old approaches, the Basic Indicator Approach (BIA, former Articles 315-316), the Standardised/Alternative Standardised Approach (TSA/ASA, former Articles 317-320), and the Advanced Measurement Approach (AMA, former Articles 321-324), are all gone. Every institution now uses the same method.

Article 312(1) of the amended CRR is direct: the own funds requirement for operational risk is the Business Indicator Component (BIC), calculated per Article 313. That is it. No model choice, no competent authority permission to select an approach, no partial use across business lines.

The BIC calculation in brief

The BIC is derived from the Business Indicator (BI), which aggregates three sub-components from the institution’s P&L:

  • Interest, Leases and Dividend Component (ILDC): the larger of net interest income or net interest expense, plus dividend income, computed as a three-year average of absolute values.
  • Services Component (SC): fee and commission income plus fee and commission expense, plus other operating income and other operating expense, again as a three-year average of absolute values.
  • Financial Component (FC): the sum of the net P&L and absolute value items on the trading book and banking book, as a three-year average.

The BI is the sum of these three components. The BIC then applies marginal coefficients to the BI across three buckets (Article 313):

  • BI up to EUR 1 billion: 12%
  • BI from EUR 1 billion to EUR 30 billion: 15%
  • BI above EUR 30 billion: 18%

These are marginal rates, not flat rates. An institution with a BI of EUR 2 billion does not apply 15% to the full amount. It applies 12% to the first EUR 1 billion and 15% to the remaining EUR 1 billion. I have seen draft calculations where teams apply a single flat rate to the whole BI. That error inflates (or deflates) the own funds requirement, and it will not survive validation.

Where the ILM went

The Basel III final standards (BCBS d424) designed the Standardised Measurement Approach with two components: the BIC and an Internal Loss Multiplier (ILM) that adjusts the requirement based on the institution’s historical operational risk losses. In theory, a bank with low historical losses relative to its BIC would get a requirement below the BIC alone, and a bank with high losses would get a higher requirement.

The EU chose not to activate the ILM. Article 312(1) of the CRR as amended sets the own funds requirement equal to the BIC alone. There is no loss multiplier in the EU calculation. The result: OFR = BIC, full stop.

Article 312(2) does leave a door open. It allows an institution, with competent authority permission, to use a methodology that factors in historical operational risk loss data. The EBA disclosure templates (EU OR2, EU OR3) explicitly reference Article 312(2) as a methodology that institutions would disclose if used. But no EU Member State has activated this option to date, and the CSSF has not signalled any intention to do so for Luxembourg-supervised entities. For all practical purposes, operational risk capital in the EU is the BIC and nothing else.

The real problem starts when teams confuse this with the loss data collection obligation. Just because ILM = 1 does not mean loss data is irrelevant. Institutions whose BIC exceeds EUR 750 million must still collect and disclose yearly operational risk losses under the Pillar 3 framework (Article 446 CRR). That loss data feeds the SREP. It does not feed the Pillar 1 formula, but it can absolutely feed supervisory add-ons.

The Reporting Timeline: Why “June 2026” Is the Date That Matters

CRR3 applied from 1 January 2025. The first quarterly COREP reference date under CRR3 was 31 March 2025. But the operational risk reporting templates were not ready in time for that date.

The EBA published its final ITS on supervisory reporting for operational risk (CRR3 phase 1) on 16 June 2025. That final report covered the new template suite: C 16.01, C 16.02, C 16.03, and C 16.04. The EBA simultaneously published the RTS on business indicator components (under Article 314(9)) and the ITS mapping BI items to FINREP reporting cells (under Article 314(10)).

The original plan was a first reference date of 31 March 2026, giving institutions roughly nine months after the final ITS publication to implement. Then in December 2025, the European Commission adopted Regulation (EU) 2025/2475, which pushed the application of the new operational risk reporting requirements to the end of June 2026.

What this means concretely

The EBA press release of 17 December 2025 spells out the phased approach:

  • Template C 16.01 (OPR OF, own funds requirements): required from the March 2026 reference date, using COREP OF module release 4.2. However, the “other operating expenses” data points are not required for March 2026.
  • Templates C 16.02, C 16.03, C 16.04: first mandatory submission is the June 2026 reference date. Voluntary reporting from March 2026 is permitted.

This is where teams commonly misclassify the obligation. Some read the postponement as “nothing changes until June 2026.” That is wrong. C 16.01 reporting under the new structure was already required for March 2026. The postponement only covers the extended template suite. If your team did not update C 16.01 for March 2026, you already have a problem.

Remittance dates

The Q2 2026 reference date (30 June 2026) follows the standard quarterly COREP remittance timetable. For significant institutions, that means the usual 42-day deadline, which puts the remittance date at 11 August 2026. Luxembourg less significant institutions should still check the CSSF remittance calendar and any institution-specific instructions, but the right framing is the standard COREP timetable rather than a rough 46-49 day estimate.

The New Template Suite: C 16.01 Through C 16.04

The old C 16.00 (OPR) template, which captured own funds requirements under whichever approach an institution used (BIA, TSA/ASA, or AMA), is replaced by four templates. The scope expansion is significant.

C 16.01: OPR OF (Own Funds Requirements)

This template captures the calculated BIC-based own funds requirement. It reports the BI value, the BIC derived from it, and the resulting own funds requirement. Under the old framework, C 16.00 was a relatively simple template because the BIA calculation was straightforward and the TSA breakdown was coarse. C 16.01 now requires the BI amount and the BIC broken down by the marginal coefficient buckets.

The Luxembourg angle matters because many smaller CSSF-supervised banks previously used the BIA, which required exactly one input: gross income. The BIC requires disaggregated P&L data across three sub-components, each of which has its own sub-items. That is a fundamentally different data sourcing exercise.

C 16.02: OPR BIC (Business Indicator Component detail)

This template breaks down the BI into its three sub-components (ILDC, SC, FC) and their sub-items, for each of the last three financial years. It is the core data template. Getting this right requires mapping your chart of accounts to the EBA’s list of typical BI items, as specified in the RTS under Article 314(9)(a).

The EBA also published an ITS mapping (Article 314(10)) that links BI sub-items to FINREP reporting cells. If your institution reports FINREP, this mapping is your reconciliation anchor. If you do not report FINREP (some smaller institutions have waivers), you still need to produce the same breakdown from your accounting records, without the FINREP cross-check.

Common mistake: treating the interest component as simply “net interest income from the P&L.” The ILDC includes interest income, interest expense, interest income from finance leases, and dividend income, each as separate data points within the sub-component. The lease sub-component is embedded within the interest component, following the same logic as the Basel standard. Institutions applying IFRS 16 need to trace lease-related interest correctly. Those on Lux GAAP may handle leases differently, and the template instructions accommodate both IFRS and national accounting frameworks.

C 16.03: OPR BD (Operational Risk Breakdown)

This quarterly template requires a breakdown of total losses, expenses, provisions, and other financial impacts from operational risk events, as recorded in the institution’s P&L. For each of the last three financial years, institutions report where operational risk events hit the income statement: in staff expenses, administrative expenses, depreciation, provisions, impairments, or other categories.

This template matters because it feeds the “other operating expenses” element in the SC. If an institution’s other operating expenses include material operational risk event costs, those costs affect the BI calculation. The template ensures supervisors can see whether the SC is being driven by business-as-usual operating costs or by operational risk event clean-up costs.

This is where teams usually misclassify. Operational risk events that are booked as provisions or impairments are still operational risk impacts and still need to be captured in C 16.03. If your loss event database is not reconciled to your general ledger, you will have gaps.

C 16.04: Information at subsidiary level (Article 314(2a))

This template applies at consolidated level only. Where an institution uses the derogation under Article 314(2a) to compute a separate ILDC for certain subsidiary institutions, this template captures the subsidiary-level breakdown. For Luxembourg banking groups with subsidiaries in multiple jurisdictions, this template requires careful attention to intercompany elimination.

The derogation under Article 314(2a) allows the consolidating institution to compute the ILDC separately for subsidiary institutions whose interest margin is materially different from the group average. If you are not using this derogation, C 16.04 does not apply. But if you are, the intercompany balances between the subsidiary and the rest of the group must be properly excluded. I have seen consolidated reporting teams initially miss this because the derogation was claimed at group level without informing the reporting team which subsidiaries were in scope.

Data Sourcing: Where the Actual Work Lives

The capital calculation may be simpler than the old AMA (no model, no scenario analysis, no loss distribution fitting). But the reporting data sourcing is harder than the old BIA. Under the BIA, you needed one number: gross income, averaged over three years. Under the BIC, you need the full BI sub-component decomposition, reconciled to FINREP where applicable, for three years of history.

Chart of accounts mapping

The EBA RTS under Article 314(9)(a) provides a list of typical items for each BI sub-component. These items do not map one-to-one to every institution’s chart of accounts. The mapping exercise is where most implementation effort sits. For Luxembourg banks on Lux GAAP, the mapping is particularly tricky because the standard chart of accounts (plan comptable normalisé) does not always align cleanly with the IFRS-oriented BI definitions.

The EBA ITS under Article 314(10) provides the mapping to FINREP cells. This helps if you report FINREP, because you can cross-check your BI items against your existing FINREP submission. But the mapping is not always one-to-one. Some BI items span multiple FINREP cells, and some FINREP cells feed multiple BI items. Treat the mapping as a reconciliation tool, not as a direct feed.

Three-year averaging

The BI uses a three-year average. For the 30 June 2026 reference date, the relevant years are 2023, 2024, and 2025 (assuming a December year-end). This means your BI calculation relies on audited financial data that predates CRR3 application. The data existed before the framework changed, but it was never collected in this specific disaggregation. Reconstructing three years of BI sub-component history from legacy P&L records is a non-trivial exercise, especially where the chart of accounts changed during that period or where mergers/acquisitions occurred.

Article 315 CRR and the associated RTS (Article 315(3)) provide rules for adjusting the BI following mergers, acquisitions, and disposals. If your institution underwent a material corporate event in 2023-2025, you need to apply these adjustment rules to the historical BI. The RTS specifies when you can use actual historical data, when you must use alternative methodologies, and when competent authority permission is required (specifically for excluding BI items related to disposals). A materiality threshold for disposals allows adjustments without supervisory permission for minor transactions.

Pillar 3 Disclosure: Separate but Linked

The operational risk Pillar 3 disclosure templates under Article 446 CRR have also been revised. The key templates are:

  • EU OR1: Operational risk losses (ten-year history, using EUR 20,000 and EUR 100,000 thresholds)
  • EU OR2: Business indicator and sub-components
  • EU OR3: Own funds requirements and risk-weighted exposure amounts

EU OR1 is where the loss data collection obligation bites. Institutions with BIC above EUR 750 million must disclose operational risk loss data, even though the ILM is not used in the capital calculation. The ten-year loss history in EU OR1 requires institutions to maintain loss databases going back a decade, with consistent event classification.

The EUR 750 million BIC threshold is not the same as EUR 750 million in total assets or gross income. It is the calculated BIC amount. For a large Luxembourg bank with diversified P&L, reaching that threshold depends on the BI composition, not just on size. Smaller specialist institutions with high trading or fee income relative to their asset base could exceed the threshold despite being relatively small by total asset measures.

The mapping tool published by the EBA links the reporting templates (C 16.01 through C 16.04) to the disclosure templates (EU OR1 through EU OR3). Consistency between what you report to the supervisor and what you disclose publicly is not optional. Discrepancies between COREP and Pillar 3 will be visible to supervisors who use the mapping tool, and they will ask questions.

What Luxembourg Teams Commonly Get Wrong

Based on the structure of the new framework and the transition mechanics, these are the areas where I expect the most errors in the first filing cycle.

1. Treating the BIC calculation as a relabelling of the old BIA

The BIA used gross income (net interest income + net non-interest income). The BIC uses the BI, which is a sum of absolute values of specific P&L sub-components. These are not the same concept. Gross income can be negative (if a bank has a net loss). The BI, because it uses absolute values and sums them, is always positive. A bank that reported zero or negative gross income under the BIA will now have a positive BI. Its operational risk capital requirement may increase substantially.

2. Ignoring the March 2026 obligation

Some teams interpreted Regulation (EU) 2025/2475 as postponing all operational risk reporting to June 2026. It did not. C 16.01 was required for the March 2026 reference date. The postponement covered C 16.02, C 16.03, and C 16.04 specifically. Teams that skipped C 16.01 updates for Q1 2026 need to correct that before the June submission.

3. Misclassifying lease income in the ILDC

For IFRS 16 reporters, interest income from finance leases sits inside the ILDC interest sub-component. For institutions on Lux GAAP that treat leases differently, the classification may not be obvious. The EBA instructions accommodate both frameworks, but the data sourcing responsibility falls on the reporting team. If lease-related items are material, misclassification will distort the ILDC and, by extension, the BI and BIC.

4. Not reconciling BI items to FINREP

The EBA published the ITS mapping specifically so institutions can reconcile BI sub-items to FINREP cells. If your BI calculation produces numbers that do not reconcile to your FINREP submission, one of them is wrong. The validation rules (published as part of the Q4 2025 technical package) will catch some mismatches, but not all. Manual reconciliation is required.

5. Overlooking C 16.04 for consolidated reporting

Groups that use the Article 314(2a) derogation must report C 16.04. The decision to use the derogation sits with the group risk function. If the reporting team was not involved in that decision, they may not know C 16.04 is required. Check with your prudential risk team whether any subsidiaries have a materially different interest margin that triggered the derogation.

6. Confusing the Pillar 3 loss disclosure threshold

The EUR 750 million threshold for loss data collection and disclosure refers to the BIC amount, not to total assets, revenue, or any other size metric. An institution needs to calculate its BIC first, then check whether it exceeds EUR 750 million. If it does, the ten-year loss history disclosure obligation applies from the first disclosure reference date. That loss database needs to be ready before the first Pillar 3 report is due, not when the COREP template is submitted.

CSSF and ECB Supervision: Who Reports What

In Luxembourg, the supervisory setup for operational risk reporting depends on whether the institution is directly supervised by the ECB (Significant Institution, SI) or by the CSSF (Less Significant Institution, LSI).

For SIs, the ECB sets supervisory expectations through the Joint Supervisory Team. The ECB has been clear in its public communications (including the Supervisory Board speeches of late 2024 and early 2025) that CRR3 implementation, including operational risk, is a priority. SI reporting teams should expect scrutiny of the first BIC-based submission. The ECB’s SREP framework already incorporates operational risk loss data into supervisory assessments, even without the ILM.

For LSIs supervised by the CSSF, the reporting obligation is the same (COREP templates via the EBA framework), but the supervisory intensity may differ. The CSSF collects COREP data via the standard EBA channels (S2 platform). Luxembourg LSIs that previously used the BIA have the steepest learning curve, because they are moving from the simplest possible calculation (15% of gross income) to a three-sub-component breakdown with FINREP cross-references.

This is where the Luxembourg angle matters specifically. Luxembourg hosts a large number of smaller banks and branches of non-EU institutions. Some of these entities have lean reporting teams. The shift from BIA to BIC is proportionally harder for a five-person finance team than for a large SI with a dedicated regulatory reporting department. The CSSF has historically been pragmatic about implementation timelines for smaller entities, but the EBA ITS does not include a proportionality carve-out for operational risk templates. Everyone files the same templates.

What to Do Before the June 2026 Reference Date

If your institution has not yet completed implementation, this is the minimum checklist:

  • Map your chart of accounts to the BI sub-items listed in the RTS under Article 314(9)(a). Confirm that every P&L line item is classified into one of the three sub-components (ILDC, SC, FC) or excluded.
  • Reconstruct the BI for 2023, 2024, and 2025 using the mapped items. Reconcile to FINREP where applicable.
  • If your institution underwent a merger, acquisition, or disposal in 2023-2025, apply the adjustment rules from the RTS under Article 315(3).
  • Verify that your COREP reporting software has been updated to release 4.2 and supports templates C 16.01 through C 16.04.
  • If your institution reports at consolidated level, determine whether the Article 314(2a) derogation applies to any subsidiaries and prepare C 16.04 accordingly.
  • Calculate the BIC and determine whether it exceeds EUR 750 million. If yes, confirm that your operational risk loss database covers ten years and uses the EUR 20,000 threshold for event capture.
  • Run the EBA validation rules (from the Q4 2025 technical package) against a test submission before the remittance date.

After the BIA: A Harder Calculation, but a Better One

The old BIA was simple to compute but poor at capturing operational risk. A bank could double its operational risk exposure (through new business lines, outsourcing, or digital transformation) without any change to its gross income, and the BIA capital requirement would stay flat. The BIC is more granular. It reflects the actual composition of an institution’s business through its P&L components.

The trade-off is reporting complexity. Three sub-components, three years of history, a mandatory mapping to FINREP, and a new set of templates that demand data the old framework never asked for. For Luxembourg’s banking sector, the practical challenge is not the formula. It is the data pipeline. Getting the right numbers out of your general ledger, into the BI calculation, and into the COREP template with consistent classification across three years. That is where the work is.

The June 2026 reference date is not a soft launch. It is the first mandatory filing. There is no grace period in the ITS.

Sources and References

Related Articles

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.

Similar Posts