EBA Simplification Package:

1. Context and Timeline

The revision was prompted by the amended version of Article 317 of the CRR, introduced as part of CRR III, which requires the EBA to develop a risk taxonomy for operational risks that complies with international standards, as well as to establish a methodology for classifying loss events based on this taxonomy. The corresponding regulatory technical standards (RTS) have already been drafted by the EBA and submitted to the European Commission for adoption (EBA/RTS/2025/03); they are expected to enter into force in 2026.

The new taxonomy is significantly more granular than the previous framework under CRR II: It continues to include 7 event types at Level 1, but supplements these with 26 Level 2 categories and 15 additional attributes. In doing so, the EBA specifically addresses current developments in the areas of Environmental, Social, and Governance (ESG) as well as digital operational risks and resilience requirements in the context of the Digital Operational Resilience Act (DORA).

This substantive realignment of the taxonomy makes it imperative to adapt the existing COREP reporting templates C 17.01 and C 17.02, as they are no longer compatible with the new CRR III framework.

Timeline Overview:

• 2026: Entry into force of EBA/RTS/2025/03 on the OpRisk taxonomy (Art. 317 CRR); institutions must transition their internal loss and claims databases to the new taxonomy.
• 2026–2027 (transition phase): The existing reporting forms C 17.01 and C 17.02 remain in effect but will only be completed based on the previous Level 1 categories; reporting according to the new Level 2 categories will not take place during this phase.
• 30 September 2027 / first reporting deadline 31 December 2027: Entry into force of the revised ITS on reporting; first application of the new, granular reporting form C 17.01 on a semi-annual basis.
• As of the first reporting deadline, 31 December 2027: Retroactive reporting of all loss data and claims since the new taxonomy took effect, as well as a one-time submission of the ten-year loss history via a separate, aggregated template.
  
  

2. Summary of Key Changes

Essentially, the EBA is shifting the logic of operational risk (OpRisk) loss reporting from aggregated to granular, case-by-case reporting. The key changes can be summarised as follows:

From Aggregation to Individual Reporting:
Instead of aggregating loss data — as was previously the case — according to numerous combinations of business lines and event types, institutions will in the future be required to report each individual loss event above the regulatory reporting threshold as a separate row in an open table format. The EBA deliberately opted against the traditional structure, as this would have led to a significant increase in the number of data points given the large number of possible Level 1/Level 2 combinations.

New Reporting Form C 17.01: The previous reporting forms C 17.01 and C 17.02 are being repealed and replaced by a new reporting form C 17.01, which enables granular, loss-event-specific reporting on a semi-annual basis.

One-time historical reporting: 
Since Article 318(1) of the CRR requires institutions to maintain aggregated net and gross loss data over a ten-year period, the EBA has provided for a one-time collection of this historical data. This will be carried out using a separate aggregated reporting form (C 17.02), which will not be part of the ongoing ITS reporting but is to be implemented as part of a separate EBA decision on transitional arrangements.

Preservation of Proportionality: 
The granular reporting requirement applies only to institutions that exceed the thresholds set forth in Article 316 of the CRR. For small and non-complex institutions (SNCIs), medium-sized institutions that are expected to fall below the threshold, and large institutions below the threshold under Article 316(1) of the CRR, a voluntary reporting option is provided — this applies to both ongoing granular reporting and the one-time historical reporting.

Pragmatic transitional solution: 
To bridge the gap between the entry into force of the new taxonomy (2026) and the implementation of the new reporting forms (end of 2027), institutions should continue to use the existing templates in the meantime, but fill in only Level 1 categories. By the first reporting deadline for the new template, institutions must then report retroactively for the entire period since the new taxonomy became applicable.

3. Implications for Institutions from a Reporting Perspective

From a reporting perspective, there are several immediate areas of action for affected institutions:

• First, the technical and procedural infrastructure for capturing OpRisk loss data must be reviewed and adjusted as necessary. Granular reporting at the individual-case level requires that internal loss databases are already capable of assigning the necessary attributes and the new Level 1/Level 2 classification to each loss event — and retroactively, since a complete back-reporting covering the entire period since the taxonomy took effect will be required as of the first reporting deadline in 2027. Institutions should therefore not wait until 2027 to implement this transition, but rather carry it out in parallel with the entry into force of the RTS in 2026 to ensure a robust data foundation for future reporting.
• The 2026–2027 transition phase also requires a “streamlined” continuation of the existing reporting logic: While the old templates remain formally in effect, they may only be populated with Level 1 data. For the reporting function, this means a double maintenance burden — on the one hand, continuing the previous (reduced) reporting, and on the other hand, simultaneously establishing granular data management for future reporting.
• Particular attention should be paid to Question 5 raised in the consultation paper regarding the treatment of loss adjustments that relate to previously unreported claims that were first recorded in earlier fiscal years. Institutions should critically review the proposed reporting logic — according to which such cases must be reported regardless of when they were first recorded (column 0050) — and evaluate data availability.
• Finally, institutions should begin conceptual preparations early for the one-time reporting of the ten-year loss history, as this requires access to historical data that may not be available in older systems at the required level of classification detail.
  
  

4. Implications for Institutions from a Risk Perspective

Beyond the mere reporting requirement, the new taxonomy also has a significant impact on institutions’ operational risk management. Since the classification of loss events according to the new, granular taxonomy follows directly from Article 317 of the CRR, institutions are required — regardless of the actual reporting process — to adapt their internal loss databases accordingly; in this respect, the reporting requirement is merely the regulatory consequence of an existing data collection obligation.

At the same time, the taxonomy’s higher level of granularity increases data quality requirements. Institutions must ensure that loss events are classified consistently across business lines and that the assignment of Level 2 categories and attributes is documented in a traceable manner. In the future, errors in loss data collection will affect not only internal analyses but also directly impact the quality of regulatory reporting.

From a risk perspective, granular reporting also presents an opportunity: The significantly finer classification into Level 1 and Level 2 categories, along with the 15 additional attributes — which, among other things, reflect ESG aspects and relate to digital operational risks and resilience requirements in the context of DORA — enable more precise internal risk management and a deeper understanding of the risk landscape. Particularly noteworthy is the inclusion of new attributes for cyber risks, third-party risks, ESG risks, greenwashing risks, and business continuity aspects. The EBA is thus creating a data foundation that goes beyond traditional loss data collection in operational risk management while also addressing current supervisory priorities stemming from DORA, third-party risk management, and ESG risk management. In this context, the EBA expressly emphasises that granular data management is intended to enable multiple uses: the same data that must be maintained for internal risk management purposes anyway should in the future also be usable for regulatory reporting without separate aggregation.

At the same time, the supervisory perspective is shifting: By having access to individual loss events and their development over time, the competent authorities gain a significantly more granular insight into the risk development of institutions subject to the reporting requirement under Article 316 of the CRR. Institutions should prepare for the fact that anomalies in loss history — such as clusters of certain event types or combinations of attributes — may be addressed in a more targeted manner in future supervisory dialogues.

Last but not least, it should be noted that the existing proportionality and threshold values set forth in Articles 316 and 319 of the CRR remain substantively unchanged under the Simplification Package. Institutions that already exceed the relevant thresholds today should therefore not expect any material relief — the scope of information to be reported by larger institutions essentially already corresponds to the current legal framework.

The simplification sought by the EBA thus primarily concerns the structure of the reporting system. From the perspective of operational risk management, however, the reform leads to higher requirements for loss data collection, data quality, and governance. The complexity is therefore not eliminated, but rather partially shifted from the downstream reporting process to the upstream data collection and data classification stages.

5. Position of the German Banking Industry Committee (DK) 

In its response of 10 July 2026, the DK supports the supervisory objective of increasing transparency and comparability of OpRisk loss data and explicitly welcomes the fact that the existing proportionality arrangements and reporting thresholds under Art. 316 CRR remain unchanged. It argues, however, that the granular reporting approach does not achieve genuine simplification, entails considerable additional implementation effort, and in places deviates from the final version of EBA/RTS/2025/03 on the OpRisk taxonomy.

Specifically, the DK calls for a critical review, or partial removal, of several new data fields (including Event ID, Record Type, Event Status, Loss Adjustments, and Pending Losses), as well as for the harmonisation of the differing reporting thresholds applied under C 17.01 (gross loss) and C 17.02 (net loss). It also questions the added value of the ten-year loss history reporting and suggests either dispensing with it or relying instead on the already established OR1 disclosure template. For the transition phase, the DK argues — on grounds of legal and planning certainty — that the existing reporting forms C 17.01 and C 17.02 should continue to be used unchanged up to and including the reporting reference date of 30 June 2027.

Conclusion and Outlook

Module 3 of the EBA Simplification Package marks a notable shift in the reporting of operational risks: away from aggregated metrics and towards granular, loss-event-based reporting. Despite its name, the “Simplification Package” is not primarily about reducing the scope of reporting but rather about structurally simplifying the reporting format while simultaneously increasing the depth of information. For institutions that already maintain detailed loss databases, the additional effort is likely to remain manageable; for other institutions, however, the new regulations represent a significant step towards modernisation and an integrated, granular reporting system. The fact that this additional effort is real rather than merely theoretical is underlined by the DK's critique, which questions whether the granular reporting approach delivers a genuine simplification effect in practice.

Institutions would be well advised to begin converting their loss databases to the new taxonomy not only by the first reporting deadline at the end of 2027, but already in parallel with the entry into force of the RTS in 2026 — particularly in light of the retroactive catch-up reporting requirement and the one-time historical reporting.