BCBS 239 — Risk Data Aggregation & Risk Reporting Principles · vBCBS 239 (Principles for ef…

BCBS 239 — Risk Data Aggregation & Risk Reporting Principles

BCBS 239 — Risk Data Aggregation & Risk Reporting Principles — 100% of in-scope requirements covered.

14 requirements · 7 in scope (7 enforced) · 7 out-of-scope (outside KYE™’s authority layer). The 100% is weighted over the in-scope base.

Source: The Basel Committee on Banking Supervision's Principles for effective risk data aggregation and risk reporting (BCBS 239, January 2013) set 14 principles across four areas: overarching governance and infrastructure (P1 governance, P2 data architecture & IT infrastructure), risk data aggregation capabilities (P3 accuracy & integrity, P4 completeness, P5 timeliness, P6 adaptability), risk reporting practices (P7 accuracy, P8 comprehensiveness, P9 clarity & usefulness, P10 frequency, P11 distribution), and supervisory review (P12 review, P13 remedial actions & supervisory measures, P14 home/host cooperation). KYE Protocol™ governs the EVIDENCE side of the principles: every risk report bound to its data-lineage evidence chain before filing or reliance, every embedded number traceable to model_id + version + validation reference, production and distribution provably timestamped, and the whole chain reconstructable offline from published keys. KYE™ does not build the bank's data architecture, aggregate the risk data, or compute the risk numbers. · License: BCBS 239 is published by the Bank for International Settlements and is publicly available; the KYE™ registry paraphrases each principle's intent and cites the official principle number for mapping purposes only.

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Overarching governance & infrastructure (P1–P2) 2 1 0 0 0 100%
Risk data aggregation capabilities (P3–P6) 4 3 0 0 0 100%
Risk reporting practices (P7–P11) 5 3 0 0 0 100%
Supervisory review, tools & cooperation (P12–P14) 3 0 0 0 0 0%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
bcbs-239.principle1-governance Principle 1 — Governance: risk-data aggregation and reporting under board-owned governance with named, recorded authority enforced audit_events: kye.purpose.request.v1, kye.purpose.admissibility.v1, kye.evidence.decision_map.v1
engines: internal, internal
rule_packs: kye:rule-pack:model-risk-data-governance
dictionaries: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
bcbs-239.principle2-data-architecture Principle 2 — Data architecture and IT infrastructure supporting aggregation in normal and stress conditions out-of-scope (no enforcement cited)
bcbs-239.principle3-accuracy-integrity-lineage Principle 3 — Accuracy and integrity: every risk report bound to its data-lineage evidence chain (sources, transformations, integrity hash) enforced audit_events: kye.evidence.decision_map.v1, kye.evidence.pack.v1, kye.replay.context_seal.v1
engines: internal
rule_packs: kye:rule-pack:model-risk-data-governance
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/30-AUDIT-WORM-RETENTION.md
bcbs-239.principle4-completeness Principle 4 — Completeness: the lineage chain proves which sources, books, and entities the report aggregated — omissions are visible enforced audit_events: kye.evidence.decision_map.v1, kye.evidence.pack.v1
engines: internal
rule_packs: kye:rule-pack:model-risk-data-governance
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/31-DATA-GOVERNANCE-PACK.md
bcbs-239.principle5-timeliness Principle 5 — Timeliness: generating up-to-date aggregated risk data quickly, including in stress / crisis out-of-scope (no enforcement cited)
bcbs-239.principle6-adaptability Principle 6 — Adaptability: ad hoc / bespoke risk reports are reconstructable — the lineage chain replays deterministically enforced audit_events: kye.replay.context_seal.v1, kye.replay.proof.v1, kye.evidence.pack.v1
engines: internal, internal
rule_packs: kye:rule-pack:model-risk-data-governance
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/21-DELEGATED-AUDITABILITY.md
bcbs-239.principle7-reporting-accuracy Principle 7 — Accuracy of risk reports: every reported number traces to its model version, validation reference, and lineage — reconciled and verifiable enforced audit_events: kye.evidence.tool_call.v1, kye.evidence.pack.v1, kye.replay.context_seal.v1
engines: internal, internal
rule_packs: kye:rule-pack:model-risk-data-governance
constitution_refs: constitution/13-RESILIENCE-LOOP.md
bcbs-239.principle8-comprehensiveness Principle 8 — Comprehensiveness: reports cover all material risk areas with appropriate depth out-of-scope (no enforcement cited)
bcbs-239.principle9-clarity-usefulness Principle 9 — Clarity and usefulness: reports communicate risk in a clear, concise, decision-useful way out-of-scope (no enforcement cited)
bcbs-239.principle10-frequency Principle 10 — Frequency: when each report was produced is provably timestamped, so the required cadence is demonstrable enforced audit_events: kye.evidence.pack.v1, kye.replay.context_seal.v1
engines: internal
rule_packs: kye:rule-pack:model-risk-data-governance
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/30-AUDIT-WORM-RETENTION.md
bcbs-239.principle11-distribution Principle 11 — Distribution: who received each report, when, is recorded as evidence while confidentiality is preserved enforced audit_events: kye.evidence.decision_map.v1, kye.evidence.pack.v1
engines: internal
rule_packs: kye:rule-pack:model-risk-data-governance
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/38-COMMS-RAIL.md
bcbs-239.principle12-supervisory-review Principle 12 — Supervisory review of the bank's compliance with the Principles out-of-scope (no enforcement cited)
bcbs-239.principle13-remedial-actions Principle 13 — Remedial actions and supervisory measures for deficiencies out-of-scope (no enforcement cited)
bcbs-239.principle14-home-host-cooperation Principle 14 — Cooperation between home and host supervisors out-of-scope (no enforcement cited)