BCBS — Basel Committee on Banking Supervision
Type: standard-setter Sector: International banking supervision First seen: 2026-03-18 Last updated: 2026-06-04
Updated 2026-06-04 based on S-2026-06-02-bcbs-ict-range-of-practices — the ICT range-of-practices report (d611) was published on 2 June 2026; the “scheduled” tracked-change entry is updated to reflect actual publication and a Positions bullet added. Updated 2026-06-02 based on S-2026-02-26-bcbs-d608-consolidated-guidelines — dedicated Source page created for the d608 consolidated-guidelines consultative document (previously referenced without a source); d608 bullet enriched with the 13-module structure and the no-new-expectations framing.
Snapshot
The Basel Committee on Banking Supervision — the primary international standard-setter for bank prudential regulation, hosted by the BIS. The Committee’s Governance of AI adoption paper (BIS othp90) is the most explicit international supervisory anchor for bank AI governance frameworks to date.
Positions / Claims they advance
- AI governance is treated as an extension of existing model risk management, not a parallel discipline [S-2025-11-19-bcbs-othp90].
- Ten-step playbook for bank AI adoption: interdisciplinary AI committee; responsible-AI principles; enterprise AI framework; AI tools inventory; stakeholder mapping; risk-and-control assessments; ongoing monitoring; anomaly / incident reporting; workforce skilling; continuous review [S-2025-11-19-bcbs-othp90].
- Elements of othp90 become fully applicable from 1 August 2026 [S-2025-11-19-bcbs-othp90].
- BCBS d605 finalised on 10 December 2025: 12 principles for third-party risk management (9 banks, 3 supervisors); supersedes the 2005 Joint Forum Outsourcing paper; aligns with DORA [S-2025-12-10-bcbs-d605].
- BCBS d608 consultative document (February 2026): proposes reorganising 76 current guidelines and sound practices into 13 modular chapters — including CGO (Corporate governance), RMA10 Risk data (built on BCBS 239 + the Jan 2026 implementation report), RMA50 Digitalisation and fintech risks (folding in the Mar 2022 AI/ML newsletter and May 2024 Digitalisation of finance paper) and ORR30 Third-party risk (built on d605) — cutting total guidance volume by ~75% while explicitly not introducing new expectations; comments due 26 June 2026, finalisation expected H2 2026 [S-2026-02-26-bcbs-d608-consolidated-guidelines].
- BCBS d610 operational risk technical amendment issued 23 March 2026; implementation required by 1 April 2029.
- BCBS 239 (January 2013): risk data aggregation principles remain a live supervisory priority; data lineage persistently weak across G-SIBs.
- Range-of-practices report on ICT risk management (non-malicious ICT incidents) approved at the 19–20 May 2026 BCBS meeting and published 2 June 2026 as BCBS d611; it is descriptive (reference points across jurisdictions), complements the 2018 cyber-resilience report (d454), and frames ICT as core to operational risk management and operational resilience; the Committee will keep monitoring AI-model developments and their bank cyber-security implications [S-2026-06-02-bcbs-ict-range-of-practices][S-2026-05-20-bcbs-ict-press-release].
People
- GHOS (Group of Governors and Heads of Supervision) — endorses BCBS direction; March 2026 GHOS meeting endorsed a targeted review of G-SIB methodology governance and transparency.
Relationships
- part-of → BIS — host body; secretariat.
- implemented-by → EBA — implements Basel standards in the EU.
- partners-with → FSB — coordination on cross-border financial stability.
- relates-to → BIS Financial Stability Institute — publishes FSI Insights papers on AI in FS (No. 63, No. 73).
- relates-to → Federal Reserve — SR 11-7 model risk anchor.
- relates-to → PRA — SS1/23 model risk anchor.
- relates-to → DORA — d605 alignment.
Tracked changes
- 2013-01 — BCBS 239 published.
- 2025-11-19 — Press release p251119: third-party risk principles finalised; AI governance paper othp90 referenced.
- 2025-12-10 — d605 published.
- 2026-02-26 — d608 consultation launched.
- 2026-03 — GHOS endorses G-SIB methodology review.
- 2026-03-23 — d610 op-risk technical amendment issued.
- 2026-06-26 — d608 consultation closes.
- 2026-05-20 — BCBS press release p260520: ICT range-of-practices report approved; market developments and cryptoasset targeted review discussed [S-2026-05-20-bcbs-ict-press-release].
- 2026-06-02 — Publication of ICT range-of-practices report (BCBS d611) [S-2026-06-02-bcbs-ict-range-of-practices].
- 2026-08-01 — othp90 elements fully applicable.
- 2029-04-01 — d610 implementation required.