NorwayFinanstilsynet
EBA consults on operational-risk rules until 31 December
The draft framework covers governance, risk-management processes and assessment systems, including DORA integration and proportionality for smaller institutions.
By Taxxa AI OyPublished 2 September 2026
Banks and other institutions concerned by the proposed operational-risk framework can respond to the European Banking Authority's consultation until 31 December 2026Finanstilsynet. The draft regulatory technical standards address the framework required under Article 323 of the Capital Requirements Regulation, CRR3
Europa. The EBA identifies the standards as under consultation, so the current step is review and feedback on a proposal.
The proposed framework has three main components: governance and control arrangements, processes for managing operational risk, and systems for assessing operational riskFinanstilsynet. The EBA describes harmonised and proportionate requirements for identifying, assessing, monitoring and managing such risk across institutions.
Finanstilsynet says the proposal incorporates DORA's ICT-risk requirements as an integrated part of the operational-risk frameworkFinanstilsynet. Its notice also identifies specific proportionality provisions, including for institutions with a business indicator below EUR 750 million
Finanstilsynet. That threshold concerns proportionality in the proposed framework and should be assessed within the draft's requirements.
For Norwegian institutions, Finanstilsynet expects the resulting rules to be incorporated into the EEA Agreement and implemented through Norway's CRR frameworkFinanstilsynet. It asks firms to inform the supervisor of matters of particular importance to Norwegian interests. The notice says a separate Norwegian consultation will generally not be conducted when the rules are implemented
Finanstilsynet, making the current consultation the stated opportunity to raise those concerns.
Responses can be submitted to the EBA. Its consultation page gives the response cutoff as 31 December 2026 at 23:59Europa and says contributions will be published after the consultation closes unless the contributor requests otherwise
Europa. The same page provides registration for a public hearing, with a registration deadline of 25 September 2026 at 16:00
Europa.
The EBA launched the consultation on 26 August 2026. Institutions considering a response can review the three proposed components, their interaction with DORA and the proportionality provisions against their own operational-risk arrangements.
The relevant materials are the EBA's draft RTS under CRR Article 323 and Finanstilsynet's consultation notice on the operational-risk management framework.
Review the draft operational-risk framework and submit comments to the EBA by 31 December 2026. Inform Finanstilsynet of issues important to Norwegian interests; hearing registration closes on 25 September.