# Metrics that measure a bank's data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → maturity
A regulator walks into a US G-SIB (Global Systemically Important Bank) for a routine BCBS 239 exam. They don't ask "do you have a data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → policy?" Every bank says yes. They ask: "Show me the dashboard that proves your critical data elements passed quality checks last quarter, and who owned the fix when they didn't." If the bank can't produce that scorecard in real time, the exam gets harder fast.
This is the shift happening across banking in 2026: governance is no longer proven by policy documents. It's proven by metrics.
BCBS 239 ("Principles for Effective Risk Data Aggregation and Risk Reporting") was issued by the Basel Committee on Banking Supervision in 2013, after the 2008 crisis exposed banks that couldn't even tell regulators their total exposure to Lehman Brothers overnight. It set 14 principles, but principles don't self-enforce. Supervisors (the Federal Reserve, the ECB's Single Supervisory Mechanism, the UK's PRA) now expect banks to show measurable, tracked evidence of compliance.
That evidence takes the form of governance metrics. Three matter most.
What it is: the percentage of critical data elements (CDEs) that have a named, accountable data owner.
A CDE is a field that matters for risk, regulatory reporting, or capital calculation, things like loan-to-value ratio, counterparty legal entity identifier (LEI), or risk-weighted asset inputs. Not every field in a bank's systems is a CDE. A typical retail bank might tag 200 to 500 fields as critical out of tens of thousands.
Why it matters: an unowned data element is an orphan. When it breaks, no one is accountable for fixing it, and it often doesn't get fixed until an audit finds it.
Benchmark: mature banks target 95%+ ownership coverage on CDEs (estimate, commonly cited internally, not a published regulatory threshold). Banks in early-stage governance programs often sit at 50 to 70%.
Worked example:
What it is: the average time from when a data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.View full definition → issue is logged to when it's resolved and verified.
Banks log data issues in tools like Collibra, Informatica Axon, or internally built issue-management platforms. Each issue gets severity-tiered (critical, high, medium, low) similar to an IT incident.
Why it matters: speed of remediation is a proxy for whether governance is a living process or a paperwork exercise. A bank that logs 10,000 issues a year but takes 18 months to close them isn't governing data, it's cataloguing problems.
Benchmark (industry estimates, not official figures):
European banks under the ECB's supervisory expectations often report remediation timelines in their internal model risk and data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.View full definition → dashboards reviewed during Targeted Review of Internal Models (TRIM)-style exercises.
A simple calculation: if a bank opens 500 critical issues in a year and closes 420 within the 45-day target, its on-time remediation rate is:
On-time rate = closed_on_time / total_opened
420 / 500 = 84%Anything consistently below roughly 80% tends to draw supervisory attention, because it signals the remediation process can't keep pace with issue discovery.
What it is: the percentage of CDEs that pass automated data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.View full definition → (DQDQThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.View full definition →) rules (completeness, accuracy, timeliness, consistency) in a given reporting cycle.
This is the metric most directly tied to regulatory reporting confidence. If the field "customer risk rating" feeds into a Comprehensive Capital Analysis and Review (CCAR) submission in the US, or COREP/FINREP returns in Europe, its pass rate tells you how much you should trust that number.
Typical DQ dimensions checked:
Benchmark: leading banks report CDE pass rates above 98% for Tier 1 regulatory reporting fields (estimate). A pass rate in the low 90s or below on a CDE feeding capital or liquidity reporting is generally treated as a red flag requiring escalation to the Chief Data Officer.
SELECT
COUNT(CASE WHEN dq_status = 'PASS' THEN 1 END) * 100.0 / COUNT(*) AS pass_rate
FROM cde_quality_checks
WHERE reporting_date = '2026-03-31'
AND cde_flag = TRUE;This is the kind of query that feeds a governance dashboard reviewed monthly by a Data GovernanceData GovernanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → Council, a cross-functional committee (risk, compliance, IT, business lines) that most large banks now run as standard practice.
Knowledge check
1. What is the core shift in how regulators assess BCBS 239 compliance in 2026 compared to earlier approaches?
2. Why was BCBS 239 originally introduced by the Basel Committee?
3. A bank has thousands of data fields across its systems but only tags 300 as 'critical data elements' (CDEs). What is the reasoning behind this selective tagging?
4. Select ALL correct answers about why 'data ownership coverage' is considered an important governance metric.
Select all the correct answers.
5. Select ALL correct answers about what a regulator is likely evaluating when reviewing a bank's data governance maturity under BCBS 239.
Select all the correct answers.
None of these numbers means much alone. A bank can have 95% ownership coverage but a 40% pass rate, meaning owners exist but aren't fixing anything. The real signal is the combination:
| Metric | Healthy signal | Warning signal |
|---|---|---|
| Ownership coverage | 95%+ | Below 80% |
| Remediation on-time rate | 80%+ | Below 60% |
| CDE pass rate | 98%+ (Tier 1 fields) | Below 95% |
Regulators reviewing BCBS 239 compliance, or in the US, examiners looking at Federal Reserve SR 11-7 model risk guidance and related data controls, increasingly ask for these three together, sometimes trended over 8 to 12 quarters, to see whether governance is improving or just holding steady.
A useful public reference for how supervisors think about this is the Bank of England's and PRA's published supervisory statements on risk data aggregation, which echo BCBS 239 expectations: Bank of England supervisory statements.
🎬 [VIDEO: "Basel Committee BCBS 239: Risk Data Aggregation Explained" - youtube.com - search for recent explainer videos covering BCBS 239 principles and how banks operationalize risk data aggregation and reporting requirements]
A large European bank preparing for an ECB on-site inspection will typically produce:
1. A CDE inventory with ownership tagged (Metric 1).
2. An issue log with aging buckets and closure trends (Metric 2).
3. A monthly DQDQThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.View full definition → dashboard segmented by business line and regulatory report (Metric 3).
If all three trend positively across quarters, examiners treat that as evidence governance is embedded in operations, not bolted on for the exam.