Topic starter
24/06/2026 7:10 pm
TL;DR: BCBS 239 requires banks to prove where risk data came from, how it changed, and which controls governed it, according to Collibra. The real lesson is that reporting credibility depends on governed lineage, ownership, and evidence ready before the regulator asks, not after the fact.
Editorial analysis by NHI Mgmt Group, based on content published by Collibra: “BCBS 239 explained: How banks can prove data integrity to regulators”.
Key questions
Q: How should banks use data lineage to support BCBS 239 compliance?
A: Banks should use data lineage to prove where risk data originated, how it changed, and who owns each stage of the reporting chain.
Q: Why does BCBS 239 make manual reconciliation a governance problem?
A: Because manual checks do not scale across many systems, definitions and reporting cycles.
Q: How should banks prioritise controls for critical data elements?
A: They should focus ownership, lineage, quality checks and approval evidence on the data elements that materially affect regulatory reporting.
Practitioner guidance
- Define critical data elements first Start with the risk data elements that drive capital, liquidity, credit and regulatory submissions, then assign named owners and control responsibilities to each one.
- Map lineage to reporting evidence Trace each critical report backward from submission to source systems, transformations and approvals, and retain evidence that ties each step to a responsible control owner.
- Replace manual reconciliation with governed workflows Move recurring signoffs, exception handling and quality checks into a controlled workflow so evidence is created as part of the process rather than reconstructed later.
Bottom line: BCBS 239 pushes banks to prove the control path behind risk numbers, not just the final report value.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:21 am
BCBS 239 has turned data lineage into a control requirement, not a reporting convenience. The article shows that risk reporting now depends on being able to prove source, transformation, ownership and approval, not just produce a final number. That shifts lineage from supporting metadata into evidence of governance. Banks that treat lineage as optional documentation will keep failing the same question in different forms: show me how you know.
A question worth separating out:
Q: How do you know if a data governance framework is actually working?
A: A framework is working when teams can answer three questions quickly: who owns the data, who can access it, and what control changed that access. If access reviews produce clean evidence, exceptions are visible, and classification changes affect enforcement, the framework is operating as a real control model rather than a slide deck.
👉 Read our full editorial: BCBS 239 proves why data lineage is now a control requirement