BCBS 239 and data lineage: what IAM teams should take from it

TL;DR: BCBS 239 requires banks to prove where risk data came from, how it changed, and which controls governed it, according to Collibra. The real lesson is that reporting credibility depends on governed lineage, ownership, and evidence ready before the regulator asks, not after the fact.

NHIMG editorial — based on content published by Collibra: BCBS 239 explained: How banks can prove data integrity to regulators

By the numbers:

• 63% of organizations lack the right data management practices, and 60% of AI projects will be abandoned without AI-ready data.

Questions worth separating out

Q: How do banks prove risk data integrity under BCBS 239?

A: Banks prove risk data integrity by linking each reportable figure to its source systems, transformation steps, owners, and controls.

Q: Why does data lineage matter for regulatory reporting?

A: Data lineage matters because regulators need to see how a number came to be, not just the final value.

Q: What breaks when banks rely on manual reconciliation for risk reporting?

A: Manual reconciliation breaks repeatability.

Practitioner guidance

• Identify critical data elements first Create a controlled inventory of the data points that materially affect risk reports, regulatory disclosures, and supervisory evidence.
• Attach lineage to every reportable metric Require source-to-report traceability for metrics that drive capital, liquidity, credit, or conduct reporting.
• Replace spreadsheet reconciliation with governed controls Move repeatable checks into governed workflows and evidence capture systems, especially where the same manual reconciliation appears every reporting cycle.

What's in the full article

Collibra's full blog post covers the operational detail this post intentionally leaves for the source:

• How BCBS 239 maps to ownership, policy, lineage, and evidence workflows in a governed operating model
• Examples of how critical data elements support risk reporting and supervisory review
• The specific way Collibra positions data lineage, controls, and reporting in banking governance
• Why manual reconciliation creates friction in audit readiness and how teams can reduce it

👉 Read Collibra's explanation of BCBS 239 and data integrity →

BCBS 239 and data lineage: what IAM teams should take from it?

Explore further

View Full Forum →  |  NHI Foundation Course →