CRR3 Is the Most Complex Regulatory Overhaul Since Basel III. And Most Banks Are Under-Resourced for It.

CRR3/CRD VI is not a model restatement. It is a fundamental redesign of how European banks calculate regulatory capital. The standardised approach has been rebuilt with granular counterparty classifications and collateral haircuts. The IRB framework is constrained by strict floors on PD and LGD estimates. The output floor—capping IRB RWA at 72.5% of the standardised approach—forces every institution with significant IRB usage to reconsider its entire capital structure. The fundamental review of the trading book (FRTB) and the new counterparty credit risk methodology (SA-CCR) are not backward-compatible with existing systems.

And yet, we observe a striking pattern: banks consistently underestimate the project scale. They staff the programme as if it were a regulatory reporting uplift. They sequence the workstreams as if data governance were a supporting function, not a blocking dependency. They treat the output floor as a computational problem rather than a capital strategy problem. By month 9 of the programme, they discover they are 18 months behind.

This article is for board members, CROs, and CFOs who recognise that CRR3 implementation is not a technical project. It is a capital transformation programme with material strategic implications. We'll walk through the five most consistent failure patterns, what they cost, and what genuine programme differentiation looks like.

Failure Mode 1: Data Governance Is an Afterthought

CRR3's new standardised approach demands data that most banks' systems were not architected to capture. Collateral haircuts under the new standardised approach, the granular counterparty classifications, the treatment of exposures to financial institutions—all require data precision that sits outside historical IRB reporting. Most banks have excellent PD and LGD data but sparse coverage of counterparty regulatory status, collateral types, LTV ratios, and facility-level credit risk classifications.

Programmes that start with the model and discover the data problem halfway through—when they attempt to populate the output floor calculation or the new SA framework—waste 18 months. They find that 15% of exposures lack counterparty type classification. They discover that collateral records are incomplete or inconsistent across business lines. They realise that their transaction-level facility coding, sufficient for regulatory reporting, is insufficiently granular for the new standardised approach.

The fix requires front-loading data governance: By month 3 of the programme, a data inventory must be completed. For each major data element required by CRR3 (counterparty type, collateral detail, facility classification, geographic location, etc.), the bank must audit: (a) current data availability, (b) data quality (completeness, consistency, accuracy), (c) system capability to capture going forward, and (d) remediation timeline and cost. Only after this inventory is complete should detailed model architecture design begin. Parallel track: establish a data governance committee chaired by the Chief Data Officer, with representation from risk, operations, technology, and finance. This committee owns data quality standards for CRR3 and has veto power over model design that cannot be supported by available data.

Banks that do this typically discover they need 6–12 months to remediate data gaps before they can reliably run the output floor calculation. That is a known cost, budgeted and sequenced. Banks that discover data gaps mid-programme delay their parallel run by 12–18 months, and the regulator notices.

Failure Mode 2: IRB Recalibration Is Treated as a Model Project, Not a Capital Strategy

CRR3 introduces strict PD and LGD floors, longer observation periods for parameter estimation, and tighter capital constraints on counterparty credit risk (CCF floors). Each of these looks like a model parameter change. A data scientist can re-estimate PD under the new floor constraints. A risk analyst can apply the new CCF caps. The models will be compliant.

But the cumulative impact on RWA density is a capital allocation question that belongs on the ALCO table, not in the model validation team. A bank with 40% IRB usage across its portfolio will see its IRB RWA increase 15–40% depending on the concentration of its credit portfolio and the tightness of the new floors. If the output floor is binding, the increase is larger. This reshapes the bank's capital efficiency, changes the cost of capital by counterparty and product, and forces decisions about what to grow, what to shrink, and what to exit.

Programmes that park IRB recalibration entirely in model governance, without CFO/CRO ownership, produce technically compliant but strategically incoherent capital structures. The CRO recalibrates the models. The models show higher RWA. But there is no strategic conversation about whether the new RWA density is acceptable, whether product pricing needs to change, or whether the bank's business strategy needs to shift. When the regulator reviews the programme, the absence of this strategic dimension is noted. More problematically, the bank goes live with a capital structure that is regulatory-compliant but commercially misaligned.

The fix is ALCO ownership: IRB recalibration must be sponsored by the CFO or CRO, not delegated to the model team. The programme should include a capital impact workstream run jointly by risk and finance. By month 6, this workstream should produce: (a) baseline RWA under current models and CRR3 requirements, (b) RWA impact of new PD/LGD floors, (c) RWA impact of the output floor, (d) RWA by major business line and counterparty segment, (e) impact analysis on the bank's capital ratios and capital efficiency metrics, and (f) strategic options for managing the new capital structure (e.g., business mix rebalancing, product repricing, geographic reallocation). This analysis then feeds into strategic planning and ALCO decisions. The IRB recalibration follows from capital strategy, not the reverse.

Critical timing issue: The output floor calculation will only be fully credible after 12+ months of parallel run data. But strategic decisions about capital allocation need to be made months before that. This forces programmes to make capital strategy decisions on incomplete information—specifically, on modelled output floor impacts that may differ from actual parallel run experience. The solution is to build contingency into the initial strategic plan, with a formal update at month 12 when parallel run data is more robust.

Failure Mode 3: Business Lines Are Not in the Room

CRR3 changes the cost of capital by product, counterparty, and geography. A bank's wholesale credit portfolio might see RWA increase 20% due to tighter LGD floors. Its trading book will face FRTB charges that bear little resemblance to current internal models. Its counterparty credit exposure will be calculated under a new SA-CCR methodology that produces different capital charges than the current exposure method.

Yet we routinely see CRR3 programmes staffed entirely in back-office functions: finance, risk, compliance, technology. The commercial banking, treasury, trading, and investment banking desks are not engaged until go-live is weeks away. At that point, when traders and relationship managers discover that the cost of capital has changed materially for specific products or counterparties, the design is locked and the programme cannot respond.

Worse: the pricing implications of CRR3 need to flow into product P&L within months of go-live. If the wholesale desk's RWA increases 15%, the cost of capital for those exposures increases. Either the desk reprices aggressively and loses market share, or it accepts lower returns on the business. The decision belongs to the desk head and CFO. But if the desk was not in the programme design, that conversation happens reactively, ad-hoc, and often too late to adjust the go-live plan.

The fix is integrated governance from month 1: Establish a Commercial Working Group with senior representation from each major business line (wholesale credit, retail, treasury, trading, investment banking). This group is embedded in the programme's governance structure. By month 6, the CRR3 programme delivers to this group: (a) capital impact by business line and major product, (b) sensitivity analysis (e.g., what if credit spreads widen? what if counterparty concentration shifts?), (c) pricing implications, and (d) strategic options for managing the new capital structure. The desks have a voice in programme design. They understand the changes before go-live. They can adjust pricing and client relationship strategies in real time, not after the fact.

Failure Mode 4: The Parallel Run Is Treated as a Testing Phase, Not a Decision Gate

CRR3 came into force on 1 January 2025. But national regulators and the ECB have granted banks a transition period: parallel reporting is required, but actual capital requirements remain under CRR2 rules until January 2026 (with a possible extension). This parallel period should be treated as the most critical decision gate of the entire programme. It will surface:

  • The output floor bite: Which business lines and counterparty segments are most affected by the 72.5% floor? Where is the floor binding? Are there structural choices (e.g., business exit, product repricing) that make sense only if the floor is binding long-term?
  • IRB-to-SA reconciliation: Are the IRB and SA calculations producing consistent underlying exposure data? Or are there systemic discrepancies (e.g., the IRB model treats a counterparty as wholesale; the SA framework treats it as retail) that need to be resolved?
  • SA-CCR netting discrepancies: The new counterparty credit risk calculation produces different netting adjustments than the current exposure method. Where is exposure increasing? Are the trading desks' risk limits adequate?
  • FRTB valuation issues: Are the fundamental review of the trading book calculations producing sensible results? Are there data gaps or model gaps that need to be addressed before the FRTB becomes live?

Programmes that treat the parallel run as a validation exercise—checking that the systems run without errors, that outputs reconcile—miss the opportunity to make structural decisions. By the time the regulator locks the bank in at the annual SREP, those decisions are frozen.

The fix is treating the parallel run as a decision forum: Throughout the transition period, the parallel run should feed into strategic decision-making. Monthly, the programme should report to ALCO: (a) output floor impact, (b) RWA by line of business, (c) any issues surfaced by the parallel run data, and (d) strategic options for responding. When the parallel run reveals that the output floor is binding for 60% of the IRB portfolio, that is material information. It may force a decision to exit or shrink certain businesses. It may force product repricing. It may force a rethink of the target capital structure. These conversations need to happen during the transition period, not after the regulator has locked in the capital requirements.

Failure Mode 5: The Supervisor Relationship Is Managed Reactively

CRR3 gives the ECB and national regulators significant discretion in areas that materially affect capital requirements. IRB model approval timelines are longer and approval criteria are stricter. The output floor can be applied fully or, under certain conditions, partially waived for institutions meeting stringent criteria. The FRTB can be implemented using the internal models approach (IMA) if the bank meets approval thresholds, or otherwise the standardised approach (SA) applies. Supervisory Review and Evaluation Process (SREP) decisions on Pillar 2 Requirements (P2R) are heavily influenced by the ECB's assessment of how well institutions have executed CRR3 implementation.

Banks that engage supervisors early, with a clear implementation narrative and transparent impact analysis, tend to fare materially better than those that wait. An early conversation with the ECB about the bank's CRR3 strategy—what the data governance plan is, how IRB recalibration will be sequenced, what the output floor impact looks like, how FRTB will be implemented—gives the regulator confidence that the bank is thinking strategically. It creates a forum for the bank to raise questions (e.g., "Can we apply for an output floor waiver?" or "What is the approval timeline for IRB model changes?") early, when the answers can influence programme design.

Conversely, banks that engage supervisors reactively—waiting until there is a problem or until months before go-live—find that regulatory expectations have become fixed. An issue that could have been resolved through early dialogue becomes a deficiency note. An IRB model change that could have been pre-approved through early engagement becomes a contested finding.

The fix is structured early engagement: Assign a senior executive (typically the CRO) to lead a supervisor relationship workstream. By month 2 of the programme, request a pre-implementation engagement with the ECB and/or national regulator. Present: (a) the programme scope and timeline, (b) the data governance plan, (c) the IRB recalibration roadmap, (d) the output floor impact analysis (preliminary), and (e) specific questions the bank needs the supervisor to answer (e.g., approval timelines, discretionary relief options). Update the supervisor quarterly thereafter. This creates continuity and demonstrates strategic oversight. When issues arise (and they will), the supervisor is already engaged and understands the context. The relationship becomes collaborative rather than adversarial.

What the Top Quartile Programs Look Like

We've identified the five failure modes. Now, what does success look like? The top quartile programmes—the ones that will genuinely succeed—share a common architecture.

What Good Programs Do
Governance: Integrated ALCO/Board-level sponsorship; clear RACI for all major decisions; executive compensation tied to programme milestones.

Data: Data inventory completed by month 3; data governance committee established; data remediation plan with dedicated budget.

Capital Strategy: Commercial Working Group embedded in governance; capital impact modelled by business line by month 6; pricing and business strategy updated to reflect new capital reality.

Parallel Run: Parallel run treated as decision gate, not testing phase; monthly reporting to ALCO; strategic responses to findings.

Supervisor Relations: Quarterly engagement with ECB/NCA; early notification of issues; structured dialogue on discretionary relief.
What Off-Track Programs Do
Governance: Siloed model/compliance team; no CFO visibility until year 2; programme delivery driven by technology roadmap, not capital strategy.

Data: Data gaps discovered in parallel run; ad-hoc remediation; systems not ready to capture CRR3 data at go-live.

Capital Strategy: Business lines not engaged until go-live; capital impact treated as technical output, not strategic decision.

Parallel Run: Treated as validation exercise; issues noted but not escalated; reactive responses to findings.

Supervisor Relations: Engagement deferred until issues arise; regulator questions answered after decisions are locked; discretionary relief not pursued proactively.

The difference is not in the technical sophistication of the models. Both types of programmes will produce compliant IRB models and functional capital calculation engines. The difference is in governance maturity and strategic integration. Top quartile programmes treat CRR3 as a capital transformation; they embed the regulator as a partner; they make hard strategic choices early, when there is still optionality.

HM
Hannan Mohammad

Founder & Managing Director, Ezelman · Former SVP Risk at a tier-one institution · Specialist in CRR3/CRD VI implementation, IRB model governance, output floor strategy, and capital transformation programmes for G-SIBs

FAQ

What are the main workstreams in a CRR3 implementation programme?
CRR3 implementation typically comprises six core workstreams: (1) IRB Recalibration—recalibrating PD, LGD, and CCF models to comply with new floor constraints and stricter ECB scrutiny; (2) Output Floor Implementation—designing the computational infrastructure and governance framework to apply the 72.5% output floor to the standardised approach across the portfolio; (3) Standardised Approach Redesign—building granular data capture and calculation engines for the new credit risk, market risk, and counterparty credit risk frameworks; (4) FRTB/SA-CCR Transition—implementing fundamental review of trading book and new counterparty credit risk calculation methodologies; (5) CVA Risk Management—redesigning counterparty valuation adjustment governance and calculations; and (6) Data Governance & Reporting—establishing the data infrastructure to support parallel runs, validation, and regulatory reporting. Sequencing matters: data governance should precede model work, and the output floor architecture should be developed in tandem with IRB recalibration to understand RWA impacts.
How long does a CRR3 implementation take?
For a complex IRB institution with significant trading activity, a credible full CRR3 implementation takes 3–4 years from formal programme launch to regulatory sign-off. The first 12 months are typically absorbed by data inventory, current-state architectural assessment, and model impact analysis. Months 12–24 focus on design, build, and internal testing. Months 24–36 comprise the parallel run, validation against regulatory requirements, and supervisory engagement. Months 36–48 cover go-live preparation, ECB approval processes, and final regulatory reporting alignment. Institutions that attempt to compress this timeline (e.g., 24 months) consistently produce incomplete implementations that either delay regulatory sign-off or, worse, receive deficiency notices during the first post-implementation inspection. Simpler institutions with limited IRB models and trading books may achieve implementation in 2–3 years, but this is rare.
What is the biggest data challenge in CRR3 implementation?
The most consequential data challenge is the absence of standardised approach data in most banks' core systems. CRR3's new standardised approach requires granular classification of every counterparty (wholesale, retail, sovereign, etc.), precise collateral haircut alignment, and transaction-level facility type coding. Most banks' reporting systems were architected for IRB purposes and do not capture this detail. A bank might have excellent PD estimation data but no systematic record of collateral types, LTV ratios, or counterparty regulatory status. Additionally, the output floor requires dual-track capital calculation (IRB and SA) with consistent underlying exposure data—any discrepancy between the two approaches cascades into RWA reconciliation issues. Banks that do not systematically audit their data against CRR3's granularity requirements by month 6 of their programme typically discover major gaps by month 18, forcing a remediation cycle that delays the parallel run by 12+ months.
How does CRR3 affect the IRB approval process?
CRR3 introduces several changes to IRB model approval and governance: (1) stricter PD and LGD floor constraints, which require ECB pre-approval before implementation; (2) mandatory use of longer observation periods (minimum 7 years for PD, up from 5 in some cases), reducing the predictive power of recent data and potentially requiring institutions to blend historical datasets; (3) more rigorous CCF validation, particularly for derivative and commitment exposures; and (4) heightened ECB scrutiny of IRB model governance, especially around model change approval and back-testing failure handling. Banks seeking to modify IRB models under CRR3 must now submit a formal change request to the ECB for most parameter updates, whereas previously some changes could be implemented through internal governance. The approval timeline for a material IRB change now extends 6–9 months. Institutions that do not map their IRB recalibration roadmap against the new ECB approval process risk discovering mid-programme that a planned model refinement requires a 9-month approval cycle they had not budgeted.