Level 1 is signed. More than 120 EBA mandates sit behind it. The banks that will be ready in 2028 are the ones that read the CCF RTS as a forecast, not a technical update.
The CCF RTS is not just about credit conversion factors. It is the first observable test of how the EBA intends to operationalise CRR3’s Level 1 text. If you want to know what every subsequent mandate will look like, read this one closely. Three signals emerge.
The EBA will challenge legal-only classification. Having the contractual right to cancel is not enough — you must demonstrate the operational infrastructure to do it within one business day. This is a paradigm shift: the regulator is no longer reading your contracts. It is auditing your processes.
Every instance of “where appropriate” in the Level 1 text will be progressively closed by the EBA. The CCF RTS is the template: it converts broad discretion into narrow, documented criteria. Expect the same pattern in operational risk, market risk, and CVA mandates.
Documented, reviewable criteria will be required — not just for internal models, but for every classification decision. The RTS signals an era where “expert judgement” must be traceable, versioned, and audit-ready.
For every new EBA mandate that lands, ask: “Does this mandate narrow optionality, demand evidence, or shift from form to substance?” If the answer to any of these is yes — and it almost always will be — you are looking at capital impact, not just a compliance exercise. The CCF RTS scored three for three. Most mandates will score at least two.
CRR3 is not one regulation. It is a mandate factory. The Level 1 text delegates more than 120 discrete items to the EBA — Regulatory Technical Standards, Implementing Technical Standards, guidelines, and reports. They arrive in waves, and each wave carries capital consequences.
| Cluster | Key Mandates | Capital Sensitivity | Timeline | Risk Level |
|---|---|---|---|---|
| Credit Risk & Output Floor | CCF RTS, UCC eligibility, SA-CR mapping, Output Floor calculation methodology, transitional provisions | Direct CET1 erosion of 15–40 bps. Output Floor amplifies every SA-CR change. | 2025–2027 | CRITICAL |
| Operational Risk | Business Indicator Component (BIC) mapping, loss data collection RTS, ILM calibration guidelines | Full replacement of AMA. Banks with low historical losses face capital increases under new standardised approach. | 2025–2027 | HIGH |
| Market Risk / FRTB | Boundary classification ITS, P&L attribution test thresholds, risk factor modellability criteria | Trading book desks failing PLAT face SA fallback. 30–80% RWA uplift per desk. | 2026–2028 | HIGH |
| CVA / Securitisation / Concentration | CVA exemption criteria, STS securitisation RTS updates, large exposure calculation methodology | Selective but concentrated impact. CVA exemption narrowing affects derivative-heavy banks. | 2026–2028 | MEDIUM |
Each cluster does not operate in isolation. The Output Floor means that every SA-CR change — including CCF recalibration — has a multiplied effect on IRB banks. A 20bps change at the SA level can become a 40bps change at the consolidated level. The pipeline is not additive. It is compounding.
Most banks have a CRR3 “programme”. Few have an anticipation capability. A programme executes known requirements. An anticipation framework reads emerging mandates as capital signals — before the final text is published. Four components are non-negotiable.
A single, continuously updated inventory of every EBA mandate triggered by CRR3. Not a spreadsheet. A live system that tracks consultation stage, expected publication date, capital relevance, and internal owner.
Why it matters: You cannot anticipate what you cannot see. Most banks discover mandates 3–6 months late.For each mandate, a structured analysis of the range of possible interpretations — from conservative to aggressive — with capital impact estimates for each. Updated as consultation responses and final texts emerge.
Why it matters: The final text is rarely a surprise. The direction of travel is visible 12–18 months early.A pre-computed matrix showing how each mandate interpretation translates to CET1 impact across business lines, legal entities, and portfolios. Enables rapid impact assessment when final text drops.
Why it matters: When a mandate is published, the board wants a number within 48 hours, not 8 weeks.A quarterly review cycle where the CRO function presents the mandate pipeline, updated capital ranges, and recommended actions to the board risk committee. Not ad hoc. Not annual. Quarterly.
Why it matters: Governance lag is the number one reason banks are surprised by regulatory capital events.The point is not to predict the future. The point is to build a standing capability that converts regulatory signals into capital estimates faster than your competitors — and faster than your supervisor expects.
— Hannan Mohammad, EzelmanEuropean banks are spending between €40 million and €80 million on CRR3 implementation. The vast majority goes to Day One compliance: system changes, calculation engines, reporting templates. Almost none goes to what happens after Day One.
Every board risk committee should be asking their CRO: “Of our €X million CRR3 budget, what fraction is dedicated to reading, interpreting, and acting on the 120+ mandates that will reshape our capital requirements continuously from 2026 to 2032?” If the answer is less than 15%, the programme is structurally under-investing in the part that determines long-term capital efficiency.
Day One is a milestone. Day Two is the operating model. The banks that win will be the ones that built for Day Two while everyone else was still arguing about Day One.
Three concrete actions. No multi-year programme. No €5 million budget request. These are moves a CRO can authorise this quarter, with existing resources, and see results within 90 days.
In 2028, when the full CRR3 framework is operational and the first generation of EBA mandates has landed, there will be two types of banks.
They built the registry in 2026. They ran the CCF re-baseline as a pilot. They responded to consultations, shaped the final text, and had capital estimates ready before each mandate was published. Their CET1 plans absorbed the changes. Their boards were never surprised.
They treated each mandate as a standalone compliance exercise. They discovered capital impacts 6 months after publication. They scrambled to re-forecast CET1 trajectories. Their boards asked why no one saw it coming. The answer was always the same: “We were focused on Day One.”
CRR3 is not a project with a go-live date. It is a pipeline that will reshape European bank capital for a decade. CCF is the canary. The question is whether your institution is reading the signals — or waiting for the final text.
— Hannan Mohammad, Founder & Managing Partner, Ezelman