CRR3 is not a project. It is a pipeline — and CCF is the canary.
Level 1 is signed. More than 120 EBA mandates sit behind it. The banks that will be ready in 2028 are the ones that read the CCF RTS as a forecast, not a technical update.
- CRR3 delegates 120+ mandates to the EBA — each one carries capital consequences. The CCF RTS is the first test case, and it reveals the regulatory playbook for every mandate to follow.
- Three signals emerge from the CCF RTS: substance over form, narrow optionality, and mandated evidence. These patterns will repeat across operational risk, market risk, and CVA mandates.
- 90% of CRR3 budgets target Day One compliance. The remaining 10% must cover mandate interpretation and ongoing calibration for a decade. This structural under-investment is the biggest risk most boards are not discussing.
- Three moves a CRO can execute this quarter: build a live mandate registry, run a CCF re-baseline as proof of concept, and install a standing consultation working group. No multi-year programme required.
Why the CCF RTS Is the Canary
The CCF RTS is not just about credit conversion factors. It is the first observable test of how the EBA intends to operationalise CRR3’s Level 1 text. If you want to know what every subsequent mandate will look like, read this one closely. Three signals emerge.
Substance Over Form
The EBA will challenge legal-only classification. Having the contractual right to cancel is not enough — you must demonstrate the operational infrastructure to do it within one business day. This is a paradigm shift: the regulator is no longer reading your contracts. It is auditing your processes.
Narrow Optionality
Every instance of “where appropriate” in the Level 1 text will be progressively closed by the EBA. The CCF RTS is the template: it converts broad discretion into narrow, documented criteria. Expect the same pattern in operational risk, market risk, and CVA mandates.
Mandate Evidence
Documented, reviewable criteria will be required — not just for internal models, but for every classification decision. The RTS signals an era where “expert judgement” must be traceable, versioned, and audit-ready.
The EBA Mandate Pattern — Decoded from CCF RTS
For every new EBA mandate that lands, ask: “Does this mandate narrow optionality, demand evidence, or shift from form to substance?” If the answer to any of these is yes — and it almost always will be — you are looking at capital impact, not just a compliance exercise. The CCF RTS scored three for three. Most mandates will score at least two.
Example: Unconditionally Cancellable Commitments
The qualitative shape of one case: a material CET1 unlock on a single CRR3 book
Anonymised European G-SIB. The CRR3 levers — CCF, off-balance-sheet commitments, SA-CR re-segmentation — that moved the Day-1 number, and the ECB conversation that signed it off. Mandate-specific figures withheld; public-data calibration (EBA Basel III monitoring, Pillar 3 disclosures) on request.
CFO Capital-Impact Case · coming soon Publishing autumn 2026.The Pipeline Behind the Pipeline
CRR3 is not one regulation. It is a mandate factory. The Level 1 text delegates more than 120 discrete items to the EBA — Regulatory Technical Standards, Implementing Technical Standards, guidelines, and reports. They arrive in waves, and each wave carries capital consequences.
| Cluster | Key Mandates | Capital Sensitivity | Timeline | Risk Level |
|---|---|---|---|---|
| Credit Risk & Output Floor | CCF RTS, UCC eligibility, SA-CR mapping, Output Floor calculation methodology, transitional provisions | Direct CET1 erosion of 15–40 bps. Output Floor amplifies every SA-CR change. | 2025–2027 | CRITICAL |
| Operational Risk | Business Indicator Component (BIC) mapping, loss data collection RTS (the internal loss multiplier is set to 1 in the EU, Art. 314 CRR) | Full replacement of AMA. Own funds equal the BIC alone (ILM = 1 in the EU), so a low historical loss record no longer reduces Pillar 1 capital. | 2025–2027 | HIGH |
| Market Risk / FRTB | Boundary classification ITS, P&L attribution test thresholds, risk factor modellability criteria | Trading book desks failing PLAT face SA fallback. 30–80% RWA uplift per desk. | 2026–2028 | HIGH |
| CVA / Securitisation / Concentration | CVA exemption criteria, STS securitisation RTS updates, large exposure calculation methodology | Selective but concentrated impact. CVA exemption narrowing affects derivative-heavy banks. | 2026–2028 | MEDIUM |
Each cluster does not operate in isolation. The Output Floor means that every SA-CR change — including CCF recalibration — has a multiplied effect on IRB banks. A 20bps change at the SA level can become a 40bps change at the consolidated level. The pipeline is not additive. It is compounding.
What an Anticipation Framework Looks Like
Most banks have a CRR3 “programme”. Few have an anticipation capability. A programme executes known requirements. An anticipation framework reads emerging mandates as capital signals — before the final text is published. Four components are non-negotiable.
Live Mandate Registry
A single, continuously updated inventory of every EBA mandate triggered by CRR3. Not a spreadsheet. A live system that tracks consultation stage, expected publication date, capital relevance, and internal owner.
Why it matters: You cannot anticipate what you cannot see. Most banks discover mandates 3–6 months late.Interpretation Tree
For each mandate, a structured analysis of the range of possible interpretations — from conservative to aggressive — with capital impact estimates for each. Updated as consultation responses and final texts emerge.
Why it matters: The final text is rarely a surprise. The direction of travel is visible 12–18 months early.Capital Sensitivity Map
A pre-computed matrix showing how each mandate interpretation translates to CET1 impact across business lines, legal entities, and portfolios. Enables rapid impact assessment when final text drops.
Why it matters: When a mandate is published, the board wants a number within 48 hours, not 8 weeks.Governance Cadence
A quarterly review cycle where the CRO function presents the mandate pipeline, updated capital ranges, and recommended actions to the board risk committee. Not ad hoc. Not annual. Quarterly.
Why it matters: Governance lag is the number one reason banks are surprised by regulatory capital events.The point is not to predict the future. The point is to build a standing capability that converts regulatory signals into capital estimates faster than your competitors — and faster than your supervisor expects.
— Hannan Mohammad, EzelmanThe Controversial Part
European banks are spending between €40 million and €80 million on CRR3 implementation. The vast majority goes to Day One compliance: system changes, calculation engines, reporting templates. Almost none goes to what happens after Day One.
Every board risk committee should be asking their CRO: “Of our €X million CRR3 budget, what fraction is dedicated to reading, interpreting, and acting on the 120+ mandates that will reshape our capital requirements continuously from 2026 to 2032?” If the answer is less than 15%, the programme is structurally under-investing in the part that determines long-term capital efficiency.
Day One is a milestone. Day Two is the operating model. The banks that win will be the ones that built for Day Two while everyone else was still arguing about Day One.
Where to Start, This Quarter
Three concrete actions. No multi-year programme. No €5 million budget request. These are moves a CRO can authorise this quarter, with existing resources, and see results within 90 days.
- Assign 6 people (regulation, risk, finance) for 3 weeks
- Catalogue every EBA mandate triggered by CRR3 Level 1
- Tag each by: risk domain, capital sensitivity (H/M/L), expected publication date
- Map internal ownership for each mandate
- Deliver a live, searchable registry — not a PDF
- Take the CCF RTS as the test case for the anticipation framework
- Re-classify the entire OBS portfolio under the final draft RTS criteria (EBA/RTS/2025/06, 18 August 2025)
- Quantify CET1 impact under conservative, base, and aggressive interpretations
- Present results to the board risk committee as a proof of concept
- Document the methodology — it becomes the template for every future mandate
- Create a standing 8–10 person working group (regulation, risk, finance, legal)
- Mandate: respond to every capital-relevant EBA consultation within the deadline
- Maintain the interpretation tree and capital sensitivity map quarterly
- Report to the CRO every quarter on pipeline status and capital range updates
- Build institutional memory that compounds over time
The Part That Will Be Obvious in 2028
In 2028, when the full CRR3 framework is operational and the first generation of EBA mandates has landed, there will be two types of banks.
Banks that anticipated
They built the registry in 2026. They ran the CCF re-baseline as a pilot. They responded to consultations, shaped the final text, and had capital estimates ready before each mandate was published. Their CET1 plans absorbed the changes. Their boards were never surprised.
Banks that reacted
They treated each mandate as a standalone compliance exercise. They discovered capital impacts 6 months after publication. They scrambled to re-forecast CET1 trajectories. Their boards asked why no one saw it coming. The answer was always the same: “We were focused on Day One.”
CRR3 is not a project with a go-live date. It is a pipeline that will reshape European bank capital for a decade. CCF is the canary. The question is whether your institution is reading the signals — or waiting for the final text.
— Hannan Mohammad, Founder & Managing Partner, EzelmanThe Mandate Cascade: 2025 → 2032
Related Intelligence
Primary documents cited in this analysis
- [1]
- [2]EBAEBA/RTS/2025/06 — Final draft RTS on off-balance-sheet items under Article 111(8) CRR (18 August 2025; consulted as EBA/CP/2024/08, March 2024); awaiting Commission adoption → source
- [3]
Dates, paragraph numbers and document versions verified at publication. Where consultations are still open, we flag draft status in text. Corrections: research@ezelman.com.
This analysis underpins our CRR3 CCF recalibration mandates.
Partner-led, senior-only, no audit conflict. If the question in this piece is live at your institution, the first conversation is with a partner — not a BD team.
Talk to a partner →