Six parallel workstreams, nine months of runway, and a regulatory deadline that will not move. This is the practitioner's programme management guide for the most consequential regulatory change since Basel III.
Six workstreams define CRR3 execution. Each has upstream dependencies on data and infrastructure, and downstream dependencies on reporting and governance. Missing a dependency link is how programmes fail.
Full recalibration of Standardised Approach risk weights across all exposure classes. Gates Output Floor and COREP reporting. Requires clean counterparty data, exposure classification, and collateral mapping.
Computes MAX(IRB RWA, Floor% × SA RWA) across all risk types. Depends on SA-CR completion. Drives capital planning, stress testing, and board-level strategic decisions.
Replace VaR with Sensitivities-based Approach (SbM) and Internal Model Approach (IMA). Requires daily risk factor feeds, P&L attribution, and new DRC/RRAO calculations. Largely independent of credit risk streams.
New Standardised (SA-CVA) and Basic (BA-CVA) approaches replace the current framework. Depends on counterparty exposure data from SA-CR and market risk sensitivities from FRTB. Cross-workstream coordination critical.
PD floors, LGD floors, and CCF parameter recalibration under CRR3 requirements. Must run concurrently with SA-CR for Output Floor comparison. Requires model validation committee sign-off before go-live.
New COREP templates, XBRL taxonomy updates, validation rule changes, and data lineage documentation. Downstream of all five calculation workstreams. The integration bottleneck most programmes underestimate.
SA-CR is the gating workstream. Output Floor cannot be validated without complete SA-CR calculations. Reporting cannot be tested without Output Floor outputs. If SA-CR slips, the entire programme cascades. Protect SA-CR delivery above all else.
Target state assessment for a well-managed G-SIB programme. If your programme is behind these benchmarks, escalation is overdue.
| Workstream | Q2 2026 | Q3 2026 | Q4 2026 | Q1 2027 |
|---|---|---|---|---|
| SA-CR Recalibration | A Parallel run active | G Reconciliation complete | G Production hardened | G Live |
| Output Floor Engine | R Build & unit test | A Integration testing | G UAT sign-off | G Live |
| FRTB Migration | A SbM engine in test | A P&L attribution validated | G Parallel reporting | G Live |
| CVA Framework | R SA-CVA methodology | A Calculation engine build | A Reconciliation | G Live |
| IRB Recalibration | A PD/LGD floor impact | G Model validation | G ECB notification | G Live |
| Data & Reporting | R Template mapping | R ETL build & test | A Parallel submission | G Live |
In every CRR3 programme we have observed, Data & Reporting is the workstream most likely to remain red into Q4 2026. This is because it sits downstream of all calculation workstreams and absorbs every upstream delay. Protect this workstream with dedicated resource allocation and weekly escalation rights to SteerCo.
Benchmark resource allocation for a G-SIB CRR3 programme. These are minimum viable FTE levels — under-resourcing any workstream by more than 20% materially increases delivery risk.
| Workstream | Risk / Business SMEs | IT / Engineering | Data / Analytics | PMO / Governance | Total FTEs |
|---|---|---|---|---|---|
| SA-CR Recalibration | 8–12 | 6–10 | 4–6 | 2 | 20–30 |
| Output Floor Engine | 4–6 | 8–12 | 3–5 | 2 | 17–25 |
| FRTB Migration | 10–15 | 12–18 | 6–8 | 2–3 | 30–44 |
| CVA Framework | 4–6 | 4–6 | 2–4 | 1 | 11–17 |
| IRB Recalibration | 6–10 | 4–6 | 4–6 | 1–2 | 15–24 |
| Data & Reporting | 4–6 | 10–16 | 8–12 | 2–3 | 24–37 |
A typical G-SIB CRR3 programme requires 120–180 FTEs at peak, including contractors and vendor resources. Programmes that attempt delivery with fewer than 80 FTEs consistently miss milestones. The cost of under-resourcing is not proportional — it is exponential, as delays compound across dependent workstreams.
Based on direct experience across 10+ CRR3 programmes in European G-SIBs. These failure patterns repeat with alarming consistency. If you recognise any, act immediately.
Banks discover material data gaps during year-end parallel runs when reconciliation pressure is highest. Counterparty classification errors, missing collateral data, and inconsistent exposure segmentation surface too late for remediation. The fix: run data quality diagnostics in Q2, not Q4.
The Output Floor is not a formula to implement — it is a capital adequacy constraint that changes business strategy, pricing, and portfolio composition. Banks that treat it as an IT deliverable miss the board-level implications until it is too late to act.
CVA sits at the intersection of market risk and counterparty credit risk. When FRTB and SA-CR workstreams operate independently, CVA calculations lack coherent inputs. Cross-workstream data contracts must be established by end of Q2 2026.
Programmes allocate 80% of resources to calculation engines and 20% to reporting. The ratio should be closer to 60/40. New COREP templates, XBRL validation, and EBA submission testing require substantial IT investment that is consistently under-budgeted.
Banks relying on vendor platforms for risk calculation or regulatory reporting have a single point of failure. Vendor release schedules do not always align with bank timelines. Establish contractual delivery milestones with penalty clauses, and maintain manual workaround capabilities.
The ECB expects evidence of credible parallel runs before go-live. This is not optional — it is a supervisory expectation that will be tested in SREP assessments.
Run full SA-CR calculations in parallel with IRB for minimum 2 quarters before go-live. Reconcile RWA at portfolio level monthly, at counterparty level quarterly. Document all material variances (>5%) with root cause analysis.
Calculate binding floor impact weekly from Q3 2026. Track which portfolios are floor-binding and model the trajectory from 72.5% to 100%. Board must receive monthly floor impact reports with CET1 sensitivity analysis.
Daily FRTB calculations must reconcile to internal VaR metrics within documented tolerance bands. P&L attribution test (PLAT) results must be tracked for every trading desk. Failed PLATs must trigger remediation within the same reporting period.
Submit at least one full cycle of new COREP templates to internal validation before the first live submission. Run EBA validation rules against test data and resolve all hard errors. Soft warnings should be documented with justification.
Data owners must formally attest to data quality for each workstream by Q4 2026. Attestation must cover completeness, accuracy, timeliness, and consistency. Material exceptions require documented remediation plans with deadlines.
Front office must model the impact of CRR3 capital charges on product pricing, return on equity, and client profitability by Q3 2026. Products with negative economics under CRR3 must be identified for strategic review.
The governance architecture that works. Every successful CRR3 programme we have observed follows a variant of this structure. Deviations introduce ambiguity, and ambiguity kills delivery.
Cadence: Monthly → Bi-weekly from Q4 2026. Chair: CRO or Deputy CRO. Members: CFO, CIO, Head of Risk, Programme Director, ECB Liaison. Role: Strategic decisions, cross-workstream trade-offs, budget reallocation, regulatory escalation.
Cadence: Weekly. Lead: Programme Director (dedicated, not shared). Role: Milestone tracking, RAG status, cross-workstream dependency management, resource allocation, risk and issue log, SteerCo reporting. Minimum 3–5 FTEs dedicated to PMO.
Cadence: Daily standups within workstream, weekly cross-workstream sync. Profile: Senior practitioners with dual risk/IT fluency. Each workstream lead owns delivery, resource requests, and escalation to PMO. Must have authority to make technical decisions without committee approval.
Cadence: Ad hoc + quarterly supervisory updates. Lead: Head of Regulatory Affairs or dedicated CRR3 regulatory liaison. Role: Proactive supervisory communication, SREP response coordination, inspection readiness, regulatory interpretation queries. This role is not optional — it is a risk mitigant.
Do not combine CRR3 governance with other regulatory programmes (e.g., DORA, CSRD). CRR3 demands dedicated governance bandwidth. Shared governance structures create competing priorities, diluted attention, and slower decision-making. If your CRR3 SteerCo is also your DORA SteerCo, you have a structural problem.
Not all workstreams are equal. The critical path determines programme timeline. Delays on non-critical workstreams can be absorbed; delays on the critical path cannot.
| Workstream | Gates | Gated By | Critical Path? | Float |
|---|---|---|---|---|
| SA-CR Recalibration | Output Floor, IRB Recal, Reporting | Data infrastructure | YES | 0 weeks |
| Output Floor Engine | Reporting, Capital Planning | SA-CR, IRB Recal | YES | 0 weeks |
| FRTB Migration | CVA Framework, Market Risk Reporting | Market data infrastructure | PARTIAL | 2–4 weeks |
| CVA Framework | Reporting | FRTB, SA-CR (counterparty data) | NO | 4–6 weeks |
| IRB Recalibration | Output Floor comparison | SA-CR (for floor comparison) | PARTIAL | 2–4 weeks |
| Data & Reporting | Go-live (regulatory submission) | All calculation workstreams | YES | 0 weeks |
SA-CR → Output Floor → Data & Reporting → Go-Live. This is the chain that determines whether you make January 2027. Every week of slippage on SA-CR is a week lost at the end of the chain, with no recovery mechanism. FRTB and CVA have limited float because they feed into reporting independently, but any delay beyond Q3 2026 eliminates that buffer.
A phased action plan for the remaining nine months. Each phase builds on the previous. Missing a phase means compressing the next — which is how programmes fail.