---
title: "BCBS 239 — Risk Data Aggregation & Risk Reporting Principles — KYE Protocol™ coverage"
description: "BCBS 239 — Risk Data Aggregation & Risk Reporting Principles coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it."
url: https://kyeprotocol.com/compliance/bcbs-239/
lang: en
source: "KYE Protocol"
---

> BCBS 239 — Risk Data Aggregation & Risk Reporting Principles coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it.

BCBS 239 — Risk Data Aggregation & Risk Reporting Principles

# BCBS 239 — Risk Data Aggregation & Risk Reporting Principles — 100% of in-scope requirements covered.

14 requirements · 7 in scope (7 enforced) · 7 out-of-scope (outside KYE™’s authority layer). The 100% is weighted over the in-scope base.

**Source:** The Basel Committee on Banking Supervision's Principles for effective risk data aggregation and risk reporting (BCBS 239, January 2013) set 14 principles across four areas: overarching governance and infrastructure (P1 governance, P2 data architecture & IT infrastructure), risk data aggregation capabilities (P3 accuracy & integrity, P4 completeness, P5 timeliness, P6 adaptability), risk reporting practices (P7 accuracy, P8 comprehensiveness, P9 clarity & usefulness, P10 frequency, P11 distribution), and supervisory review (P12 review, P13 remedial actions & supervisory measures, P14 home/host cooperation). KYE Protocol™ governs the EVIDENCE side of the principles: every risk report bound to its data-lineage evidence chain before filing or reliance, every embedded number traceable to model\_id + version + validation reference, production and distribution provably timestamped, and the whole chain reconstructable offline from published keys. KYE™ does not build the bank's data architecture, aggregate the risk data, or compute the risk numbers. · **License:** BCBS 239 is published by the Bank for International Settlements and is publicly available; the KYE™ registry paraphrases each principle's intent and cites the official principle number for mapping purposes only.

## By category

| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
| --- | --- | --- | --- | --- | --- | --- |
| Overarching governance & infrastructure (P1–P2) | 2 | 1 | 0 | 0 | 0 | **100%** |
| Risk data aggregation capabilities (P3–P6) | 4 | 3 | 0 | 0 | 0 | **100%** |
| Risk reporting practices (P7–P11) | 5 | 3 | 0 | 0 | 0 | **100%** |
| Supervisory review, tools & cooperation (P12–P14) | 3 | 0 | 0 | 0 | 0 | **0%** |

## Every requirement → the KYE™ artefact that enforces it

| ID | Title | Status | KYE™ enforcement |
| --- | --- | --- | --- |
| `bcbs-239.principle1-governance` | Principle 1 — Governance: risk-data aggregation and reporting under board-owned governance with named, recorded authority | enforced | **audit\_events**: `kye.purpose.request.v1`, `kye.purpose.admissibility.v1`, `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **rule\_packs**: `kye:rule-pack:model-risk-data-governance` **dictionaries**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `bcbs-239.principle2-data-architecture` | Principle 2 — Data architecture and IT infrastructure supporting aggregation in normal and stress conditions | out-of-scope | _(no enforcement cited)_ |
| `bcbs-239.principle3-accuracy-integrity-lineage` | Principle 3 — Accuracy and integrity: every risk report bound to its data-lineage evidence chain (sources, transformations, integrity hash) | enforced | **audit\_events**: `kye.evidence.decision_map.v1`, `kye.evidence.pack.v1`, `kye.replay.context_seal.v1` **engines**: `internal` **rule\_packs**: `kye:rule-pack:model-risk-data-governance` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/30-AUDIT-WORM-RETENTION.md` |
| `bcbs-239.principle4-completeness` | Principle 4 — Completeness: the lineage chain proves which sources, books, and entities the report aggregated — omissions are visible | enforced | **audit\_events**: `kye.evidence.decision_map.v1`, `kye.evidence.pack.v1` **engines**: `internal` **rule\_packs**: `kye:rule-pack:model-risk-data-governance` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `bcbs-239.principle5-timeliness` | Principle 5 — Timeliness: generating up-to-date aggregated risk data quickly, including in stress / crisis | out-of-scope | _(no enforcement cited)_ |
| `bcbs-239.principle6-adaptability` | Principle 6 — Adaptability: ad hoc / bespoke risk reports are reconstructable — the lineage chain replays deterministically | enforced | **audit\_events**: `kye.replay.context_seal.v1`, `kye.replay.proof.v1`, `kye.evidence.pack.v1` **engines**: `internal`, `internal` **rule\_packs**: `kye:rule-pack:model-risk-data-governance` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/21-DELEGATED-AUDITABILITY.md` |
| `bcbs-239.principle7-reporting-accuracy` | Principle 7 — Accuracy of risk reports: every reported number traces to its model version, validation reference, and lineage — reconciled and verifiable | enforced | **audit\_events**: `kye.evidence.tool_call.v1`, `kye.evidence.pack.v1`, `kye.replay.context_seal.v1` **engines**: `internal`, `internal` **rule\_packs**: `kye:rule-pack:model-risk-data-governance` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `bcbs-239.principle8-comprehensiveness` | Principle 8 — Comprehensiveness: reports cover all material risk areas with appropriate depth | out-of-scope | _(no enforcement cited)_ |
| `bcbs-239.principle9-clarity-usefulness` | Principle 9 — Clarity and usefulness: reports communicate risk in a clear, concise, decision-useful way | out-of-scope | _(no enforcement cited)_ |
| `bcbs-239.principle10-frequency` | Principle 10 — Frequency: when each report was produced is provably timestamped, so the required cadence is demonstrable | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.replay.context_seal.v1` **engines**: `internal` **rule\_packs**: `kye:rule-pack:model-risk-data-governance` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/30-AUDIT-WORM-RETENTION.md` |
| `bcbs-239.principle11-distribution` | Principle 11 — Distribution: who received each report, when, is recorded as evidence while confidentiality is preserved | enforced | **audit\_events**: `kye.evidence.decision_map.v1`, `kye.evidence.pack.v1` **engines**: `internal` **rule\_packs**: `kye:rule-pack:model-risk-data-governance` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/38-COMMS-RAIL.md` |
| `bcbs-239.principle12-supervisory-review` | Principle 12 — Supervisory review of the bank's compliance with the Principles | out-of-scope | _(no enforcement cited)_ |
| `bcbs-239.principle13-remedial-actions` | Principle 13 — Remedial actions and supervisory measures for deficiencies | out-of-scope | _(no enforcement cited)_ |
| `bcbs-239.principle14-home-host-cooperation` | Principle 14 — Cooperation between home and host supervisors | out-of-scope | _(no enforcement cited)_ |

Canonical KYE™ surfaces referenced on this page: [KYE Protocol™](https://kyeprotocol.com/).