Financial Services Regulation

Basel III

Basel III framework badge
Summarize with
ClaudeChatGPTPerplexityGoogle AI Mode
In this article
At a Glance
Basel III – Finalization (2017)
  • Classification
    Category
    Financial Services Regulation
    Domain
    Financial Services Regulation
    Framework Family
    Other
  • Regulatory Context
    Type
    Regulation
    Legal Instrument
    Framework
    Sector
    Financial Sector
    Industry
    Financial Services
  • Region / Publisher
    Region
    Global
    Region Detail
    Switzerland
    Publisher
    Basel Committee on Banking Supervision (BCBS)
  • Versioning
    Version
    Basel III: Finalising post-crisis reforms (December 2017)
    Effective Date
    1 January 2023 (deferred from 1 January 2022); output floor phased in to 72.5% on 1 January 2028
    Issue Date
    7 December 2017
  • Adoption
    Adoption Model
    Regulatory Compliance
    Implementation Complexity
    Very High
  • Official Reference
License Information

License included / downloadable: Yes

Basel III standards are published by the Basel Committee on Banking Supervision and are publicly available through the Bank for International Settlements.

Framework text is licensed by its publisher and is included only where stated above.

Official Resources
Basel III: International Regulatory Framework for Banks
Defines the Basel III standards for banking regulation to enhance global financial stability.
Frequently Asked Questions on Basel III Monitoring
Provides answers to common questions about the implementation and monitoring of Basel III.
Basel III Monitoring Report
Describes data and analyses related to the monitoring of Basel III implementation.
Key takeaways
  • The Basel III finalization package (BCBS, December 7, 2017) completes the Basel Committee's post-crisis revisions to the bank capital framework.
  • It revises the credit risk, CVA, and operational risk approaches and adds an output floor on risk-weighted assets.
  • Implementation was deferred to January 1, 2023, and the output floor phases in to 72.5% on January 1, 2028.
  • The Committee has no supranational authority, so each jurisdiction adopts the rules through national law and may be more conservative.
  • SmartSuite Compliance Management holds the standard's requirements and evidence, and Enterprise Risk Management holds operational risk, loss events, and key risk indicators.

Overview

Basel III: Finalising post-crisis reforms is the standard the Basel Committee on Banking Supervision (BCBS) published on 7 December 2017 to complete its post-crisis revisions to the bank capital framework. It revises the standardized and internal ratings-based approaches for credit risk, the credit valuation adjustment (CVA) framework, and operational risk, where a single standardized approach replaces all existing Basel II approaches. It also adds an output floor on risk-weighted assets and finalizes the leverage ratio, including a buffer for global systemically important banks (G-SIBs). Its key objective is to reduce excessive variability of risk-weighted assets (RWA).

The standard sets minimum requirements for internationally active banks, and the Basel Committee has no supranational authority: its decisions do not have legal force, so each jurisdiction adopts the rules through national law and may be more conservative. The Group of Central Bank Governors and Heads of Supervision (GHOS) endorsed the package on 7 December 2017. In March 2020 it deferred implementation by one year, from 1 January 2022 to 1 January 2023, and extended the output floor transition to 1 January 2028.

Banks implement it by recalculating RWA under the revised approaches, running the output floor comparison, applying the standardized operational risk approach, meeting the leverage ratio and the G-SIB buffer, and reporting under national rules. The standard has been integrated into the consolidated Basel Framework.

Why does it matter?

The package changes how risk-weighted assets are calculated, so the capital ratio a bank reports can change even when its business has not.

Key benefits include:

  • Less RWA variability

More risk-sensitive standardized approaches for credit and operational risk, and constraints on internally modeled approaches, make banks' capital ratios more comparable.

  • A capital floor

Banks calculate RWA as the higher of the total from their approved approaches and 72.5% of the total calculated only with standardized approaches.

  • One operational risk method

A standardized approach based on the Business Indicator and the bank's loss history replaces all existing Basel II operational risk approaches.

  • A non-risk-based backstop

The leverage ratio is finalized, and G-SIBs must also meet a leverage ratio buffer set at 50% of their higher-loss absorbency requirement.

  • Flexible adoption

A jurisdiction that implements only the standardized approaches and not the internal models is still compliant with the Basel framework.

How does it work?

The standard has seven parts: an introduction, the standardized approach for credit risk, the internal ratings-based approach for credit risk, minimum capital requirements for CVA risk, minimum capital requirements for operational risk, the output floor, and the leverage ratio. Banks must hold Common Equity Tier 1 of at least 4.5%, Tier 1 of at least 6.0%, and total capital of at least 8.0% of RWA, plus a 2.5% capital conservation buffer.

The output floor applies to RWA: a bank's RWA are the maximum of the total from approaches it has supervisory approval to use and 72.5% of the total calculated with the standardized approaches. The 2017 transition rose from 50% in 2022 to 72.5% in 2027; the March 2020 deferral moves each step back one year, ending on 1 January 2028.

In SmartSuite, Compliance Management holds the standard's requirements with owners and evidence, Enterprise Risk Management tracks operational risk, loss events, and key risk indicators, and Enterprise Reporting supports supervisory reporting packs. SmartSuite does not calculate regulatory capital; it tracks the controls and evidence around those calculations.

Key Elements

  • Standardized approach for credit risk

Banks may choose between this approach, which assigns standardized risk weights, and the internal ratings-based approach. In jurisdictions that allow external ratings, banks may start from assessments by recognized external credit assessment institutions.

  • Internal ratings-based approach

Banks may use internal rating systems for credit risk with explicit supervisory approval. The revised framework constrains internally modeled approaches, and the 1.06 scaling factor on IRB credit risk RWA no longer applies.

  • CVA risk

A revised minimum capital requirement for credit valuation adjustment risk, implemented on the same date as the credit risk revisions.

  • Operational risk

The Business Indicator (interest, leases and dividend; services; and financial components) is multiplied by marginal coefficients of 12%, 15%, and 18% by size bucket to give the Business Indicator Component, then scaled by an Internal Loss Multiplier based on average historical losses. Operational risk includes legal risk and excludes strategic and reputational risk.

  • Output floor

RWA may not fall below 72.5% of RWA calculated with the standardized approaches, phased in from 50% and now ending on 1 January 2028.

  • Leverage ratio

A finalized leverage ratio with a revised exposure definition and, for G-SIBs, a buffer equal to 50% of the higher-loss absorbency requirement, met with Tier 1 capital.

  • Implementation dates

Originally 1 January 2022 for the credit, IRB, CVA, operational risk, and leverage ratio revisions, deferred to 1 January 2023, with the output floor transition running to 1 January 2028.

What does it cover?

The standardized approach for operational risk applies to internationally active banks on a consolidated basis, and supervisors may apply it to other banks. More generally, the Basel framework sets minimum standards: jurisdictions may adopt more conservative requirements or earlier transitional dates. National regulators, not the Basel Committee, enforce the rules, so a bank's obligations depend on how its jurisdiction has implemented them.

What are its objectives?

The Committee worked from three overarching principles in finalizing the reforms.

Strengthen the regulation, supervision, and practices of banks worldwide to enhance financial stability.

Reduce excessive variability of risk-weighted assets and restore credibility in their calculation.

Enhance the risk sensitivity of the standardized approaches and constrain internally modeled approaches.

Complement the risk-weighted capital ratio with a finalized leverage ratio and a revised capital floor.

Avoid significantly increasing overall capital requirements.

Framework in Context

This page covers the December 2017 package. Earlier Basel III documents are separate publications: the capital framework of December 2010 (revised June 2011), the Liquidity Coverage Ratio (January 2013), and the net stable funding ratio (October 2014). The 2017 operational risk standard sits beside the BCBS Principles for the sound management of operational risk and the Principles for operational resilience, and banks commonly also map it to ISO 31000 and COSO ERM.

Common Framework Mappings

Banks that apply the 2017 package connect its operational risk and governance requirements to the standards below.

Mapped frameworks include:

BCBS PSMOR 2021

BCBS Operational Resilience Principles

COSO ERM 2017

ISO 31000:2018

SMARTSUITE

How SmartSuite Supports Basel III

SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.

Use Compliance Management for the standard's requirements and evidence, and Enterprise Risk Management for operational risk, loss events, and key risk indicators.

Requirement library

Record the seven parts of the standard as requirements with owners, jurisdictional implementation status, and effective dates.

Implementation timeline

Track the deferred dates, the output floor phase-in, and the national rules that apply in each jurisdiction.

Operational risk loss data

Log operational loss events and key risk indicators in Enterprise Risk Management to support the loss history behind the Internal Loss Multiplier.

Model and calculation controls

Document the controls, reviews, and approvals around RWA, output floor, and leverage ratio calculations.

Internal audit and testing

Plan and record testing of the calculation processes and data, and track remediation to closure with Internal Audit Management.

Supervisory reporting

Use Enterprise Reporting to assemble status, open issues, and evidence for supervisors and the Board.

Related frameworks

EU DORA

DORA (Regulation (EU) 2022/2554) requires EU financial entities to manage ICT risk, report major incidents, test resilience and control ICT third-party risk, applying from January 17, 2025.

ISO 27001:2022

ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.

NIST CSF 2.0

NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.

BCBS PSMOR 2021

The Basel Committee's twelve revised Principles for the Sound Management of Operational Risk set the supervisory baseline for how banks govern, identify, control, and report the risk.

BCBS Operational Resilience Principles

The Basel Committee's seven Principles for Operational Resilience set the international baseline for how banks deliver critical operations through disruption.

FAQ

Frequently Asked Questions For Basel III (Banking Regulatory Framework)

It revises the standardized and internal ratings-based approaches for credit risk, the CVA risk framework, and operational risk, adds an output floor on risk-weighted assets, and finalizes the leverage ratio, including a G-SIB buffer. Its aim is to reduce excessive variability of risk-weighted assets.

Banks must calculate RWA as the higher of the total from the approaches they are approved to use and 72.5% of the total calculated with the standardized approaches. The transition started at 50% and, after the March 2020 deferral, reaches 72.5% on 1 January 2028.

The Basel Committee set 1 January 2022 and in March 2020 deferred implementation by one year to 1 January 2023. Jurisdictions adopt the standards through national rules, so effective dates for a given bank depend on its regulator.

It multiplies the Business Indicator, a financial-statement-based proxy for operational risk, by marginal coefficients of 12%, 15%, and 18% by bucket, then scales the result with an Internal Loss Multiplier based on the bank's average historical losses. It replaces all existing Basel II operational risk approaches.

Not directly. The Basel Committee does not have formal supranational authority, and its decisions do not have legal force. Its members commit to implement the standards, and each jurisdiction does so through its own laws and regulations.

Put this framework to work in SmartSuite

Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.