- ClassificationCategoryFinancial Services RegulationDomainFinancial Services RegulationFramework FamilyOther
- Regulatory ContextTypeRegulationLegal InstrumentFrameworkSectorFinancial SectorIndustryFinancial Services
- Region / PublisherRegionGlobalRegion DetailSwitzerlandPublisherBasel Committee on Banking Supervision (BCBS)
- VersioningVersionBasel III: Finalising post-crisis reforms (December 2017)Effective Date1 January 2023 (deferred from 1 January 2022); output floor phased in to 72.5% on 1 January 2028Issue Date7 December 2017
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityVery High
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
Basel III standards are published by the Basel Committee on Banking Supervision and are publicly available through the Bank for International Settlements.
Framework text is licensed by its publisher and is included only where stated above.
- The Basel III finalization package (BCBS, December 7, 2017) completes the Basel Committee's post-crisis revisions to the bank capital framework.
- It revises the credit risk, CVA, and operational risk approaches and adds an output floor on risk-weighted assets.
- Implementation was deferred to January 1, 2023, and the output floor phases in to 72.5% on January 1, 2028.
- The Committee has no supranational authority, so each jurisdiction adopts the rules through national law and may be more conservative.
- SmartSuite Compliance Management holds the standard's requirements and evidence, and Enterprise Risk Management holds operational risk, loss events, and key risk indicators.
Overview
Basel III: Finalising post-crisis reforms is the standard the Basel Committee on Banking Supervision (BCBS) published on 7 December 2017 to complete its post-crisis revisions to the bank capital framework. It revises the standardized and internal ratings-based approaches for credit risk, the credit valuation adjustment (CVA) framework, and operational risk, where a single standardized approach replaces all existing Basel II approaches. It also adds an output floor on risk-weighted assets and finalizes the leverage ratio, including a buffer for global systemically important banks (G-SIBs). Its key objective is to reduce excessive variability of risk-weighted assets (RWA).
The standard sets minimum requirements for internationally active banks, and the Basel Committee has no supranational authority: its decisions do not have legal force, so each jurisdiction adopts the rules through national law and may be more conservative. The Group of Central Bank Governors and Heads of Supervision (GHOS) endorsed the package on 7 December 2017. In March 2020 it deferred implementation by one year, from 1 January 2022 to 1 January 2023, and extended the output floor transition to 1 January 2028.
Banks implement it by recalculating RWA under the revised approaches, running the output floor comparison, applying the standardized operational risk approach, meeting the leverage ratio and the G-SIB buffer, and reporting under national rules. The standard has been integrated into the consolidated Basel Framework.
Why does it matter?
The package changes how risk-weighted assets are calculated, so the capital ratio a bank reports can change even when its business has not.
Key benefits include:
- Less RWA variability
More risk-sensitive standardized approaches for credit and operational risk, and constraints on internally modeled approaches, make banks' capital ratios more comparable.
- A capital floor
Banks calculate RWA as the higher of the total from their approved approaches and 72.5% of the total calculated only with standardized approaches.
- One operational risk method
A standardized approach based on the Business Indicator and the bank's loss history replaces all existing Basel II operational risk approaches.
- A non-risk-based backstop
The leverage ratio is finalized, and G-SIBs must also meet a leverage ratio buffer set at 50% of their higher-loss absorbency requirement.
- Flexible adoption
A jurisdiction that implements only the standardized approaches and not the internal models is still compliant with the Basel framework.
How does it work?
The standard has seven parts: an introduction, the standardized approach for credit risk, the internal ratings-based approach for credit risk, minimum capital requirements for CVA risk, minimum capital requirements for operational risk, the output floor, and the leverage ratio. Banks must hold Common Equity Tier 1 of at least 4.5%, Tier 1 of at least 6.0%, and total capital of at least 8.0% of RWA, plus a 2.5% capital conservation buffer.
The output floor applies to RWA: a bank's RWA are the maximum of the total from approaches it has supervisory approval to use and 72.5% of the total calculated with the standardized approaches. The 2017 transition rose from 50% in 2022 to 72.5% in 2027; the March 2020 deferral moves each step back one year, ending on 1 January 2028.
In SmartSuite, Compliance Management holds the standard's requirements with owners and evidence, Enterprise Risk Management tracks operational risk, loss events, and key risk indicators, and Enterprise Reporting supports supervisory reporting packs. SmartSuite does not calculate regulatory capital; it tracks the controls and evidence around those calculations.
Key Elements
- Standardized approach for credit risk
Banks may choose between this approach, which assigns standardized risk weights, and the internal ratings-based approach. In jurisdictions that allow external ratings, banks may start from assessments by recognized external credit assessment institutions.
- Internal ratings-based approach
Banks may use internal rating systems for credit risk with explicit supervisory approval. The revised framework constrains internally modeled approaches, and the 1.06 scaling factor on IRB credit risk RWA no longer applies.
- CVA risk
A revised minimum capital requirement for credit valuation adjustment risk, implemented on the same date as the credit risk revisions.
- Operational risk
The Business Indicator (interest, leases and dividend; services; and financial components) is multiplied by marginal coefficients of 12%, 15%, and 18% by size bucket to give the Business Indicator Component, then scaled by an Internal Loss Multiplier based on average historical losses. Operational risk includes legal risk and excludes strategic and reputational risk.
- Output floor
RWA may not fall below 72.5% of RWA calculated with the standardized approaches, phased in from 50% and now ending on 1 January 2028.
- Leverage ratio
A finalized leverage ratio with a revised exposure definition and, for G-SIBs, a buffer equal to 50% of the higher-loss absorbency requirement, met with Tier 1 capital.
- Implementation dates
Originally 1 January 2022 for the credit, IRB, CVA, operational risk, and leverage ratio revisions, deferred to 1 January 2023, with the output floor transition running to 1 January 2028.
What does it cover?
The standardized approach for operational risk applies to internationally active banks on a consolidated basis, and supervisors may apply it to other banks. More generally, the Basel framework sets minimum standards: jurisdictions may adopt more conservative requirements or earlier transitional dates. National regulators, not the Basel Committee, enforce the rules, so a bank's obligations depend on how its jurisdiction has implemented them.
What are its objectives?
The Committee worked from three overarching principles in finalizing the reforms.
Strengthen the regulation, supervision, and practices of banks worldwide to enhance financial stability.
Reduce excessive variability of risk-weighted assets and restore credibility in their calculation.
Enhance the risk sensitivity of the standardized approaches and constrain internally modeled approaches.
Complement the risk-weighted capital ratio with a finalized leverage ratio and a revised capital floor.
Avoid significantly increasing overall capital requirements.
Framework in Context
This page covers the December 2017 package. Earlier Basel III documents are separate publications: the capital framework of December 2010 (revised June 2011), the Liquidity Coverage Ratio (January 2013), and the net stable funding ratio (October 2014). The 2017 operational risk standard sits beside the BCBS Principles for the sound management of operational risk and the Principles for operational resilience, and banks commonly also map it to ISO 31000 and COSO ERM.
Common Framework Mappings
Banks that apply the 2017 package connect its operational risk and governance requirements to the standards below.
Mapped frameworks include:
BCBS PSMOR 2021
BCBS Operational Resilience Principles
COSO ERM 2017
ISO 31000:2018
How SmartSuite Supports Basel III
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management for the standard's requirements and evidence, and Enterprise Risk Management for operational risk, loss events, and key risk indicators.
Requirement library
Record the seven parts of the standard as requirements with owners, jurisdictional implementation status, and effective dates.
Implementation timeline
Track the deferred dates, the output floor phase-in, and the national rules that apply in each jurisdiction.
Operational risk loss data
Log operational loss events and key risk indicators in Enterprise Risk Management to support the loss history behind the Internal Loss Multiplier.
Model and calculation controls
Document the controls, reviews, and approvals around RWA, output floor, and leverage ratio calculations.
Internal audit and testing
Plan and record testing of the calculation processes and data, and track remediation to closure with Internal Audit Management.
Supervisory reporting
Use Enterprise Reporting to assemble status, open issues, and evidence for supervisors and the Board.
Related frameworks

DORA (Regulation (EU) 2022/2554) requires EU financial entities to manage ICT risk, report major incidents, test resilience and control ICT third-party risk, applying from January 17, 2025.

ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.

NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
Frequently Asked Questions For Basel III (Banking Regulatory Framework)
It revises the standardized and internal ratings-based approaches for credit risk, the CVA risk framework, and operational risk, adds an output floor on risk-weighted assets, and finalizes the leverage ratio, including a G-SIB buffer. Its aim is to reduce excessive variability of risk-weighted assets.
Banks must calculate RWA as the higher of the total from the approaches they are approved to use and 72.5% of the total calculated with the standardized approaches. The transition started at 50% and, after the March 2020 deferral, reaches 72.5% on 1 January 2028.
The Basel Committee set 1 January 2022 and in March 2020 deferred implementation by one year to 1 January 2023. Jurisdictions adopt the standards through national rules, so effective dates for a given bank depend on its regulator.
It multiplies the Business Indicator, a financial-statement-based proxy for operational risk, by marginal coefficients of 12%, 15%, and 18% by bucket, then scales the result with an Internal Loss Multiplier based on the bank's average historical losses. It replaces all existing Basel II operational risk approaches.
Not directly. The Basel Committee does not have formal supranational authority, and its decisions do not have legal force. Its members commit to implement the standards, and each jurisdiction does so through its own laws and regulations.

Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.


