The European Union published Commission Delegated Regulation (EU) 2026/1167 in the Official Journal on September 3. The measure supplements the Capital Requirements Regulation with technical standards that specify operational-risk requirements, including the treatment of business-indicator components, operational-risk losses, and related calculations.

EUR-Lex lists September 23, 2026 as the date of effect. Specialist analysis from Regulation Tomorrow independently confirmed the publication and the twentieth-day entry-into-force calculation. The act was adopted on May 28; the in-window development is its official publication, not the original adoption decision.

The immediate audience is regulated banks and other institutions covered by the relevant capital rules. Risk, finance, audit, data, and compliance teams will need to connect definitions in the standard with the way operational events, losses, and business-indicator components are recorded and reviewed.

The development is also relevant to RegTech providers. A final technical rule can create demand for data mapping, loss-event workflows, audit trails, model governance, reporting controls, and implementation support. That opportunity is indirect: it does not mean every technology startup or general small business is regulated by the measure.

Implementation work should begin with scope and evidence. Institutions need to identify which data fields, calculations, controls, and ownership decisions the standard affects. Generic summaries cannot replace advice tailored to a regulated entity's facts, and this article does not provide institution-specific legal guidance.

For operators selling into financial institutions, the useful signal is specificity. Buyers will not need another broad operational-risk dashboard; they will need systems that can trace the required inputs, preserve a defensible audit path, and fit the institution's existing control environment before the effective date.

Decision file

Turn the briefing into a sharper operating question.

This analysis extends the article without extending its factual claims.

01

What is established

The article establishes that the European Union published Commission Delegated Regulation (EU) 2026/1167 on September 3, with an effective date of September 23, 2026. This measure supplements the Capital Requirements Regulation with technical standards specifying operational-risk requirements. These rules govern the treatment of business-indicator components, operational-risk losses, and related calculations for regulated banks and covered institutions. The publication in the Official Journal is the official development, separate from the act's original adoption on May 28. The measure directly affects regulated financial entities, not general small businesses or every technology startup.

02

Operator lens

For operators at regulated financial institutions, the immediate task is to review scope and evidence requirements. Risk, finance, audit, data, and compliance teams must connect the new standard's definitions to how they record and review operational events, losses, and business-indicator components. They need to identify which specific data fields, calculations, controls, and ownership decisions are affected before the September 23, 2026 effective date. For RegTech founders and vendors selling into these institutions, the key signal is specificity. Buyers require systems that can trace required inputs, maintain a defensible audit path, and integrate with existing control environments, rather than generic operational-risk dashboards. Operators should seek tailored advice rather than relying on generic summaries.

03

What remains uncertain

While the publication and effective dates are established, the specific implementation details for individual institutions remain dependent on their unique facts and existing control environments. It is uncertain exactly how regulated entities will adapt their specific data mapping, loss-event workflows, and audit trails to comply with the technical standards. Institutions and vendors must monitor how these rules are practically integrated into existing systems and whether additional, institution-specific legal or regulatory guidance will be necessary for full compliance.

Questions for the next decision

  1. How do the new technical standards alter our current definitions and calculations for operational-risk losses and business-indicator components?
  2. Which specific data fields, controls, and audit trails must be updated in our existing systems before the September 23, 2026 effective date?
  3. For RegTech vendors, how can our product specifically map data, manage loss-event workflows, and provide the defensible audit paths required by this regulation?

What to carry forward

Three operating takeaways

  1. Regulation 2026/1167 was published on September 3 and takes effect on September 23, 2026.
  2. The rules concern operational-risk calculations, business indicators, losses, and related controls.
  3. The measure directly affects regulated institutions and should not be generalized to every startup.

Source record

Reporting provenance

1

EUR-Lex
Commission Delegated Regulation (EU) 2026/1167
Official Journal dated September 3, 2026

2

Regulation Tomorrow
EU 2026/1167 operational-risk requirements
September 3, 2026

Published September 4, 2026 · Source event September 3, 2026