On 26 August 2026 the EBA opened a consultation on draft RTS for the operational risk management framework under CRR3. Sixteen questions, a deadline of 31 December 2026, and one clause that decides how much of your DORA work counts. This is the framework for reading and answering them.
This covers a draft standard. EBA/CP/2026/18 is a consultation paper, open for responses until 31 December 2026 at 23:59, with a virtual public hearing on 29 September 2026. It is not in force and carries no application date. This framework is a working aid for reading and responding to it, not a compliance obligation.
What each question actually asks, the draft article it sits under, and why it matters to your institution. Six are marked High: they are the ones that decide what this standard costs you.
Eleven requirements of the draft, set against what a DORA programme already produces and what it does not reach, with columns to name your own artefact and its owner.
Six obligations change depending on which side of the business indicator threshold you sit on. They are laid out side by side, with the article behind each one.
Hearing registration, hearing date, response deadline and what happens after, so nothing is discovered a week too late.
Instant access. Work email required.
Five tabs, built from the consultation paper itself.
Prefer to score your position first? The free OpRisk RTS readiness check takes eight questions, and the full mapping article is the reference behind both.