Introduction
For banks, data quality is not simply a technology concern. It directly affects risk decisions, regulatory reporting, financial controls and the reliability of artificial intelligence.
A bank may hold customer information across core banking systems, risk platforms, payment applications and analytics environments. Each system serves a purpose, but differences in definitions, data quality and ownership can create inconsistent results. A customer exposure reported by one function may not reconcile with another. A data defect may surface during regulatory reporting rather than when the information first enters the bank.
Banking data governance addresses these challenges by establishing clear decision rights, accountable ownership, consistent data definitions and controls that keep information accurate, complete, timely and traceable. Its value lies not only in meeting supervisory expectations, but also in giving the bank confidence in the information it uses to manage risk and make decisions.
The challenge is expanding as banks adopt AI. Data that supports a regulatory report may also feed a fraud detection model, a customer analytics application or an automated decision workflow. Each use creates additional requirements around provenance, privacy, quality and permitted use.
Banks therefore need to treat governance as an operational capability that connects data management, risk oversight and AI adoption. Edgematics approaches this through the combination of data strategy, engineering, governance and orchestration, helping banks move from governance policies to controls that operate across the data lifecycle.
TL;DR
-
Banking data governance connects ownership, quality, lineage and accountability across risk, reporting and AI.
-
BCBS 239 and the ECB’s RDARR guidance provide important reference points for risk data aggregation, reporting quality and governance evidence.
-
Banks need clear definitions and traceability for critical data elements, particularly those used across multiple reports, risk models and business functions.
-
Data quality indicators are most useful when banks connect them to root cause analysis, remediation ownership and measurable deadlines.
-
AI introduces additional governance needs around training, testing and production data, model oversight and third-party dependencies.
-
Edgematics helps banks operationalize governance through Data Engineering & Governance, Data Strategy and unified data orchestration.
What Banking Data Governance Must Cover
Banking data governance defines the decision rights, responsibilities and controls that ensure data remains fit for purpose throughout its lifecycle. The scope must extend beyond regulatory reports to cover the underlying information used in risk management, customer operations, financial reporting and AI.
That distinction matters because the same data element may support several business functions, each with different obligations.
Consider a customer record. The bank may use it for credit reporting, fraud detection, customer service and regulatory compliance. A change to that record can affect multiple downstream systems. If one function updates the information while another continues to use a stale copy, the bank may encounter inconsistent decisions or reporting discrepancies.
A governance framework must therefore establish what the data means, who owns it, where it originates, how it changes and which controls apply to its use.
Risk and Regulatory Reporting
Risk data supports capital calculations, liquidity assessments, exposure monitoring and internal management reporting. Banks need to aggregate that information accurately across business lines, legal entities and source systems.
Governance should make it possible to trace material reporting figures back to their source data and underlying calculations. When a figure changes, teams need to understand why and determine whether the change reflects a legitimate business event or a data defect.
Customer and Transaction Data
Customer records, payment data and transaction histories often support multiple downstream functions. Banks must account for privacy, access restrictions, retention requirements and the business impact of inaccurate or incomplete information.
Clear data ownership and lineage help teams manage these responsibilities without creating separate, inconsistent controls for every application.
Data Used in AI
AI introduces a further requirement: banks must understand whether information is appropriate for a specific model or automated workflow.
Data that was acceptable for a historical regulatory report may not be suitable for training a model if it contains bias, outdated information or gaps that distort model behaviour. Governance must therefore consider intended use, not just the original classification of the data.
BCBS 239 and RDARR: Turning Supervisory Expectations Into Evidence
Banking data governance needs to produce evidence that risk and compliance teams can review, senior management can act on and supervisors can assess.
Two important reference points are the Basel Committee’s BCBS 239 principles and the European Central Bank’s Guide on effective risk data aggregation and risk reporting.
BCBS 239 sets out principles for effective risk data aggregation and internal risk reporting, including governance, data architecture, accuracy, completeness and timeliness. It initially targeted systemically important banks, and supervisors may apply the principles more broadly in a proportionate way depending on the institution and jurisdiction. The Basel Committee’s more recent implementation update also highlights continuing challenges involving governance, lineage, cross-border operations and emerging technologies.
The ECB’s RDARR guidance provides additional detail for institutions within its supervisory remit. It emphasizes clear accountability, an integrated data taxonomy and metadata repository, measurable data quality requirements and structured remediation of identified issues. Governance reporting should demonstrate what the bank has assessed, which deficiencies remain unresolved and how management oversees the response.
For a bank, these expectations translate into tangible deliverables:
-
An inventory of critical data elements and the material reports or risk processes they support.
-
Lineage maps connecting those elements to source systems, transformations and final outputs.
-
Defined ownership and approval responsibilities for important data decisions.
-
Data quality indicators with thresholds, evidence and accountable remediation owners.
-
Issue registers that record root causes, deadlines, status and unresolved risks.
-
Management reporting that presents progress and outstanding issues clearly.
A policy document cannot demonstrate that these controls work. Banks need operational records that show how data quality problems emerge, who owns them and whether remediation actually resolves them.
Critical Data Elements: Where Governance Becomes Specific
A governance program gains practical value when it identifies the data elements that materially affect risk, reporting and business decisions.
These critical data elements (CDEs) may include customer identifiers, exposure values, collateral information, credit classifications, transaction attributes and other fields used in material calculations or reports.
The bank needs to define each element consistently across functions. For example, if risk and finance use different definitions of customer exposure, even accurate source records can produce inconsistent results.
A business glossary should describe the meaning of each critical element, while a metadata repository connects that definition to its source systems, transformations, owners and downstream uses.
This makes lineage meaningful rather than purely technical. A reviewer should be able to trace a reported risk figure through its calculation and aggregation steps instead of relying on manual investigation or undocumented knowledge.
Edgematics’ Data Engineering & Governance practice addresses this connection between data definitions, lineage, quality controls and operational implementation.
One Data Element, Multiple Obligations
Critical data often crosses organizational boundaries. A customer identifier may support onboarding, transaction monitoring, credit risk and AI driven fraud detection.
Each use can create different requirements around accuracy, consent, access and retention. Governance needs to track those obligations across the shared data lifecycle rather than leaving each team to maintain an isolated interpretation.
This approach also helps banks understand the consequences of change. When a source system modifies a field, the bank can assess which reports, models and business processes depend on it before the change creates a downstream problem.
Data Quality Indicators Must Lead to Remediation
Banks need measurable evidence that their data governance controls are working. Data quality indicators (DQIs) provide one way to assess whether critical information meets defined requirements.
The challenge is to avoid treating quality scores as the end result. A dashboard can reveal a problem, but the bank still needs to identify its cause, assign responsibility and resolve it.
Accuracy and Completeness
Accuracy assesses whether data reflects the relevant reality or meets a validated reference. Completeness checks whether required information is present.
For a credit risk report, a missing exposure value or an incorrect customer classification may affect the bank’s view of its risk position. The bank should define thresholds according to the data element’s materiality and intended use.
Timeliness and Freshness
Timeliness measures whether data reaches the required process within its reporting or decision window. Freshness indicates how recently the information was updated.
A dataset can be accurate when created but unsuitable for a particular decision if it has become stale. Banks need to align these measures with business requirements rather than applying one universal target to every dataset.
Remediation Performance
Remediation metrics show whether the organization resolves known defects.
Banks should track adherence to remediation deadlines, the age of open issues, recurring root causes and the number of unresolved high priority defects. These indicators reveal whether the governance program is improving the underlying data or simply accumulating findings.
The ECB’s supervisory quality reporting provides a useful reference for examining failed validation rules and reporting timeliness. Banks can supplement such measures with their own trends across material data elements and business domains.
A useful management report should show direction, not just a snapshot. If the same defects repeatedly reappear, the bank needs to address the upstream process rather than continue correcting individual outputs.
From Data Governance to AI Governance in Banking
The connection between banking data governance and AI governance is becoming more direct.
AI systems rely on the information they consume, but different stages of the model lifecycle create different data requirements. Training data establishes what the model learns. Testing data helps assess performance and limitations. Production data influences outputs and operational decisions.
Banks should govern these stages separately while preserving traceability across them.
Training datasets need documented provenance, appropriate permissions and checks for material quality issues or bias. Testing data needs enough independence and coverage to support credible evaluation. Production workflows need controls for access, freshness, monitoring and the handling of sensitive information.
Banks must also oversee the vendors that supply AI models, data processing and related services. Outsourcing does not remove the institution’s responsibility for managing the associated risks.
On 15 October 2026, the Financial Stability Board published its final Sound Practices for Responsible Adoption of Artificial Intelligence. The 12 practices cover organization-wide AI governance and risk management throughout the AI lifecycle, including data governance, evaluation, human oversight, cyber risk and third-party dependencies.
For banks, this reinforces the need to connect established data governance controls with AI specific risk management. A bank that can trace a regulatory report to its source data should build comparable visibility into the data that supports an AI model or automated decision.
Edgematics explores this wider relationship through its layers of data governance perspective, connecting governance with quality, automation and trusted AI adoption.
The Banking Data Governance Operating Model
Strong governance requires clear decision rights, not simply a central team responsible for every data issue.
A useful operating model combines central standards with accountability within the business domains that create and use the data.
The board and senior management retain oversight of the governance framework and the risks associated with data quality and reporting. Where supervisory expectations require management-body approval, the supporting evidence needs to reach the right decision makers.
Business data owners remain accountable for the definitions, quality requirements and appropriate use of data in their domains.
Data stewards support consistent definitions, metadata, issue management and adherence to governance policies.
Technology and data custodians implement the controls through systems, pipelines, access policies, lineage and data quality monitoring.
Risk and compliance functions challenge the approach, monitor material concerns and oversee exceptions.
Internal audit independently assesses whether the controls operate as intended.
This structure resembles a three-lines-of-defence model adapted to data. The precise responsibilities should reflect the bank’s existing governance framework and supervisory requirements.
A central data office can establish standards and maintain an enterprise view, while federated stewards bring domain knowledge closer to the data. Many complex organizations need both: central consistency and local accountability.
The model must also connect governance findings with funding. If teams identify defects but nobody owns or budgets to fix them, the program documents risk without reducing it.
Why Banking Data Governance Programs Often Struggle
Most governance challenges do not come from a lack of frameworks. They arise when ownership, evidence and operational responsibility fail to connect.
Catalogues Without Remediation
An integrated catalogue may reveal missing metadata, inconsistent definitions or quality defects. However, discovery alone does not improve data quality.
Banks need an issue management process that assigns root causes, owners, priorities and deadlines. Funding for remediation should accompany the inventory work rather than depend on a separate, uncertain budget.
Conflicting Definitions Across Functions
Risk, finance, compliance and business teams may use different interpretations of the same data element. Without a shared taxonomy and business glossary, the bank can generate inconsistent calculations even when the underlying technology functions correctly.
Lineage That Stops Too Early
A technical lineage map that cannot connect a reported figure to its business definition and accountable owner offers only partial evidence. Banks need lineage that supports both technical investigation and supervisory review.
AI Governance That Sits Apart From Data Governance
When AI teams build separate controls without using existing data ownership, quality and lineage capabilities, the bank creates another governance structure to maintain.
A connected model allows AI governance to reuse trusted metadata and data controls while adding model specific assessments, human oversight and vendor risk management.
How Edgematics Helps Banks Operationalize Data Governance
For Edgematics, banking data governance connects strategy, implementation and operational accountability.
A successful engagement begins by identifying material reporting or risk use cases, critical data elements, ownership gaps and the evidence required to demonstrate control. It then connects those findings with the governance structures and technical mechanisms that the bank can operate consistently.
The Data Strategy practice helps establish priorities, ownership models and governance objectives linked to business outcomes.
The Data Engineering & Governance practice supports metadata management, lineage, data quality, integration and compliance controls that make those objectives operational.
PurpleCube AI supports unified data orchestration across heterogeneous environments, helping banks coordinate data workflows and connect lineage and quality controls across systems. This is particularly relevant when material reports depend on multiple source platforms and transformation processes.
Edgematics’ work also connects governance with organizational accountability. Its Data Governance Centre of Excellence engagement for a leading Pan-American bank provides a relevant example of governance capability in a regulated banking environment.
For banks assessing where to focus their efforts, the Data & AI Maturity Assessment offers a starting point for identifying gaps in data governance and AI readiness.
The goal is not to create another governance layer detached from the bank’s existing processes. It is to make governance a working capability that connects data quality, regulatory evidence, accountable ownership and responsible AI adoption.
What Banking Leaders Should Measure
Banking data governance should produce evidence that helps management make decisions.
Leaders should review whether critical data elements have clear owners, whether material reports have traceable lineage, whether data quality thresholds remain within tolerance and whether remediation teams resolve defects within agreed deadlines.
They should also monitor recurring issues, unresolved high risk findings and differences between source data and final reporting outputs.
For AI initiatives, the same review should examine training and production data provenance, quality assessment, model monitoring and third-party dependencies.
The point is to move beyond reporting the number of policies written or assets catalogued. Effective governance demonstrates that the bank can identify data risk, understand its causes, assign responsibility and verify that corrective action works.
Conclusion
Banking data governance is no longer just a regulatory responsibility. It is a critical capability for sound risk management, reliable reporting and responsible AI adoption.
BCBS 239 and the ECB’s RDARR guidance provide important reference points for governance, risk data aggregation and quality evidence. But the bank still needs to translate those expectations into clear data ownership, consistent definitions, traceable lineage, measurable quality controls and funded remediation.
AI raises the stakes by extending the use of banking data into model training, automated decisions and intelligent workflows. Banks therefore need governance that follows information throughout its lifecycle and connects traditional data controls with AI specific risk management.
Edgematics helps banks make that connection through data strategy, engineering, governance and orchestration. The objective is straightforward: build trust in the data so risk decisions, regulatory reports and AI systems have a more reliable basis for action.
Frequently Asked Questions
What is banking data governance?
Banking data governance is the framework of decision rights, accountability and controls that ensures data remains suitable for risk management, regulatory reporting, business operations and AI. It covers ownership, quality, lineage, access and the evidence needed to demonstrate control.
What is BCBS 239, and why does it matter?
BCBS 239 sets out principles for effective risk data aggregation and internal risk reporting. It emphasizes governance, accurate and complete risk data, timely reporting and the ability to aggregate information across the banking organization. Its application depends on the relevant supervisory framework.
What is RDARR in banking?
Risk Data Aggregation and Risk Reporting (RDARR) concerns how banks collect, aggregate and report risk information. The ECB’s guidance provides expectations for institutions under its supervisory remit, including governance accountability, data quality requirements, metadata and remediation.
What are the key pillars of banking data governance?
Common components include an integrated taxonomy and metadata repository, named data owners and stewards, lineage, data quality rules and monitoring, and policies covering privacy, access, retention and model data governance.
How does AI change banking data governance?
AI requires banks to consider the suitability and provenance of training, testing and production data separately. It also adds requirements around bias checks, model evaluation, human oversight, third-party providers and the governance of automated actions.
How can banks demonstrate that data governance is working?
Banks can maintain a signed management report where required, data quality indicator trends, lineage records for material reports, and remediation registers with documented root causes, owners and deadlines. Supervisory evidence should demonstrate how the controls operate rather than merely state that policies exist.
How does Edgematics support banking data governance?
Edgematics combines Data Strategy with Data Engineering & Governance to help banks define ownership, strengthen lineage and data quality, and connect governance objectives with operational controls. PurpleCube AI supports unified orchestration across data environments, while governance assessments help identify priority gaps.
Build Trust in Your Banking Data
Banks need more than accurate reports. They need data that remains traceable, accountable and fit for purpose across risk management, compliance and AI.
Book a Discovery Call with Edgematics to assess your data governance capabilities and identify how stronger ownership, quality, lineage and orchestration can support reliable banking decisions.
