ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
A Basel III compliance checklist is a structured list of the requirements a bank must meet on capital, liquidity, leverage, risk management and disclosure under the Basel III framework, together with the evidence that shows each one is in place. It helps risk, finance and compliance teams see what is done and what is still open.
Basel III is an international framework published by the Basel Committee on Banking Supervision. It is not law by itself. Each jurisdiction implements it through its own rules, with its own dates, thresholds and scope, so your regulator’s text is the authority for your institution.
This guide uses the Committee’s minimum standards as reference points. Always check national implementation, including any transitional arrangements and proportionality rules that apply to smaller banks.
A useful checklist follows the structure of the framework. It starts with capital: the quantity and quality of capital against risk-weighted assets. It continues with buffers, leverage, liquidity, internal assessment processes, supervisory review and disclosure. Governance and data sit underneath all of them.
The overview in Basel III explains the framework in context, while financial services compliance covers how these rules sit alongside other obligations.
For each requirement, the checklist should record the rule, the owner, the frequency, the source data, the evidence and the status. That turns a legal text into an operating routine. The Committee publishes the standards at Basel Committee Basel III page.
The framework sets minimum ratios: common equity Tier 1 of 4.5 percent of risk-weighted assets, Tier 1 of 6 percent and total capital of 8 percent. On top of these, banks must hold a capital conservation buffer of 2.5 percent in CET1. Jurisdictions may add a countercyclical buffer, and systemically important banks face additional surcharges.
Check that your capital instruments meet the eligibility criteria, that deductions and filters are applied correctly and that the calculation reconciles to the accounts. Also check the risk-weighted asset inputs: exposure classes, risk weights, credit risk mitigation and the treatment of off-balance-sheet items.
Keep a buffer monitoring routine. See capital buffers for how buffers work and what restrictions apply when a buffer is used, such as limits on distributions.
| Area | Headline minimum (Basel framework) | Typical evidence |
|---|---|---|
| CET1 capital | 4.5% of risk-weighted assets | Capital report, RWA calculation |
| Tier 1 and total capital | 6% and 8% of RWA | Regulatory returns |
| Capital conservation buffer | 2.5% of RWA (CET1) | Buffer monitoring report |
| Leverage ratio | 3% minimum Tier 1 to exposure | Leverage calculation |
| LCR | 100% (HQLA to 30-day net outflows) | Daily or monthly LCR report |
| NSFR | 100% (available to required stable funding) | Quarterly NSFR report |
The leverage ratio is a simple, non-risk-based backstop: Tier 1 capital divided by total exposure, with a minimum of 3 percent in the Basel framework. Check that the exposure measure includes the right components, such as derivatives, securities financing transactions and off-balance-sheet items. See Basel III leverage ratio.
The finalized framework replaces earlier operational risk approaches with a standardized approach based on a business indicator and a loss component. The details are covered in Basel III operational risk standardised approach. Check that loss data collection is complete, because jurisdictions treat the loss component differently.
Note that national implementation of the final reforms varies in timing and detail, so confirm the status in your jurisdiction. Discussion of the so-called endgame proposals is in Basel III endgame.
Two ratios anchor the liquidity framework. The liquidity coverage ratio requires enough high-quality liquid assets to cover net cash outflows over 30 days of stress, with a minimum of 100 percent. The net stable funding ratio requires available stable funding to be at least equal to the required amount over a one-year horizon, also at 100 percent.
Check asset eligibility, haircuts, outflow and inflow assumptions, operational deposit classifications and encumbrance. Reconcile the ratios to the general ledger and document every assumption. The difference between the two ratios is explained in LCR vs NSFR.
Add monitoring tools as well: concentration of funding, intraday liquidity and contingency funding plans. Regulators expect these to be tested and approved by management.
Pillar 2 expects banks to assess whether their capital and liquidity are adequate for their own risk profile, beyond the minimum ratios. The internal capital adequacy assessment process is described in ICAAP, and the internal liquidity adequacy assessment process is in ILAAP.
Check that each document covers governance, risk identification, stress testing, capital and liquidity planning, and the link to the risk appetite and business plan. It should be approved by the board and updated at least annually, or sooner when conditions change.
Keep the documents consistent. Supervisors compare the ICAAP, ILAAP, recovery plan and strategic plan, and they notice contradictions about growth, funding and risk appetite.
Pillar 3 requires banks to publish information on capital, risk exposures and risk management practices, so that market participants can assess the institution. See Pillar 3 disclosure for the content and frequency.
Build a disclosure calendar with owners, sources and review steps. Include cross-checks between disclosures, regulatory returns and the financial statements. Inconsistencies are a common cause of supervisory questions.
Keep a version history and sign-off record. Disclosure errors can carry reputational and regulatory consequences, so review before release is a control in its own right.
Basel compliance depends on data. Check that there is a data lineage from source systems to reports, reconciliation controls, clear ownership of each data element and documented methodologies. Risk data aggregation and reporting principles are a good benchmark.
Check governance: board and committee oversight, a three lines of defense structure, independent validation of models and regular internal audit coverage of the regulatory reporting chain.
Finally, test the plan. Run stress scenarios on capital and liquidity, review results with management and record actions. A plan that has never been challenged is easier to break than one that has.
A small bank reviews its position quarterly. The checklist shows CET1 at 12 percent against a 7 percent requirement including the conservation buffer, leverage at 7 percent against 3 percent and an LCR of 140 percent. All are comfortable. However, the check on liquidity data shows that two deposit categories are classified by hand, which creates a control gap.
The team assigns an owner to automate the classification, adds a monthly reconciliation and notes the change in the ILAAP. The numbers are illustrative only, but the lesson is general: comfortable ratios do not remove the need for reliable data and clear ownership, which is what a Basel III compliance checklist records.
Repeat the process each reporting cycle and track open items until they are closed.
The most frequent mistake is treating the ratios as the whole story. A bank can meet every minimum and still have weak data, unclear ownership or stale assumptions, and supervisors look at all of those. Another mistake is copying the framework text without adding national rules. The Basel standards are the reference, but your regulator’s version governs, and differences in scope, thresholds and timing are common.
A third mistake is leaving the checklist with one team. Capital, liquidity and disclosure touch finance, treasury, risk, compliance and IT, so each line needs a named owner and a reviewer from a different function. A fourth is ignoring proportionality: smaller banks may benefit from simplified rules, and using the full framework everywhere wastes effort. Finally, avoid a one-off review. A Basel III compliance checklist should be refreshed each time rules, products or business plans change.
Assign a regulatory change owner who monitors the Committee, your regulator and industry bodies for updates, logs each change and assesses its impact. Put upcoming effective dates on a calendar that finance and risk can both see.
Review the checklist after every supervisory letter, audit finding or internal incident. Report the number of open items, overdue items and high-risk items to the risk committee each quarter, so the board sees progress and can push resources where they are needed.
Turning the framework into governance documents, calculation workbooks and report templates takes significant effort. A prepared set of templates gives you a structure that your risk and finance teams can adapt.
The Basel III Toolkit provides 25 Microsoft Office templates covering governance and risk appetite, capital management, RWA calculation, credit, market and operational risk, IRRBB, liquidity, leverage, ICAAP, ILAAP and stress testing. Use it alongside your regulator’s rules, which always take precedence.
Start by mapping each template to the requirement it supports and assigning an owner, then review the result with compliance.
The framework sets CET1 at 4.5 percent, Tier 1 at 6 percent and total capital at 8 percent of risk-weighted assets, plus a 2.5 percent capital conservation buffer.
The liquidity coverage ratio and the net stable funding ratio must each be at least 100 percent under the framework.
No. It is an international standard that national regulators implement through their own laws and rules, so dates and details vary.
The framework sets a 3 percent minimum Tier 1 leverage ratio, with additional requirements for some global systemically important banks.
They are internal processes through which a bank assesses whether its own capital and liquidity are adequate for its risk profile.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026