Banking

The capital rules changed in 2025, and the hardest parts arrive in 2027.

CRR3 has applied since January 2025, but the output floor is still climbing, market risk becomes binding on 1 January 2027, and the third-country branch regime applies from 11 January 2027.

The output floor stops internal models from producing less capital than a fixed share of the standardised calculation. It began at 50 per cent, sits at 55 for 2026, reaches 60 in 2027 and 72.5 by 2030. Because each step is small and announced well in advance, the work to meet the next one tends to be left late.

Market risk works differently. Banks have been calculating and reporting under the new framework since January 2025 without it binding, and from 1 January 2027 the results determine actual capital. The two years in between were meant for building and validating the systems, and most of that time has now gone. CRD6 separately requires ESG risk management plans with the management body overseeing the transition plan, and its third-country branch regime applies from 11 January 2027, with EBA guidelines on authorisation and capital endowment already final.

And the rules that apply to everyone

Underneath the prudential rules sits a second set that reaches every financial institution, and for a bank each one lands somewhere specific. The AI Act treats creditworthiness assessment as high-risk while expressly leaving fraud detection out, GDPR pulls against the retention and profiling that anti-money-laundering duties demand, DORA makes no allowance for size, and sustainability reporting draws on the same data as Pillar 3.

Where each banking rule sits in the change cycle

The third-country branch regime is still at analysis, because the first job is working out which branches are in scope and in which class. ESG risk management plans are at design, since the management body has to take ownership of a plan that has not been written yet. Market risk is at implementation against a fixed date, and the output floor is mostly a question of evidence: the standardised calculation now drives capital, so it has to hold up to the same scrutiny as the internal model.

Every regulatory change moves through the same regulatory change lifecycle. No matter where each rule sits, Helia can help your teams.

CRD6 third-country branches

Applies Jan 2027

Where the sector gets stuck

Scope comes first

Whether a branch is in scope, and which class it falls into, changes the answer entirely. That determination has to be made before anything can be designed, and it depends on activity rather than size.

AnalyseRequirements extracted article by article and mapped to service domains, affected departments and process owners, so scoping starts from where each requirement lands in the organisation. Regulatory Nexus

CRD6 ESG risk plans

Management body oversight

Where the sector gets stuck

A plan the board has to own

The management body oversees the transition plan and its milestones, so the plan has to hold up when the board questions it.

DesignAssess the existing governance and risk documents against the requirements, so the plan is built on what is actually missing. Impact Assessment

Market risk, FRTB

Binding 1 January 2027

Where the sector gets stuck

The parallel run ends

Two years were given to build and validate the systems. From January the reported numbers set capital, so they have to be defensible.

ImplementCompare the model documentation, validation policies and control descriptions against each other and against the requirements, so the inconsistencies surface before validation finds them. Impact Assessment

CRR3 output floor

55% now, 72.5% by 2030

Where the sector gets stuck

The standardised number now binds

The standardised calculation stops being a comparison and becomes the binding number for more of the book each year. It has to be evidenced to the same standard as the internal model.

EvidenceTrace each requirement to the control meant to satisfy it and surface the ones with nothing behind them, with the reasoning for each verdict on record. Risk & Control

Helia does the heavy lifting. You stay fully in control.

Helia reads regulatory text and pulls out what is actually being asked for. It takes the documents you already have, whether policies or procedures, and assesses them against those requirements. It maps your controls to the requirements they are meant to satisfy and shows where nothing covers them. And it keeps the trail intact, so any conclusion can be followed back to the wording it came from.

We built Helia for the stretch between reading a regulation and reporting on it, because that is where most of the effort in a regulatory change goes.

The judgement calls stay with you. Our senior practitioners, who have run this inside regulated institutions, take the first assessments with your team, so you see how conclusions are reached and hold the method afterwards.

Already live, and providing value today

RegAI Helia is already live in a number of large European financial institutions. From massive acceleration in interpreting regulatory requirements, through complex impact assessments run against your own internal artefacts, to speeding up the creation of regulatory data requirements, the Helia workbench provides value modularly, and it does so today.

Where the gain sits for you depends on what you already have, so the first conversation is about your current set-up.

The capital rules changed in 2025, and the hardest parts arrive in 2027.

And the rules that apply to everyone

Where each banking rule sits in the change cycle

CRD6 third-country branches

Scope comes first

CRD6 ESG risk plans

A plan the board has to own

Market risk, FRTB

The parallel run ends

CRR3 output floor

The standardised number now binds

Helia does the heavy lifting. You stay fully in control.

Already live, and providing value today

Wherever you are in the cycle, we can help