Over the past few years, three major banks have paid nearly $1 billion in combined penalties — not for exotic trading losses or cyber breaches, but for fundamental failures in data visibility and risk management that proper mainframe data lineage could have prevented. Each of those failures traces back to the same standard: BCBS 239, the Basel Committee's rule requiring banks to prove where their risk numbers come from — accurately, completely, and on demand.
The financial services industry is learning an expensive lesson about the true cost of treating mainframe systems as "black boxes." With mainframes processing 70% of global financial transactions daily, 95% of credit card transactions, and 87% of ATM transactions, these aren't isolated incidents — they're wake-up calls for an industry that can no longer afford operational blindness in its most critical infrastructure.
What operational blindness has already cost
Three recent penalties show exactly what happens when risk data originates in systems no one can fully see into.
$348M
JPMorgan Chase
Trades left unmonitored across 30+ venues, 2014–2023.
$536M
Citibank
A decade of risk-data governance failures.
$2B+
Danske Bank
Ongoing BCBS 239–related compliance failures.
2 of 31
Fully BCBS 239 compliant
Of 31 global systemically important banks.
JPMorgan's $348M wake-up call
In March 2024, JPMorgan Chase paid $348 million in penalties for a decade-long failure that left billions of transactions unmonitored across 30+ global trading venues. The US Federal Reserve and Office of the Comptroller of the Currency found that certain trading and order data through the CIB wasn't feeding into its trade surveillance platforms between 2014 and 2023 — a systematic breakdown of the market-conduct risk controls required under US banking regulations.
JPMorgan, like 92 of the world's top 100 banks, relies heavily on mainframe systems for core trading operations. These IBM Z systems process the vast majority of transaction volume, but the critical problem emerges when trading data originates on the mainframe and feeds downstream surveillance platforms. Without comprehensive data lineage, the gaps create dangerous blind spots where billions in transactions can slip through unmonitored. The penalty is a reminder that regulators now expect complete transparency in data flows: you can't manage what you can't see.
Citi's $536M governance breakdown
Citibank's lesson was even costlier. In October 2020, Citi received a $400M penalty from the OCC, followed by an additional $136M in combined fines in 2024 from both the OCC and the Federal Reserve — $536M in total for failures in data governance and risk data aggregation that regulators called "longstanding" and "widespread." The OCC found that Citi had failed to establish effective risk data aggregation processes, develop comprehensive data governance plans, produce timely regulatory reporting, and adequately report data quality status. Some issues dated back to 2013 — nearly a decade of compromised data visibility.
Like virtually all major banks, Citi runs core banking operations on mainframes where critical risk data originates. Every loan, trade, and customer transaction flows through those platforms before being aggregated into the enterprise risk reports regulators require. When the mainframe is treated as a black box, those data flows stay opaque to downstream risk systems — exactly the visibility gap that comprehensive mainframe data lineage closes.
Danske Bank's $2B+ problem
The pattern culminates with Danske Bank, whose compliance struggles have driven more than $2 billion in penalties since 2020. While these stemmed from various violations, many could likely have been exposed earlier through proper BCBS 239 compliance — the bank's transaction-monitoring failures and AML deficiencies represent clear gaps in the comprehensive risk data aggregation the standard requires.
And BCBS 239 remains banking's most persistent regulatory challenge. Nearly 11 years after publication and 9 years past its deadline, the November 2023 progress report revealed a sobering reality: only 2 of 31 global systemically important banks achieved full compliance, and not a single principle has been fully implemented across all assessed banks. The ECB has since made BCBS 239 deficiencies a top supervisory priority for 2025–2027, explicitly warning that non-compliance could trigger enforcement actions, capital add-ons, and the removal of responsible executives. With regulatory patience exhausted, the consequences are no longer just financial — they're existential. This is why banks can no longer ignore BCBS 239 data lineage requirements.
The mainframe blind spot
Most BCBS 239 discussions miss a critical point: the majority of banks' risk data originates on the mainframe systems that run core banking operations and risk calculations. As the Basel Committee's own assessment put it, "several banks still lack complete data lineage, which complicates their ability to harmonize systems and detect data defects."
With mainframes handling 83% of all global banking transactions, understanding these systems is no longer optional. Yet banks keep struggling for the same three reasons: decades-old COBOL programs lack documentation and follow patterns that traditional lineage tools can't interpret; data flows through complex JCL jobs, VSAM files, and DB2 operations stay invisible to downstream risk systems; and business analysts can't access or understand mainframe data flows without deep technical expertise. The logic is buried, and the people who wrote it are gone.
How mainframe data lineage solves the BCBS 239 crisis
The fix is comprehensive mainframe data lineage that closes those blind spots directly:
- Complete visibility — trace data flows from mainframe CICS transactions through DB2 operations to downstream systems, mapping exactly how critical risk data moves through the transformations conventional tools miss.
- Business accessibility — let business analysts discover and act on mainframe information without deep technical expertise, turning lineage from technical obscurity into actionable intelligence.
- Automated monitoring — track mainframe batch processes in real time to catch when critical risk calculations fail or drift, before they become the systematic failures that cost JPMorgan, Citi, and Danske billions.
- Regulatory preparedness — trace exactly where specific data resides within the mainframe environment and extract it rapidly when regulators demand it: the core capability BCBS 239 requires.
The path forward
After a decade of BCBS 239 struggles and nearly $1 billion in recent penalties, it's clear the traditional approaches aren't working — the banks still wrestling with data aggregation are the ones that never invested in understanding their mainframe data flows. With the ECB intensifying enforcement and supervisory patience exhausted, mainframe data lineage isn't just modernization; it's regulatory survival infrastructure.
The choice is straightforward: illuminate your mainframe data flows, or keep paying the billion-dollar cost of operational blindness. With regulators expecting rapid and recurring risk data aggregation, banks can no longer afford to manage what they cannot see. The path forward starts with understanding what you can't currently see — before regulators demand answers you can't provide. The first test is simple: can your bank actually prove BCBS 239 compliance right now?
Frequently Asked Questions
What is BCBS 239? BCBS 239 is the Basel Committee on Banking Supervision's standard—formally the "Principles for effective risk data aggregation and risk reporting." It requires banks to aggregate risk data accurately and completely, and to prove where every risk number comes from, on demand.
What does BCBS 239 require? At its core, BCBS 239 requires banks to demonstrate the accuracy, completeness, and timeliness of their risk data—with governance and data lineage strong enough to trace any figure back to its source and defend it to regulators.
Why do banks struggle to comply with BCBS 239? Because most risk data originates in mainframe systems running decades-old COBOL that no current team fully understands. Without visibility into those data flows, banks can't prove lineage—which is why only 2 of 31 global systemically important banks have reported full compliance.
How does data lineage help with BCBS 239 compliance? Data lineage traces risk data from its mainframe origin through every transformation to the reports regulators see. It's the capability BCBS 239 effectively demands: proof of where a number came from and what happened to it along the way.
What is risk data aggregation? Risk data aggregation is the process of collecting and consolidating a bank's risk data across systems to produce accurate, complete risk reports. BCBS 239 sets the standard for doing it reliably—and data lineage is what makes it defensible.