What is data governance in banking?

Data governance can be considered a subdiscipline of the broader practice of data management. Where data management covers the day-to-day operational work of acquiring, storing, protecting and processing data, data governance focuses specifically on the quality, security and availability of that data. Data governance sets out the specific rules and initiatives that guide management practices, often laying out metrics for success.

In late 2020, US regulators fined Citigroup USD 400 million. Yet the penalty had nothing to do with a rogue trader or a failed investment. It rather derived, at least in part, from deficiencies in how the bank managed its own data.

The Office of the Comptroller of the Currency (OCC) cited issues with risk management, internal controls and data governance. Among the offenses: Citibank couldn’t reliably aggregate its own risk data, nor could it demonstrate to stakeholders that it had the problem under control.¹ Just months before the 2020 censure, Citibank had erroneously transmitted USD 900 million dollars (to creditors of a Revlon loan), a mistake it attributed to human error.² The OCC, for its part, demanded of Citibank a “thorough redesign” of its data architecture and modernization of its IT infrastructure.

Citi’s case was unusual in scale but not in kind. A search of an OCC database shows that between 2023 and early 2026, it brought dozens of actions against banks for issues related to data governance, including compliance risk management, inaccurate records and IT issues.

Regulatory fines can be substantial. Across financial services in 2024, these fines reached a record USD 19.3 billion globally.³ Ultimately, the cost of noncompliance often extends beyond financial damages to reputational damages and loss of consumer trust.

Banks often begin with a data governance framework, which establishes several things: clear data ownership (who is responsible for each banking data dataset), data governance policies, safeguards around data quality and procedures for what to do when something goes wrong.

Because banking data maps to real banking operations (with people’s financial well-being at risk), the stakes are higher than in many industries. Data governance frameworks are therefore crucial for members of the banking industry.

Data lineage refers to the route that data takes: where it starts, how it moves and where it ends up. This information is important to regulatory reporting. 

Data classification refers to the practice of labeling data by sensitivity so the right controls apply. For instance, a Social Security number is handled much more cautiously than data on a branch’s total number of monthly visitors. 

Metadata management—essentially, maintaining data about data (like when it was uploaded and how it’s defined)—helps banks stay organized around their data.

Metadata, often organized in a dictionary-like data catalog, can help disambiguate what exactly is meant by a field labeled “customer” and whether that field can refer to individuals, firms or both.

The related but more general concept of data quality helps define (and measure) whether databases are accurate, complete and timely enough to be trusted.

The world’s financial system is a sprawling, interconnected international network. As such, many banks operate under overlapping, international regulatory requirements.

The Basel Committee on Banking Supervision (BCBS) describes itself as the primary global standard-setter for prudential bank regulation. It sits at the world’s oldest international banking institution (the Bank for International Settlements, founded in 1930). Its 45 members include the world’s major financial regulators, such as the US Federal Reserve, the European Central Bank and the Bank of Japan. 

A few years after the 2008 financial crisis, the BCBS issued its standard number 239 (BCBS 239)⁴, which squarely addresses data governance. The standard aimed to strengthen banks’ risk management through improved risk assessments, measurable data quality and risk data aggregation. Originally aimed at “global systemically important banks” (G-SIBs), then “domestic systemically important banks” (D-SIBs), the standard’s expectations have been adopted across the banking sector. A 2024 McKinsey report on BCBS cited a “renewed focus” on the standard and “growing pressure on banks to meet the expectations of local regulators”—of which the OCC’s Citibank fine is but one example.⁵

Layered on top of these international banking regulations are a mix of general and local data privacy and data security regulations (some banking-focused, others industry-agnostic). For instance, the EU’s sweeping General Data Protection Regulation (GDPR) requires banks (or indeed any firm) to know what personal data they hold, why they have it, how accurate it is and how they protect it.

In the US, some states have specific legislation pertaining to banks and data. In New York State, cybersecurity regulation (23 NYCRR Part 500)⁶ mandates that banks and insurance firms operating in New York implement strict security measures and risk assessments. The law also requires access controls, asset inventories with data ownership and classification, retention policies and incident response planning. 

Sometimes regional and sector-specific legislation intersect in complex ways. For instance, California’s Consumer Privacy Act (CCPA) broadly affects how firms doing business in the state handle personal data, including in ways that can affect some banks. At the same time, its application is limited. For instance, the statute exempts certain personal information already regulated by the 1999 federal Gramm-Leach-Bliley Act (GLBA).

In sum, compliant data governance in banking is subject to a complex latticework of regulations that apply to various jurisdictions (international, local) and data types (general customer data, financial data).

Despite over a decade of legislation on the matter, regulatory bodies have reported sluggish compliance and persistent data governance challenges. Increasingly, regulators are publishing lengthy, detailed guidance on how banks should prioritize and structure their reforms.

In 2024, for instance, the European Central Bank (ECB) put out a 20-page “Guide on effective risk data aggregation and risk reporting.”⁷ These and other guides go beyond abstract principles, extending to concrete guidance.

The ECB recommends beginning with a prioritization exercise. An effective data governance strategy focuses first on the most important data: risk reports, financial data disclosures and supervisory submissions. A robust data governance framework will aim to make sure that critical data elements have defined data owners, quality standards and controls.

Both BCBS and ECB underscore the importance of concretizing data ownership, mapping specifically who is accountable for a given dataset. Such roles are often embedded across business and IT functions. Many firms formalize this arrangement through data stewards, people in business units responsible for custodianship and data quality management (itself a broad concept comprising data accuracy, completeness and data integrity). Ultimately, the goal is for firms to have high-quality data to support informed decisions and better decision-making.

A 2026 newsletter from BCBS notes data lineage, which it defines as “the traceability of data from its origin to its final use,” as a persistently “challenging component” for banks. BCBS notes that “legacy systems, distributed data estates”—think data silos—“and the dynamic nature of data lineage complicate banks’ efforts to confirm end-to-end traceability.” But it insists on its importance and notes that data lineage has inherent business benefits, including cost reduction and improved efficiency.⁸

Controls tie everything together. Validation rules can catch errors before they propagate, while access controls can limit data access to authorized users, preventing unauthorized access. Data classification can ensure that sensitive information gets treated that way, while retention and lifecycle management policies can govern how long data is kept and when it’s securely disposed of. Finally, for the manual workflows that persist in banks, governance can put review processes and audit trails around them until automation replaces them, helping to streamline operations over time.

Two forces are shaping the future direction of data governance for banking.

The first is AI and the ecosystem around it. AI and machine learning are increasingly used across banking operations in everything from fraud detection to the scoring of customer experiences. In this environment, many governance failures are likely to surface not as data breaches or privacy harms, but as automated decisions that affect customers. It’s no surprise that the EU’s AI Act layers new requirements on top of existing data governance obligations for use cases involving “high-risk AI.”

The second force is the shift toward real-time data in digital banking. Data now moves faster than ever. As banks move toward faster payments, instant reporting and live risk monitoring, the traditional model of periodic batch processing and after-the-fact quality checks is no longer adequate for many competitive firms. Thus a forward-looking data strategy might include governance that validates data as it moves, not just after it lands—maintaining both compliance and operational efficiency.

It might be the case that the banks that treat governance as a reactive compliance exercise will continually spend on remediation. Alternatively, banks that invest in it as operational infrastructure might ultimately spend less, move faster and have an easier time adjusting to what comes next.