Regulatory Proportionality and the Small Bank Data Challenge
Proportionality tells you how much machinery to build; it never tells you which questions you are excused from answering — and a small bank is excused from none of them.
The Comfortable Misreading of Proportionality
There is a sentence I have heard in small banks more times than I can count, usually offered with some relief: “We’re a Level 3 firm — proportionality applies to us.” It is true, and it is also the beginning of a serious misunderstanding. The relief in the sentence betrays what the speaker thinks proportionality means: less. Less reporting, less governance, less data machinery, a lighter version of what the large banks endure. That reading is comfortable, common, and wrong, and building a data programme on top of it is how small and specialist firms end up, some months later, in an uncomfortable conversation with the PRA or the FCA about why proportionate did not mean what they hoped.
This is a Perspective on a single point that the smaller end of the industry consistently gets wrong. Proportionality is a design principle, not a discount. It governs how much apparatus you build to answer the regulator’s questions. It does not shorten the list of questions. A small bank classified as a Level 3 or Small CRR firm faces the same obligations in principle — sound data governance, reliable risk reporting, defensible compliance — as an institution many times its size. What changes is the scale and complexity of the machinery that is reasonable to build in order to meet them. The obligation is constant; only the engineering is proportionate.
Same Questions, Different Machinery
Consider what the regulator is actually asking of any deposit-taker, large or small. Can you identify and aggregate your risk exposures accurately and in reasonable time? Do you know the provenance and quality of the data feeding your regulatory returns? Can you demonstrate that the numbers you report are governed — that someone owns them, that errors are caught, that the figures can be reconstructed and defended? Is your compliance monitoring grounded in data you can actually trust?
Not one of those questions disappears because a firm is small. A small bank still reports capital and liquidity. It still has exposures to aggregate, returns to substantiate, and conduct to monitor. The regulator’s underlying concern — that the firm genuinely understands its own position and can prove it — is scale-invariant. What proportionality legitimately changes is the answer to a different question: given our size and the complexity of our business, how elaborate must the apparatus be that produces these answers?
Proportionality tells you how much machinery to build; it never tells you which questions you are excused from answering — and a small bank is excused from none of them.
A global institution running dozens of business lines across many jurisdictions may need an industrial data architecture — dedicated aggregation platforms, formal data lineage tooling, large stewardship functions — to answer those questions with confidence. A small bank running a focused book does not, and would be foolish to try. But the small bank must still answer them. The task is not to scale the large bank’s apparatus down until it fits the budget. It is to design, from the firm’s own scale upward, the lightest apparatus that genuinely answers the questions. Those are different exercises that happen to arrive in the same territory, and the difference in starting point matters enormously.
The Two Failure Modes
Small banks tend to fail this challenge in one of two directions, and the practitioner’s job is to steer between them.
The first failure is doing too little, and it follows directly from the comfortable misreading. The firm treats proportionality as permission and builds a data capability that is genuinely inadequate — spreadsheets standing in for governed processes, no clear ownership of critical figures, returns assembled heroically each quarter by one or two people who hold the logic in their heads. It survives while nothing goes wrong and while those people stay. Then a figure is challenged, or a person leaves, or the regulator asks the firm to reconstruct how a number was produced, and the absence of real capability is exposed all at once. The firm was not being proportionate. It was under-built, and called it proportionate.
The second failure is subtler and, in my experience, more common among firms that take the obligation seriously. Frightened of the first failure, the firm over-engineers. It looks at what large institutions do, assumes that is the standard of seriousness, and imports apparatus wildly out of proportion to its size — heavyweight tooling, elaborate governance forums, control frameworks that consume more effort to operate than the risks they address could ever justify. This is not prudence; it is a different kind of failure. It burns scarce capacity on machinery the firm does not need, starves the things that actually matter, and often produces worse answers, because an over-complex apparatus in a small firm is fragile, poorly understood, and unloved.
- Too little: proportionality read as permission. Real gaps in governance, ownership, and reconstructability, hidden until stress reveals them.
- Too much: proportionality ignored out of fear. Large-firm apparatus imported wholesale, consuming capacity the firm cannot spare and answering no question better.
- The target sits between: the lightest apparatus that genuinely and durably answers the regulator’s questions at this firm’s scale.
Designing From Scale Upward
The discipline that avoids both failures is to design from the firm’s scale upward, anchored to the questions rather than to anyone else’s architecture. In practice this means starting not from a reference model of what a bank’s data function should contain, but from a short and honest list: what must this firm be able to demonstrate, to whom, and how quickly? Every element of data capability then earns its place by reference to that list, or it does not get built.
- Start from the obligations, expressed as questions the firm must be able to answer on demand — not from a template architecture.
- For each question, identify the critical data that answers it, and give that data an owner. Ownership is the one thing proportionality never lets you omit; a firm of any size can name who is accountable for a number.
- Build the lightest process that makes the answer reliable and reconstructable. In a small firm this may be modest tooling with strong discipline rather than heavy tooling — and that is a legitimate proportionate choice, provided the discipline is real.
- Document the reasoning. Proportionality is a judgement, and a judgement the firm can explain — why this much apparatus and no more — is defensible to a regulator in a way that an unexamined “we’re small” never is.
That last point is the one most often missed. Proportionality is not a status the firm possesses; it is a decision the firm makes and must be able to justify. The regulator does not object to a small bank running a light-touch data capability. It objects to a firm that cannot articulate why its capability is adequate to its risks. The defensible position is never “we did less because we are small.” It is “we designed our capability to answer these specific obligations at our specific scale, and here is the reasoning.” The first is an excuse. The second is proportionality actually practised.
Proportionality as Craft
The reframe I would press on any programme leader in a small or specialist bank is to stop treating proportionality as a concession granted by the rulebook and start treating it as a craft the firm must be good at. Getting it right is harder than either extreme, not easier. Doing too little requires no thought; doing too much requires only money and imitation. Doing exactly enough — building the apparatus that genuinely answers the regulator’s questions at your scale and not one element more — requires real judgement about what matters, honest self-assessment about where the firm is exposed, and the confidence to explain the choices out loud.
Proportionate does not mean easy. It means fit. A small bank that internalises this does not spend its scarce capacity apologising for its size or imitating institutions ten times larger. It builds a data capability that is exactly the right size for what it is — which is, in the end, the only thing the regulator was ever asking for.