In February 2026, the European Central Bank imposed EUR 12.18 million in penalties on J.P. Morgan SE for misreporting risk-weighted assets under the Capital Requirements Regulation. Notably, supervisory templates reconciled and validation rules passed. The failure was not arithmetic — it was structural. This paper examines how exposure misclassification and improper CVA perimeter exclusions can materially understate risk-weighted assets while remaining mechanically consistent. It outlines six deterministic structural controls that test portfolio fingerprint integrity, risk-weight stability, credit risk density coherence, and CVA scope completeness. Applied consistently across reporting cycles, these controls would surface structural distortion early and escalate persistent deviations before supervisory intervention. The case underscores a clear supervisory message: reconciliation ensures correctness of form; structural integrity ensures credibility of substance. Under CRR III and intensifying supervisory scrutiny, structural plausibility is no longer optional — it is foundational to resilient prudential reporting.

March 3, 2026