The political deal, which also introduces sweeping and controversial changes to how banks assess the risk of corporate and home loans, must now be voted on by member states in the EU’s Council and by lawmakers to become legislation, a process that can in practice take many months.