What Is Regulatory Reporting? The Role of LEI Explained

May 7, 2026

Every regulated firm in the UK and EU operates under a layer of reporting obligations that sit on top of normal accounting. These submissions let regulators monitor markets, assess risk, and prevent the kind of failures that triggered the 2008 financial crisis, and they depend, increasingly, on a single piece of data: the Legal Entity Identifier (LEI).

What Is Regulatory Reporting in Finance?

In finance, regulatory reporting is the structured data layer that allows supervision to function. Authorised firms feed prescribed information to their regulators on a defined schedule, and the regulators use it to oversee the markets and institutions in their remit.

Regulatory Reporting Meaning and Purpose

The regulatory reporting meaning is straightforward: regulators set out what data they need, in what format, and how often, and firms submit it. The structured nature of those submissions is what allows authorities to compare data across institutions, products, and jurisdictions, and to monitor solvency, detect market abuse, track systemic risk, and verify that firms are following the rules they signed up to when authorised.

Why Regulatory Reporting Matters

A bank can look healthy on its public accounts and still be carrying risks that only show up in granular regulatory submissions. Stress test data, transaction-level trade reports, and capital adequacy calculations are designed to surface those risks before they spread, which is why reporting quality is now a board-level operational risk: inaccurate or late reports lead to fines, supervisory scrutiny, and in some cases trading restrictions.

Who Is Responsible for Regulatory Reporting?

Responsibility sits with the regulated entity itself. The senior managers named in the firm’s regulatory permissions are accountable for accuracy and timeliness, even when day-to-day work is delegated to a compliance team, finance function, or external service provider. In practice, regulatory reporting usually involves:

Compliance, which interprets the rules and signs off on submissions
Finance, which produces capital, liquidity, and accounting data
Operations and IT, which build the data pipelines feeding the reports
Risk, which validates figures against internal risk models
Senior management, which carries personal accountability under regimes like the UK Senior Managers and Certification Regime (SMCR)

Smaller firms often outsource the technical submission work to a regtech vendor, but the regulatory liability stays with the firm.

Financial Reporting vs Regulatory Reporting

Financial and regulatory reporting are different exercises serving different audiences, even though they often draw on overlapping source data. Financial reporting communicates a firm’s performance to the market; regulatory reporting feeds supervisors with the granular data they need to oversee the firm.

Key Differences

Dimension	Financial Reporting	Regulatory Reporting
Audience	Investors, lenders, the public	Regulators and supervisors
Standards	IFRS, UK GAAP, US GAAP	Regulator-defined templates (COREP, FINREP, MiFIR, EMIR, etc.)
Frequency	Annual and interim	Daily, weekly, monthly, quarterly depending on report
Granularity	Aggregated	Often transaction-level or position-level
Format	Narrative plus financial statements	Structured data files (XBRL, XML, CSV)
Public?	Yes	Generally confidential
Identifier used	Company number, ticker	LEI, plus regulator-specific IDs

A FTSE 100 bank’s annual report shows summary capital ratios for investors and analysts. The same bank’s COREP submission breaks those ratios down across hundreds of risk-weighted exposure categories at counterparty level, never seen by the market and never intended to be.

Why Standardisation Matters

Standardisation is what makes regulatory data usable. If every firm reported derivatives exposures in its own format, regulators would have no way to aggregate them across the market or compare counterparties. Standardised templates, ISO-compliant identifiers, and machine-readable files are what allow authorities to spot concentration risk, market manipulation, and interconnectedness across firms. The LEI sits inside that layer as the only globally consistent way to identify a legal entity across jurisdictions, which is why it has been mandated in regulatory reporting frameworks across the G20.

Regulatory Reporting Requirements

Regulatory reporting requirements are defined regime by regime, but they share a recognisable shape. Each one specifies who has to report, what data the report must contain, in which format, on what cycle, and to which submission channel.

Data, Accuracy, and Deadlines

Every report defines:

Scope: which firms, products, or activities are covered
Data fields: what must be reported, often hundreds of fields per record
Format: usually XML, XBRL, or a regulator-specific schema
Frequency: from intraday (some transaction reports) to annual (some prudential disclosures)
Submission channel: a regulator portal, an Approved Reporting Mechanism (ARM), or a Trade Repository
Deadline: often T+1 for transaction reports, with strict cut-off times

Accuracy expectations have tightened. The FCA has issued multi-million-pound fines for transaction reporting errors, including £34.3 million against Goldman Sachs International in 2019. UBS, Merrill Lynch, and Deutsche Bank have all faced similar enforcement. “We submitted on time” is no defence if the data is wrong.

Common Compliance Obligations

Across most regimes, firms must:

Identify which reports apply to them based on permissions and activities
Maintain reference data, including counterparty LEIs, instrument identifiers (ISINs), and product taxonomies
Produce reports from authoritative source systems and reconcile them against books and records
Submit on time, in the correct format, through the approved channel
Retain reporting records for the regulator-specified period (typically five to seven years)

Where LEIs Fit Into Reporting Requirements

The LEI is the connective tissue of modern regulatory reporting: a 20-character ISO 17442 code that uniquely identifies a legal entity anywhere in the world. The system is governed by the Global Legal Entity Identifier Foundation (GLEIF), overseen by the LEI Regulatory Oversight Committee under the Financial Stability Board. In a transaction report, the LEI is how the regulator knows precisely which legal entity bought, sold, or held an instrument; without it, a report referencing “ABC Capital Ltd” could mean any of dozens of similarly-named entities across jurisdictions. For most regulated firms in the UK and EU, holding a current LEI is a precondition for trading regulated instruments. If you are unsure whether your business needs one, our guide on who needs an LEI number covers the main scenarios.

Types of Regulatory Reporting (with examples)

The types of regulatory reporting span transaction data, prudential metrics, and conduct-related disclosures. The table below summarises the main categories.

Category	Example Regimes	What It Covers	Frequency
Transaction reporting	MiFIR, EMIR, SFTR	Trade and position-level data on regulated instruments	Daily (T+1)
Prudential reporting	COREP, FINREP, Liquidity Coverage Ratio (LCR)	Capital adequacy, liquidity, balance sheet	Monthly to quarterly
Risk reporting	Stress testing, ICAAP, ILAAP	Internal risk models and resilience	Annual
Tax reporting	FATCA, CRS, Country-by-Country Reporting	Cross-border account and income data	Annual
AML / KYC reporting	Suspicious Activity Reports (SARs), wire transfer reports	Financial crime indicators	Event-driven
Conduct reporting	Best execution (RTS 28 in legacy form), complaints data	Customer outcomes	Annual to semi-annual

Transaction Reporting (e.g. MiFIR, EMIR)

Transaction reporting gives supervisors a near-complete view of trading activity in regulated markets. The data feeds the surveillance algorithms used to detect market abuse, the analytics behind post-trade transparency, and the reconstruction work that follows disorderly market events.

Each main regime captures a different slice of activity: MiFIR sits at the venue and instrument level and treats every executed trade as a discrete reportable event; EMIR follows the lifecycle of a derivatives contract from execution through valuation, collateral exchange, and termination; SFTR captures the secured-financing exposures (repos, stock loans, margin lending) that proved hardest to map after 2008. The LEI is mandatory across all three for the reporting firm and for both counterparties.

Prudential and Risk Reporting (e.g. COREP, FINREP)

Prudential and risk reporting tells supervisors whether a firm is solvent today and whether it would remain solvent under stress. The cycle runs from quantitative point-in-time submissions on capital and liquidity through to forward-looking exercises like ICAAP and ILAAP, where the firm itself sets out its assessment of the risks it carries and the capital held against them.

The template-driven nature of COREP and FINREP is deliberate: cross-firm comparability matters more than narrative nuance, because supervisors need to know how a bank’s leverage ratio compares with peers. The same data also feeds macro-prudential analysis at the Bank of England’s Financial Policy Committee and at the European Systemic Risk Board, where the question shifts from the health of any single firm to whether the system as a whole is building up risks.

AML, KYC and Tax Reporting (e.g. FATCA, CRS)

Anti-money-laundering reporting includes Suspicious Activity Reports filed with national Financial Intelligence Units (the National Crime Agency in the UK), and broader transaction monitoring obligations. KYC underpins this work as the ongoing process of verifying customer identity.

Tax reporting under FATCA (the US Foreign Account Tax Compliance Act) and CRS (the OECD Common Reporting Standard) requires financial institutions to identify accounts held by US persons or non-resident taxpayers and report them annually to their national tax authority, which then exchanges the data internationally.

Regulatory Reporting in Banking

Regulatory reporting in banking is the most extensive of any sector. A mid-sized UK bank can be subject to dozens of separate reporting regimes simultaneously, each with its own templates, deadlines, and validation rules.

Regulatory Reporting for Investment Banks

Regulatory reporting for investment banks layers transaction reporting (MiFIR, EMIR, SFTR) on top of prudential reporting (COREP, FINREP, large exposures, leverage ratio), with market-conduct reporting on top of that for areas like best execution, order book audit trails, and algorithmic trading controls. Volume is substantial: a single tier-one investment bank can submit hundreds of millions of transaction reports per year, each with around 65 fields under MiFIR, all reconciled against trading systems, the firm’s books, and the records held by counterparties and venues.

Basel III and Prudential Reporting

The Basel III framework, agreed by the Basel Committee on Banking Supervision in response to the 2008 crisis, sets the international standards for bank capital, leverage, and liquidity. The remaining reforms (known in the UK as Basel 3.1) take effect in the UK from 1 January 2027 following the PRA’s confirmation in January 2026 of its final rules, with full implementation by 2030. COREP, the Liquidity Coverage Ratio, the Net Stable Funding Ratio, and large exposures reporting all flow from Basel-derived requirements as implemented in the UK Capital Requirements Regulation and the PRA Rulebook.

Stress Testing and Risk Disclosure

Stress testing is a periodic exercise where banks model the impact of severe but plausible scenarios on their capital and liquidity. The Bank of England runs an annual cyclical scenario for the largest UK banks; the European Banking Authority does the same for major EU banks. Results inform supervisory expectations on capital buffers and, for the largest firms, are partly published. Pillar 3 disclosures sit alongside this as the public-facing element of the Basel framework, requiring banks to publish standardised information on risk-weighted assets, capital composition, and exposures.

MiFID Regulatory Reporting Explained

MiFID regulatory reporting is one of the most LEI-dependent regimes in finance, and the area most readers reach when they search for “what is regulatory reporting” in a trading context.

MiFID II vs MiFIR Reporting

MiFID II is a directive (transposed into national law); MiFIR is a regulation (directly applicable across the EU). Both took effect on 3 January 2018, and the UK retained both as onshored law after Brexit, now referred to as UK MiFID II and UK MiFIR, supervised by the FCA. The split matters for reporting: most transaction-level data obligations sit in MiFIR; best execution and product governance obligations sit in MiFID II. When practitioners say “MiFID reporting” they usually mean the MiFIR transaction reporting regime.

Transaction Reporting Fields and Triggers

Under UK MiFIR Article 26, an investment firm must submit a transaction report for every transaction it executes in a financial instrument that is admitted to trading or traded on a UK trading venue (or for which a request for admission has been made). Reports go to the FCA via an Approved Reporting Mechanism by the end of the working day after the trade. Each report contains around 65 fields, including:

The transmitting firm’s LEI
The buyer and seller LEIs (or national IDs for individuals)
The trader and decision-maker IDs
Instrument identification (ISIN)
Venue, price, quantity, currency, and timestamps
Waiver and short-sale flags

Why LEIs Are Required Under MiFID

Since 3 January 2018, the rule has been simple: no LEI, no trade. An investment firm cannot execute a reportable transaction on behalf of a legal-entity client unless that client has a valid, current LEI, and ESMA gave only a six-month temporary easement in 2018 before strict enforcement began. The reasoning is structural: a transaction report is only useful if the regulator can identify the parties involved across jurisdictions and across products, and the LEI is the only identifier that does this consistently. If you trade through a UK or EU broker as a corporate, partnership, or fund, this is the rule that explains why your broker has asked for one. Filling out the form for the LEI registration takes minutes.

Global Regulatory Reporting Frameworks

Global regulatory reporting operates as a network of national and supranational regimes, broadly aligned through international standards but implemented locally. International bodies set the principles, regional authorities draft the technical standards, and national regulators run the submission infrastructure firms file into.

UK Reporting Regimes (FCA, PRA, HMRC)

In the UK, three authorities sit at the centre of regulatory reporting:

The Financial Conduct Authority (FCA) supervises conduct and markets. It receives MiFIR transaction reports, EMIR derivatives data (via Trade Repositories), SFTR reports, and conduct-related returns through its RegData portal.
The Prudential Regulation Authority (PRA), part of the Bank of England, supervises the largest banks, building societies, insurers, and major investment firms. It receives prudential returns through the BEEDS portal.
HM Revenue & Customs (HMRC) receives tax-related regulatory data, including FATCA and CRS submissions and Country-by-Country Reports.

EU Reporting Regimes (ESMA, EBA, ECB)

Across the EU, three authorities set the technical standards:

The European Securities and Markets Authority (ESMA) writes the technical standards behind MiFIR, EMIR, SFTR, and prospectus rules. National competent authorities (such as BaFin in Germany or AMF in France) collect the data.
The European Banking Authority (EBA) issues the COREP, FINREP, and resolution-reporting standards used across the EU banking system.
The European Central Bank (ECB) supervises significant euro area banks under the Single Supervisory Mechanism and collects supervisory and statistical reporting (including AnaCredit for granular credit data).

Although the UK left the EU, much of the technical machinery (XBRL taxonomies, validation rules, identifier standards) remains aligned, which is why a multinational firm typically runs a single reporting platform serving both jurisdictions.

International Standards Bodies (BIS, IOSCO, FSB)

Above national regulators sit the bodies that set the global rules:

The Bank for International Settlements (BIS) hosts the Basel Committee on Banking Supervision, which produces the Basel framework.
The International Organization of Securities Commissions (IOSCO) brings together securities regulators globally and sets standards for market regulation, including derivatives reporting principles.
The Financial Stability Board (FSB) coordinates international financial regulation on behalf of the G20 and oversees the Global LEI System through the LEI Regulatory Oversight Committee.

These bodies set the standards that national regulators then implement, working through their member authorities rather than collecting reports from firms directly.

Challenges in Regulatory Reporting

Regulatory reporting carries operational risks that sit some distance from the rule book itself. Firms know what the regulations say; the difficulty is delivering the data accurately and consistently across constantly shifting requirements.

Data Volume and Changing Rules

Volume is structural: a single derivatives desk can generate millions of EMIR-reportable events a year, multiplied across products, entities, and reporting regimes. EMIR Refit, which took effect on 29 April 2024 in the EU and 30 September 2024 in the UK, expanded the number of reportable fields from around 130 to over 200, with new ISO 20022 XML formatting requirements. The regulatory reporting framework itself is constantly evolving: MiFIR Review is in progress, EMIR has been refit, the Basel 3.1 reforms are landing, and AI-related governance reporting is on the horizon.

RegTech, Automation, Real-Time Monitoring

Regulatory technology, or regtech, automates reporting workflows. Modern regtech platforms typically cover trade capture and enrichment from multiple source systems, reference data lookups (LEIs, ISINs, classification codes), validation against regulator-published rule sets before submission, direct submission to ARMs, Trade Repositories, or regulator portals, and reconciliation and audit trails for supervisory review. Real-time monitoring tools sit on top, alerting compliance teams to suspected breaches, missing reports, or reconciliation breaks.

Reducing Errors and Compliance Costs

The most expensive reporting errors are usually reference-data errors. A wrong LEI, an incorrect counterparty classification, or an outdated ISIN can flow through millions of reports before anyone notices, and catching them at submission time is too late because the same bad data has already been sent dozens of times. The work has to happen upstream, in the reference-data layer that feeds the reporting engine. LEIs in particular need annual renewal, and a lapsed LEI in a transaction report is a known and frequent cause of regulatory rejections: see update an LEI for the renewal process.

How to Get an LEI for Regulatory Reporting

Acquiring an LEI is straightforward, but the timing matters. Most firms find out they need one when a counterparty refuses to onboard them or a trade is rejected, which puts the LEI on the critical path for revenue.

When You Need an LEI

The trigger for an LEI is usually external: a broker, custodian, bank, or trading venue asks for one as part of onboarding, and the request applies to the legal entity rather than the people behind it. Common scenarios include:

Trading shares, bonds, ETFs, or derivatives through a UK or EU broker
Opening a corporate brokerage account for the company’s treasury
Issuing securities into a regulated market
Acting as a counterparty to derivatives transactions (EMIR)
Being a fund or sub-fund subject to AIFMD or UCITS reporting

Pension scheme trustees, charity trading subsidiaries, holding companies, and SPVs all routinely need LEIs even when not regulated themselves, because their counterparties are. For a more detailed walk-through, see how to get an LEI number.

Registration and Renewal

Registration is straightforward. You provide your legal name as it appears on the official register (Companies House, the Charity Commission, or equivalent), your registered address, and details of any direct or ultimate parent. The data is validated against authoritative sources, the LEI is issued, and it appears in the global GLEIF database. LEIs must be renewed every 12 months; if a code lapses it shows as “lapsed” in the GLEIF database, which can cause trade rejections. You can register or renew an LEI with us, with issuance handled by the relevant accredited LEI issuer.

Mapping Your LEI to Reporting Obligations

Once issued, your LEI becomes the firm’s regulatory fingerprint, appearing as the reporting firm or counterparty identifier in MiFIR, EMIR, and SFTR submissions, in FATCA and CRS filings where institutional accounts are involved, and across prudential reports identifying group entities. For groups, every legal entity that conducts reportable activity needs its own LEI, including subsidiaries and SPVs. You can verify any LEI through the LEI search tool.

Frequently Asked Questions

Is regulatory reporting mandatory for SMEs?

Most non-financial SMEs do not face direct regulatory reporting, but any SME that trades regulated instruments, holds derivatives, or is subject to FCA permissions does. SMEs in financial services should assume reporting obligations apply.

How often must reports be submitted?

It depends on the report. MiFIR transaction reports are due T+1 (the working day after the trade). COREP and FINREP are typically quarterly. FATCA and CRS are annual. Suspicious Activity Reports are event-driven and must be filed without delay.

What happens if a firm reports late or incorrectly?

Late or inaccurate reports trigger supervisory follow-up and can lead to fines. The FCA has issued fines exceeding £25 million for systematic transaction reporting failures, and persistent issues can affect a firm’s regulatory permissions and senior manager assessments.

Do non-EU firms need an LEI for EU reporting?

Yes, in most cases. Any non-EU legal entity that is a counterparty to a reportable transaction with an EU firm, or that issues securities traded on EU venues, needs an LEI. This applies equally to UK entities trading with EU counterparties post-Brexit.

Share the Post: