The real regulatory risk isn’t the submission. It’s the data behind it

It starts with data

Most regulatory reporting failures don’t begin with a missed deadline.

They begin months earlier, buried in inconsistent data definitions, fragmented systems, manual workarounds and assumptions that no one has challenged. By the time an incorrect filing reaches a regulator, the reporting team hasn’t created the problem – they’ve simply exposed it.

Increasingly, regulators are looking beyond the accuracy of the final return to the quality of the governance and controls that produced it.

That changes the role of regulatory reporting. It is no longer simply an operational process or an end-of-period obligation. Increasingly, it is becoming evidence of how well an organisation governs its data.

Regulatory reporting is only as reliable as the data behind it

Data is created, shared and transformed across multiple systems, teams and service providers long before it reaches a regulatory return. By the time a return is prepared, reporting teams may be reconciling different versions of the truth against an immovable deadline.

The scale of the challenge is becoming clearer. In a 2025 review of around 3,800 investment firms, the FCA carried out 323,000 data-quality tests on MIFIDPRU regulatory reporting. Around 40% of firms had either reporting errors or were still working towards consistent, good-quality reporting, with issues including inconsistent data across sources, incorrect reporting guidance and data-entry errors.

The issue is not unique to the UK. ESMA has identified significant data-quality challenges across European reporting regimes. In its review of EMIR data, around 5 million reconcilable derivatives remained unpaired, while more than 20% of reported derivatives did not receive the required daily valuation update.

These findings point to a broader governance challenge. Different teams may interpret the same regulatory definition differently, ownership can become blurred and manual interventions can fill the gaps between disconnected processes.

As regulators place greater emphasis on data lineage and the reuse of reported information, consistency matters more than ever. The same data points increasingly flow into multiple regulatory returns, meaning an underlying issue can have consequences beyond a single submission.

Every manual workaround creates another control risk

Spreadsheets remain an essential part of many reporting processes, but the real risk is when they become the control framework. Every copied value, manual adjustment or undocumented override makes the process harder to evidence and defend.

As regulatory data is reused across multiple obligations, a single error can affect several submissions rather than just one. That is why firms are investing more heavily in automated validation, comparison reporting and tolerance-based exception alerts.

These controls don’t replace expert judgement. They help direct it to the areas that genuinely require investigation, while creating stronger evidence that reporting controls are operating effectively.

Governance is becoming the real test

Historically, firms focused on one question: How do we complete this return?

Today, regulators are asking a different one: How was this information produced?

That answer extends well beyond the reporting team. It depends on governance, systems architecture, delegated oversight, clear ownership and effective challenge across the reporting process.

The firms making the greatest progress are identifying the data elements that create the highest regulatory risk – those reused across multiple reports, dependent on judgement or sourced from third parties – and applying proportionate controls around them.

Rather than reviewing everything equally, they are focusing governance where it has the greatest impact.

Good data still needs good judgement

Data quality is fundamental to reliable regulatory reporting. But good data, on its own, does not produce a good return.

Regulatory reporting increasingly requires judgement: understanding definitions, interpreting requirements, identifying anomalies and knowing when a number doesn’t look right. As regulatory frameworks evolve and requirements diverge across jurisdictions, the ability to understand how data should be interpreted and applied in different regulatory contexts becomes just as important as the quality of the data itself.

This is particularly relevant where data comes from multiple systems, administrators or third-party providers. A reporting process may be able to validate whether a figure is complete or falls within an expected range, but it cannot always determine whether the figure makes sense in the regulatory context.

That is where experienced reporting professionals add value. They understand not only what the data says, but what it means, where it has come from and how it should be used for the specific return being prepared.

The value of independent challenge

Who is asking those questions matters too.

When the team preparing a regulatory return is independent from the teams and service providers responsible for producing the underlying data, they can challenge that information objectively.

They are not responsible for creating the data, so they are not simply “marking their own homework”. They can ask the questions that might otherwise be missed: Why has this figure changed? Does it reconcile with other reporting? Is this interpretation consistent with the regulatory requirement? What evidence supports the number?

That independence matters. It is not about assuming the data is wrong; it is about having the knowledge and objectivity to recognise when something needs to be questioned, and the expertise to understand what happens next.

As regulatory reporting becomes more complex and data flows across more systems, providers and jurisdictions, independent oversight can provide an important additional layer of confidence in the reporting process.

Data quality is becoming a competitive advantage

The direction of travel is clear. Regulators are placing greater emphasis on data quality, standardisation, lineage and the reuse of regulatory information. As reporting frameworks become increasingly interconnected, expectations around accuracy, consistency and traceability will continue to rise.

The firms that respond best will treat regulatory data as a strategic asset rather than a reporting by-product. Better data can reduce remediation costs, improve operational resilience and make it easier to implement new reporting requirements. It can also give Boards greater confidence in the information they use to oversee risk.

Summary

For years, regulatory reporting has been viewed as evidence of compliance. Increasingly, regulators are treating it as evidence of governance.

The firms that succeed won’t simply produce accurate returns. They’ll be able to demonstrate that every number is owned, understood, appropriately challenged and trusted.

Good data is fundamental. But in an increasingly complex regulatory environment, trusted reporting depends equally on the people who know how to understand it, question it and use it properly.