Regulatory reporting explained: what goes to whom, and when
Regulatory reporting is the obligation on a supervised business to submit defined information to a regulator, a supervisor or a financial intelligence unit, either on a fixed schedule or when a specific trigger occurs. The content, the recipient and the deadline are all set externally, and none of them is negotiable.
The term covers a wide span, from a quarterly solvency return to a single report about one customer. This entry concentrates on the second kind, because that is the one non-specialist staff are most likely to trigger.
What does regulatory reporting mean?
Two features separate a regulatory report from ordinary management information. The format is prescribed rather than chosen, and the obligation to file survives whatever the firm would prefer commercially. A firm cannot decide that a report is not worth making because the customer is valuable or the amount is small.
The reports also travel in one direction. Filing does not begin a conversation, and a firm rarely learns what happened to a report it made.
Scheduled reporting versus event-driven reporting
- Scheduled reporting runs to the calendar: prudential returns, capital and solvency data, complaints data, conduct and transaction reporting. It is a data quality and systems discipline, and it usually sits with finance or a dedicated reporting team.
- Event-driven reporting runs to a trigger: a suspicion of money laundering, a sanctions match, a personal data breach, a significant operational incident, a material change in the business. It can originate anywhere in the organisation, including from a claims handler on an ordinary file.
Most firms are much better at the first than the second, because the first has an owner and a deadline in a diary. The second depends on someone noticing something and knowing where to send it.
What is a suspicious activity report?
A suspicious activity report, SAR, is a report made to a financial intelligence unit when a business knows or suspects, or has reasonable grounds to suspect, that funds or activity relate to money laundering, terrorist financing or other predicate offences. In some jurisdictions it is called a suspicious transaction report, STR, and in the United States a SAR is filed with FinCEN.
The international basis is FATF Recommendation 20, which requires firms to report suspicion promptly to the national FIU, covering attempted transactions and applying regardless of the amount involved. Three features of the obligation cause the most confusion:
- The threshold is suspicion, not proof. Nobody filing a report is expected to have established that an offence occurred.
- Volume is normal. The United Kingdom Financial Intelligence Unit, part of the National Crime Agency, states that it has received more than 850,000 SARs a year, with a database holding over 4.5 million reports. A report is a routine intelligence contribution, not an accusation.
- Filing is not permission to proceed. Several regimes operate a separate consent or defence mechanism that a firm must use before continuing with a transaction it has reported.
Confidentiality: why you cannot tell the customer
This is the part that most often catches out staff who do not work in financial crime day to day. Disclosing that a report has been made, or that an investigation is under way, is a criminal offence in most regimes, commonly called tipping off.
FATF Recommendation 21 sets both sides of the balance: staff who report in good faith are protected from liability for breach of confidentiality, and disclosing that a report has been filed is to be a criminal offence. National implementations put real weight behind it. In the United Kingdom, section 333A of the Proceeds of Crime Act 2002 carries up to two years' imprisonment on conviction on indictment. In the United States, 31 U.S.C. 5318(g)(2) provides that an institution and its directors, officers, employees and agents may not notify any person involved in the transaction that it has been reported, and the SAR itself, along with any information revealing its existence, is confidential.
The operational consequence is specific and it needs to be trained. A handler on a delayed file cannot explain the real reason for the delay, cannot hint at it, and cannot record it in a customer-facing note or a system field the customer can request. Scripts for exactly this situation belong in the procedure, because the honest instinct is the dangerous one.
Regulatory reporting example: the redirected payment
A claims handler receives a request to redirect a settlement to a third party shortly before payment, and the explanation shifts between two calls. The red flag indicator is logged and the file goes to the nominated officer, not back to the customer.
The officer files a report and follows the local consent process before any payment moves. The customer is told only that the payment is being processed and a further check is under way, which is true, and says nothing about the report.
Where the obligations differ by jurisdiction
Nothing above is universal in its detail. Which body receives reports, the filing format, whether a consent regime exists and how long it takes, the exact scope of the tipping-off offence and its defences, the retention period for the underlying records, and which sectors are in scope at all: every one of these is a national choice.
Firms operating in more than one market should hold a separate procedure per jurisdiction rather than a group policy with local annexes. The related obligations sit under anti money laundering and know your customer, and where a report leads to investigation, the file usually passes to a special investigation unit or an equivalent financial crime team. This entry is background for working professionals and is not legal advice.