Regulatory Reporting

What Is Regulatory Reporting?

In financial crime compliance, regulatory reporting means the reports that regulated firms are legally required to submit to public authorities about their customers' activity and their own controls. The best-known examples go to the national Financial Intelligence Unit (FIU): suspicious activity or transaction reports, and in some countries threshold-based reports such as currency transaction reports. Other reports go to sanctions authorities, tax authorities and prudential or conduct supervisors.

Regulatory reporting turns information that only the private sector holds into intelligence that authorities can use. A single bank sees one customer's payments; an FIU that receives reports from many institutions can link activity across them and pass analysis to law enforcement.

Why Regulatory Reporting Matters

Reports are the main channel through which the financial system contributes to the detection of crime. They also carry direct legal risk for the reporting firm:

• Failure to report where a legal duty exists can be an offense or a regulatory breach for the firm and, in some regimes, for individuals.
• Late or poor-quality reports reduce their usefulness to authorities and are a frequent subject of supervisory criticism.
• Tipping off a customer that a report has been made, or is being considered, is prohibited in most jurisdictions.
• Reporting data reveals control quality. Supervisors use reporting volumes and quality as indicators of whether a firm's monitoring is working.

Main Types of Reports

Suspicious Activity and Transaction Reports

Firms report activity they know, suspect or have reasonable grounds to suspect is linked to money laundering, terrorist financing or other crime. Different jurisdictions call these SARs or STRs. They are the core of AML reporting and are not tied to any amount in most countries, although the US sets dollar thresholds for mandatory filing by different types of institution.

Threshold-Based Reports

Some countries require reports on transactions above a fixed amount, regardless of suspicion. In the United States, financial institutions file a Currency Transaction Report for transactions in currency of more than $10,000 in one business day, including multiple transactions that aggregate above that amount. Other jurisdictions have cash or wire transfer reporting thresholds of their own.

Sanctions Reports

Firms that block or freeze funds usually have to report this to the sanctions authority. In the United States, OFAC requires reports of blocked property and rejected transactions within ten business days, and an annual report of blocked property held. In the United Kingdom, relevant firms must report to OFSI when they know or have reasonable cause to suspect that a person is a designated person or has committed certain sanctions offenses, and must report frozen assets they hold.

Tax and Transparency Reports

Financial institutions report account information under regimes such as FATCA and the OECD Common Reporting Standard. Where beneficial ownership registers exist, obliged entities may also be required to report discrepancies between the register and their own records.

Supervisory Returns

Many supervisors require periodic data returns describing a firm's financial crime risk, such as customer numbers by risk category, high-risk jurisdictions served and volumes of alerts and reports.

Regulatory Expectations

FATF Recommendation 20 requires financial institutions to report promptly to the FIU when they suspect, or have reasonable grounds to suspect, that funds are the proceeds of crime or related to terrorist financing. Recommendation 21 protects reporting institutions from liability for good faith reports and prohibits tipping off. Recommendation 29 sets out the role of the FIU as the national center for receiving and analyzing these reports.

In the United States, reporting requirements derive from the Bank Secrecy Act and FinCEN's regulations, and reports are filed electronically through FinCEN's BSA E-Filing System. In the European Union, obliged entities report to the national FIU under the AML Directives, now complemented by the AML Regulation (EU) 2024/1624. In the United Kingdom, suspicious activity reports go to the UK Financial Intelligence Unit within the National Crime Agency under the Proceeds of Crime Act 2002 and the Terrorism Act 2000. Many FIUs worldwide receive reports through goAML, a system developed by the United Nations Office on Drugs and Crime.

Best Practices

• Map every obligation. Maintain an inventory of reports the firm must file in each jurisdiction, with owner, trigger, deadline and format.
• Write for the reader. A good narrative explains who, what, when, where and why the activity is suspicious, in language an investigator unfamiliar with the firm can follow.
• Keep the evidence together. Link each report to the alerts, screening results, customer records and decisions that led to it.
• Control deadlines. Track filing clocks from the point of detection, not from the point an analyst picks up the case.
• Learn from feedback. Use FIU feedback, typology publications and quality reviews to improve detection and narratives.

How on8.ai Helps

Reports are only as good as the detection and evidence behind them. SmartSanction records the reasoning behind every sanctions, PEP and risk match, which helps analysts explain screening outcomes in reports. RemitGo, currently in development, is a banking and payments platform with SmartSanction and Passporter embedded.

Related Terms

• SAR (Suspicious Activity Report)
• Financial Intelligence Unit (FIU)
• Egmont Group
• AML Compliance Officer
• Transaction Monitoring System (TMS)
• Passive NFE (Non-Financial Entity)