• Skip to primary navigation
  • Skip to main content
  • Skip to footer
CUBE announces its acquisition of The HubCUBE announces its acquisition of The HubCUBE announces its acquisition of The Hub

CUBE global

  • Products
        • RegPlatform product overviewOur enterprise product, providing regulatory intelligence for large, global financial institutions looking to tackle complex compliance.
        • RegAssure product overviewOur highly intuitive, seamless compliance product, that grows with your small or medium sized business.
        • View all products
  • Solutions
        • PrivacyGlobal governance for data privacy regulations, the world over
        • RecordsHolistic oversight of ever-growing regulations for records
        • CybersecurityAutomated workflows for up to date, relevant data on cyber
        • Technology riskEffective policies and controls to mitigate technology risk
        • Financial crime and AMLWatertight audit trails to show risk-based rationale
        • View all solutions
  • Resources
        • Resource hubLifting the lid on financial services, compliance, and regulation
        • Read

        • Case Studies
        • Blog posts
        • Reports
        • Brochures
        • Find

        • Compliance Corner
        • Compliance Confessions
        • ESG Conference
        • CUBE’s regulation game
        • Listen

        • Videos
        • Webinars
        • Podcasts
  • Partners
        • Advisory and consulting partnersEnhance your regulatory compliance offering with the entire suite of CUBE regulatory data.
        • Integration partnersCompliance is complex enough without over-complicated integration procedures.
        • Technology partnersAdd value to existing customer applications with a unified window into regulatory intelligence.
        • Partners overview
  • About us
        • About usThe story of who we are, how we got here and why we’re exceptionally proud of what we do
        • TeamThe visionaries and leaders powering CUBE’s success
        • NewsThe latest news from CUBE
        • CareersOur movement to transform regulatory data into regulatory intelligence
        • ContactWant to know more? Get in touch
  • Request a demo
Customer login
Home » Resources » PRA ‘disappointed’ by deficiencies in firms’ regulatory reporting

September 23, 2021 | Ali Abbas

Estimated reading time: 5 minutes

PRA ‘disappointed’ by deficiencies in firms’ regulatory reporting


The Prudential Regulation Authority (PRA) – part of the Bank of England (BOE) – has issued a Dear CEO letter, outlining its expectations that banks and building societies complete timely and accurate regulatory returns. In messaging that broadly echoes a similar letter issued in October 2019, the PRA has said that it expects “all firms to submit reliable and accurate regulatory returns and for the regulatory reporting process to receive no less rigour than financial reporting.”

s.166 Reviews

Since the PRA issued their initial letter in 2019, it has commissioned a number of skilled persons to undertake reviews under Section 166 of the Financial Services and Markets Act 2000 (FSMA). The reviews provided a clarifying lens on key topics, including:

  • Governance arrangements
  • Systems and controls around the production of the returns
  • The schedule of key interpretations
  • The accuracy of reporting returns

As well as this, the PRA has asked a number of firms to demonstrate how they deliver regulatory reporting of an appropriate quality, noting that “the integrity of regulatory reporting is essential for us to advance our primary objective to promote the safety and soundness of PRA-authorised firms”.

PRA “disappointed” with results of review

Following these reviews, the PRA notes that it is “disappointed to find significant deficiencies in a number of firms’ processes” used to deliver accurate and reliable regulatory returns. In particular, the PRA was disappointed that financial institutions apparently do not apply the same level of care and diligence in their regulatory returns as they do to other financial reports to be shared with the market and their peers.

While many firms have gone to great lengths to improve or enhance their regulatory reporting processes, it is clear that the PRA expects firms to go further. In particular, it has found failures in:

1. Governance and ownership

  • In some firms, the responsibility for regulatory reporting had been spread across teams and individuals.
  • This was made worse in firms that also had fragmented or complex end-end processes, which led to poor understanding of both documentation and processes.
  • The PRA also found instances of poor governance around key regulatory interpretations, especially around essential elements such as basic documentation, periodic reviews and sign offs.

In response to these findings, the PRA notes that senior accountability and ownership is fundamental to the production and integrity of a firm’s regulatory reporting and financial reporting. With that in mind, the relevant senior manager should have overall oversight of the effectiveness and processes to ensure the delivery of accurate and reliable regulatory returns.  Moreover, it expects responsibilities to be clear for all individuals.

2. Controls

  • The PRA found a number of gaps in end-end processes for regulatory reporting, especially around insufficient controls for models and in lack of reconciliation checks for errors.
  • This was made worse by a “high degree of manual intervention in the end processes” for regulatory returns.
  • Many firms used spreadsheets in their regulatory reporting process, which carry an “inherent risk of error because of their vulnerability to over-writing”. Firms that used spreadsheets often failed to have a sufficiently robust control environment in place for the purpose of generating reliable and accurate returns.

The PRA expects that firms’ governance arrangements for regulatory returns are supported and bolstered by an effective and robust control framework. Operating models should be clearly audited and documented, with effective controls at every stage.

3. Data and investment

  • The PRA’s review found that firms have not generally prioritised investment in regulatory reporting, which means there is a reduced capacity and capability when compared alongside financial reporting.
  • This lack of investment often leads to “outdated reporting system infrastructure” and the need for “manual intervention to fill data and system gaps”.

It notes that those firms that had effectively invested in systems and data had a far more efficient infrastructure, which required less manual intervention and fewer errors – leading to better outcomes and more effective and efficient use of data in the long term.

CUBE comment

The PRA is rightly “disappointed” with the standard of regulatory reporting produced by many of the reviewed firms. This Dear CEO letter would suggest that, despite issuing a similar letter in 2019, there has been little investment or effort made to improve the state of regulatory reporting across the industry.

The PRA, I would assume, would purport to be tech agnostic. As many financial regulators often suggest, they do not care if a financial institution is using technology or not – as long as they are doing the job well. The interesting point about this recent Dear CEO letter is that there is a distinct sense of disdain for firms that are relying on “manual intervention” or “outdated reporting system infrastructure” in order to complete their regulatory reporting.

I suppose this disdain is warranted, in a number of ways. Can there be anything more frustrating as a financial regulator, than to see firms continually doing a bad job – when the technology and infrastructure exists to enable firms to do a good job. And not only a good job – a job that would also save the firm time, money and potentially funds spent on regulatory fines when things go wrong.

The PRA has said it will “consider the full range of supervisory responses and enforcement powers” at its disposal – i.e. it will not be soft on those who fail to improve the standards they apply to regulatory reporting.

Firms that have been subject to the PRA’s reviews will undoubtedly be scrambling to put in an effective regulatory reporting framework, now they know that their current systems are “outdated” or “fragmented”. For firms that have not yet faced review, it may well be wise to heed the message of the letter and assess their current regulatory reporting processes. Let’s hope the PRA won’t need to publish a third Dear CEO in 2023.


CUBE automates regulatory reporting for audit to give assurance to those who need it, when they need it.

Request a demo

Related resources
View all resources
Learn about the Financial Services and Markets Bill (FSMB)
Blogs

How the FSMB will transform UK financial markets

Learn from TSB Bank's operational resilience failings
Blogs

5 lessons to take away from TSB bank’s operational resilience failings 

Learn about the UK's Data Protection Bill
Blogs

What does the UK’s new Data Protection Bill mean for UK data?

Find out why Santander was fined for anti money laundering (AML)
Blogs

Santander fined £107.7 million for repeated anti-money laundering failures


Want CUBE updates and latest industry news sent straight to your inbox?

Footer

Add CUBE logo here

  • Products
    • Partners
    • Solutions
  • Resource hub
    • Blogs
    • Reports
    • Brochures
    • Compliance Corner
    • Webinars
    • Podcasts
    • Videos
  • Behind CUBE
    • About us
    • Meet the team
    • Careers
    • News
    • Contact us
  • The legal bits
    • Privacy policy
    • Cookie policy
    • Terms of use
    • Accessibility
Follow us:
  • LinkedIn
  • Twitter
  • YouTube

© 2023 CUBE Content Governance Global Limited

  • English
  • US

envelope

Want CUBE updates and latest industry news sent straight to your inbox?

Sign up to our Newsletter here