Regulatory reporting in one minute
Regulated firms, such as banks, insurers, investment firms and payment companies, send their supervisors data on a fixed schedule: monthly, quarterly or annually. Supervisors use it to monitor each firm between inspections, compare firms with their peers and spot risks early. For the firm it is an obligation. For the supervisor it is the main window into the market.
What firms report
Most reporting falls into six families. A single firm may file dozens of returns across them.
How a return travels
Every return makes the same six-step journey. Firm-side guides stop at step three. For a supervisor, the value is in the last three.
- 01DefineThe supervisor sets out what must be reported, usually as templates, a data point model or a taxonomy.
- 02PrepareThe firm extracts data from its systems, maps it to the requirement and signs it off.
- 03SubmitThe return travels through a portal, an API or, still too often, an email.
- 04ValidateRules check that the return is complete, consistent and plausible, ideally before it is accepted.
- 05AnalyseSupervisors read the data against history, peers and risk, and decide what needs attention.
- 06ActQuestions to the firm, a visit, a case, or nothing at all. The decision belongs to a supervisor.
Formats: from Excel to granular data
Formats sit on a spectrum. At one end, spreadsheets sent by email: in a 2025 study of Pacific regulators, 91% of reporting institutions still worked this way (AFI and MSC). In the middle, web portals and structured standards such as XBRL, Inline XBRL and xBRL-CSV, checked against a published taxonomy. At the other end, granular, record-level data collected through APIs, from which supervisors derive the views they need.
The right point on the spectrum depends on the size of the market and the questions you need answered. Moving along it should be an iteration, not a replatform.
Why it is hard, on both sides
For firms, the cost is in mapping data from many systems to requirements that change several times a year, then fixing returns that bounce on validation messages they cannot read. For supervisors, it is in the opposite direction: chasing late and wrong returns, cleaning data by hand, waiting months for vendor releases to change a rule, and then not having the time to analyse the data that finally arrives.
Where it is heading
Two shifts are under way. The first is straight-through reporting: data flows from firms’ systems to the supervisor without re-keying and is validated on the way in. The second is granular data. The ECB has set a go-live of Q2 2031 for its Integrated Reporting Framework (ECB, June 2026), and the Bank of England’s February 2026 Future Banking Data discussion paper reviews what data is collected and how (Bank of England). Both point to fewer templates and more data that supervisors can query directly.
Where AI fits, and where people decide
Supervisors already use AI, but mostly to summarise and draft (Central Banking, Jul 2026). The bigger prize is putting it inside the reporting flow: reading every return and its attachments as they land, explaining a failed check to the firm in plain language, and pointing supervisors at the returns that need a human look. Our view is simple. AI reads. Rules check. People decide. The checks that must be repeatable stay deterministic, every finding traces back to its data and rule, and a supervisor makes the call.
- 1How many returns still arrive by email or spreadsheet, and from whom?
- 2What share of returns fail validation first time, and how long does the fix take?
- 3Who can change a validation rule, and how long does it take to go live?
- 4How many analyst hours go into cleaning data before anyone reads it?
- 5Which question can your current returns not answer, and what would it take to collect the data that could?
Questions
What is regulatory reporting?
Regulatory reporting is the regular submission of data by regulated firms to their supervisors, covering areas such as capital, liquidity, solvency, conduct and financial crime. Supervisors use it to monitor firms between inspections and to spot risks early.
What is the difference between regulatory reporting and supervisory reporting?
They are often used interchangeably. Supervisory reporting usually means the prudential and conduct returns a supervisor uses to oversee individual firms, while regulatory reporting can also include statistical, transaction and public disclosure reporting.
What formats are used for regulatory reporting?
Spreadsheets and portal forms are still common, especially for smaller authorities. Larger frameworks use XBRL, Inline XBRL or xBRL-CSV, and a growing number of central banks are moving to granular, record-level data collected through APIs.
What is straight-through reporting?
Reporting in which data flows from a firm’s systems to the supervisor without manual re-keying, and is validated automatically on the way.
How is AI used in regulatory reporting?
On the firm side, AI helps prepare and check returns. On the supervisor side, it reads returns and the documents around them, explains validation failures and surfaces anomalies. Deterministic rules should still make the pass or fail decisions, and supervisors keep the final say.
What is the difference between RegTech and SupTech in reporting?
RegTech is the technology firms use to produce and submit their reports. SupTech is the technology supervisors use to collect, check and analyse them.