The PRA's Dear CEO letter on regulatory reporting, "Reliability of regulatory returns", was sent on 31 October 2019 to the chief executives of UK banks and building societies. It restated that "we expect firms to submit complete, timely and accurate regulatory returns", asked firms to be ready to demonstrate the governance and controls behind them and the key interpretations they rest on, copied "the relevant senior manager", and announced skilled person reviews focused on the Common Reporting framework (PRA, 2019). A follow-up letter in September 2021 reported "significant deficiencies", and three enforcement cases put prices on the failings. Botminds' COREP & FINREP Reporting is built to produce the evidence these letters ask for: every cell traced to its source, every interpretation and mapping approved by a named person, and a trail the senior manager can read.
This guide reads the two letters and the three fines side by side, and turns them into the controls a COREP and FINREP team should be able to show.
Each failing the PRA named, and the control that answers it
| What the PRA found | Case | The control that answers it |
|---|---|---|
| "Approach to technical interpretations of reporting requirements was insufficiently robust" | Citi, 2019 | A register of key interpretations, each with an owner, a citation, sign-off and a review date |
| "Documentation of multiple aspects of its UK regulatory reporting control framework was inadequate" | Citi, 2019 | Each control documented, with who runs it, on what, and the evidence it leaves |
| Failed to "establish and implement effective controls in interpreting relevant regulatory rules and guidance" | Metro Bank, 2021 | Mapping changes proposed with the cited rule, accepted by one person and approved by another |
| Failed to "allocate appropriate and adequate resources" | Citi 2019; Metro Bank 2021 | Capacity planned for releases as well as quarter ends |
| Notified the PRA of an error "after a four-month internal investigation" | Standard Chartered, 2021 | A written policy on when an error is notified, with escalation the same day it is found |
| Failed to "maintain and operate adequate controls testing and checks" | Standard Chartered, 2021 | Every check run on every draft and reconciliation to the general ledger each cycle |
What did the PRA Dear CEO letter on regulatory reporting say?
It said four things. First, the expectation itself: "We expect firms to submit complete, timely and accurate regulatory returns. These expectations have not changed; the integrity of regulatory reporting is the foundation of effective supervision." Second, what a firm must be ready to do on request: "demonstrate how the design and operation of the governance, controls and other processes deliver regulatory reporting of appropriate quality", give "details of the key interpretations and judgements made relating to regulatory returns and the governance processes used to validate these", and give "details of any material regulatory reporting errors identified, together with an explanation of the actions taken to remediate them" (PRA, 31 October 2019).
Third, accountability: "The production and integrity of a firm's financial information and its regulatory reporting is a prescribed responsibility", so the letter went to the relevant senior manager too. Fourth, the method: the PRA would "commission reports from skilled persons" focusing "on the Common Reporting framework" and other returns such as the PRA110 cashflow mismatch template. The letter also named the hardest problem: "in many cases these have been hard coded into firms' systems", meaning interpretations made over years.
"Depending on the quality of governance and record keeping in the past, it may be necessary for firms to: (i) undertake work to identify the key interpretations and judgements; and (ii) validate these interpretations and judgements."
Sarah Breeden and David Bailey, PRA, Dear CEO letter, 31 October 2019
What is a Dear CEO letter?
It is a letter the PRA sends to the chief executives of a whole class of firms to restate or sharpen its expectations on a subject. It is not a rule: this one rests on rules that already existed, citing the PRA's approach to banking supervision, the General Organisational Requirements part and Notifications Rule 6.1. But it tells firms what supervisors will ask for and what will happen if they find gaps: "You should expect us to consider the full range of supervisory responses where we have concerns" (PRA, 2019). Each enforcement notice that followed cited the letter in its notes.
What is a skilled person review of regulatory returns?
It is a review the PRA commissions under section 166 of the Financial Services and Markets Act 2000, carried out by an independent expert at the firm's cost, reporting to the PRA. The 2019 letter said such reviews "may, for example, involve: a 'reasonable assurance' opinion on whether the return reviewed has been properly prepared; a review of the relevant governance, controls and other processes; and the gathering of information that will enable us to review the key interpretations applied in preparing the return", with the main focus "on the larger firms".
The 2021 letter says what happened: the PRA "commissioned a number of reports from skilled persons (covering credit and market risk returns at larger firms)", which "required skilled persons to opine on governance arrangements, systems and controls to produce the returns, the schedule of key interpretations, and to provide an assessment of the accuracy of the returns" (PRA, 10 September 2021).
What the skilled persons found: the 2021 thematic letter
The PRA was "disappointed to find significant deficiencies in a number of firms' processes", and its findings fall under three heads. Governance and ownership: responsibility spread across many people and teams and pushed too far down, and "poor governance around key regulatory interpretations including a lack of basic documentation, periodic reviews, and/or appropriate sign-off". Controls: "insufficient controls around models, End User Computing (EUC) and a lack of reconciliation checks for errors", spreadsheets not "formally registered" as end-user computing, "unsatisfactory reconciliation disciplines". Data and investment: firms that "have not prioritised investment in regulatory reporting", with "the need for significant manual intervention to fill data and system gaps" (PRA, 2021).
It also set a bar that a reporting team can measure itself against: "We expect all firms to submit reliable and accurate regulatory returns and for the regulatory reporting process to receive no less rigour than financial reporting." And it said what to do when errors appear after filing: assess the impact and resubmit any material error.
Three PRA regulatory reporting fines, before and after the settlement discount
Why was Citi fined by the PRA?
For governance and controls, not a single error. The PRA fined Citigroup Global Markets Limited and two Citi UK branches £43.9 million in November 2019 because "between 19 June 2014 and 31 December 2018 ... the firms' UK regulatory reporting framework was not designed, implemented or operating effectively", leading to "significant errors in the firms' returns, including six substantive matters which had a material or potentially material impact on the returns" (PRA, 26 November 2019). The returns "did not provide the PRA with an accurate picture of CGML's capital or liquidity position", although Citi "remained in surplus to its liquidity and capital requirements at all times".
The PRA listed five failings: systems and controls not "designed, implemented and operating effectively"; inadequate "human resources" for the liquidity returns; inadequate documentation of the control framework; an approach to "technical interpretations of reporting requirements" that "was insufficiently robust"; and oversight that "fell significantly below the standards expected of a systemically important institution". The rules breached were Fundamental Rule 6, the Branch Return Rule and Notifications Rule 6.1.
Why was Metro Bank fined by the PRA?
For its COREP returns. The PRA fined Metro Bank £5,376,000 in December 2021 "for failing to act with due skill, care and diligence in relation to the regulatory reporting of its capital position and for failings in its regulatory reporting governance, controls and investment with respect to its Common Reporting (COREP) returns" between 13 May 2016 and 23 January 2019 (PRA, 22 December 2021). On 23 January 2019 the bank had announced an adjustment of "approximately £900 million" to its December 2018 risk-weighted assets, after finding it had used the wrong risk weight for some commercial loans.
The bank stayed above its capital requirement, but the PRA saw "an inaccurate picture of the firm's regulatory capital position". During rapid growth it had failed to invest in reporting governance; specifically, it failed to "establish and implement effective controls in interpreting relevant regulatory rules and guidance" and to "allocate appropriate and adequate resources". Metro Bank breached Fundamental Rules 2 and 6. It is the clearest public case of a COREP return that passed its checks and was still wrong, the subject of COREP validation rules pass; the return can still be wrong.
Standard Chartered: the price of telling the PRA late
The largest of the three fines was about speed of disclosure. In 2017 the PRA had set Standard Chartered a temporary liquidity expectation for US dollar outflows; between March 2018 and May 2019 the bank "made five errors reporting the liquidity metric", and for one of them "only notified the PRA of the error after a four-month internal investigation" (PRA, 20 December 2021). The fine of £46.55 million cited Fundamental Rules 6 and 7, and failures to "implement a documented policy setting out when liquidity errors or potential liquidity errors should be notified to the PRA" and to "maintain and operate adequate controls testing and checks".
The PRA's chief executive drew the lesson: "We expect firms to notify us promptly of any material issues with their regulatory reporting." Investigating an error before telling the supervisor is natural; the case shows the PRA expects to hear first.
What each fine turned on
Citi, 2019
- Controls and documentation · 40%
- Interpretations · 20%
- Resources · 20%
- Oversight · 20%
Metro Bank, 2021
- Care over accuracy · 25%
- Interpretations · 25%
- Resources · 25%
- Oversight and escalation · 25%
Standard Chartered, 2021
- Notification · 40%
- Controls testing · 20%
- Resources · 20%
- Escalation policy · 20%
What is Fundamental Rule 6?
Fundamental Rule 6 says: "A firm must organise and control its affairs responsibly and effectively" (PRA Rulebook, Fundamental Rules 2.6). It was breached in all three cases. Two other rules recur: Fundamental Rule 2, "A firm must conduct its business with due skill, care and diligence" (Metro Bank), and Fundamental Rule 7, "A firm must deal with its regulators in an open and cooperative way and must disclose to the PRA appropriately anything relating to the firm of which the PRA would reasonably expect notice" (Standard Chartered).
Under them sits Notifications Rule 6.1, which Citi breached: a firm must take reasonable steps to make the information it gives the PRA accurate, with estimates and judgements properly based, and complete (PRA Rulebook, Notifications 6.1). Those reasonable steps are where a firm's controls are judged.
What are the PRA expectations for regulatory reporting today?
The same as in 2019, with a named owner. The prescribed responsibility the letter cited is rule 4.1(9) of the Allocation of Responsibilities part, which still gives a senior manager the production and integrity of the firm's financial information and regulatory reporting (PRA Rulebook). The PRA's October 2026 consultation on streamlining prescribed responsibilities proposes to remove several, but not this one (PRA CP14/26). The checklist below turns the two letters into what a firm should be able to hand over the day a supervisor asks.
What to be able to show the PRA on request
- How governance and controls produce each return
Process documented front to back, from trade capture or loan booking to the filed template.
- The schedule of key interpretations
Each with its question, answer, rule, owner, sign-off and review date.
- How interpretations were validated
Who checked them, against what, and when they were last checked.
- Reconciliation to the general ledger
For every submission cycle, with breaks explained.
- End-user computing under control
Spreadsheets in the process registered, reviewed and documented.
- Material errors and their remediation
What was found, what was resubmitted, when the PRA was told.
- The senior manager's oversight
What the holder of the prescribed responsibility sees, and how often.
- Investment matched to need
Capacity for releases and quarter ends, not tactical fixes.
How should banks govern reporting interpretations?
By treating each one as a decision with an owner, not a line of code. The PRA's three steps are to "identify the key interpretations and judgements", "validate these interpretations and judgements" and "correct them where appropriate" (PRA, 2021). In practice that means a register that ties each interpretation to the cells it affects, so that when a rule or a product changes, the bank knows which interpretations to revisit, and when one is corrected, which returns to resubmit.
In COREP & FINREP Reporting, an interpretation enters the return through a mapping or an override, and neither changes without two people. A mapping proposal carries the paragraph it rests on and the exposures it moves; an analyst accepts it and a different manager approves it with a reason code, after seeing its impact. Every action, by people and agents, is kept with who, what, when, why and the evidence, for seven years, and the Evidence agent builds the pack for the senior manager, internal audit or the PRA supervisor. What that evidence looks like for an AI-prepared return is covered in FINREP AI: what the rules ask of an AI-prepared return.
An interpretation becomes a mapping only with a second person and a reason
The trail a supervisor or skilled person can follow
Questions people ask
When did the PRA send its Dear CEO letter on regulatory reporting?
On 31 October 2019, from Sarah Breeden and David Bailey to the chief executives of PRA-regulated banks and building societies, under the title "Reliability of regulatory returns". A follow-up, "Thematic findings on the reliability of regulatory reporting", was sent on 10 September 2021.
How much was Citi fined by the PRA in 2019?
£43,890,000, jointly on Citigroup Global Markets Limited, Citibank N.A. London branch and Citibank Europe plc UK branch, after a 30% settlement discount; without it the fine would have been £62.7 million. The failings ran from June 2014 to December 2018.
Is a Dear CEO letter legally binding?
No; the binding requirements are in the PRA Rulebook, such as the Fundamental Rules and Notifications Rule 6.1, which the 2019 letter cites. The letter says how the PRA reads them and what it will ask for, and the later fines were brought under those rules.
Which returns did the PRA's skilled person reviews cover?
The 2019 letter said the work would "focus on the Common Reporting framework" and other returns such as the PRA110 cashflow mismatch template; the 2021 letter says the reviews covered credit and market risk returns at larger firms.
What should a bank do when it finds an error in a submitted return?
Assess its impact, resubmit if it is material, and tell the PRA promptly: corrections go "without undue delay" under the Reporting (CRR) part, and Standard Chartered's fine turned partly on a four-month delay in notification.