FINREP AI means using machine learning and language models to prepare, map, check or explain a bank's supervisory financial returns. We found no rule in the PRA Rulebook, the EU's reporting regulation or the EBA's standards that forbids it, and none written for it. What applies is what applied before: a named senior manager holds the prescribed responsibility for the firm's regulatory reporting (PRA Rulebook, Allocation of Responsibilities 4.1(9)), and the firm must take reasonable steps to make what it sends "factually accurate or, in the case of estimates and judgments, fairly and properly based after appropriate enquiries" (Notifications 6.1). Botminds' COREP & FINREP Reporting was designed around those duties: its agents read, populate, validate and explain, and people accept, approve, release and attest.
This guide takes the questions a CFO or head of reporting asks before relying on AI in a return, and answers each from the rules, the regulators' own surveys and the research.
Who answers for what in an AI-prepared return
| Who | What they do | What they never do | What they must be able to show |
|---|---|---|---|
| Senior manager holding PR Q | Owns the production and integrity of regulatory reporting; can sit with the CFO (SMF2) | Delegate the responsibility to a vendor or a model | How governance and controls deliver returns of appropriate quality |
| Head of regulatory reporting | Releases the return when every check has passed | Release with an open override or unexplained difference | The release checklist and its evidence |
| Manager | Approves mappings, overrides and explanations | Approve their own work | The reason code and the impact seen at approval |
| Analyst | Accepts or rejects each agent proposal | Accept without checking the cited paragraph | The citation and exposures behind each acceptance |
| Agents | Read releases, populate cells, run rules, explain differences and drivers | Change a mapping, override a cell, accept their own explanation, move a date, submit | Lineage for every cell; the prompt and model version behind every statement |
Can AI prepare FINREP?
It can do much of the preparing, under rules written for people. FINREP is a defined set of templates, F 01.01 to F 19.00 quarterly and the rest semi-annually or annually, filled from the bank's general ledger and loan systems under instructions the EBA turns into a data point model with "a clear, machine readable structure for reporting requirements" (EBA, 2026). Reading those instructions, placing ledger balances and exposures in the right rows, running the published validation rules and explaining a movement are all tasks software can do. Deciding what an instruction means for a product the bank invented, and signing that the return is right, are not.
The EU regulation is indifferent to how the cells were filled. It requires institutions to submit the information in the prescribed formats and by the prescribed dates (Implementing Regulation (EU) 2024/3117); it says nothing about tools. The same is true of the PRA's Reporting (CRR) part. The constraint is the accuracy duty and the accountability above it.
Is AI allowed in regulatory reporting in the UK?
Nothing we found in the PRA Rulebook prohibits it. The PRA's model risk principles expect firms to manage AI where it is used in models: SS1/23 lists among its sub-principles "identifying and managing the risks associated with the use of artificial intelligence in modelling techniques such as machine learning", and its principles "are applicable to all types of models that are used to inform business decisions ... including models used for financial reporting purposes" (PRA SS1/23). Its expectations are addressed to banks with internal model approval for regulatory capital; other banks will find in it the standard a supervisor is likely to reach for.
The EU AI Act points the same way for the EU. Its list of high-risk uses in finance names "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score" and life and health insurance pricing; supervisory reporting is not on it, and the recitals say AI systems provided for by Union law "for prudential purposes to calculate credit institutions' and insurance undertakings' capital requirements should not be considered to be high-risk" (Regulation (EU) 2024/1689, Annex III and recital 58). Not being high-risk under the AI Act does not lower the reporting duty; it only means the duty comes from banking rules, not AI rules.
Who is accountable for regulatory returns?
The firm, and within it a named senior manager; never the tool. The PRA's Fundamental Rules require a firm to run its affairs responsibly and effectively (Rule 6) and to be open and cooperative with its regulators (Rule 7) (PRA Rulebook, Fundamental Rules). Those are the rules the PRA's reporting fines were brought under: Citi in 2019 for Rule 6 and Notifications 6.1, Metro Bank in 2021 for Rules 2 and 6, Standard Chartered in 2021 for Rules 6 and 7. None of those cases turned on the technology; each turned on governance, controls, interpretations and resources.
That shapes how AI can be used. A return the firm cannot explain cell by cell is a return it cannot defend, however it was made. The PRA said in 2019 that a firm must be able, on request, to show how its governance and controls produce returns of the right quality and to list the key interpretations behind them (PRA, 2019). An AI that fills cells without showing where each number came from makes that harder, not easier. The cases are set out in the PRA's Dear CEO letter on regulatory reporting, and three fines.
What does the PRA expect from senior managers on regulatory returns?
Oversight of the whole process, front to back, with the power to act on it. The 2021 letter says "the relevant senior manager should be empowered to have overall oversight of the effectiveness of front-to-back processes and cross-functional processes to ensure the delivery of accurate and reliable regulatory returns", and warns against pushing responsibility so far down that nobody senior sees the whole (PRA, 2021). The 2019 letter suggests "regular, comprehensive reviews of the effectiveness of the governance, controls and other processes around regulatory returns" and "deep dives that look at the accuracy of the returns themselves".
For an AI-prepared return, oversight means the senior manager can see three things without asking a data scientist: which cells the agents produced and from what, which decisions people took and on what evidence, and where the two disagreed. The solution's sample bank has its CFO attest each return as an internal control, with the evidence on one page; the PRA prescribes the responsibility, not that form of sign-off. How a team is organised around that responsibility is in head of regulatory reporting: the team after Basel 3.1 and DPM 2.0.
Do banks use AI agents for regulatory reporting?
UK firms use AI agents widely, and mostly to recommend rather than to act. The Bank of England and FCA's survey published on 26 October 2026 found that "80% of respondents reported having AI agents deployed", that most "deployed AI agents with only limited autonomy", and that "only 2% reported deploying agents with broad autonomy" (Bank of England and FCA, 2026). Even including plans for the next year, no more than 9% expected agents to "change limits, thresholds and controls". The survey does not break out regulatory reporting, but generative AI was "most widespread in Operations and IT and Risk and Compliance", and use "was expected to increase most in ... compliance and regulatory activities".
UK financial firms use agents to support decisions, not to make them
86%
of respondents use AI, up from 75% in 2024
196 firms responded
80%
have AI agents in production for decision support: agents recommend, humans decide
2%
have agents deployed with broad autonomy
90%+
report human approval, pre-deployment review and vendor due diligence as controls
What AI does well in COREP and FINREP work, and what it does not
AI reads and extracts well; it links data to the exact regulatory concept less reliably. Researchers who built a benchmark on tagging financial statements against more than 10,000 US GAAP concepts found that "while models generalize well in extraction, they struggle significantly with fine grained concept linking" (FinTagging, arXiv preprint, not peer reviewed, 2025). Placing an exposure in an exposure class or a general ledger account in a FINREP row is concept linking. That is why the design that holds up is one where AI proposes the link with its evidence and a person accepts it, and where deterministic checks such as the published validation rules run as rules, not as a model's opinion.
Where an agent helps, and where a person must decide
Agents can do it: Read it, keep what touches the bank's templates, draft mapping proposals with citations.
A person must decide it: Accept each proposal after checking the paragraph and the exposures it moves.
Agents can do it: Populate cells from the general ledger and risk systems, each with its lineage, using approved mappings only.
A person must decide it: Override a cell, with a reason, and have a second person check it.
Agents can do it: Run every rule on every draft; explain each failure and its likely cause.
A person must decide it: Fix the cause; never edit data just to make a rule pass.
Agents can do it: Check the relationships and draft the rule that explains each difference.
A person must decide it: Accept or reject the explanation.
Agents can do it: Find the instruction, the Q&A and past decisions that bear on a question.
A person must decide it: Decide the interpretation, own it and review it.
Agents can do it: Assemble the evidence pack and the trail.
A person must decide it: Release it, attest it, submit it, and report any material error.
How is AI used in COREP reporting with this solution?
Through seven agents with written limits, each step visible. The flow below follows one quarter at the solution's sample bank, a fictional UK lender, from a release to a submitted return. Analysts accept, managers approve, the head releases and the CFO attests; the attester never submits.
Seven agents propose and check; five people decide
Agent
Release agentReads each Bank of England taxonomy and PRA policy statement and proposes mapping changes for the bank's templates only.
Never: change a mapping
A person decides
Analyst, then managerThe analyst accepts a proposal; a different manager approves it with a reason code after seeing its impact.
Agent
Preparation agentPopulates COREP and FINREP and writes each cell as a sentence with its lineage.
Never: override a cell or use a feed that failed its tie-out
Agent
Validation and Cross-template agentsRun every published rule and check COREP against FINREP, explaining failures and differences.
Never: edit data to pass a rule or accept their own explanation
Agent
Parallel-run, Deadline and Evidence agentsExplain the Basel 3.1 difference by driver, watch the calendar, build the attestation pack.
Never: send parallel results to the regulator or move a regulatory date
A person decides
Head, CFO, submitterThe head releases, the CFO attests, someone other than the attester submits.
Every action, by people and agents, with its evidence
What makes an AI-prepared return defensible
The same things that make any return defensible, made visible: the source behind every number, the person behind every judgement, and a trail a supervisor or auditor can follow without the team in the room. The checklist below is what we would ask of any AI used on COREP or FINREP, this solution included.
Eight tests for AI in a COREP or FINREP return
- Every cell drills to its source
Exposures, mapping rule, ledger balance and source system, not a model's summary.
- Every agent statement cites a passage
A paragraph of a policy statement, a ledger balance, an exposure.
- Proposals, never silent changes
A mapping or a cell changes only when a named person approves.
- Two people on every judgement
Maker and checker are different people, enforced by the system.
- Uncertainty routed to a person
Below a confidence threshold the administrator sets, a second analyst reviews.
- Rules run as rules
Published validation rules and tie-outs run deterministically; AI explains the result.
- Versions on the record
The prompt, model and rules version behind each run are kept with the return.
- Customer data protected
Names masked by default; revealing one needs a reason and is logged.
The tests matter more than the model. A return can pass every validation rule and still be wrong, which is the subject of COREP validation rules pass; the return can still be wrong; AI that shows its sources makes that kind of error easier to find, and AI that hides them makes it harder.
The source behind one exposure, with the passage a citation points to
Questions people ask
Does the PRA allow AI to prepare regulatory returns?
We found no PRA rule that prohibits it. The firm stays bound by the accuracy duty in Notifications 6.1 and the Fundamental Rules, a senior manager holds prescribed responsibility for regulatory reporting, and banks with internal models apply SS1/23's model risk principles, which cover AI used in models for financial reporting.
Can AI map data to EBA templates?
It can propose mappings, and it is good at reading the instructions and data point definitions. Research finds language models weaker at linking data to the exact concept than at extracting it, so each proposed mapping needs its citation and a person who accepts it, and a second person who approves it.
Can AI explain validation rule failures?
Yes, and it saves time: a rule failure is a formula and a set of cells, and an agent can state it in words with the amount and the likely cause. In the solution's sample quarter, three failing rules traced to one unmapped product family, and approving one mapping fixed all three.
Is regulatory reporting high-risk under the EU AI Act?
It is not among the Act's listed high-risk uses, which in finance cover creditworthiness and credit scoring of natural persons and life and health insurance pricing. The reporting duties under EU banking law apply in full whatever tools a bank uses.
Who signs an AI-prepared COREP or FINREP return?
The same people who sign any return. The PRA requires a senior manager to hold the prescribed responsibility for regulatory reporting; how the firm evidences sign-off is its own control, and in the solution's sample the CFO attests and someone else submits.