Regulatory reporting solutions for COREP and FINREP take a bank's general ledger, risk and treasury data, fill the supervisor's templates, run the published validation rules and produce the file the regulator accepts. Every serious product does that. What separates them is what happens around it: how fast a new release becomes approved mappings, whether any cell can be traced to the exposures behind it, whether COREP is checked against FINREP, where interpretations live, and what evidence the senior manager who answers for the return can read. Botminds' COREP & FINREP Reporting is one answer, built on agents that read, populate, validate and explain while people decide. The ten questions below are written to be asked of any solution, ours included, and each comes with the proof to demand.
The questions follow the hardest parts of the work in 2026 and 2027: five EBA releases in two years, a quarterly cycle of validation rule changes, the move to DPM 2.0, UK Basel 3.1 from 1 January 2027, and a supervisor that has fined banks for interpretations and controls rather than for arithmetic.
Ten questions for a COREP and FINREP solution, and the proof each needs
| Question | Ask to see, on your own data | Why it matters |
|---|---|---|
| 1. Which taxonomy, release and rules version, for which reference date? | The Bank of England 3.7.0 and 4.1.1 packages, or EBA 4.4 phase 1, loaded with their validations | UK and EU now run different taxonomies; hotfixes and re-uploads follow releases |
| 2. How does a new release become approved mappings? | Last release narrowed to your templates, with proposals, citations and the time to approval | Reading the release is the biggest block of a quarter's work |
| 3. How are small validation packages and deactivations handled? | Which rules version ran on each draft, and what replaced a deactivated rule | The EBA changes rule status every quarter |
| 4. Can any cell be traced to its exposures and source? | A random cell opened down to exposures, mapping rule and source system | Valid is not accurate; only the source shows a misclassified exposure |
| 5. Is COREP checked against FINREP? | The relationships checked and the rule behind each difference | No EBA validation rule links the two frameworks |
| 6. How does it run Basel 3.1 in parallel? | C and OF templates for one reference date, the difference by driver | The first UK Basel 3.1 quarterly return is due 12 May 2027 |
| 7. Where do interpretations live, and who owns them? | The register: question, answer, citation, owner, review date | The PRA asks firms to find, validate and correct their interpretations |
| 8. How is separation of duties enforced? | An attempt to approve your own mapping or override, refused | Maker-checker by policy fails when it is not enforced |
| 9. What does the accountable senior manager see? | The evidence pack for one return, on one page | A senior manager holds prescribed responsibility for regulatory reporting |
| 10. What happens when a submitted number is wrong? | The trail from finding to correction, resubmission and notice | Corrections are due without undue delay; late notice drew a fine |
What should a regulatory reporting solution include?
At minimum: the current templates and taxonomy for every framework the bank files, a mapping layer from general ledger accounts and product codes to template rows, the published validation rules, a filing format the regulator accepts, and controls over who changes what. The EBA describes its data point model as containing "all the relevant technical specifications necessary for developing an IT reporting solution" (EBA), so the specification is public. What a bank buys is everything the specification leaves out: the bank's own data, its own interpretations, and the evidence that the two met correctly.
The PRA has said what that evidence must show. Its 2021 letter expects reconciliation to the general ledger in every cycle, controlled spreadsheets and other end-user tools, and documented interpretations (PRA, 2021). A solution that fills the templates but leaves those to spreadsheets beside it has solved the easy half.
What kinds of regulatory reporting solutions are there?
Four kinds of product are sold under the label, often combined. Knowing which one you are looking at tells you, before a demonstration, which questions it will struggle with.
Four kinds of COREP and FINREP solution, by what each does
| Kind | What it does | Strong on | Ask hardest about |
|---|---|---|---|
| Template and filing engine | Holds the templates and taxonomies, runs the rules, produces the XBRL file | Questions 1 and 3 | Questions 4, 5 and 7: lineage, cross-checks, interpretations |
| Data and calculation platform | Builds a regulatory data layer and calculates risk-weighted amounts from it | Question 4, if lineage is kept | Question 2: how fast a release changes its rules |
| Managed or outsourced service | People outside the bank prepare or review the returns | Capacity in peak weeks | Questions 7 and 9: the bank keeps the responsibility |
| Agents that read, map, check and explain | Propose mappings from releases, populate, explain failures and differences, assemble evidence | Questions 2, 4, 5 and 9 | Question 8, and whether people really decide |
Questions 1 to 3: is it current, and how fast does it change?
1. Which taxonomy, release and rules version, for which reference date? A UK bank files on the Bank of England Banking XBRL taxonomy, version 3.7.0 today and 4.1.1 for rules applying from 1 January 2027; the Bank applies later EBA taxonomies to UK firms only where a PRA consultation says so (Bank of England). An EU bank files on the EBA line, where release 4.4's first phase was finalised on 12 October 2026 and a hotfix "may" follow in January 2027 (EBA). Ask the vendor to open both, on the dates you file.
2. How does a new release become approved mappings? This is where the hours go. Ask for the last release the vendor processed, narrowed to your templates: how many changes it read, how many touched you, how many became mapping proposals, with what citations, and how long until each was approved. In the solution's sample bank a 312-change release came down to 46 that touched its templates and 16 mapping proposals, with a design target of 4 business days to an approved mapping against 2 to 4 weeks by hand. How the reading works is in EBA reporting framework 4.4: inside the agent that reads a release.
3. How are small validation packages and deactivations handled? The EBA publishes a small validation rules package every quarter, which can switch rules off, switch them back on or change their severity (EBA). Ask which rules version ran on each draft of last quarter's return, and what the bank checks in place of a deactivated rule.
Questions 4 and 5: can it prove a number, not just pass a rule?
4. Can any cell be traced to its exposures and source? Validation rules test consistency, not truth; a misclassified exposure passes them. Pick a cell at random in a template the vendor did not prepare for the demonstration and ask to see the exposures in it, the mapping rule that placed each one, the ledger balance it ties to and the source system. If that takes a separate tool or a day's work, the trace will not be there when a supervisor asks. Why the rules are not enough is in COREP validation rules pass; the return can still be wrong.
5. Is COREP checked against FINREP? No published EBA rule does it. Our count of the EBA's validation rules file for release 4.4 found no rule that reads both a COREP and a FINREP table (EBA, October 2026), so own funds against equity, exposures against loans and advances, and defaulted exposures against non-performing ones are the bank's own checks. Ask how many relationships the solution checks, and to see one legitimate difference explained with its rule.
One cell, down to the mapping rules that placed its exposures
Questions 6 and 7: Basel 3.1 and the interpretations behind it
6. How does it run Basel 3.1 in parallel? UK Basel 3.1 renames and redraws the templates: own funds requirements become OF 02.00, a new OF 02.01 reports the output floor, standardised credit risk becomes OF 07.00, and the old operational risk templates give way to OF 16.00 (PRA PS1/26 Appendix 18). Ask to see the current and Basel 3.1 versions of one return for the same reference date, and the difference in total risk exposure explained by driver, each opening its cells. The dates that fix the plan are in Basel 3.1 reporting: a platform plan that is live by 12 May 2027.
7. Where do interpretations live, and who owns them? The PRA found interpretations built into firms' systems with little documentation, and asked firms to find them, validate them and correct them (PRA, 2021). A solution that buries an interpretation in a mapping table makes that work harder. Ask for the register: each interpretation with its question, its answer, the paragraph it rests on, its owner and its next review date.
"Where firms invested in data they had a simpler and more efficient infrastructure, requiring less manual intervention."
PRA, Thematic findings on the reliability of regulatory reporting, 10 September 2021
Questions 8 to 10: control, evidence and error
8. How is separation of duties enforced? Ask the vendor to try it: log in as the manager who accepted a proposal and approve it, or as the person who attested and submit. A solution that only records who did what will let both happen. In COREP & FINREP Reporting an analyst accepts, a manager who did not make the proposal approves, the head releases, the CFO attests, and the attester never submits; administrators cannot approve or attest.
9. What does the accountable senior manager see? A senior manager holds the prescribed responsibility for the firm's regulatory reporting (PRA Rulebook, 4.1(9)). Ask for the evidence pack for one return: how many cells have lineage, how many rules ran on how many drafts, every mapping change and override with its approver and reason, every audit event. If it takes the team a week to assemble, it is not evidence the senior manager can rely on.
10. What happens when a submitted number is wrong? The rule is to correct "without undue delay" (PRA Rulebook, Reporting (CRR) Article 3(5)), and the PRA expects material errors to be resubmitted. Standard Chartered was fined £46.55 million in 2021 partly for spending four months investigating a reporting error before telling the PRA (PRA). Ask to see how the solution traces an error to every return and cell it touched, and who is told when.
The evidence for one return, on one page
How do you compare regulatory reporting vendors?
On your own last quarter, not on their sample. Give each shortlisted vendor the same pack: last quarter's return as filed, the mapping rules in force, extracts from the source systems, and the most recent release your team has already worked through, with your own results held back. Then count four things: how many of your mapping changes it found, how many it proposed that you missed, how many cells it can trace to source, and how long a manager took to approve its proposals.
The illustration below shows the shape of that comparison using the solution's sample quarter: the share of the work a reviewer still has to look at after the reading and checking are done.
How much of a release and a return still needs a person, in the sample quarter
What is XBRL regulatory reporting?
It is filing a return as a structured XBRL file whose every value is tagged against the regulator's taxonomy. The EBA's XBRL taxonomies present "the data items, business concepts, relations and validation rules described by the DPM in the technical format of an XBRL taxonomy" (EBA), and the Bank of England publishes a filing manual that sets "filing rules that limit the flexibility of XBRL in the creation of XBRL instance documents" (Bank of England). In the UK, the PRA's own review notes that its data arrives through the Bank's BEEDS portal, the FCA's RegData platform and email, and that "most RegData collections are encoded in XBRL" (PRA DP1/26).
XBRL is a requirement, not a differentiator: every credible solution produces a valid file. COREP & FINREP Reporting hands its prepared return to the bank's existing regulatory reporting system and submission portal, which send the XBRL file and bring back the regulator's receipt.
How much does a regulatory reporting solution cost?
Licence prices are rarely published, so weigh any price against the cost of the work it changes. The EBA's 2021 study put the median annual cost of EBA supervisory reporting at about €305,000 for a small and non-complex institution and €4.8 million for a large one, plus implementation costs of €100,700 and €2.7 million for changes (EBA/REP/2021/15); the detail by size is in FINREP reporting requirements, and what they cost by bank size. The terms below are how we would build the case, priced in your own hours.
What a COREP and FINREP solution should be weighed against
Release reading
days per release × releases a year × day rate
The largest block in our estimate: about 15 days a quarter by hand
Head of reporting
Draft-by-draft fixing
days decoding failures × quarters
About 5 days a quarter in our estimate
Managers
Evidence and reconciliation
days assembling packs and COREP–FINREP ties × quarters
About 4 days a quarter, and the work supervisors test
Head and internal audit
Licence, integration, validation
licence + data connections + audit and model-risk review
Budget for read-only feeds from five or more source systems
CFO
How COREP & FINREP Reporting answers the ten questions, and where it does not
It fits a UK or EU reporting team that already has a filing route and wants the reading, preparing, checking and explaining done by agents with every decision left to people. It answers questions 2, 4, 5, 8 and 9 directly: a Release agent that narrows each release to the bank's templates, cells written as sentences with lineage, 86 COREP–FINREP relationships checked in the sample, enforced separation of duties, and an evidence pack built by an Evidence agent. It answers question 6 with a Parallel-run agent that explains the Basel 3.1 difference by driver.
It does not replace the bank's filing engine or submission portal, calculate internal model capital, decide an interpretation, or send parallel-run results to the regulator. The way to test the fit is the back-test above: a sample of your own templates, mappings and last quarter's return.
The Basel 3.1 difference, attributed to drivers before the first live return
Questions people ask
What is COREP reporting software?
Software that holds the COREP templates and taxonomy, fills them from the bank's data through mapping rules, runs the published validation rules and produces the XBRL file for the supervisor. Most products also cover FINREP and other prudential returns from the same data.
What should a regulatory reporting vendor demonstrate?
Its handling of your last release and last quarter, not a prepared sample: the changes it finds, a random cell traced to source, COREP checked against FINREP, a refused self-approval, and the evidence pack for one return. Those are the points the PRA's letters and fines turned on.
Do we need separate solutions for UK and EU COREP?
Not necessarily, but the solution must run two lines: the Bank of England taxonomy for the UK entity and the EBA releases for EU entities, with different codes and dates. From 2027 the UK Basel 3.1 templates use OF codes, while the EU keeps its C codes.
Can a regulatory reporting solution make us compliant?
No product transfers the responsibility: the PRA places it on a senior manager of the firm. A solution can make the return provable, by tracing each number to its source and recording each decision, which is what the PRA asks a firm to demonstrate.
How long does a COREP and FINREP solution take to evaluate?
A back-test on one quarter and one release is enough to answer the ten questions. The work is mostly on the bank's side: providing the pack of last quarter's return, mappings, source extracts and release, and having a manager score the results.