The biggest regulatory reporting challenges are not in the arithmetic of a report but in what feeds it and how it is classified: data quality problems that nobody traces to the reports they affect, interpretations of instructions that nobody challenges, and reconciliations that fall behind until the filed figures are wrong. That is what the public enforcement record shows. In July 2024 the Federal Reserve and the OCC penalized Citigroup and Citibank about $135.6 million, the OCC citing a lack of processes to monitor how data quality concerns affect regulatory reporting. In 2019 the Bank of England's Prudential Regulation Authority fined three Citi entities £43.9 million over the controls behind their regulatory returns. And Republic First Bank's examiners found weak reconcilements and inaccurate Call Reports before it failed in 2024. Botminds' Regulatory Reporting Reconciliation was designed around the controls these cases describe: every reported figure tied to its source, every difference explained or traced, every break owned and dated.
Four public cases, and what each cost
$135.6M
Federal Reserve and OCC penalties on Citigroup and Citibank, July 2024
£43.9M
PRA fine on three Citi entities for regulatory reporting controls, November 2019
$664M
secured borrowings Republic First reported as unsecured on its June 2023 Call Report
3years
of revisions the FDIC said institutions could file after misreporting uninsured deposits in 2023
What are the biggest regulatory reporting challenges?
Read across the public cases, the biggest regulatory reporting challenges are five: knowing which reported figures a data problem touches, interpreting complex instructions correctly and consistently, keeping reconciliations current, documenting the control framework well enough that someone else can follow it, and putting enough skilled people on the work. None of them is solved by a faster report generator, and each shows up first as a difference between two places that should agree.
Five cases, the control that failed, and what it cost
| Case | What the record says failed | Consequence | The reconciliation question it raises |
|---|---|---|---|
| Citigroup and Citibank, 2024 | Data quality management remediation behind plan; no processes to monitor the effect of data quality concerns on regulatory reporting | Fed $60.6M and OCC $75M, on top of 2020 orders | Which reported figures does each known data issue touch, and by how much? |
| Citi UK entities, 2019 | Controls and governance over UK regulatory returns not designed or operating effectively; technical interpretations insufficiently robust; documentation inadequate | PRA fine of £43.9M after a 30% settlement discount | Is every classification backed by a written, reviewed basis? |
| Republic First Bank, 2023–2024 | Unresolved weaknesses in financial account reconciliations; inaccurate Call Reports; secured borrowings reported as unsecured | Amended Call Reports; failure in April 2024 with an estimated $667.1M loss to the Deposit Insurance Fund | How old are the open breaks, and who owns each one? |
| Uninsured deposits, industry-wide, 2023 | Estimated uninsured deposits reduced for collateral or for subsidiaries' intercompany deposits, against the instructions | Amendments of up to three years of Call Reports, or more | Does each schedule follow its own instruction, even where another schedule eliminates the same balance? |
| Citi UK returns, the six matters | Errors with "a material or potentially material impact on the returns" | Returns the PRA called unreliable | Which differences were explained by habit rather than by evidence? |
Why was Citi fined for data quality?
Citi was fined in 2024 because it had not done what its 2020 orders required on data quality, and because, in the OCC's words, it lacked a way to see what bad data did to its regulatory reports. The Federal Reserve fined Citigroup $60.6 million for violating its 2020 enforcement action, saying the firm "has made insufficient progress remediating its problems with data quality management and failed to implement compensating controls to manage its ongoing risk" (Federal Reserve, July 10, 2024). The 2020 order it enforced had addressed "data quality management and regulatory reporting", among other areas (Federal Reserve order).
The OCC's action the same day assessed $75 million against Citibank, based on violations of its own 2020 order "and lack of processes to monitor the impact of data quality concerns on regulatory reporting" (OCC NR 2024-76). The 2020 OCC order itself had come with a $400 million civil money penalty, according to the Federal Reserve's 2024 order. The status of the orders after July 2024 is not stated here; the agencies' own releases are the place to check it.
In addition, the Bank lacks processes to monitor the impact of data quality concerns on regulatory reporting.
OCC, order for a civil money penalty against Citibank, N.A., AA-ENF-2024-51, July 2024
That sentence describes a reconciliation problem exactly. A bank with thousands of known data issues needs to know which of them change a figure on the Call Report or the FR Y-9C, by how much, and whether the change is inside or outside the tolerance. A data issue that never reaches a report is a data problem; one that does is a reporting problem, and the only way to know which is to tie the reports back to the sources the issues live in.
Compensating controls: what a bank owes while its data are being fixed
A compensating control is what protects the reports while the underlying data are still being repaired, and the Federal Reserve faulted Citigroup for not having enough of them. Its 2024 order says the 2020 action required a plan to improve data quality management "and actions to ensure that appropriate compensating controls across Citigroup are implemented and maintained until the end state is achieved and functioning as intended", and found progress on those controls "has not been adequate" (Federal Reserve order, July 2024).
For regulatory reporting, the natural compensating control is an independent comparison of each reported figure with another view of the same balance. Data remediation takes years at a large bank; a cross-report reconciliation can run every night of the next close. It does not fix the data, but it tells the reporting team which known data problems reach a filed figure this quarter, and by how much, which is what the OCC said was missing.
What was the PRA fine for regulatory reporting?
In November 2019 the Prudential Regulation Authority fined Citigroup Global Markets Limited and two Citi UK branches a combined £43.9 million for failings in the internal controls and governance behind their regulatory reporting between June 2014 and December 2018; without a 30% settlement discount it would have been £62.7 million (Bank of England, November 26, 2019). The PRA found errors including six substantive matters with a material or potentially material impact on the returns, and concluded that "the returns submitted were unreliable and did not provide the PRA with an accurate picture of CGML's capital or liquidity position."
Two of the PRA's findings speak directly to reconciliation work. It found that the way CGML settled technical interpretations of the reporting rules was not robust enough for decisions that complex, given how much they could move the returns (the PRA's Dear CEO letter on regulatory reporting quotes the finding). And it found the firms' documentation of multiple aspects of their UK regulatory reporting control framework inadequate for their size and complexity. An interpretation is a classification decision; a reconciliation that keeps the basis for every classification and every reconciling item is where those decisions become visible and reviewable.
Republic First: reconciliations fall behind, then the Call Report is wrong
Republic First Bank shows the sequence from the inside, because the FDIC's Inspector General reviewed it after the bank failed. Through 2023, according to the review, the bank "continued to face delays in meeting required financial reporting deadlines, due to unresolved material weaknesses, particularly related to financial account reconciliations" (FDIC OIG, EVAL-25-01). In September 2023 it amended three quarters of Call Reports after its auditors raised a deferred tax asset valuation issue, and the amendments dropped it to "Adequately Capitalized". The Pennsylvania Department of Banking and Securities closed the bank on April 26, 2024, and the FDIC recorded a final estimated loss to the Deposit Insurance Fund of $667.1 million.
The misreported borrowings had a cost of their own. The FDIC's comments printed in the review explain that its "September 2023 liquidation analysis was based on inaccurate June 30, 2023, Call Report data", because the bank had reported $664 million of secured borrowings as unsecured on Schedule RC-O. The error was corrected in a second analysis in April 2024. A supervisor planning for a failure relied on the Call Report, and the Call Report had one large balance on the wrong line.
A misread instruction, amended industry-wide
The fourth case is not one bank but many. In July 2023 the FDIC told institutions that some had been understating estimated uninsured deposits on Schedule RC-O, either by reducing them for deposits collateralized with pledged assets, which has no bearing on deposit insurance coverage, or by leaving out subsidiaries' intercompany deposits that the instructions require there even though they are eliminated from the balance sheet (FDIC FIL-37-2023). Those institutions were told to amend, and could submit up to three years of revisions.
The second error is a reconciliation failure in its purest form. The same balance, a subsidiary's deposit at the bank, is correctly eliminated on one schedule and must be included on another. A process that copies the elimination everywhere because it was right once will be wrong on RC-O every quarter, and nothing inside RC-O will show it.
The pattern under the cases
Under all four cases is the same pattern: the error lived in a data source, a mapping or an interpretation, and it reached the report because nothing compared the report with an independent view of the same balance and asked why they differed. None of the orders or reviews faults a bank's addition. The controls they describe are about knowing where each figure came from, whether a known problem touches it, and whether a classification has a basis someone reviewed.
What the record said, and the reconciliation evidence that answers it
What the record said: No processes to monitor the impact of data quality concerns on regulatory reporting.
The evidence a reconciliation can keep: Each break traced to the feed or mapping that caused it, with the reported figures it moved and by how much.
What the record said: An approach to technical interpretations that was insufficiently robust.
The evidence a reconciliation can keep: A cited basis for every reconciling item and classification, re-derived each run and approved by someone other than its author.
What the record said: Inadequate documentation of the control framework.
The evidence a reconciliation can keep: Rules with versions and owners, runs with every value and its source, exportable for examiners.
What the record said: Delays from unresolved weaknesses in account reconciliations; inaccurate Call Reports.
The evidence a reconciliation can keep: Every break with an owner, a due date and an age, escalated before the filing date.
What the record said: A schedule reduced against its own instructions.
The evidence a reconciliation can keep: A rule comparing the schedule with an account-level recalculation under that schedule's rules.
The evidence of a quarter in Regulatory Reporting Reconciliation, ready before anyone asks
What the cases do not show
The cases do not show that any of these banks lacked reconciliation software, and none of the orders prescribes a tool. What they describe are governance and control failures: remediation that missed its milestones, interpretations nobody challenged, documentation nobody could follow, reconciliations that fell behind while resources went elsewhere. A product cannot supply governance. What it can supply is the evidence that governance needs: which figures depend on which sources, which differences have a basis, which breaks are open and whose they are.
The cases also come from very different banks. Citi is a global systemically important group under multi-year orders; Republic First was a $5.9 billion bank whose reporting problems ran alongside the liquidity and capital problems that caused its failure; the uninsured deposit errors were found at a number of institutions at once. The common thread is not size or complexity. It is that each error lived somewhere other than the report, and reached it unchallenged.
What controls prevent regulatory reporting errors?
The controls that prevent regulatory reporting errors are the ones the OCC lists in its examiner booklet: separation of duties, dual controls and independent reconcilements, a preparer and an independent reviewer, quality control before filing and quality assurance after it, and an audit function that tests them (OCC Comptroller's Handbook, Regulatory Reporting). Read against the cases, each control has a specific job.
Seven controls, each matched to a case it answers
- Tie every reported figure to its source, every close
Answers Citi 2024: a data issue that moves a reported figure shows up as a difference.
- Keep a written basis for every classification and reconciling item
Answers the PRA's interpretation finding: a decision with a basis can be reviewed and challenged.
- Re-derive recurring explanations each quarter
Answers the RC-O case: an elimination right on one schedule is not assumed right on another.
- Give every break an owner and a due date before the filing date
Answers Republic First: reconciliations cannot quietly fall behind.
- Separate who prepares, who reviews and who approves
The OCC's preparer and independent reviewer, applied to closures and adjustments.
- Test the rules with planted errors
Shows the control would catch a misclassification before an examiner does.
- Keep the evidence as the work happens
Answers the PRA's documentation finding: the framework can be followed by someone else.
Testing the rules is a step most programmes skip; data reconciliation testing with planted errors sets out how. Giving every break an owner is the subject of who waits on whom when a reconciliation break is open.
What examiners do next: materiality and refiling
When examiners find a misstatement, they decide whether it is material and, if so, which reports must be refiled and how far back. The OCC's booklet lists what goes into that judgement: "Considerations include the nature and root causes of the errors, history of refilings or call report-related violations, if any, and the effect of the refiling on other publicly available financial statements" (OCC Comptroller's Handbook, Regulatory Reporting). The FDIC's examination manual adds that Call Reports filed with significant errors, including errors that require an amendment, may be treated as a substantive violation of its Part 304 reporting rule and can warrant a matter requiring attention (FDIC RMS Manual, Section 4.5).
"History of refilings" is the phrase to notice. An examiner judging a misstatement looks at the bank's track record, so the cost of an error depends partly on the errors before it. A reconciliation that finds a classification error before filing, rather than in the next examination, changes the history an examiner reads. To see how the sample bank's close keeps that history, start from Regulatory Reporting Reconciliation.
Breaks with owners and clocks in Regulatory Reporting Reconciliation, so none ages into a filed error
Questions people ask
What did the OCC fine Citibank for in 2024?
The OCC assessed a $75 million civil money penalty against Citibank on July 10, 2024, based on the bank's violations of its October 2020 order and its "lack of processes to monitor the impact of data quality concerns on regulatory reporting", according to the OCC's news release. The same day it amended the 2020 order to require the bank to prioritize the remaining remediation.
What regulatory reporting failures lead to fines?
In the public cases, fines followed control failures rather than single errors: remediation that missed its milestones, no way to see how data problems affected the reports, unreliable returns from weak governance and documentation. Statute also allows daily civil money penalties for Call Reports filed late or with false or misleading information, in three tiers depending on whether the failure was inadvertent, otherwise, or knowing or reckless.
What caused Republic First Bank to fail?
The review found the direct cause was the bank's conclusion that it could no longer hold its held-to-maturity securities to maturity; with too little liquidity, it had to recognize large fair value losses and became critically undercapitalized. It also found "the dysfunctional Board and management team was a significant contributing factor". Reporting failures ran alongside: unresolved reconciliation weaknesses, delayed filings and inaccurate Call Reports.
What is data quality management in banking?
It is the set of standards, owners, checks and remediation that keeps data accurate from the point it enters the bank. The OCC's booklet calls data quality fundamental to accurate regulatory reporting and ties it to the data's source. Citi's orders show supervisors expect a bank to know which reported figures each data quality problem affects.
Are regulatory reporting challenges different in the UK and the EU?
The reports differ, but the failures in the record look alike. The PRA's 2019 Citi case turned on interpretations, documentation and governance behind the returns, the same themes as the U.S. orders. Banks reporting COREP and FINREP face the additional load of frequent releases of the European Banking Authority's reporting framework.