Market Watch 82

Remediation is the process by which firms address deficiencies, errors or non-compliance identified in their transaction reporting data, systems or processes. Remediation plans vary based on an issue’s scale and complexity, and the firm’s operational setup. We assess the appropriateness of a remedial timeline on a case-by-case basis. While some issues may take time to remediate due to their complexity, others should be addressed swiftly to prevent prolonged risk exposure. We expect firms to be proactive and transparent throughout the process. 

We have seen remedial exercises extending beyond reasonable timelines due to:

• Taking excessive time to present a remedial plan or implement corrective actions.
• Missing deadlines set by internal governance bodies or the FCA.
• Requesting extensions without justifiable reasons.
• An absence of measurable progress between regulatory check-ins.
• Repeatedly revising root causes or impacted volumes of transaction reports. 

We have identified common themes in the root cause(s) for delayed remedial work: 

• Internal processes: Siloed teams, fragmented ownership of tasks and lengthy approval chains slow down decision making.
• Resourcing: Assigning insufficient resource to resolve issues effectively and competing business priorities result in slower response times.
• Difficulty in tackling the root cause: Focus on fixing the symptoms rather than the root cause leads to issues resurfacing.
• Compliance culture: Reactive culture results in firms addressing issues only when prompted.
• Governance: Weak structures and lack of accountability lead to loss of momentum as remedial work is not managed centrally or treated with urgency. 

Back reporting is the process by which firms correct inaccurate and incomplete transaction reports. Delays in back reporting leave us unable to trust data and potentially limit our ability to detect and investigate market abuse.

We distinguish between protracted remediation of an issue and delayed back reporting as each presents a different set of operational and compliance risks. The following case studies give an overview of common causes for delayed back reporting.

Case study 1: Crystallised compliance risk

A firm deploys a fix for an issue but fails to identify and correct all affected historical reports. Even though the root cause has been resolved, the firm remains non-compliant until it has completed back reporting. This indicates ineffective compliance oversight. It suggests the firm lacks internal processes to ensure timely corrections, raising concerns about accountability and non-financial risk management.

Case study 2: Internal governance weakness 

A firm has a complex book of remedial work involving a range of issues, each at a different stage of its resolution lifecycle. The firm is not demonstrating a risk-based approach to sequencing actions and directing resources, such as prioritising back reporting for the waiver indicator over submitting transaction reports for unreported exchange traded derivative transactions. This raises concerns about the firm’s internal governance, particularly its operational risk management and compliance delivery.

Case study 3: Data access and infrastructure limitations

A firm is facing significant delays in back reporting due to inaccessible historic data. This is because data was archived incorrectly following a system migration. This raises concerns about data governance, record keeping controls and data retention as part of change management. Without accurate and accessible past records, the firm may potentially be left exposed to unresolved reporting failings. 

Case study 4: Impact on BAU

A firm began a large back reporting exercise but underestimated the impact on BAU processes. As compliance and operational teams diverted resources to data retrieval, validation, testing and regulatory engagement, the day-to-day reporting accuracy declined as exception management was deprioritised. The firm subsequently created an independent back reporting workflow with dedicated resource, allowing tasks to be reprioritised and addressing individual workflow needs without crossover.   
 

Breach notifications play a critical role in data quality. In line with observations in Market Watch 70[1], we expect breach notifications to clearly describe the issue, its root cause, and highlight any gaps or weaknesses in reporting processes, data governance and controls. 

We received 241 breach notifications in Q1 2025. The table below (Table 1) summarises our supervisory observations and best practices from our review of these notifications. 

We will continue to monitor the quality of breach notifications closely and to that end we introduced a quality flag as part of our case management and record keeping.

Our transaction reporting[3] page gives further information. Please direct any questions about transaction reporting and instrument reference data to [email protected].