Regulatory breach reporting is the procedure a financial firm follows when it discovers that it has broken, or may have broken, a legal or regulatory requirement. Staff are required to report incidents internally; the compliance function records each one in a breach log, investigates the cause and extent, and assesses whether it is significant enough to be notified to the regulator. Significance is judged by factors such as customer harm, financial loss and duration.
Many regimes impose a general duty to tell the regulator promptly of anything it would reasonably expect to know, alongside specific deadlines for certain events. A notification normally describes what happened, who was affected, the immediate steps taken and the plan to put things right, which may become a regulatory remediation plan. Late or incomplete reporting is itself a breach and tends to worsen any enforcement action. Breach data is reviewed within the compliance monitoring programme and supports regulatory compliance reporting to the board.