Delegated Reporting: Rules, Liability, and Oversight

Delegated reporting is a regulatory arrangement in which a firm authorizes a third party — typically a broker, central counterparty, or specialist vendor — to submit its mandatory transaction reports. The task moves; the obligation does not. Across every major regime, the firm that owes the report almost always remains legally liable for its accuracy, completeness, and timeliness, even when someone else presses “send.”

What Delegated Reporting Actually Is

In a standard arrangement, your firm captures trade data internally and passes it to a delegate. The delegate formats it into the regulator’s required schema, validates it, and transmits it to the relevant trade repository or competent authority. The appeal is cost: smaller buy-side firms rarely want to build XML pipelines for multiple jurisdictions when a delegate already processes high volumes and spreads that infrastructure across clients.

This is not ordinary IT outsourcing. The delegate is fulfilling a specific regulatory obligation on your behalf, which means the arrangement sits inside a formal compliance framework with oversight duties, contractual requirements, and, in some cases, regulator notification rules that generic vendor relationships never carry.

Which Regimes Allow It

Delegation is built into the architecture of the largest transaction reporting regimes on both sides of the Atlantic, but the mechanics differ.

European Union

Three EU regulations expressly permit delegation. Article 9(1f) of the European Market Infrastructure Regulation (EMIR) allows counterparties and CCPs to delegate the reporting of derivative contracts to a third party.¹ Under Article 26(7) of the Markets in Financial Instruments Regulation (MiFIR), investment firms can report through an Approved Reporting Mechanism (ARM) or the trading venue that executed the transaction.² Article 4 of the Securities Financing Transactions Regulation (SFTR) permits delegation for repos, securities lending, and similar transactions.³

United States

Under SEC Rule 613 and FINRA’s Consolidated Audit Trail (CAT) rules, broker-dealers may use a “CAT Reporting Agent” provided the arrangement is governed by a written agreement setting out each party’s functions and responsibilities.⁴ FINRA’s Trade Reporting and Compliance Engine (TRACE) covers fixed-income transactions,⁵ and the CFTC handles swap data reporting under Dodd-Frank.

Who Is Liable When Reporting Goes Wrong

This is the question the arrangement turns on, and the answer varies more than compliance summaries often suggest.

EMIR: The Obligation Does Not Transfer

Under EMIR, the delegating counterparty retains complete responsibility for the correctness and timeliness of reported data. Germany’s BaFin states the position plainly: “The obligation of delivering a correct report will not pass to the third party. The party subject to the reporting obligation will not be released from this obligation until the trade repository has received a correct and full report.”⁶ Late submissions, format errors, or missed trades — the penalty lands on you.

MiFIR: A Narrow Carve-Out for the ARM

MiFIR takes a slightly different line. Investment firms are responsible for the completeness, accuracy, and timeliness of their reports as a general rule, but when they use an ARM or trading venue, they are not responsible for failures “attributable to the ARM or trading venue.” Those failures fall on the ARM or venue instead.²

This is not a blank pass. The same article requires firms to “take reasonable steps to verify the completeness, accuracy and timeliness of the transaction reports which were submitted on their behalf.” So even under MiFIR, you must actively check the output. And any error that traces back to the data you provided, rather than to the ARM’s processing, remains your problem.

CAT: No Contracting Away

FINRA’s position on CAT reporting agents is unambiguous: “The member receiving or originating the order…is responsible for complying with the CAT Rules, and cannot contract away or otherwise shift this responsibility to a third party.”⁴ The CAT Reporting Agent Agreement itself makes both the agent and the firm “solely responsible for ensuring that any information or data that CAT Reporting Agent submits to the CAT System is accurate and complete.”⁷

EMIR Refit: Mandatory Reporting for Certain Trades

The 2019 EMIR Refit went further than ordinary delegation. When a financial counterparty (FC) trades an OTC derivative with a non-financial counterparty sitting below the clearing threshold (an “NFC-“), the FC is “solely responsible, and legally liable, for reporting on behalf of both counterparties” and for ensuring the correctness of the reported details. The NFC- can choose to report its own side, but it must notify the FC first, and in that case the NFC- assumes responsibility and legal liability for its report.¹ UCITS management companies and AIFMs sit in a similar position: the management entity is liable for reporting OTC derivatives entered into by the funds it manages, not the fund itself.

The Common Thread

Across every major regime, the delegating firm carries the bulk of the liability. The MiFIR carve-out for ARM-attributable failures is the notable exception, and even that comes with ongoing verification duties. Your delegate is a service provider performing a task; the regulator still sees you as the party that owes the report.

Setting Up a Delegation Arrangement

A delegation relationship begins with due diligence and is formalized in a written contract. Skipping either step is itself a compliance failure.

Due Diligence

Before engaging a delegate, assess their operational stability, technology infrastructure, and record of accurate submissions. Data security standards such as ISO 27001 give you a benchmark for their information security controls.⁸ The review should also cover staffing depth, internal control frameworks, and the delegate’s ability to handle your specific instrument types and jurisdictions.

Due diligence is not a one-off. Your oversight duty runs for the life of the contract, so if the delegate’s systems degrade, staff turns over, or error rates climb, you need to catch it before the regulator does.

What the Contract Must Cover

At a minimum, the written agreement should address:

Scope: which instruments, transaction types, and regimes the delegate reports for.
Data security: how the delegate protects sensitive transaction data.
Performance metrics: measurable benchmarks for submission success rates, error rates, and resolution times.
Audit rights: your right to inspect systems, processes, and submission records.
Error correction: which party repairs and resubmits rejected data, and on what timeline.
Termination and transition: the process for an orderly handoff if the relationship ends.

For US firms, FINRA specifically requires that the written CAT Reporting Agent agreement outline each party’s functions and responsibilities, including exception management and error correction.⁴

Regulator Notification

Some regimes want to know you have delegated. Under EMIR, national competent authorities must be informed of reporting arrangements, particularly where a financial entity has sole responsibility for reporting on behalf of a non-financial counterparty.⁹ You also need to confirm the delegate has registered your Legal Entity Identifier (LEI) correctly with the trade repository, since LEIs are mandatory for counterparty identification under both EMIR and MiFIR.¹⁰

Oversight After Signing

Signing the contract is the easy part. The real work is verifying that your delegate submits accurate, complete, and timely reports every day.

Input Data Quality

You are responsible for the data you send. Transaction details need correct instrument classification, quantity, pricing, execution timestamps, and counterparty identifiers. A misclassified instrument or wrong price will produce a rejected or inaccurate report, and the liability traces back to you. Many jurisdictions require conformity with the ISO 20022 messaging standard to harmonize reporting across systems and repositories.¹¹

Reconciliation

Reconciliation means comparing what the delegate actually submitted against your internal trade records. For CAT reporting, FINRA expects firms to conduct daily reviews of the CAT Reporter Portal to confirm files were accepted and to identify submission or integrity errors, and to perform periodic comparative reviews of accepted CAT data against internal order and trade records.¹² The frequency and sample size must be “sufficiently representative of the firm’s overall CAT reporting volume.”¹³ A token monthly spot-check of 50 trades when you submit thousands daily will not satisfy the requirement.

When you use a reporting agent, FINRA also requires you to periodically obtain a complete set of the CAT data submitted on your behalf so you can independently validate accuracy.⁴ Any discrepancy should trigger error resolution immediately. Under the CAT rules, firms must repair errors by the T+3 correction deadline.¹²

What Failures Cost

Regulators on both sides of the Atlantic have shown they will impose meaningful penalties for reporting failures. A delegation arrangement is no defense.

EU

Under EMIR Article 12, competent authorities can impose administrative penalties or periodic penalty payments when reported data “repeatedly contains systematic manifest errors.” The periodic penalty can reach 1% of the entity’s average daily turnover for the preceding business year, imposed for every day the infringement continues, for up to six months.¹⁴

The UK’s Financial Conduct Authority has been active. It fined Sigma Broking Limited £1,087,300 for failing to submit complete and accurate transaction reports over a five-year period. That was Sigma’s second such fine; the FCA had previously fined the firm £531,600 for failing to report 56,000 transactions and identify 97 suspicious trades.¹⁵

US

FINRA fines for CAT reporting failures have reached seven figures. FINRA fined one major broker-dealer $1,000,000 for failing to timely and accurately report tens of billions of equity and option order events to the CAT Central Repository between 2020 and 2024. FINRA Rule 6893(a) requires members to record and report data “in a manner that ensures the timeliness, accuracy, integrity and completeness of such data.”¹² TRACE also carries direct costs for late submissions, with a $3-per-trade fee for late “as/of” reports that accumulates quickly for high-volume firms.¹⁶

Planning for a Delegate Failure

System outages, cyberattacks, and the delegate’s own financial distress can all interrupt reporting. Because the obligation stays with you, a delegate’s failure does not pause your deadline. FINRA Rule 4370 requires broker-dealers to maintain business continuity plans that address regulatory reporting, and if you rely on another entity for a mission-critical system — which delegated reporting is — the BCP must address that relationship.¹⁷ In practice, that means either a second delegate you can activate or the internal capability to submit directly in emergency mode.

Your contract should reinforce this. Termination and transition clauses need to specify how quickly the delegate must transfer data and reporting access back to you, and in what format. A delegate that holds your reporting infrastructure hostage during a dispute is a risk you can manage in advance.

Records and Access

Retention periods for transaction records run for years, and in some cases more than a decade. US broker-dealers under SEA Rule 17a-4 preserve transaction records for at least six years, the first two in easily accessible form.¹⁸ CFTC swap counterparties keep records through the life of the swap and for five years after termination.¹⁹ CCPs under EMIR must maintain records on services and on all contracts processed for at least 10 years following termination.²⁰

For CAT, FINRA expects firms to keep the underlying books and records that support reported data, along with a map showing how internal records correspond to reported CAT fields, and to archive CAT feedback within a 90-day window to enable corrections.¹² If your delegate holds the submission confirmations and error logs, your contract must guarantee access for the full retention period, including after the relationship ends. Otherwise the records you are required to produce sit with a counterparty you no longer control.

1
Legislation.gov.uk. Regulation (EU) No 648/2012 – Article 9
2
European Securities and Markets Authority. Article 26 Obligation to Report Transactions
3
European Securities and Markets Authority. Article 4 Reporting Obligation and Safeguarding in Respect of SFTs
4
FINRA. Regulatory Notice 20-31
5
FINRA. FINRA Rule 6730 – Transaction Reporting
6
BaFin. Reporting Obligation Under Article 9 of EMIR
7
CAT NMS Plan. Consolidated Audit Trail Reporting Agent Agreement
8
International Organization for Standardization. ISO/IEC 27001 – Information Security Management Systems
9
CNMV. Reporting Obligations Under EMIR
10
European Securities and Markets Authority. EMIR Reporting
11
ISO. ISO 20022 and Regulatory Reporting
12
FINRA. Consolidated Audit Trail
13
FINRA. 2024 FINRA Annual Regulatory Oversight Report – Consolidated Audit Trail (CAT)
14
European Securities and Markets Authority. Article 12 Penalties
15
Financial Conduct Authority. FCA Fines Sigma Broking Limited for Transaction Reporting Failures
16
FINRA. 7730. Trade Reporting and Compliance Engine (TRACE)
17
FINRA. Books and Records
18
FINRA. SEA Rule 17a-4 and Related Interpretations
19
Commodity Futures Trading Commission. Final Rule on Swap Data Recordkeeping and Reporting Requirements
20
European Securities and Markets Authority. Article 29 Record Keeping