January 2024 to July 2026. Five supervisors, four currencies, and in every single case the finding was about data — how it was classified, whether anyone owned it, whether it was checked, and whether what reached the regulator was true.
Grouped not by who was fined, but by the capability that was missing. Each figure is the running total of every published penalty in that area over the period. If your estate is weak in one of these, that is the price of the weakness.
Cumulative penalties · January 2024 – July 2026 · ten actions
Controls too weak to monitor data quality in regulatory reporting, and insufficient progress remediating the deficiencies once they were known.
Exposures, instruments and deposits assigned to the wrong category or the wrong party — and ownership left unassigned.
Control deficiencies across the reporting chain, incorrect figures submitted repeatedly, and information given to a regulator that was not true.
Required exposures never reported to the central repository at all.
Amounts are shown in the currency each penalty was levied in. We do not publish a converted grand total — choosing an FX rate to manufacture one large number is exactly the sort of thing this audience checks. Per-area subtotals reconcile to the per-regulator subtotals in the public registers.
Figures compiled by hand when the submission fell due, rather than produced as a by-product of a control that runs anyway. When evidence is manufactured to meet a date, nobody upstream is accountable for whether it is right — and in the worst case on this page, what reached the supervisor had been fabricated outright.
A classification set once and never re-tested. A quality check run on a sample because the full run was too expensive. A stewardship issue closed with nothing to show it closed. None of these looks like a failure on the day — which is exactly why they run for years.
All ten actions, de-identified. We do not publish the institutions’ names — the argument is in the categories and the duration, not in anyone’s embarrassment.
| Date | Regulator | Area that failed | Penalty | The finding |
|---|---|---|---|---|
| Jul 2026 | PRA | Reporting accuracy | £4.17m | Incorrect deposit-protection liabilities and fee-tariff data submitted repeatedly across four years |
| Mar 2026 | PRA | Reporting accuracy | £2.0m | Misleading capital information, and fabricated documents given to the regulator |
| Mar 2026 | ECB | Classification | €6.2m | Sovereign-bond options misclassified as model-eligible — wrong market-risk RWA across six reporting periods |
| Feb 2026 | ECB | Classification | €12.18m | Corporate exposures misclassified and given the wrong risk weights — 15 consecutive quarters |
| Jan 2026 | ECB | Classification | €2.26m | Guaranteed receivables assigned to the debtors rather than the guarantors — 13 consecutive quarters |
| Mar 2025 | RBI | Completeness | ₹6.82m | Large-credit borrowers never reported to the central credit repository |
| Jul 2024 | Federal Reserve | Data-quality monitoring | $60.6m | Insufficient progress remediating data-quality management deficiencies |
| Jul 2024 | OCC | Data-quality monitoring | $75.0m | Governance and controls too weak to monitor data quality in regulatory reporting |
| May 2024 | PRA | Reporting controls | £33.88m | Reporting control deficiencies across a data and reporting transformation |
| Jan 2024 | PRA | Classification & ownership | £57.42m | 99% of eligible protected deposits classified “ineligible”, with ownership left unassigned |
Sources: the PRA, ECB, OCC, Federal Reserve and RBI public enforcement registers, compiled August 2026. Figures as published. Institutions are deliberately not named.
None of these was a bad day. Almost every one ran undetected for quarters or years, inside institutions with the best-resourced data functions in the world.
Capable teams, real control frameworks, expensive tooling, and audit functions that had signed things off. The error still ran for years.
A control tested once a year cannot catch a misclassification that starts quietly, stays perfectly consistent, and never trips an alert.
The failure mode in every row above is how long it lasted. That is the case for continuous per-product measurement — and it is made here by the supervisors, not by us.
Not in principle. Today, with something you could put in front of a supervisor.
Misclassification, unassigned ownership, unverified submissions, incomplete reporting — these are not abstract governance themes. Each is something a score can be computed from, and re-computed next month.
Is every critical data element classified, and does that classification still match the instrument?
Is the product owned by a named person, and is that assignment current?
Was the submitted figure reconciled to source, and is there standing evidence that it was?
Are the required entities actually reported, or were some skipped on cost?
Thirty days, one slice of your estate, success criteria agreed up front — and you keep the result either way.