Regulatory reporting set-up: documents to prepare

Setting up regulatory reporting turns a licence into an ongoing duty. The company must build documents and processes that let it submit accurate returns on time, every cycle. Preparation usually takes two to six weeks, depending on what already exists inside the business. This page sets out the stages, the documents, and the point after which changes become costly.

Why reporting set-up matters

Once a digital asset firm receives authorisation, the supervisor expects periodic returns covering transaction volumes, incident logs, and changes to the business model. The duty to report begins on the date authorisation takes effect, not on the date the first return is due. A firm that treats reporting as an afterthought discovers the gaps only when a submission is rejected or queried, and by then the correction takes longer than the original preparation would have.

The practical risk is not the reporting content itself but the absence of a repeatable process. A one-off return can be assembled by hand. A recurring one needs an owner, a schedule, and a record of who checked what.

Timeline for preparation

A firm with an existing compliance function moves through these stages close to the lower end. A firm building the function from nothing should plan for the full six weeks, and should not compress the dry run to save time.

Documents to prepare

1. Appoint a reporting owner. The compliance officer, or a named deputy, takes responsibility for each submission and for keeping the file current.
2. Map the data sources. List every system that generates a reportable event and record who controls it. This mapping overlaps with the assessment used elsewhere in data governance; see Assessment data protection explained for how that assessment is structured.
3. Draft the reporting policy. Set out what is reported, on what trigger, and by which deadline. Keep it short enough that a new hire can follow it without further explanation.
4. Build the evidence trail. Keep proof that the data was checked before submission, not only the submission itself. A reviewer should be able to reconstruct the check a year later.
5. Test the reporting flow. Run one dry submission before the live one and record the result, including anything that had to be fixed.
6. Log every change. Any change to the reporting scope, the data map, or the owner should be dated and kept in a single change log.

Who reviews the file

The supervisory authority receives the report and may query it within its own return window. Internally, the reporting owner signs off before submission, and a second reviewer checks the evidence trail beforehand. Where several filings compete for the same reporting slot, the order in which documents were prepared and dated matters, much as it does in Seniority and priority claims step by step. Disputes about content are resolved internally first; only unresolved queries go to the supervisor's contact point, and the response deadline is set by the supervisor's own request, not by the firm.

If your situation differs

• If the firm already reports under a different regime, reuse the existing data map and adjust the trigger list rather than starting the mapping stage from nothing.
• If the reporting owner leaves before the first cycle, hand over the change log together with the policy document, not the policy alone.
• If a report is queried, reply within the deadline stated in the query and keep a written record of the reply, including who drafted it.

How the working file is structured

A reporting file must survive staff changes intact. It normally sits in one folder with five parts: the policy, the data map, the escalation contact list, the dry-run record, and the change log. When a key person leaves without handing over the underlying records, the gap shows up only at the next review, a pattern also visible in Photonics and instrumentation — when a founder leaves with. The fix is the same in both settings: date every document, and never let a single person be the only holder of the current version.

What this page does not cover

This page does not cover the content of individual returns, the specific fields required, or the consequences of a late filing; those depend on the licence held and the supervisor involved. Missing the first two reporting cycles narrows the room left to negotiate a correction, a cost dynamic close to the one described in When the issuer loses control of the contract. This page also does not replace advice on cross-border reporting duties where the firm operates through more than one licensed entity.

Verified

Checked on routine review. This overview reflects general supervisory practice for authorised digital asset firms in the EU and describes the process rather than any single instrument, in line with the procedural scope of this page.

Related reading

For a comparable step-by-step process inside the same practice, see Complaint handling procedure step by step.

FAQ

How long does regulatory reporting set-up take in practice?
Typically two to six weeks, depending on how much of the data map and policy already exist. Firms with a working compliance team tend to finish nearer the two-week mark.

Which documents are needed to start?
Five items: a reporting policy, a data map, an escalation contact list, a dry-run record, and a change log. Nothing else is strictly required before the first submission.

What happens if the other side does not respond?
If a service provider or co-obligor does not supply data on time, record the gap in the change log and notify the reporting owner at once. The submission still proceeds, with the gap documented rather than the deadline missed.

Next step

If your reporting set-up needs a second look before the first submission, our team can review the file directly. We reply during business hours within minutes, and give a fee estimate within one working day.

— Aleks Vaher, AURELIS