Regulatory reporting: RegData and REP-CRIM explained

What RegData is and what it replaced

RegData is the FCA's data collection platform. Firms use it to submit regulatory data and to view a tailored schedule of their reporting requirements. Each scheduled item, or task, carries a due date and a status so a firm can see at a glance what needs to be completed and when, and the FCA sends reminder emails with links to those tasks.

RegData replaced the previous system, Gabriel. The FCA moved firms across in phased groups based on their reporting requirements. The migration began in October 2020 and the FCA announced on 19 May 2021 that all reporting firms had moved, transferring 52,000 firms and 120,000 users from Gabriel to RegData.

Importantly, the move did not change the data items or the forms themselves. The FCA has been clear that data items and relevant forms did not change as a result of the move, so the substance of what firms report stayed the same while the platform underneath became faster to navigate and easier to build on. RegData now sits alongside My FCA, the FCA's unified portal for regulatory tasks, invoicing and attestations.

For firms, the practical takeaway is that RegData is both the calendar and the postbox for FCA regulatory reporting. It tells you what is due and it is where you submit. That makes the reporting schedule inside RegData the single source of truth your compliance function should be reconciling against.

How returns are scheduled to your firm

A firm does not choose which returns it completes. The FCA generates a reporting schedule from the regulated activities in your permission, and each obligation is anchored to your accounting reference date (ARD). Change your permissions or your ARD and your schedule changes with it, which is why keeping firm details accurate is a reporting control in its own right.

Within RegData, each item on the schedule shows a due date and a status, and firms can view all their submissions in one place. Returns are submitted either by inputting data directly into the online form or, for larger or more structured returns, by uploading a file such as XML or XBRL. RegData is available Monday to Friday from 7am to 10pm and at weekends from 8am to 5pm, so submission is not a 24-hour service and last-minute filing carries avoidable risk.

Because the schedule is driven by permissions and dates rather than by memory, the most reliable operating model is to treat RegData as authoritative, then mirror it into your own compliance calendar with owners and internal deadlines that sit ahead of the FCA due dates. Nasara Connect customers manage this on the control platform, which turns the RegData schedule into assigned tasks with reminders.

The REP-CRIM financial crime return (SUP 16.23)

REP-CRIM is the Annual Financial Crime Report, governed by SUP 16.23 of the FCA Handbook. It gathers structured data on a firm's exposure to financial crime and money laundering risk, and it lets the FCA become more data-led in understanding which firms carry inherent money laundering risk because of the activities they undertake.

The return covers a broad set of financial crime indicators. These include the number of politically exposed persons (PEPs) among customers, high-risk customers subject to enhanced due diligence, suspicious activity reports (SARs) raised internally and reported externally, sanctions screening and matches, staff dedicated to financial crime roles, and customer relationships exited for financial crime reasons.

REP-CRIM is submitted through RegData like other returns, and the deadline is 60 business days of the firm's accounting reference date. The FCA extended the obligation to a wider population of firms with effect from 30 March 2022, as set out in Policy Statement PS21/4, significantly broadening the number of firms that must file. To put the population in context, the FCA supervises roughly 22,000 firms under the Money Laundering Regulations, and between 2017 and 2020 it received 5,685 REP-CRIM submissions from over 2,300 different firms.

Getting REP-CRIM right is not only a scheduling task. The data you report feeds the FCA's view of your financial crime risk profile, so the underlying figures should reconcile to your transaction monitoring, SAR and sanctions records rather than being assembled from scratch at year end.

Who must submit REP-CRIM

The obligation to complete REP-CRIM turns on firm type and, for some categories, on revenue. Certain firm types must submit irrespective of revenue: banks, building societies and mortgage lenders fall into this group. Other firms must submit where their activity type is in scope and their total annual revenue is £5m or more, which captures many intermediaries, e-money institutions and consumer credit firms.

More broadly, the return applies to firms the FCA supervises under the Money Laundering Regulations. Cryptoasset businesses registered under those regulations are within scope, while general insurers and insurance intermediaries are generally excluded unless they carry on activities that fall within the Money Laundering Regulations.

The practical test for any firm is therefore twofold. First, are you supervised under the Money Laundering Regulations, or are you a firm type named as in scope regardless of size. Second, if you are in a category that depends on a threshold, does your total annual revenue reach £5m or more. If either route captures you, REP-CRIM belongs on your schedule and the £5m question should be revisited each year as revenue changes.

Common FCA returns and their frequencies

REP-CRIM is one obligation among many, and most firms carry several returns on their schedule at once. The precise set depends on your permissions, but the returns below are among the most widely encountered. Frequencies and deadlines are set in the Handbook and reflected in your RegData schedule; the exact reporting periods are anchored to your accounting reference date.

The Retail Mediation Activities Return (RMAR), set out in SUP 16.12, is the core return for intermediaries arranging or advising on mortgages, non-investment insurance or retail investment products. It is completed at least twice a year, with 30 working days after each reporting period to submit. The complaints return under DISP 1.10 requires most firms to report complaints volumes twice a year within 30 business days of the period end, although some smaller firms and credit unions report annually. Firms should note that the FCA has confirmed changes to complaints reporting that move to a fixed six-month and calendar-year basis, with the first reporting period running from 1 January 2027 to 30 June 2027.

Late submission, fees and why accuracy matters

The FCA treats late and non-submission of returns as a supervisory concern, not an administrative footnote. A firm that misses a deadline is charged an administrative fee, and repeated or serious failures can lead to further supervisory or enforcement action. The fee has long been a standard charge levied automatically when a return is overdue.

The FCA has consulted, through CP25/35, on reducing the administrative fee for overdue or late regulatory returns from £250 to £100, on the basis that a lower fee is fairer and more proportionate for smaller firms. Current FCA firm guidance on complaints reporting now refers to an administration fee of £100 for missing the deadline. Firms should treat the fee as a live figure to confirm against the latest FCA fees rules rather than assume a fixed amount, and in any case the cost of a late return is far more than the fee itself.

That wider cost is reputational and supervisory. A late or plainly inaccurate return signals weak controls, and because RegData records status and timing, there is no hiding a missed deadline. Accuracy matters just as much as timeliness: figures that do not reconcile can prompt questions, corrections and follow-up. The defensible position is a well-scheduled, well-owned reporting process where returns are prepared early, reviewed against source data and submitted with time to spare. Firms building that discipline from authorisation onward can find guidance in our authorisation resources.

Conclusion

FCA regulatory reporting rewards firms that treat it as a controlled, repeatable process rather than a series of last-minute filings. RegData tells you what is due and is where you submit; the Handbook, principally SUP, defines each return and its deadline; and your accounting reference date and permissions determine your personal schedule. REP-CRIM under SUP 16.23 is a good example of why the detail matters, because whether it applies at all depends on your firm type and, for some, on a £5m revenue threshold that can change year to year.

The firms that report well share a simple pattern. They take the RegData schedule as authoritative, assign a named owner to every return, set internal deadlines ahead of the FCA's, reconcile submitted figures to source data, and confirm receipt after filing. Do that consistently and late fees, corrections and supervisory questions largely take care of themselves, leaving your compliance team free to focus on the risks the returns are designed to surface.

Frequently asked questions