What the notice records
Between 1 October 2022 and 31 March 2023, Infinox Capital Limited submitted no transaction reports at all for the single-stock CFD trades it executed through one of its two corporate brokerage accounts. That account carried approximately 60% of the firm’s single-stock CFD business. The count came to 46,053 reports not submitted by close of the following working day, or at all.
The Authority found the gap in its own data. It identified a discrepancy in the transaction data Infinox had submitted and contacted the firm on 5 May 2023. On 31 May 2023 the firm confirmed the failure and put the number at around 6,000. On 6 July 2023 it revised that to as many as 50,000 and filed a formal breach notification. Back reporting of the affected trades finished on 15 December 2023, and it took a year from first contact for the firm to give the Authority a complete and accurate count.
A third party had already found it. Infinox commissioned a review of its compliance with MiFIR and EMIR reporting obligations in February 2023. On 16 March 2023 that review identified the failure to report the single corporate account, recommended the firm investigate the duration and volume of the under-reported transactions, and anticipated that a breach notification and back reporting would be required. Fifty days later, with no contact from the firm about the breach, the Authority called first.
The penalty was £99,200 under section 206 of the Financial Services and Markets Act 2000, imposed by the Settlement Decision Makers and reduced by a 30% Stage 1 settlement discount from the £141,800 the Authority states it would otherwise have imposed. The Final Notice is dated 27 January 2025; the FCA published it on 29 January. The contravention is Article 26(1) of UK MiFIR, which requires an investment firm to report complete and accurate details of its executed transactions no later than the close of the following working day. It was the first enforcement action for a transaction reporting breach since the requirement became UK law under MiFIR in January 2018.
The judgement nobody was asked to check
One person at the firm identified by hand which financial instruments were reportable whenever new business commenced, so that the relevant data reached the transaction reporting systems. Until the third-party review was commissioned in February 2023, the firm put no steps in place to scrutinise that process and no checks in place to confirm that the correct trades had been identified as reportable. Those two sentences sit at paragraph 4.12 and are the whole of what the Authority found about systems and controls.
The £99,200 is not the finding. The finding is a classification made once, by hand, at the opening of a business line, with no second reader behind it and no reconciliation capable of contradicting it.
The reportability determination decides which trades enter the population the reporting pipeline then processes, which places it upstream of every control applied to that pipeline. A trade never classified as reportable generates no report, so it produces no submission to the Market Data Processor, no rejection message, and no exception for an operations team to clear. A control that tests what was sent against what was accepted returns a clean result on a population that is already missing the trades. The single-stock CFD desk began trading in October 2022 and the reports were absent from the start.
The Authority had described this failure mode two months before the notice. Market Watch 81, published in November 2024, sets out five connected root causes of transaction reporting data quality problems — change management, reporting process and logic design, data governance, control framework, and governance, oversight and resourcing — and states that a weakness in one spreads to the others. Under change management it records data quality issues, including failures to report transactions, where key staff dependencies exist and there are no clear policies and procedures for managing reporting in that person’s absence. Under data governance it records that incomplete data lineage can produce business flow blind spots resulting in unreported transactions.
Where a firm is inclined to attribute a root cause to human error, the Authority’s stated best practice is for the firm to consider whether improvements in process, controls or oversight would have prevented the issue before it happened. That instruction sits in Market Watch 82 of 23 July 2025, in the guidance on completing the root cause section of a breach notification. The Authority received 241 such notifications in the first quarter of 2025, of which 66% gave clear and relevant information on the weaknesses in systems and controls behind the issue, 31% gave inadequate detail, and 3% left the section blank. The FCA has since added a quality flag to its case management and record keeping for these notifications.
The obligation the notice does not cite
The Failings section of the notice is two sentences long and names one provision: Article 26(1). RTS 22 — Commission Delegated Regulation (EU) 2017/590, which sets out the machinery behind Article 26 — appears nowhere in the notice.
Article 15 of RTS 22 was in force throughout the relevant period and describes the absent controls in sequence. Article 15(1)(h) requires mechanisms for identifying unreported transactions for which there is an obligation to report, including reports rejected by the competent authority that were never successfully resubmitted. Article 15(2) requires a firm that becomes aware of an error, an omission, a failure to submit, or a report submitted where no obligation existed, to notify the Authority promptly; it carries no materiality threshold. Article 15(3) requires arrangements to ensure reports are complete and accurate and specifies what those arrangements include: testing of the reporting process, and regular reconciliation of front-office trading records against data samples the competent authority provides. Article 15(4) covers the case where no samples are supplied — the firm reconciles its front-office records against the reports actually submitted, checking timeliness, the accuracy and completeness of individual fields, and their compliance with the prescribed formats.
That reconciliation runs from the front office outward, beginning with what the desk executed rather than with what the pipeline generated, and the direction is the control. A reconciliation that starts from the reporting system’s own output cannot surface a trade the reporting system never knew about, which is why reconciliation is evidential only when the record it starts from was produced independently of the process under test. The independent record has been available for years: the Goldman Sachs International Final Notice of 27 March 2019 records that the Authority had made a facility available to firms to review the accuracy of their reports by requesting samples of the data they had submitted to it.
Market Watch 81 describes reconciliations designed so that they exclude source data or specific data flows; reconciliations run on selected fields only, or on an irregular basis, which the Authority states may not identify all errors and omissions or meet the requirements of RTS 22; and firms that exclude services and data provided by third parties from their control and reconciliation arrangements altogether.
In enforcement, the reconciliation duty surfaces as aggravation rather than as charge. The Sigma Broking Final Notice of 29 July 2025 records, among the aggravating factors, that the firm had been reminded during the relevant period of the requirements to submit complete and accurate transaction reports and to reconcile records regularly. Neither 2025 notice charges a breach of Article 15.
The arithmetic behind £99,200
The Authority priced each missing report at £2.00.
Step 1 was £0: no financial benefit was derived from the breach. At Step 2 the Authority declined to treat revenue as the indicator of harm and used the number of missing reports instead, so 46,053 at £2.00 gives £92,106. It set seriousness at Level 3, which on the scale these notices use applies 20%, producing £18,421.20. At Step 3 it added 10% for aggravating factors — the volume of guidance it had published through its transaction reporting page, Market Watch, the Transaction Reporting User Pack, the ESMA guidelines and Q&A and the Transaction Reporting Forum; the delay in bringing the breach to its attention; and prior instances of the firm failing to submit reports for other parts of its business — producing £20,263.32. At Step 4 it multiplied that figure by seven.
The Authority stated its reasoning for that multiplier: the absolute value was too small to meet its objective of credible deterrence given the profits available to a brokerage, and without an increase firms might treat a transaction reporting penalty as a cost that can be factored into operating. Seven multiplied £20,263.32 into £141,843.24. That is the calculation’s output, not the penalty: the Authority rounds down to the nearest £100 when it imposes, so the notice gives £141,800 as the figure it would have imposed without the discount and £99,200 as the penalty imposed.
Sigma Broking was fined on the same £2.00 tariff six months later, and its 924,584 incomplete or inaccurate reports gave a Step 2 base of £1,849,168. Seriousness was Level 4, applying 30%, for £554,750. Aggravating factors added 40%, for £776,650 — the Authority listed its published guidance, the firm’s October 2022 penalty for similar failings, its delay in disclosing the third-party review, and the two Final Notices it had published against other firms during the relevant period. The Step 4 multiplier was two, and the discount produced £1,087,300.
In the Goldman Sachs International notice of 27 March 2019, decided under the pre-MiFIR reporting rules in SUP 17, the Authority attributed £1.50 to each missing or inaccurate report and £1.00 to each erroneously submitted one, giving a Step 2 base of £157,108,729 across 106,663,474 reports falling within the post-2010 penalty regime. Seriousness was Level 3, aggravation added 10%, and Step 4 added nothing: the Authority considered £34,563,920 already sufficient to deter. That figure covers conduct after March 2010 alone. The discount reduced it to £24,194,700, and a separate £10,150,000 for the earlier conduct produced the £34,344,700 imposed.
| Final Notice | Date | Reports | Per-report value | Step 2 base | Seriousness | Step 3 | Step 4 | Penalty after 30% discount |
|---|---|---|---|---|---|---|---|---|
| Goldman Sachs International | 27 Mar 2019 | 106,663,474 (post-2010 conduct) | £1.50 missing or inaccurate; £1.00 erroneous | £157,108,729 | Level 3 (20%) | +10% | none | £24,194,700, part of £34,344,700 |
| Infinox Capital | 27 Jan 2025 | 46,053 | £2.00 | £92,106 | Level 3 (20%) | +10% | × 7 | £99,200 |
| Sigma Broking | 29 Jul 2025 | 924,584 | £2.00 | £1,849,168 | Level 4 (30%) | +40% | × 2 | £1,087,300 |
Dividing each penalty by its report count reverses the order. Infinox paid roughly £2.15 for each missing report, Sigma roughly £1.18, and Goldman Sachs International roughly £0.23 across the post-2010 portion and £0.16 across the whole notice. These are derived figures rather than numbers the Authority publishes, and the mechanism producing them is Step 4: the multiplier rises as the report count falls, because a tariff applied to a small population cannot on its own produce a penalty the Authority regards as credible.
No schedule for that multiplier exists. DEPP 6.5A.4G states the power to increase a penalty where the Step 3 figure is insufficient to deter and sets no scale for the increase. Nor is the seriousness scale the Handbook’s: DEPP 6.5A.2G runs from 0% at level 1 to 20% at level 5 where revenue indicates the harm, and allows the Authority not to use those percentage levels where revenue is not an appropriate indicator, which is how level 3 becomes 20% and level 4 becomes 30% in these notices. The two 2025 notices applied Step 4 multipliers of seven and two to the same £2.00 tariff. A firm sizing its exposure by multiplying missing reports by £2.00 is calculating the one input that moved least between the two cases.
A new business line the reporting team did not see
Between November 2007 and April 2010, the Regulatory Operations team at Goldman Sachs International did not always have full visibility of the firm’s new business activities or of significant changes affecting transaction reporting, and did not always have clear communication with front office teams about changes to front-office IT systems feeding the back-office reporting systems. The notice records the consequence: on occasions when front-office systems changed, Regulatory Operations was not told, and could not make the corresponding changes to the reporting systems.
From April 2010 the firm made it compulsory for Regulatory Operations to sign off any new business activity or significant amendment to an existing one, irrespective of whether the activity was anticipated or expected to affect the transaction reports submitted to the Authority. That final clause is the control. The sign-off does not depend on anyone first judging that reporting is affected, which is the judgement that failed at Infinox, and it places the decision with a function other than the one opening the business — the same separation between the party that acts and the party that records the evidence that payment controls draw around an authorisation.
An internal audit at the same firm had named the underlying gap in June 2009, recording as a significant finding that its transaction reporting controls tested the accuracy of reports rather than their completeness. By 31 March 2015 the firm had added an end-to-end reconciliation that independently re-created the population of transactions it had executed and reconciled that population against the reports it had submitted. The notice records that this exercise identified transaction reporting errors the existing control framework had not.
Goldman Sachs International submitted approximately 1.5 billion transaction reports during its relevant period, of which 220.2 million were affected, around 15%. Infinox failed to submit 46,053. The control that closes the gap is identical at both ends: a reportability determination made by someone other than the person opening the business, and a reconciliation that starts from the trading record rather than from the report.
What replaces the rule the fine was issued under
Article 26(1) is being repealed. In Policy Statement PS26/15, published on 3 August 2026, the FCA confirmed that HM Treasury will repeal Articles 25, 26 and 27 of UK MiFIR together with RTS 22, RTS 23 and RTS 24, and that new chapters MAR 13, MAR 14 and MAR 15 of the Handbook replace them. The instrument comes into force on 3 April 2028.
Article 15 survives the move intact. The FCA did not consult on changing it; its requirements are recreated at MAR 14.14 and MAR 14.15. Respondents asked for more guidance on the Authority’s expectations for transaction reporting systems and controls, including a materiality threshold for breach notifications. The FCA declined to introduce a threshold and added MAR 14.15.5G, guidance that a transaction reporting firm or qualifying trading venue operator should establish and maintain an incident management framework, proportionate to the nature, scale and complexity of its business, enabling it to triage, assess and manage errors and omissions, analyse their cause, implement and monitor remedial action, operate an internal escalation protocol, and notify the Authority. The FCA states that the guidance aligns with best practice observations made in Market Watch 81 and 82.
That guidance does not say who runs the framework. An escalation protocol presupposes a named owner and a governance body that receives the escalation, and Market Watch 81 records firms whose transaction reporting sat outside their wider risk management arrangements and was therefore never measured as an operational and compliance risk — a question of compliance programme architecture rather than of reporting logic.
From 3 August 2026 the default back reporting period is three years rather than five, stated as guidance at MAR 14.15.4G, with the Authority retaining the ability to require five years on an exceptional basis. Infinox back reported over roughly seven months to 15 December 2023. Sigma Broking finished back reporting and quantified its errors at 924,584 on 5 February 2025, more than a year after telling the Authority in January 2024 that around 984,000 reports might be affected.
Transaction reporting fields fall from 65 to 52. FX derivatives leave the regime, as do instruments tradeable only on EU trading venues. The FCA puts the current annual cost of MiFID transaction reporting to industry at £493 million and expects the changes to remove more than £100 million a year from it. Draft schemas, validation rules and a new Transaction Reporting User Pack are due in October 2026.
ESMA set out a long-term “report once” model across MiFIR, EMIR and SFTR in its final report of 2 July 2026, and its shorter-term measures include reducing or removing certain reporting fields and reconciliation requirements and simplifying error and omission notifications.
Neither package reaches the determination that failed here. Fields describe a trade once it is inside the reported population, and scope rules set which instruments may enter it. Whether a given desk’s trades were classified into that population at all remains a judgement made inside the firm; under the new rules MAR 14.5.3G limits only the window for making it, with reportability determined against FCA FIRDS up to and including T+7 after execution. During the implementation period to 3 April 2028 the Authority has said it will not act in the areas covered by its flexible supervisory approach and does not expect firms to correct errors or notify it of issues affecting them. The reportability determination and the notification duty are not among those areas.
Next read: Regulatory operations — how reporting, records, examinations and remediation are owned and evidenced.
Sources
- Financial Conduct Authority, Final Notice: Infinox Capital Limited (FRN 501057), 27 January 2025. Establishes the relevant period, the 46,053 unsubmitted reports, the single corporate account and its ~60% share of the single-stock CFD business, the chronology from 16 March 2023 to 15 December 2023, the paragraph 4.12 finding on the reportability determination, and the five-step penalty calculation including the £2.00 per-report value, the Step 4 multiplier of seven, and the £141,800 the Authority would have imposed without the settlement discount.
- Financial Conduct Authority, press release, “FCA issues first fine for transaction reporting failures under MiFIR”, 29 January 2025. Establishes the publication date, the undiscounted penalty of £141,800, and the status of the action as the first under UK MiFIR.
- Financial Conduct Authority, Final Notice: Sigma Broking Limited (FRN 485362), 29 July 2025. Establishes the second MiFIR transaction reporting action, the 924,584 incomplete or inaccurate reports, the identical £2.00 tariff with Level 4 seriousness, the 40% aggravation and the Step 4 multiplier of two, the completion of back reporting on 5 February 2025, and the aggravating reference to reconciling records regularly.
- Financial Conduct Authority, Final Notice: Goldman Sachs International (FRN 142888), 27 March 2019. Establishes the pre-MiFIR tariff of £1.50 and £1.00, the Step 2 base of £157,108,729, the absence of any Step 4 uplift, the April 2010 Regulatory Operations sign-off control, the June 2009 internal audit finding on accuracy against completeness, the end-to-end reconciliation added by 31 March 2015, the availability of the FCA data sample facility, and the split of the penalty between the two penalty regimes with rounding down to the nearest £100 at imposition.
- Commission Delegated Regulation (EU) 2017/590 (RTS 22), Article 15, as published by legislation.gov.uk and current to 20 August 2026. Establishes the requirements for identifying unreported transactions, prompt notification without a materiality threshold, testing of the reporting process, and reconciliation of front-office trading records against regulator data samples or against submitted reports.
- Financial Conduct Authority, Market Watch 81, newsletter, November 2024. Establishes the five connected root causes of data quality issues, the key-staff dependency finding, the data lineage blind spot finding, and the observations on reconciliations that exclude source data, run on selected fields, or omit third-party services.
- Financial Conduct Authority, Market Watch 82, newsletter, 23 July 2025. Establishes the 241 breach notifications received in Q1 2025, the quality percentages for systems and controls detail, the introduction of a quality flag, and the stated best practice on root causes attributed to human error.
- Financial Conduct Authority, Policy Statement PS26/15, “Improving the UK transaction reporting regime”, 3 August 2026. Establishes the repeal and replacement of Articles 25 to 27 and RTS 22 to 24 by MAR 13 to 15, the recreation of RTS 22 Article 15 at MAR 14.14 and MAR 14.15, the new MAR 14.15.5G incident management guidance and the decision not to set a materiality threshold, the three-year back reporting default at MAR 14.15.4G effective 3 August 2026, the reduction from 65 to 52 fields, the £493 million cost figure and expected savings, the October 2026 schema and user pack, the T+7 FIRDS window at MAR 14.5.3G, and the 3 April 2028 commencement.
- European Securities and Markets Authority, Final Report on the Call for Evidence on a comprehensive approach for the simplification of financial transaction reporting (ESMA12-1406959660-3235), 2 July 2026. Establishes the “report once” model across MiFIR, EMIR and SFTR and the shorter-term measures on fields, reconciliation requirements and error and omission notifications.
- Financial Conduct Authority, DEPP 6.5A, Decision Procedure and Penalties Manual, Handbook guidance in force since 1 April 2013. Establishes the five-step framework, the Step 4 deterrence power without a published scale, and the provision at DEPP 6.5A.2G(13) allowing the Authority not to apply the published seriousness percentages of 0% to 20% where revenue is not an appropriate indicator of harm.
