Multi-entity filing: entitlements, separation and audit trail.

Two different shapes

A group files for its own entities, at individual, sub-consolidated and consolidated levels. The entities are related, the data is ultimately one dataset, and the separation requirement is usually about limiting who sees what rather than about hard confidentiality walls.

A service provider files for unrelated clients. The data must not mix, staff working on one client should not see another, and the confidentiality obligations come from client contracts. These are stricter requirements, and they are architectural rather than procedural.

The same platform can serve both, but the account structures differ, and choosing the wrong one is expensive to unwind after data has been loaded.

Separation of data

• One entity, one home. Every dataset, mapping and output belongs to exactly one entity. Shared workspaces holding several entities’ data create exactly the ambiguity an audit will find.
• Consolidated views are derived, not stored separately. A consolidated return should be produced from the entity datasets, with the perimeter recorded, rather than maintained as an independent dataset that drifts.
• Reference data can be shared; transactional data should not be. Code lists and identifier registries are common goods. Positions, exposures and account records are not.

Who can do what

Three privileges are worth separating explicitly, because they carry different risk:

Mapping change and output release are the two that most often sit with the same person by default. Separating them is the single most useful control in a multi-entity setup, and it costs nothing.

The audit trail

The question a reviewer asks is not “is this figure right” but “how did this figure come to be filed”. Answering it requires, per submitted package: which entity and level, which reference date, which source data, which mapping version, which framework version, who ran it, who approved it, and the validation report as it stood at the time.

That record has to survive the people involved. A trail that depends on someone remembering which spreadsheet was used is not a trail.

Delegated filing and liability

Where one party files on behalf of another, preparation can be delegated but responsibility generally is not — except where a framework expressly assigns it, as EMIR does in defined cases. The practical implications: the entity remains answerable for what was filed in its name, so it needs visibility of the output rather than only assurance that a filing occurred; and the arrangement should state what is filed, from what data, on what timetable, and how errors are notified back.

Official sources

Primary instruments only. Each is named in full so the reference remains traceable even if a link moves.

1. Commission Implementing Regulation (EU) 2024/3117 — supervisory reporting of institutions, including reporting levelsEUR-Lex · Implementing Regulation · individual, sub-consolidated and consolidated obligations
2. Regulation (EU) 2016/679 (General Data Protection Regulation)EUR-Lex · Regulation · where filing data includes personal data
3. Regulation (EU) No 648/2012 (EMIR), Article 9 — where responsibility for reporting is assigned by the frameworkEUR-Lex · Regulation · the delegated reporting exception

Questions, answered

Can several entities share one account?

They can, but it means everyone with access to that account sees every entity's data. For a group with one reporting team that is often acceptable; for a service provider with client confidentiality obligations it usually is not. Decide before loading data, because separating afterwards means re-loading.

Does a consolidated return replace the individual ones?

No. Individual, sub-consolidated and consolidated reporting are separate obligations, absent a specific waiver from the competent authority. The consolidated return should be derived from the entity datasets rather than prepared independently.

If we delegate filing to a provider, are we still responsible?

Generally yes. Preparation can be delegated; responsibility for what is filed in your name usually cannot, except where a framework expressly assigns it. Ask to see the output and the validation report rather than only confirmation that a submission was made.

What does an auditor actually ask for?

The path from source data to submitted package for a specific filing: which data, which mapping version, which framework version, who ran it, who approved it, and the validation report at the time. If any of those depends on someone's recollection, that is the finding.

REGREP is an independent software provider. This record explains a reporting framework in plain language and is not legal, tax or regulatory advice. Confirm scope, thresholds and submission dates with your competent authority before you file.