Outsourcing reporting — what stays with you
Reporting is one of the most commonly outsourced functions in a payment firm, and one of the least commonly outsourced well. The obligation never moves — a return filed by a provider is your return, and a wrong figure in it is your wrong figure. What can move is production. What cannot is the ability to explain what was filed, which is the thing a supervisor actually tests.
1. What can move, and what cannot
| Activity | Outsourceable | Why |
|---|---|---|
| File production and formatting | Yes | Mechanical, specification-driven |
| Taxonomy and validation tooling | Yes | Commodity capability with real economies of scale |
| Submission and channel operation | Often | Subject to whose credentials are used — see below |
| The mapping | Not in substance | It encodes decisions about your business that only you can defend |
| Sign-off | No | It is an assertion by your firm about your figures |
| The explanation | No | A supervisory query is answered by you, on your timetable, not the provider’s |
2. The four artefacts to retain
Whatever the operating model, four things should exist inside your firm and be reachable without the provider’s cooperation:
- The mapping, versioned, showing source field to data point with transformations and dimensional qualifiers. This is the asset with the longest useful life and the one that makes a provider replaceable.
- The pinned extracts the returns were built from, keyed to reference date.
- The submitted files and acknowledgements.
- The validation output and reconciliations, with reconciling items attributed.
The practical test is a thought experiment worth running before signing anything: if the provider relationship ended tomorrow, could you answer a supervisory query about a return filed last year? If the answer depends on the provider’s goodwill, the arrangement has a dependency that is not in the contract.
3. Credentials are a design decision
Whose credentials are used to file is more consequential than it looks. Where a provider submits under its own access, three things follow: you may not see the acknowledgement directly, you may not see rejections at all, and you cannot file without the provider in a contingency.
Where you hold the credentials and the provider operates them under your access, you retain the ability to file independently — but you take on the enrolment and certificate lifecycle, including the renewal cycle that causes more channel outages than any other single cause.
Neither is wrong. What is wrong is not deciding: firms frequently discover which model they are in during an incident, which is the worst possible moment to find out that the only person who can submit is at another company.
4. Oversight that actually tests something
Provider oversight built around service levels — files delivered on time, tickets closed — measures the provider’s operations rather than the correctness of your returns. Three checks test the thing that matters:
- Re-perform a sample. Independently derive a small number of data points from your own source data and compare. This is the only oversight activity that tests the mapping rather than the process.
- Review the reconciliations, not the summary. Reconciling items and their attribution are where a mapping problem first shows.
- Track rejections and resubmissions over time. A stable low rate is fine; a rising one is a leading indicator of drift between your business and the mapping.
5. A worked case
Facts: a firm outsources production and submission of its statistical returns. Eighteen months in, a supervisor queries a figure and asks how a counterparty classification was derived.
What happens: the reporting lead forwards the query to the provider, which responds within its contractual service window — several days. The answer describes the logic in general terms, because the detailed derivation is embedded in the provider’s tooling. A follow-up question requires a second round trip.
What the practitioner should have had: a mapping document held internally that answers the question directly, and a pinned extract that lets the derivation be re-performed. Both are artefacts the provider produces anyway; the only decision is whether they are delivered to you as part of the service or retained by the provider as its own working papers.
The contractual fix: make the mapping and the extracts deliverables rather than by-products, on a defined cadence, in a usable format. That single clause converts an opaque arrangement into a transparent one at essentially no cost to the provider.
FAQ
Can we outsource the whole reporting function?
Production can move. The obligation, the sign-off and the ability to explain what was filed cannot — and the last of those is what a supervisory query tests.
What is the single most important thing to retain?
The mapping, versioned and held internally. It is what makes a provider replaceable and what answers a derivation query without a round trip.
Whose credentials should be used for submission?
Either model can work, but it should be an explicit decision. Filing under the provider’s access removes your ability to file independently in a contingency.
Related: Reporting governance and sign-off · Mapping source data · AMLR outsourcing
