A missed regulatory deadline rarely feels dramatic in the moment. A filing slips a day. A breach notification waits for legal sign-off. A consultation response is never sent. Nothing breaks that afternoon. The cost arrives later, and it arrives in three layers: the fine itself, the remediation bill that dwarfs it, and the reputational drag that outlasts both. This piece tries to make those layers concrete.
Layer one: the fine
The headline number is the part everyone remembers, and it is usually the smallest part of the total.
Regulators increasingly treat reporting and notification deadlines as hard obligations, not best-effort targets. Two cases make the point.
In October 2017 the FCA fined Merrill Lynch International £34,524,000 for failing to report 68.5 million exchange traded derivative transactions under the European Markets Infrastructure Regulation (EMIR) over roughly two years. The trades themselves were not the problem. The failure to report them on time was.
Years later the pattern still holds. In January 2025 the FCA issued its first fine under UK MiFIR for transaction reporting failures, penalising Infinox Capital Limited £99,200 for failing to submit 46,053 reports on single-stock CFD trades. Article 26(1) of UK MiFIR requires complete and accurate details "as quickly as possible, and no later than the close of the following working day." A missed day, multiplied by tens of thousands of trades, becomes an enforcement case.
Data protection works the same way. Under Article 33 of the GDPR, a controller must notify the supervisory authority of a personal data breach "without undue delay and, where feasible, not later than 72 hours" after becoming aware of it. Late notification is itself a breach, independent of whatever caused the incident. Supervisory authorities across the EU have treated delayed or absent notifications as an aggravating factor when setting penalties.
The lesson: the deadline is the obligation. You can do everything else correctly and still be fined for being late.
Layer two: remediation, the invisible multiplier
The fine is a line in a press release. Remediation is the part that consumes the compliance team for the next year.
Once a firm misses a deadline and the gap is discovered, the work does not stop at paying the penalty. Typical follow-on costs include:
- Back-reporting. Reconstructing and resubmitting every missed report, often across systems that were never designed to replay history.
- Data quality reviews. Regulators rarely accept "we filed late" in isolation; they ask whether the underlying data was ever correct, which opens a wider look-back.
- External advisers. Law firms and consultants brought in to scope the failure, respond to the regulator, and attest to the fix.
- Skilled Person or equivalent reviews. In several regimes a regulator can require an independent review at the firm's expense, a cost that is frequently a multiple of the fine.
- Control rebuild. New monitoring, new sign-off steps, new testing, and the internal hours to design and embed them.
None of this appears in the headline figure. For many organisations the remediation programme costs several times the penalty, and it lands on the same team that was already stretched thin enough to miss the deadline in the first place.
Layer three: reputational drag
The third layer is the hardest to quantify and the slowest to fade.
Enforcement notices are public. Counterparties read them. So do banking partners, auditors, prospective investors, and the regulator's own supervision team, which now files the firm under "higher touch." The practical effects show up quietly:
- Longer, more sceptical due diligence from partners and clients.
- Tighter terms, or withdrawn appetite, from banks and payment providers.
- More frequent and more detailed regulatory information requests.
- Internal distraction, as senior management time is pulled toward the aftermath rather than the business.
Reputational drag does not settle a case. It changes the friction of everything the firm does next, sometimes for years.
Why deadlines get missed
Most missed deadlines are not the result of a decision to ignore a rule. They come from not knowing the deadline existed, or not knowing it had moved. A consultation closes. A guidance document resets a reporting format. A national regulator publishes an updated template with a short transition window. If nobody on the team saw the publication, the clock was already running before anyone knew it had started.
That is a monitoring problem, not a diligence problem. The obligations are scattered across dozens of authorities, each publishing on its own site, in its own language, on its own schedule.
Turning the deadline into something you can see
The cheapest deadline to meet is the one you knew about early. This is where structured regulatory watch earns its place.
Seqlense Doc tracks publications across roughly 85 European regulators, including the AMF, ACPR, BaFin, CSSF, ESMA, EBA, ECB, CNIL and the EDPB, covering finance, data protection, insurance and cyber. Instead of manually checking sites, a team can run targeted queries in SEQQL, filtering by source:, doctype: and lang: to surface exactly the consultations, guidance and regulation that carry a deadline. A doctype:consultation filter across your relevant regulators turns a scattering of missed windows into a single, reviewable list.
The point is not the tooling for its own sake. It is that most of the three-layer cost described above is avoidable at the top of the funnel. A deadline you see in time is a filing. A deadline you miss is a fine, a remediation programme, and a paragraph that follows you around.