AFM Sets New Fine Policy for Unreported MiFIR Transaction Reporting Failures
The Dutch Authority for the Financial Markets (AFM) has published a new fine policy that makes one expectation unmistakably clear: investment firms that discover a shortfall in their MiFIR transaction reports must disclose it voluntarily, and failing to do so now carries a precisely defined financial penalty. Announced on 14 October 2026, the policy gives compliance teams, CFOs, and auditors a firm enforcement benchmark to work with, while the AFM signals that periodic checks will verify whether firms are actually living up to the self-reporting standard.
Why the AFM Is Formalising This Now
Transaction reporting under MiFIR (the Markets in Financial Instruments Regulation) is a cornerstone of market surveillance across the EU. When investment firms submit reports that are late, incomplete, inaccurate, or simply missing, the AFM loses visibility over trading activity that it is legally required to monitor. The regulator has long expected firms to detect and self-correct reporting problems, but it acknowledges that the existing framework left too much ambiguity about what happens when a firm stays silent.
The new policy is designed to close that gap. By publishing explicit thresholds and fine amounts, the AFM is trading vagueness for predictability. Firms now know exactly where the line is, and they know that crossing it without a voluntary disclosure will result in a defined sanction rather than an uncertain one. The regulator frames this as a level-playing-field measure: firms that invest in detection and disclosure should not be disadvantaged against those that quietly hope problems go unnoticed.
The Self-Reporting Obligation Under MiFIR
MiFIR Article 26 requires investment firms to report complete and accurate details of every transaction in financial instruments to their national competent authority, in the Netherlands that is the AFM, on a T+1 basis. The obligation covers a wide range of instruments traded on EU venues, and non-compliance has always been a supervisory priority. What the new policy adds is a clear articulation that the obligation to report a deficiency is just as binding as the obligation to report the transaction itself.
The Two Categories of Shortfall and Their Thresholds
The AFM distinguishes between two types of reporting failure, each with its own threshold for what counts as a "substantial number of transactions." That threshold is the trigger for a mandatory fine when no voluntary disclosure has been made.
Non-Reporting and Late Reporting
A shortfall qualifies as substantial if more than 100,000 transactions have not been reported to the AFM at all or were not reported on time. Alternatively, the threshold is met if the unreported or late transactions represent more than 25% of the total transactions that should have been reported, measured over a period of at least two weeks. Either condition, whichever is met first, brings the firm into fine territory if no proactive disclosure has been made.
Incomplete, Inaccurate, or Incorrect Reporting
The AFM applies a higher threshold for qualitative failures, recognising that errors in submitted reports are a different category of problem from simply not reporting at all. Here, a substantial number of transactions is defined as more than 500,000 transactions affected, or more than 50% of reportable transactions over a period of at least four weeks. The higher bar reflects the practical reality that data quality issues can affect large volumes of reports while still being correctable without undermining the overall picture available to supervisors.
The Fine Structure: Statutory Basis and Applied Amounts
The statutory maximum fine for a breach of the transaction reporting obligation is 500,000 euros. The AFM is not proposing to use that figure as its starting point. Instead, the policy sets a working level that is substantially lower, provided the failure falls within the parameters of this specific framework.
First and Repeat Offences
For a first offence under this policy, the AFM will impose a fine of 25,000 euros. If the same firm commits a second qualifying failure within five years, the fine rises to 50,000 euros. These figures represent a significant reduction from the statutory ceiling, a reduction the AFM describes as deliberate. The regulator wants sanctions to be proportionate and foreseeable, so that firms treat the penalty as a credible but not catastrophic incentive to disclose, rather than as a reason to conceal problems and gamble on non-detection.
It is worth stressing what this structure does not cover. The reduced fine amounts apply specifically to situations where a firm fails to self-report a qualifying shortfall. Other enforcement routes, including sanctions for persistent or egregious non-compliance, remain available to the AFM and are not capped at these figures.
Periodic Supervision and What Firms Should Expect
The AFM will conduct periodic checks to verify whether firms are disclosing transaction reporting incidents voluntarily. This is not a passive enforcement posture. The regulator is telling the market that it will actively test whether the self-reporting norm is being followed, meaning that a firm which stays silent and hopes to avoid scrutiny is taking on a measurable risk of detection in addition to the risk of a higher sanction.
Implications for Compliance Monitoring Programmes
For compliance officers and heads of operations at investment firms, the policy creates a direct requirement to build or upgrade detection capabilities. Finding a reporting error after the AFM does is, under this framework, strictly worse than finding it first. That asymmetry should drive investment in automated reconciliation, real-time transaction data validation, and clear escalation paths so that a qualifying shortfall reaches the compliance function quickly enough to allow voluntary disclosure.
Firms using crypto accounting software or digital asset accounting software as part of their reporting infrastructure face an additional layer of complexity. Digital asset transactions that fall within MiFIR scope must be captured accurately and in the correct format. Any gap in how those tools handle instrument classification, trade capture, or data export directly translates into a potential reporting failure. The AFM policy makes the cost of such gaps more concrete than it has ever been.
Accounting and Audit Implications
The new fine policy has direct relevance beyond the compliance function. For external auditors and internal audit teams, it raises questions about whether existing controls over transaction reporting are fit for purpose and whether any known or suspected reporting gaps should be reflected in audit findings or management letters.
Provisioning for Regulatory Fines
Under IFRS, a provision for a regulatory fine must be recognised when it is probable that an outflow of resources will occur and the amount can be estimated reliably. The AFM's published fine amounts now provide firms with a more concrete basis for that estimate. If a firm's compliance team has identified a qualifying shortfall that has not yet been disclosed, the finance function needs to assess whether a provision of at least 25,000 euros should be recognised in the current period, with appropriate disclosure in the notes about the nature of the contingent liability.
Audit committees should request explicit confirmation from management that all known MiFIR reporting shortfalls have been assessed against the AFM's new thresholds and that the disclosure decision has been documented. The combination of defined thresholds and published fine amounts makes this a considerably more auditable area than it was before the policy was issued.
Controls Over Transaction Data Quality
From a broader controls perspective, the policy reinforces the need for investment firms to treat transaction reporting data as a critical financial reporting stream, not merely an operational back-office function. The data lineage from trade execution through booking, enrichment, and submission to the AFM should be subject to the same rigour applied to financial statement inputs. Where crypto bookkeeping software or digital asset accounting software feeds into that chain, the controls framework must extend to those tools, including version management, reconciliation procedures, and exception handling.
For accounting firms advising investment firm clients, the AFM's move is a useful prompt to revisit the scope of regulatory compliance reviews. See also our coverage of how IAASB is bringing crypto assets into the audit agenda, which highlights the broader direction of travel for audit standards in this space, and our earlier analysis of AML licensing lessons from South Korea's exchange crackdown for a cross-jurisdictional view of how regulators are raising the cost of non-compliance.
What Firms Should Do Now
The policy took effect with its publication on 14 October 2026. There is no transition period for firms that have already identified reporting shortfalls. Practical steps to take immediately include the following.
Immediate Actions for Investment Firms
First, audit existing transaction reporting pipelines against the AFM's thresholds. Any backlog of unreported or late transactions approaching the 100,000 threshold, or any data quality issue affecting a large proportion of submissions, should be escalated to the compliance function and legal counsel without delay.
Second, review the voluntary disclosure process. Does the firm have a documented procedure for notifying the AFM when a qualifying shortfall is identified? If not, one needs to be in place before the next periodic AFM check. The procedure should specify who has authority to make the notification, what information must be included, and how the disclosure is recorded internally.
Third, assess technology dependencies. Crypto accounting software, crypto bookkeeping software, and any other digital asset accounting software used in the reporting chain should be reviewed to confirm that instrument classification and data output meet MiFIR requirements. Vendors should be asked to confirm compatibility and to provide documentation of any known limitations.
Fourth, brief the audit committee. Given the provisioning implications discussed above, the audit committee should be informed of the AFM's new policy and asked to confirm that management has completed the threshold assessment.
Frequently Asked Questions
Does this AFM policy apply to crypto asset transactions?
The policy is framed around MiFIR transaction reporting obligations, which cover financial instruments admitted to trading on EU regulated markets, MTFs, and OTFs. Crypto assets classified as financial instruments under MiFID II fall within scope. Firms should assess on an instrument-by-instrument basis whether their digital asset activities generate MiFIR reportable transactions and apply the same disclosure discipline to any shortfalls in those reports.
What counts as "voluntary" disclosure under the new policy?
The AFM expects firms to report shortfalls on their own initiative, before the regulator identifies the problem through its own supervision. A disclosure made only after the AFM has already flagged the issue in an inspection or data review is unlikely to qualify as voluntary. Firms should not wait for external prompting.
Are the 25,000 and 50,000 euro fines the only sanctions available?
No. The reduced fine amounts are specific to cases covered by this policy, where a firm fails to self-report a qualifying shortfall. The AFM retains full discretion to use the statutory maximum of 500,000 euros, or other supervisory tools, for different categories of non-compliance or for conduct that falls outside the scope of this framework.
How should the finance team handle a known but undisclosed shortfall in the accounts?
Under IFRS IAS 37, if a qualifying shortfall has been identified and voluntary disclosure has not yet been made, the probability of a fine being imposed is higher than if the firm discloses proactively. The finance team should consult legal counsel and consider whether a provision is required. The AFM's published amounts provide a more reliable estimate basis than was previously available.
Will the AFM publish the names of firms fined under this policy?
The AFM has a general policy of publishing enforcement decisions, including the names of firms sanctioned, subject to any applicable legal constraints. Firms should assume that a fine imposed under this policy may be made public and factor reputational risk into their disclosure calculus.