QFC Reporting Requirements for Financial Institutions

QFC reporting requirements for financial institutions are set out in 31 CFR Part 148 and 12 CFR Part 371, and they come down to one operational standard: a covered firm must keep detailed, standardized records on every qualified financial contract it holds and be able to deliver that data electronically to the FDIC within 24 hours of a request. There is no routine filing schedule. The data must be production-ready at all times.

Which Institutions Have to Comply

The rules apply to firms designated as “records entities.” Under 31 CFR § 148.2(n), a financial company is a records entity if it is a party to at least one open QFC and meets any one of several criteria.¹ Those criteria are:

Nonbank financial companies that the Financial Stability Oversight Council has designated for Federal Reserve supervision under 12 U.S.C. § 5323.
Systemically important financial market utilities designated under 12 U.S.C. § 5463.
Global systemically important bank holding companies identified under 12 CFR Part 217.
Companies with at least $50 billion in total consolidated assets that also have either $250 billion or more in gross notional derivatives outstanding or at least $3.5 billion in derivative liabilities.
Any financial company that consolidates with, or is consolidated by, a firm meeting one of the criteria above.

That last category catches institutions that would not otherwise qualify. A smaller subsidiary becomes a records entity simply by sitting inside the corporate group of a G-SIB or large derivatives dealer. A firm that qualifies through the derivatives-participant thresholds stays classified as a records entity for at least one year after it drops below them.¹

Foreign Banking Organizations

The framework reaches foreign banks with significant U.S. operations. The Federal Reserve’s 2017 final rule on QFC restrictions applies to the U.S. operations of systemically important foreign banking organizations, covering their U.S. branches and agencies.² Foreign banks meeting the applicable thresholds under 12 CFR Part 252 face the same recordkeeping standards as domestic firms.

Insured Depository Institutions

Insured depositories operate under a parallel FDIC rule at 12 CFR Part 371, which splits records entities into two tiers based on size.

Full scope entities are insured depositories with at least $50 billion in total consolidated assets, or affiliates of a Part 148 records entity. They maintain the most detailed level of QFC data, including all four data tables and all master data lookup tables. Limited scope entities qualify as records entities but fall below the full scope thresholds; they keep position-level data, counterparty-level data, master tables, and governing documents, but with fewer required fields and without some of the collateral and legal agreement detail tables.³

A de minimis exemption is available. Entities with 50 or fewer open QFC positions are generally exempt from the detailed data table requirements, though they still must retain copies of the documents governing their QFC transactions.⁴

What Counts as a Qualified Financial Contract

A QFC is a specific category of financial agreement defined in 12 U.S.C. § 5390(c)(8)(D) that includes securities contracts, commodity contracts, forward contracts, repurchase agreements, swap agreements, and any similar agreement the FDIC designates by regulation or order.⁵ In practice, that captures interest rate swaps, credit default swaps, currency swaps, securities lending arrangements, and overnight repo agreements.

What Data Must Be Maintained

The data structure is standardized to the level of individual field names. Under 31 CFR § 148.4, records entities organize QFC data into four primary tables plus master data lookup tables.⁶

Table A-1 holds position-level data. Each open QFC gets its own entry with notional amount, valuation, maturity date, and a counterparty identifier.
Table A-2 aggregates positions into counterparty netting sets to show the net exposure to each counterparty under each netting agreement.
Table A-3 captures the governing legal agreements, including ISDA master agreements, global master repurchase agreements, and any supplements or modifications.
Table A-4 tracks collateral posted and received, including asset type, location, and the safekeeping agent holding it.

Beyond those four, records entities keep master data lookup tables for their corporate organization, counterparty details, booking locations, and safekeeping agents.⁶ They also retain all governing documents for every QFC relationship: master agreements, annexes, credit support documents, guarantees, and novation records.

Legal Entity Identifiers

Every counterparty that has been issued a Legal Entity Identifier must be identified by that LEI in the records. The regulation defines an LEI as the global identifier maintained by a utility accredited by the Global LEI Foundation or endorsed by the Regulatory Oversight Committee.¹ The LEI requirement runs through the entire data structure. Table A-1 requires it for counterparty identification, Table A-2 uses it for netting agreement counterparties, and the Counterparty Master Table mandates it as the primary identifier when one exists. All records entities within a corporate group must use the same counterparty identifiers consistently.

The 24-Hour Production Standard

Records entities do not submit QFC data on a regular filing calendar. The obligation is to maintain the data continuously and produce it on demand. Under 31 CFR § 148.3(a)(3), a records entity must be capable of providing all required QFC records electronically to both its primary financial regulatory agency and the FDIC within 24 hours of a request.¹

The clock does not pause for weekends, holidays, or system outages. A request typically arrives when a firm is showing signs of distress and regulators need to size up its QFC exposures. Data systems have to be production-ready at all times, with current valuations reflecting the latest market conditions. A firm that has let its QFC data grow stale, or that relies on manual processes to compile it, will almost certainly miss the deadline.

How the Data Is Submitted

When the FDIC requests QFC records, the data moves through a secure electronic portal. The FDIC uses GlobalScape Secure File Transfer for the transmission itself.⁷ The file format is specific. Files must be tilde-delimited flat files, not XML or CSV. Field names from the Appendix A tables serve as column headers in the first row. Dates follow the YYYY-MM-DD format. No field may be left blank: text fields that do not apply must contain “NA,” numeric fields “0,” and date fields “2099-12-31.”

Point of Contact

Each records entity designates a Point of Contact responsible for the file transfer. The FDIC issues the POC a User ID by email, then provides the password separately by telephone. The POC uploads the data files to the secure portal and notifies the FDIC by email. The FDIC confirms receipt after downloading the files, and the files are then deleted from the portal.⁷ A designated POC who understands the technical specifications and can execute the transfer under pressure is one of the first things that tends to break down when an institution is in crisis and key personnel start leaving.

Why the Rules Exist: The One-Business-Day Stay

The entire framework supports a narrow resolution window. When the FDIC is appointed receiver for a covered financial company under Title II of the Dodd-Frank Act, counterparty rights to terminate, accelerate, and net out QFC positions are suspended briefly. Under 12 U.S.C. § 5390(c)(8)(F)(ii), payment and delivery obligations are stayed from the moment of appointment until the earlier of two events: the counterparty receives notice that the contract has been transferred to a bridge financial company, or 5:00 PM Eastern Time on the business day following the appointment.⁸

Inside that window, the FDIC decides which QFCs to transfer to a solvent institution and which to leave behind. If the records are current, complete, and structured to the regulatory tables, the FDIC can map counterparty exposures, identify netting sets, locate collateral, and make transfer decisions within hours. If not, the resolution becomes chaotic. The 24-hour production standard exists so the data is already in that form when it is needed.

Enforcement and Supervisory Consequences

For insured depository institutions, the consequences are explicit. Under 12 CFR § 371.7, violating the QFC recordkeeping requirements is a regulatory violation subject to enforcement under Section 8 of the Federal Deposit Insurance Act (12 U.S.C. § 1818).³ That statute gives regulators cease and desist orders, removal authority over officers and directors, and civil money penalties. For nonbank records entities under 31 CFR Part 148, enforcement flows through the entity’s primary financial regulatory agency.

The practical risk reaches further than formal penalties. An institution that cannot produce clean QFC data within 24 hours is signaling that it lacks the operational capacity for an orderly resolution, and that kind of deficiency tends to attract heightened supervisory attention across the firm’s wider risk management infrastructure.

1
eCFR. 31 CFR Part 148 – Qualified Financial Contracts Recordkeeping Related to the FDIC Orderly Liquidation Authority
2
Federal Register. Restrictions on Qualified Financial Contracts of Systemically Important U.S. Banking Organizations and the U.S. Operations of Systemically Important Foreign Banking Organizations
3
eCFR. 12 CFR Part 371 – Recordkeeping Requirements for Qualified Financial Contracts
4
Government Publishing Office. Federal Register Volume 81 Issue 210 – Recordkeeping Requirements for Qualified Financial Contracts
5
Legal Information Institute. 12 USC 5390 – Powers and Duties of the Corporation
6
eCFR. 31 CFR 148.4 – Content of Records
7
Federal Deposit Insurance Corporation. Recordkeeping Requirements for Qualified Financial Contracts (QFCs) – Technical Points
8
Office of the Law Revision Counsel. 12 USC 5390 – Powers and Duties of the Corporation