Does mandatory reporting go far enough?