ESMA Enforcement Actions

Key dates

24 June 2013

– Earlier ESA Board of Appeal case law clarifies that appeals are reserved for “decisions” that produce binding legal effects and that the Board lacks jurisdiction over acts that are not such decisions, including certain complaints‑handling outcomes

21 July 2022

– In Decision BoA‑D‑2022‑01 (appeal “C” v EBA), the Board of Appeal holds that an appeal against EBA’s decision not to initiate an investigation into alleged non‑application of EU law in relation to payment accounts is inadmissible under Article 60(2) of Regulation (EU) No 1093/2010

16 July 2026

– The ESAs’ Joint Board of Appeal issues the present decision dismissing, as inadmissible, an individual’s appeal against EBA’s decision not to open an investigation into a possible breach of Union law by the Finnish FIN‑FSA in relation to a bank account closure

Suggested considerations

• Review internal complaints‑handling and escalation procedures to ensure that disputes over account closures and related supervisory decisions are managed through national complaint bodies and courts, rather than assuming EBA or Board of Appeal review will be available.
• Update legal and compliance guidance notes to reflect that EBA’s decision whether to initiate a breach‑of‑Union‑law investigation is discretionary and generally not subject to appeal before the Board of Appeal, limiting external escalation avenues.
• Train front‑office, customer‑service and complaints staff to provide accurate information to customers about available redress routes, emphasising national ombudsman, national competent authority and judicial mechanisms rather than ESMA/EBA appeals.
• For groups operating across the EU, map national complaint and judicial mechanisms for account closures in each jurisdiction and integrate them into group‑wide conduct risk frameworks and customer communication templates.
• Monitor further ESA and EU court case law on which ESA acts are susceptible to appeal before the Board of Appeal, and adjust litigation and escalation strategies accordingly.

What changed

• - The decision clarifies that EBA’s decision whether or not to initiate an investigation into a possible breach or non‑application of Union law under Article 17 of Regulation (EU) No 1093/2010 is a...
• The Board of Appeal confirms that a decision not to open a Union law breach investigation does not constitute a reviewable “decision” for the purposes of Article 60(1)–(2) of the ESA Regulations and...
• The Board of Appeal confirms that individual complaints about account closures and associated supervisory handling remain primarily within the remit of national competent authorities and national...
• The decision reiterates that only certain categories of ESA acts that produce binding legal effects (for example, decisions adopted under Articles 17, 18 or 19 of the ESA Regulations, and acts within...
• The outcome aligns with prior Board of Appeal and EU court case law confirming that persons outside the specific categories listed in Article 17(2) of the ESA Regulations have no right of appeal to...

Key dates

Since July 2011

– ESMA has been responsible for the supervision and registration of credit rating agencies in the EU under the CRA Regulation, including enforcement actions for breaches

TBD (post‑02 July 2026)

– Potential appeal window for Moody’s Germany to bring the case before the Board of Appeal of the European Supervisory Authorities; any appeal does not have automatic suspensive effect, though suspension can be granted by the Board of Appeal on request

02 July 2026

– ESMA Board of Supervisors adopts supervisory measures and imposes fines on Moody’s Deutschland GmbH for four negligent breaches of the CRA Regulation, and publishes a public notice and press release

Suggested considerations

• Conduct a comprehensive review of all ESMA‑related reporting processes to ensure that data submitted to ESMA (including rating information, historical performance data, rating changes, and other CRA regulatory reports) is complete, accurate, and kept up‑to‑date at all times.
• Map and document all responsibilities for ESMA reporting within the CRA group, ensuring that where one entity reports on behalf of others, the allocation of roles, ownership of data, and validation steps is explicitly defined, approved, and regularly reviewed.
• Perform a gap analysis of existing regulatory reporting policies, procedures, and internal control mechanisms against CRA Regulation requirements and ESMA supervisory expectations, and update documentation to remove ambiguities and outdated provisions.
• Implement or strengthen data validation and reconciliation controls over submissions to the European Rating Platform and ESMA’s central repositories, including automated checks for missing ratings, non‑withdrawn ratings, incorrect rating actions, and inconsistencies in historical performance data.
• Establish a formal governance process for changes to regulatory reporting frameworks, ensuring regular review, independent challenge by compliance or risk functions, and clear escalation routes for identified data quality issues or control failures.

What changed

• - ESMA has clarified, through enforcement, that CRAs must ensure complete, accurate and up‑to‑date data is reported to ESMA across all relevant CRA reporting channels (including the European Rating...
• ESMA has reinforced that errors limited to regulatory reporting data (and not directly affecting published ratings) can still constitute material breaches of the CRA Regulation, demonstrating that...
• ESMA has indicated that group reporting arrangements (where one CRA entity reports on behalf of others in the group) must have clear documentation of responsibilities, validation processes, and...
• ESMA has emphasized that regulatory reporting frameworks must include robust policies, procedures and internal control mechanisms, and that deficiencies in these frameworks constitute distinct...
• ESMA has signalled that negligence, rather than intentional misconduct, is sufficient to trigger significant fines under the CRA Regulation, and that both aggravating and mitigating factors will be...

Key dates

14 November 2013

- REGIS-TR initial registration with ESMA under EMIR

7 May 2020

- REGIS-TR registration extended to SFTR reporting

14 June 2024

- ESMA Supervisory Report identifying serious indications of breaches

17 June 2024

- Public notice references investigations leading to findings (dated in decision docs)

17 February 2026

- ESMA Board of Supervisors meeting discussing the case

Suggested considerations

• For REGIS-TR specifically: Cease three ongoing breaches (policies/procedures under EMIR/SFTR; SFTR organisational structure for business continuity) per ESMA supervisory measures (EMIR Art. 73).
• For all TRs: - Review and strengthen policies/procedures for clarity on governance roles/responsibilities.
• Audit organisational structure for SFTR business continuity and orderly functioning.
• Conduct operational risk assessments, implementing controls/systems to minimise risks under EMIR/SFTR.
• Enhance data confidentiality/integrity protections and misuse prevention measures.

What changed

• This is an enforcement decision, not new legislation, but it reinforces existing EMIR and SFTR requirements on TRs, particularly:
• Policies and procedures: Must be adequate to ensure compliance, with clear roles and responsibilities for governing bodies (breaches under EMIR Art. 78(3) and SFTR Art.
• Organisational structure: Must ensure business continuity and orderly functioning, especially for SFTR services (breach under SFTR).
• Operational risk management: Identify and minimise risks via systems, controls, and procedures (breaches under EMIR and SFTR, Point (a) Section II Annex I EMIR).
• Data confidentiality and integrity: Protect information received under EMIR and prevent misuse (breaches under EMIR). Fines were calculated per EMIR Art.