ESMA Reports

Key dates

2022

- ESMA’s original peer review identified shortcomings in the supervision of cross-border activities and issued recommendations to strengthen authorisation, supervision, cooperation, and enforcement

September 2025

- ESMA’s 2026 work programme says the follow-up on the peer review of cross-border provision activities of investment firms was expected to be launched around this time

20 July 2026

- ESMA published the follow-up report on the supervision of cross-border activities of investment firms

TBD (est. 2028)

- ESMA indicated in the earlier peer review context that it expected to carry out a follow-up assessment in two years to review improvements, which aligns with a later-stage review cycle

Suggested considerations

• Review cross-border business plans for all passported investment services and ensure they are supported by clear governance, staffing, systems, and client-service arrangements.
• Map all outbound cross-border activities by jurisdiction, client type, product type, and distribution channel so that compliance can identify where supervisory risk is highest.
• Strengthen controls over retail cross-border activity, including marketing, suitability/appropriateness, complaints handling, and local conduct requirements in each host market.
• Prepare to provide supervisors with more granular evidence of how cross-border risks are identified, monitored, escalated, and mitigated.
• Ensure internal reporting can distinguish cross-border revenue, complaints, incidents, and enforcement exposure from domestic business lines.

What changed

• - ESMA reports that NCAs have strengthened authorisation assessments by placing greater emphasis on firms’ cross-border business plans and intentions before granting or maintaining permissions.
• NCAs are increasingly using data-driven and risk-based supervision to monitor cross-border activity and calibrate supervisory attention to the scale, nature, and complexity of the activity.
• NCAs have expanded cooperation and enforcement, including more targeted supervisory actions and reporting of enforcement cases where relevant.
• ESMA expects NCAs with significant outbound cross-border activity to ensure that their supervisory and enforcement approaches are proportionate to the level of risk and business volume.
• The report reinforces that cross-border activity should be treated as a distinct supervisory risk area, not merely as an incidental extension of domestic supervision.

Key dates

10 January 2025

- The FASTER Directive was published in the Official Journal of the EU, establishing the legal basis for ESMA’s market capitalisation mandate

June 2025

- ESMA published a consultation paper on the draft RTS methodology for calculating market capitalisation and the market capitalisation ratio

25 July 2025

- The consultation period for ESMA’s draft RTS methodology closed

October 2025

- ESMA was expected to finalise the RTS and submit them to the European Commission

16 January 2026

- The European Commission issued a final document referring to the FASTER framework and its threshold mechanics

Suggested considerations

• Compliance teams should map whether any serviced Member State may approach or exceed the 1.5% threshold over a rolling four-year period and flag jurisdictions that could trigger special withholding tax relief consequences.
• Tax operations teams should align withholding tax relief workflows with the ESMA-published ratios so that jurisdictional eligibility assessments use the current official figures.
• Data and controls teams should document the calculation source, methodology, and reconciliation process for any internal use of ESMA market capitalisation data.
• Investment firms and intermediaries should review client-facing tax-relief processes to ensure they can respond to changes in Member State status under FASTER.
• Market-data and regulatory-reporting teams should prepare for annual updates by building a recurring review process around each ESMA publication cycle.

What changed

• - ESMA has started publishing annual market capitalisation figures and market capitalisation ratios for each EU Member State under its FASTER Directive mandate.
• The published figures are based on a harmonised methodology developed by ESMA in technical standards, using transaction data reported under MiFIR.
• Market capitalisation is calculated from shares admitted to trading on a regulated market or multilateral trading facility, with aggregation at the level of the issuer’s legal address in the relevant...
• The market capitalisation ratio is calculated as the Member State’s market capitalisation divided by the total market capitalisation of all Member States on the same date, expressed as a percentage.
• Member States whose market size exceeds 1.5% of total EU market capitalisation for four consecutive years are subject to specific withholding tax relief-related requirements.

Key dates

24 December 2024

– EMIR 3 enters into force, establishing the legal basis for the Active Account Requirement and related RTS framework

2025 (full year)

– First year of operation of the Joint Monitoring Mechanism, covering monitoring of AAR implementation and broader EU clearing landscape developments, as described in the JMM’s first Annual Report

25 June 2025 Deadline

– Active Account Requirement becomes applicable, starting the reference period for AAR compliance and reporting and triggering obligations to maintain an active account at an EU CCP for specified derivatives

February 2026 (as of)

– Approximately 500 entities have notified ESMA and national competent authorities that they are subject to the AAR, marking a key supervisory data‑collection milestone

26 February 2026 Deadline

– Regulatory Technical Standards specifying detailed AAR conditions, including operational obligations, stress‑testing, activity and reporting requirements, enter into force, operationalising how the AAR must be met in practice

Suggested considerations

• Confirm whether your entity (and any funds or branches) is subject to the Active Account Requirement by assessing EMIR clearing obligation status and relevant notional clearing volumes against EMIR 3 thresholds for AAR‑scope derivatives.
• Implement and document annual stress‑testing of the active account arrangements, including at least one test per year, to evidence that positions and new trades can be shifted from Tier 2 CCPs to EU CCPs under stress scenarios.
• Map and quantify exposures to Tier 2 CCPs across AAR‑relevant derivatives, and establish an internal monitoring framework to track shifts in clearing volumes between Tier 2 CCPs and EU CCPs in line with AAR objectives.
• Align trade booking, clearing workflows, and client documentation so that the required minimum number of trades per relevant subcategory and contract class can be cleared through the EU active account on an annual average basis, taking into account representativeness requirements where applicable.
• Prepare to submit the first AAR report by 31 July 2026, ensuring that systems and controls can capture and report activity from 25 June 2025 to 30 June 2026 in accordance with ESMA’s reporting templates and instructions.

What changed

• - ESMA has published an Interim Report on the effectiveness of the Active Account Requirement, covering implementation and market impact during 2025 and early 2026, and explicitly framing this as the...
• ESMA confirms that roughly 500 entities have formally notified ESMA and national competent authorities that they are subject to the AAR, indicating that competent authorities now have a defined...
• Notified entities represent more than 90% of notional outstanding held by EU entities in relevant AAR‑scope derivatives, signalling supervisory focus on a concentrated set of high‑exposure...
• ESMA identifies early signs of increased clearing activity at EU CCPs, particularly among smaller entities, including some full relocation of positions from Tier 2 CCPs to EU CCPs for AAR‑relevant...
• ESMA notes a gradual but limited shift in market shares from systemically important Tier 2 CCPs to EU CCPs in certain AAR‑related products, indicating that supervisors will monitor market‑share...

Key dates

13 November 2023

– Week-long 2023 Global CCP fire drill coordinated by ESMA and other authorities, simulating the default of a hypothetical major clearing member across more than 30 CCPs

5 December 2024

– Kick-off meeting for the second industry-led multi-CCP default simulation (CIDS 2025) organised by CCP Global in Singapore, setting parameters and expectations for the 2025 exercise

3 November 2025

– Start of the 2025 CCP Global International Default Simulation (CIDS) multi-CCP fire drill window (up to 7 November 2025 for some CCPs), simulating the failure of a hypothetical common participant

4 December 2025

– Debrief meeting in Singapore for CIDS 2025 participants to discuss operational outcomes, bottlenecks, and potential improvements

19 June 2026

– ESMA and the lead authorities publish the 2025 CIDS key findings and recommendations, outlining expectations for further progress in standardisation, porting, portal-based solutions, and potential market stress overlay modules

Suggested considerations

• CCPs should review and update their default management procedures to align with emerging cross-CCP standards, including harmonised communication conventions, standardised information templates, and coordinated auction timelines.
• Clearing members should conduct a cross-CCP gap analysis of their default-management playbooks to ensure they can support simultaneous auctions and calls from multiple CCPs without creating operational bottlenecks.
• CCPs and clearing members should implement or upgrade portal-based communication and workflow tools for default events, replacing fragmented email- or spreadsheet-based processes where feasible.
• Clearing brokers and client-clearing firms should test and, where necessary, redesign their porting arrangements (including client consent, documentation, booking models, and operational capacity) to ensure they can port positions and collateral under stressed but realistic timelines.
• Risk and operations teams at CCPs and clearing members should incorporate findings from the 2023 and 2025 CIDS exercises into their internal default-management training, drills, and board reporting on operational resilience.

What changed

• - Supervisory expectations are raised for standardisation and reduction of fragmentation in CCP default-management procedures and communication conventions, with a strong push toward harmonised...
• Lead authorities explicitly promote greater use of portal-based solutions (rather than ad hoc email or bespoke channels) for communication, information sharing, and auction-related workflows between...
• Authorities call for more realistic testing of porting arrangements, including end-to-end operational tests that reflect real-life constraints (documentation, client consent, timing of transfers, and...
• The lead authorities propose considering a voluntary “market stress overlay” module in future CIDS exercises, creating a coherent cross-CCP macro stress scenario to test whether operational capacity...
• ESMA confirms that global CCP fire drills are now a core component of system-wide resilience expectations, effectively embedding regular multi-CCP default simulations into ongoing supervisory...

Key dates

17 January 2025

– DORA (Regulation (EU) 2022/2554) applies, and financial entities become obliged to report major ICT‑related incidents to their competent authority once classification thresholds are met

Annual (from 2026 onwards) Deadline

– Under Article 22(2) DORA, the ESAs must issue a yearly report covering number, nature, impact, remedial actions and costs of major ICT‑related incidents; the publication in early June 2026 is the first such report and sets the expectation for future annual cycles

Suggested considerations

• Review and, where necessary, recalibrate internal incident classification criteria against the DORA definition of “ICT‑related incident” and “major ICT‑related incident”, ensuring consistency with applicable RTS on classification and materiality thresholds.
• Validate that your firm’s incident management and escalation processes can identify, assess and classify incidents “without undue delay” and trigger major‑incident reporting within the prescribed timelines (initial, intermediate and final reports).
• Conduct a gap analysis of cross‑border incident handling, ensuring that governance, communication and coordination arrangements adequately address incidents affecting multiple Member States or shared cross‑border infrastructures.
• Strengthen third‑party and outsourcing risk management by mapping critical and important functions to their supporting ICT service providers, and ensuring contracts, SLAs and incident‑response clauses support DORA reporting and cooperation obligations.
• Test and, if needed, enhance incident response runbooks to ensure close coordination with ICT service providers during incident containment, remediation and recovery, including clear roles for data provision required for regulatory reporting.

What changed

• - The ESAs have operationalised Article 22(2) DORA by issuing the first annual overview of major ICT‑related incidents, confirming that yearly ESA‑level aggregation and analysis of incident data is...
• Incident reporting under DORA is now demonstrably harmonised and centralised, with major ICT‑related incidents being notified to all competent authorities involved and then aggregated by the ESAs for...
• The report confirms that cross‑border incidents are prevalent (around one third of major incidents), reinforcing that the “borderless and interconnected” nature of ICT risk is a key supervisory...
• System failures and external events, rather than pure cyber‑attacks, are identified as the main drivers of major incidents, placing regulatory emphasis on ICT change management, resilience of core...
• The ESAs highlight third‑party and outsourcing risk as a core theme, stressing the need for robust oversight of ICT service providers and close coordination with them during incident response and...

Key dates

2025 (exact dates TBD)

– ESMA’s Call for Evidence on streamlining reporting across EMIR, MiFIR and SFTR is scheduled, with stakeholders expected to provide input on duplication removal and “report once” options

18 June 2026

– ESMA will host a webinar to present the main findings of the annual report on the quality and use of regulatory data

Suggested considerations

• Map all existing regulatory reporting obligations across EMIR, SFTR, MiFIR, AIFMD, MMFR, Prospectus and DORA ICT‑incident reporting, and document the underlying data sources, systems and ownership for each regime.
• Review and enhance data quality controls for EMIR, SFTR and MiFIR reporting, including validation rules, completeness checks, reconciliations, pairing and matching processes, and governance around Unique Transaction Identifiers and counterparty data.
• Perform a gap analysis of Prospectus reporting and DORA ICT‑incident reporting processes against ESMA’s emerging cross‑regime data quality expectations and ensure they are covered in the firm’s enterprise data governance framework.
• Establish or update a centralised regulatory data governance framework that explicitly covers cross‑regime consistency (for example, trade and position data alignment between EMIR, SFTR and MiFIR) and defines clear accountability at senior management level.
• Engage with internal IT and reporting teams to identify where a future “report once” model could be supported technically, including harmonised reference data, common identifiers and golden‑source transaction and position records.

What changed

• - ESMA confirms measurable data quality improvements across EMIR, SFTR, MiFIR, AIFMD and MMFR regulatory datasets, indicating that regulators now consider these data sufficiently reliable for...
• ESMA highlights extensive and growing supervisory use of regulatory data by ESMA and NCAs for investor protection, financial stability, orderly markets and market integrity, increasing the...
• The scope of the annual data quality and use report is expanded to include Prospectus reporting obligations, bringing prospectus‑related data formally into ESMA’s cross‑regime data quality scrutiny.
• The report scope is also expanded to include ICT‑related incident reporting under the Digital Operational Resilience Act (DORA), signaling that operational resilience incident data will be monitored...
• ESMA has launched a 2025 Call for Evidence on streamlining reporting across EMIR, MiFIR and SFTR, including options to remove duplications and apply a “report once” approach, which will likely lead...