The European Securities and Markets Authority (ESMA) published a final report on 11 May 2026 detailing the outcomes of a Common Supervisory Action (CSA) focused on compliance and internal audit functions across EU securities markets. The report aims to enhance supervisory convergence and strengthen the effectiveness of these key governance functions, directly impacting investment firms, credit institutions, and market operators subject to ESMA's remit.
ESMA, the EU's securities markets regulator, issued the final report as part of its ongoing efforts to harmonise supervisory practices among national competent authorities (NCAs). The document synthesises findings from coordinated assessments conducted by NCAs in 2025, identifying common weaknesses and recommending improvements in the independence, resources, and operational effectiveness of compliance and internal audit units.
The report is non-binding but carries significant weight as a supervisory tool, encouraging NCAs to align their expectations and enforcement actions. It does not set numerical targets but provides qualitative benchmarks, such as ensuring compliance functions have direct access to senior management and sufficient staffing. The trade-offs highlighted include balancing the cost of enhanced compliance structures for firms against the benefits of reduced regulatory risk and stronger investor protection.
For investment firms and banks, the report signals likely increased scrutiny and potential costs to upgrade compliance and audit frameworks. NCAs will need to adjust their supervisory methodologies, potentially requiring additional resources. Investors and market integrity stand to benefit from more robust governance. ESMA itself reinforces its role as a convergence driver without imposing direct penalties.
NCAs are expected to integrate the report's findings into their ongoing supervision, with ESMA planning to monitor implementation through follow-up CSAs and peer reviews. The European Commission may consider the report when reviewing relevant delegated acts under MiFID II or the Capital Requirements Directive.