ESMA Launches EU-wide Review Of Risk Management Function At UCITS Management Companies And AIFMs

On 3 July 2026, the European Securities and Markets Authority (“ESMA“) announced a new Common Supervisory Action (“CSA“) focusing on the risk management function of UCITS management companies and alternative investment fund managers (“AIFMs“) across the EU. The exercise will be carried out during 2026 and 2027 in conjunction with national competent authorities (“NCAs“), with a final report expected in 2028. 

The CSA underscores ESMA’s continuing supervisory focus on governance, control functions and the effectiveness of management company and AIFM oversight frameworks. It also forms part of a broader series of cross-border supervisory exercises designed to promote convergence in supervisory practices across the EU.

What Will Supervisors Review?

The CSA will assess compliance with key risk management requirements under the UCITS and AIFMD frameworks, with a particular focus on the effectiveness, independence and expertise of firms’ risk management functions.

NCAs will examine three principal areas:

• Governance and organisation of the risk management function, including its independence, resourcing and positioning within the organisation;
• Risk identification, measurement and monitoring, covering the manner in which firms identify and manage market, liquidity, credit, counterparty and operational risks; and
• Reporting arrangements, including escalation and reporting to senior management and governing bodies.

The review will be conducted using a common assessment framework developed by ESMA, intended to ensure a consistent supervisory approach across EU Member States.

Part of a Wider Supervisory Trend

The new CSA follows ESMA’s 2025 CSA on the compliance and internal audit functions of UCITS management companies and AIFMs, which similarly focused on the effectiveness, authority, expertise and resourcing of key control functions. The results of that exercise, published in May 2026, are expected to inform ongoing supervisory scrutiny of fund management company governance arrangements.

It also builds on ESMA’s earlier 2020 CSA on UCITS liquidity risk management, which identified a number of common weaknesses in firms’ liquidity risk frameworks, including deficiencies in governance arrangements, escalation procedures, pre-investment liquidity assessments, delegate oversight and board reporting. That exercise subsequently prompted follow-up supervisory actions by several national regulators, including the Central Bank of Ireland.

Taken together, these initiatives demonstrate ESMA’s increasingly detailed focus on the operation of second-line control functions and the ability of boards and senior management to oversee key risks effectively.

Key Takeaways for Firms

Although the detailed CSA assessment framework has not yet been published, UCITS management companies and AIFMs may wish to begin reviewing:

• the independence and organisational standing of their risk management function;
• the adequacy of staffing, expertise and resources dedicated to risk management;
• risk identification, monitoring and escalation processes;
• risk reporting provided to boards and senior management; and
• governance arrangements surrounding delegated portfolio management activities and oversight of delegated risk activities.

Given the experience of previous CSAs, firms should expect NCAs to examine not only documentary compliance with regulatory requirements but also evidence that risk management frameworks operate effectively in practice and are appropriately embedded within governance and decision-making processes.

Looking Ahead

The CSA is likely to become a significant supervisory theme for management companies and AIFMs over the next two years. The exercise reflects regulators’ growing focus on the effectiveness of fund governance arrangements, operational resilience and risk oversight, particularly against a backdrop of market volatility, liquidity challenges and increased delegation structures within the European funds industry. Firms should therefore anticipate supervisory engagement in this area and consider whether their existing risk management frameworks would withstand regulatory scrutiny.

ESMA expects to publish a final report on the findings of the CSA in 2028.

For more information and advice on preparing for the CSA, please contact any member of our Asset Management and Investment Funds Group.