ESMA Peer Review On The Supervision Of Depositary Obligations

For further information on any of the issues discussed in this publication please contact the related contact(s) on this page.

On 17 November 2025, ESMA published the findings of a peer review report on the supervision of depositary obligations with the aim of promoting the robust supervision of depositary obligations (Peer Review). The Peer Review assessed the National Competent Authorities (NCAs) supervisory and enforcement practices with a focus on the following three specific areas:

1. depositary oversight obligations in respect of (a) valuation of the assets of the UCITS/AIF; and (b) UCITS/AIF compliance with its leverage and investment restrictions;
2. depositary safekeeping obligations, specifically due diligence required for the delegation of safekeeping functions to third parties and adherence to the asset segregation rules throughout the custody chain; and
3. depositary duty not to delegate functions other than safekeeping (and certain support functions) to third parties.

This assessment of NCAs was carried out by ESMA's Peer Review Committee (the "PRC") by way of a questionnaire, on-site visits and outreach to stakeholders and targeted five relevant jurisdictions in the EU based on a set of objective criteria in order to compare and assess their supervisory practices.

The following countries were selected for the Peer Review:

• Czechia – Czech National Bank (CNB);
• Ireland – Central Bank of Ireland (CBoI);
• Italy – Banca d'Italia (BoI);
• Luxembourg – Commission de Surveillance du Secteur Financier (CSSF); and
• Sweden – Finansinspektionen (SFSA).

Overall, the PRC noted that while all NCAs had processes and procedures in place in respect to the supervision of depositary obligations, it observed a number of weaknesses. The Peer Review Report sets out certain recommendations of the PRC to NCAs to address such weaknesses.

Findings within the Peer Review Report

Concentration Risk in the Depositary Market

Concern was expressed by the PRC in respect to the European depositary market, with the review finding that within the assessed jurisdictions, the top five depositaries for UCITS accounted for between 67% - 100% of all assets under custody within the respective jurisdiction. This was identified as giving rise to the potential for overexposure to a small number of entities presenting a systemic risk in circumstances where such entities may experience financial or operational difficulties. As outlined below the Peer Review Report recommends increased supervisory intensity and more effective enforcement practices.

Supervisory Intensity

The PRC noted distinct variances in elements of NCAs' risk-based approaches, including the length of on-site supervisory cycles and therefore the different frequency and type of supervisory activities. The PRC recommended that the majority of the NCAs must reconsider the regularity of their risk based supervisory cycle to ensure a more frequent inspection cycle for the most impactful depositaries. In this context, NCAs are encouraged to consult ESMA's recently approved principles on risk-based supervision.

Enforcement Practices

The PRC considered the enforcement practices of the NCAs during the review period. The PRC invited NCAs to make more effective use of enforcement tools when issues are identified in the supervision of depositaries and encouraged NCAs to consider more frequent enforcement actions (where appropriate) on foot of identified breaches.

Valuation Oversight

The PRC considered how NCAs undertake supervision of a depositary's obligation to ensure appropriate and consistent valuation procedures are established, effectively implemented, and periodically reviewed in relation to the units of the UCITS/AIF. The PRC recommended that NCAs should revise the scope of their supervisory activities to include more in-depth assessments of a depositary's valuation-related controls and their effectiveness that is consistent with the outcome of due diligence/risk assessments of the fund manager.

The PRC called for a number of NCAs to strengthen the link between desk-based and on-site supervision where identified areas of concern at the desk-based level inform on-site inspections.

In addition, the PRC observed that for certain NCAs, the frequency of depositary controls varies significantly across market participants, even for daily dealing UCITS. The PRC recommended that NCAs should review the frequency of depositary control checks on valuations to ensure they are consistent with the valuation schedule of the fund.

Monitoring of Investment Restrictions and Leverage Limits

The PRC considered how NCAs undertake supervision of a depositary's obligation to ensure appropriate processes are implemented to monitor a UCITS/AIF's compliance with investment restrictions and leverage limits set in the applicable laws and UCITS/AIF's offering documents. In terms of reporting on investment restrictions and leverage limit breaches, the PRC observed that all NCAs receive these reports from either the depositary or fund manager.

The PRC recommended that NCAs revise the scope of their supervisory activities to include more in-depth assessments of a depositary's investment restrictions/leverage limit controls and their effectiveness that is consistent with the outcome of due diligence/risk assessments of the fund manager.

The PRC called for certain NCAs to review the frequency of depositary control checks on investment restrictions and leverage limits to ensure they are proportionate to the nature, scale and complexity of the fund.

In addition, the PRC recommended that NCAs reassess the current supervisory approach which allows depositaries to provide ex-post first level controls on investment restrictions and leverage limits on a delegation basis despite their oversight obligations concerning the same activities.

Delegation (Due-Diligence)

The PRC considered how NCAs supervise whether depositaries have implemented adequate processes and practices to comply with their due diligence obligations with respect to the delegation of safekeeping functions to third parties including the segregation of clients' assets. The PRC considered the level of supervisory activity undertaken by each NCA (such as on-site inspections) as well as the issues / documents reviewed and related scrutiny, including desk-based reviews and sample testing of due diligence reports. The PRC noted divergences in approaches between jurisdictions.

The PRC recommended that NCAs conduct more in-depth and formalised supervisory assessments of depositaries due diligence practices.

The PRC also recommended that NCAs should establish and implement supervisory expectations regarding the obtaining of legal opinions by depositaries on the adequacy of the insolvency laws in third countries.

Delegation (First Level Accounts)

In relation to the supervision of depositaries due diligence obligations on safekeeping and asset segregation, the PRC observed that out of the five jurisdictions reviewed, one of the jurisdictions does not require its depositaries to maintain first-level accounts where the safekeeping function is delegated. This was highlighted by the PRC as a divergent approach to the other NCAs and the PRC encourages that NCA to review its supervisory practices to ensure that it is satisfied with this model.

Delegation (Reconciliation)

The PRC considered how NCAs review the reconciliation processes of depositaries. The PRC noted that certain NCAs did not perform cross checks of assets held with sub-custodians directly with these entities. In addition, the PRC also noted a divergence between the expectations of NCAs regarding the frequency of reconciliations between depositaries and their sub-custodians (some jurisdictions expected daily reconciliation, some jurisdictions expected weekly reconciliations and one jurisdiction accepted monthly reconciliations).

In line with the ESMA Q&As¹, the PRC is of the view that the supervisory expectation regarding the frequency of reconciliations between the accounts of the depositaries and that of their sub-custodians should consider both the dealing and trading frequency of the UCITS or AIF. The PRC has invited NCAs to establish and implement supervisory expectations regarding the frequency of reconciliations between the accounts of the depositaries and their sub-custodians.

Delegation Prohibited (other than safekeeping of non-cash assets and support functions)

The PRC noted significant use of entities/branches in certain EU Member States and third countries. In those cases, the PRC is of the view that there would be merit in the NCAs performing more in-depth supervisory assessments and challenge on cases where supervised entities foresee entrusting third parties and branches with potentially significant tasks with relevance to depositary oversight functions. The PRC indicated that these assessments by NCAs should aim to verify that tasks indeed represent mere 'supporting tasks' as further specified in the ESMA Q&As² and therefore do not contravene the AIFMD and UCITS rules that do not allow for any delegation of oversight functions.

Regarding situations where the depositary of a UCITS or AIF is a branch and the head office is established in a Member State other than the home Member State of the UCITS, the PRC points out that the ESMA Q&As³ state that the operational infrastructure and internal governance system of such branches must be adequate to carry out depositary functions autonomously from its head office. The PRC has invited NCAs to carefully assess possible delegation arrangements in line with the narrow criteria set out in the ESMA Q&As and challenge supervised entities, where needed.

To ensure depositaries do not delegate oversight functions, the PRC recommended that NCAs more thoroughly assess, through the review of sample reports, Key Performance Indicators (KPIs), contracts/SLAs and on-site inspections at large service providers.

Next Steps

While the Peer Review focused on five specific NCAs, the PRC noted that all NCAs within the EU should review and consider the findings, recommendations and good practices detailed within the report in respect to their own supervisory framework.

The Peer Review Report indicates that the PRC's recommendations to NCAs may be subject to follow-up two years from the publication of the Report.

One of the key points of the Peer Review Report is for the NCAs to increase the frequency of engagement with Depositories coupled with a more intrusive supervisory approach. Accordingly, we recommend that Depositaries review the recommendations within the Peer Review Report to ensure that they have appropriate procedures in place.

Footnotes

1 ESMA Q&As on the application of AIFMD (ESMA 34-32-352) Section VI; question and answer no.15).

2 ESMA Q&As on the application of the AIFMD (ESMA 34-32-352), Section VI, Q&A no. 10 and ESMA Q&As on the application of the UCITS Directive (ESMA34-43-392), Section X, Q&A no. 2

3 Ibid.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.