On 3 July 2026, the European Securities and Markets Authority (ESMA) launched an EU-wide common supervisory action (CSA) on the risk management functions of Ucits management companies and authorised alternative investment fund managers (AIFMs).
On 27 July, the CSSF launched the exercise in Luxembourg by asking selected firms to complete a questionnaire covering governance, risk identification and monitoring, and reporting to senior management and governing bodies. Firms not contacted by the CSSF are outside the scope of the exercise.
CSSF keeps details of ESMA review under wraps
In response to Paperjam’s questions, the CSSF did not disclose the number of firms, selection criteria, diversity of business models, document checks, tests of the risk function’s actual independence, or the range of potential enforcement actions.
A CSSF representative nevertheless stressed that the authority would act before the EU-wide exercise ends if it identified urgent concerns: “If we see anything urgent, we will address it directly with the firms and will not wait until 2028. We will also probably make a publication after ESMA publishes its assessment.”
For other CSAs, the CSSF eventually disclosed the size of its samples:
· 36 fund managers and 2,654 sub-funds for the review of costs;
· 30 fund managers for the review of sustainability risks;
· 155 fund managers surveyed, followed by an in-depth review of 51 fund managers and more than 400 Ucits during the 2020 liquidity review.
The comparison is relevant because ESMA’s previous CSA on compliance and internal audit identified weaknesses in the independence of control functions, the quality of internal policies and board oversight. It also found differences in firms’ practices depending on their size, nature and complexity. ESMA published those findings in May 2026.
ESMA clarifies limits on CSA disclosure
Paperjam subsequently asked ESMA whether the European authority prohibited national competent authorities (NCAs) from disclosing the size, stratification, or general selection criteria of their samples.
ESMA said CSAs contribute to a common EU supervisory culture and more consistent supervisory practices. Participation nevertheless remains voluntary for NCAs and forms part of their national supervisory activities.
Whether an NCA may publish information about its sample therefore depends first on national confidentiality rules, ESMA said. Those rules must be applied consistently with the professional-secrecy requirements in Article 102 of the Ucits Directive and Article 47 of the Alternative Investment Fund Managers Directive.
ESMA added: “Given those restrictions in Union legislation, if knowing the sample size, or other criteria from the CSA methodology, would permit an entity to be identified, such information may not be disclosed without the entity’s prior agreement.”
ESMA’s response indicates that confidentiality rules may prevent the disclosure of information capable of identifying individual firms. It does not, however, establish a blanket prohibition on publishing aggregate sample sizes or broad selection criteria.
The CSA is intended to assess the effectiveness and independence of firms’ risk management functions. No publicly available information yet explains in detail how the CSSF will test those concepts in Luxembourg, particularly where portfolio management is delegated or where risk and investment functions operate within the same group structure.
