The AFM highlights the following findings of its market overview:
- Many firms’ policies and processes (i.e. compliance, regulations and professional competence) are well organised. Simultaneously, however, execution of these policies and processes is not strong enough. This creates the risk that policy looks sound on paper, but does not work sufficiently in practice;
- IT risk management is falling short, which makes organisations vulnerable to cybercrime;
- Greater clarity on the division of roles and responsibilities within organisations is required.
The AFM expects market participants to use the insights from the SREP market overview to critically evaluate their organisations and identify areas where their business operations can be improved. In September 2026, the AFM will issue a new SREP request to investment firms.
The full SREP market overview is available here (Dutch only).