On 20 July 2026, the European Securities and Markets Authority (ESMA) published its follow-up report to the Peer Review on the supervision of cross-border activities of investment firms.

Background

This follow-up report updates on the actions taken by six National Competent Authorities (NCAs) to address the findings and recommendations of the 2022 peer review on the supervision of cross-border activities of investment services.

Summary

The follow-up report focuses on the home-state supervisory responsibilities of the six NCAs reviewed: Czechia (CNB), Cyprus (CySEC), Germany (BaFin), Luxembourg (CSSF), Malta (MFSA) and the Netherlands (AFM). It assesses progress in areas where expectations were only partially met or not met, and makes the following key observations:

  • Authorisations: Most NCAs strengthened their authorisation processes to better assess firms intending to provide cross-border services. CNB, BaFin and CSSF introduced more structured requirements covering governance, business models, language capabilities, compliance arrangements, risk management and operational readiness for cross-border activity. CySEC enhanced its application process through additional questions, revised checklists, updated guidance and greater scrutiny of cross-border capabilities before licensing firms. AFM continues to examine cross-border plans during authorisation but relies largely on supervisory judgement rather than documented criteria, the report recommended introducing more formal guidance and consistent assessment criteria.
  • Ongoing Supervision: All NCAs enhanced their supervisory frameworks by collecting more information on firms’ cross-border activities and integrating that information into risk-based supervision. Most authorities now incorporate factors such as client numbers, complaints, geographic reach, revenues and product risks into supervisory risk scoring. It was recommended in the report that AFM should better integrate cross-border risks into supervisory planning and ensure adequate representation of cross-border firms in inspections, CNB should monitor whether a more systematic approach becomes necessary for credit institutions, and BaFin should increase intrusive supervisory activity, including proactive examinations of higher-risk firms.
  • Cooperation Among Authorities: Following criticism of delays in responding to requests from other regulators, CySEC introduced performance monitoring, automated tracking, regular management reviews and process improvements. Average response times have improved significantly since 2022, with fewer cases exceeding three months and overall handling times reduced. However, it was recommended in the report that CySEC should continue monitoring response times and take further action if necessary.
  • Enforcement and Sanctioning:  The report found evidence of stronger enforcement activity in several jurisdictions but recommended that CySEC should continue using enforcement proportionately and strengthen analysis of firms’ supervisory histories when determining sanctions and BaFin should ensure enforcement activity remains proportionate to the scale and risks of German firms’ cross-border operations.
  • Cross-Cutting Considerations: The report found that concerns about rapid growth in Maltese cross-border activity have not materialised. Nevertheless, MFSA has increased staffing and supervisory resources to ensure appropriate oversight. ESMA has also supported convergence through several initiatives, including a 2022 supervisory briefing on cross-border supervision, a new inter-authority fitness and propriety information-sharing system and ongoing cooperation initiatives. Since its launch in 2025, the information-sharing system has facilitated more than 650 exchanges between authorities.