EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
Recent Searches
On 11 May 2026, ESMA published its final report on the 2025 Common Supervisory Action (CSA) assessing the effectiveness of compliance and internal audit functions across UCITS management companies and AIFMs. The exercise, conducted with all EU and EEA national competent authorities (NCAs), aimed to evaluate adherence to AIFMD and UCITS requirements and to promote supervisory convergence.
The overall conclusion is positive: most fund managers comply with core regulatory requirements. However, ESMA highlights some governance weaknesses, notably around independence, resourcing, and practical effectiveness of control functions, as well as inconsistencies between documented policies and their real-world implementation.
Good vs. Poor Practices Identified
Supervisors identified several practices that contribute to robust governance frameworks:
- Prior involvement of the compliance function in the review of policies and procedures
- Use of dedicated IT tools enabling efficient and traceable interaction between compliance and operational functions
- Establishment of internal ‘Controls Committees’ to foster effective collaboration between compliance and operational functions and ensure compliance requirements are properly embedded in day-to-day operations
- Regular internal reports by the compliance function to the board of directors (at least semi-annually or quarterly)
- Clearly defined internal procedures describing how deficiencies should be promptly reported, how remedial actions and deadlines are set, and how progresses are monitored and reported to the board of directors on a regular basis
- Preparation of ad-hoc reports on specific topics triggered by events, news, regulatory developments or market changes, followed by appropriate procedural updates and enhanced monitoring of critical activities
- Inclusion of internal audit reporting as a standing item on the board agenda (to ensure that the board remains consistently and actively involved in internal audit matters)
Conversely, ESMA observed recurring weaknesses across jurisdictions:
- Insufficient follow-up monitoring and progress updates
- Lack of clear recommendations and defined deadlines
- Lack of documentation
- Insufficient focus of the group's compliance function
- Weak safeguard arrangements for electronic data processing
- Restricted access to relevant information
- Misallocation of compliance resources
- Lack of tracking of non-compliance events
- Insufficient controls relating to investment limits
- Inadequate controls frameworks overall
- Lack of coordination between second and third lines of defense
- Undocumented and inconsistent risk assessment methodologies
- Poor quality and lack of clarity in internal audit reporting
- Insufficient internal audit details, missed deficiencies and weak follow-up
- Group internal audit policies not properly implemented at local level
- Absence of internal audit review of the compliance function
These shortcomings suggest that, in some firms, compliance and internal audit still operate as “tick-the-box” functions rather than as strategic enablers of risk management.
Key areas of focus for fund managers
Based on ESMA’s findings, several priority areas require immediate attention:
Final Remarks
ESMA’s CSA confirms that while the fund management industry is broadly compliant, the real challenge lies in moving from formal compliance to effective and demonstrable control frameworks. The findings highlight a persistent gap between policies on paper and practices in reality, particularly in areas such as resourcing and proactive involvement of control functions.
In an environment marked by increasing regulatory scrutiny, product complexity, and cross-border activity, compliance and internal audit functions are expected to evolve into strategic partners capable of anticipating risks, rather than merely reporting them.
For fund managers, this represents both a risk, as weaknesses may trigger supervisory attention and remediation requirements, and an opportunity to strengthen governance, enhance investor confidence, and build more resilient operating models.
Ultimately, firms that embed control functions into decision-making, invest in capabilities, and ensure robust execution will be best positioned to meet regulatory expectations and support sustainable growth.
How EY can help
EY can support fund managers in assessing and strengthening their compliance and internal audit frameworks in light of ESMA’s findings:
- Perform independent gap assessments: benchmark your compliance and internal audit functions against ESMA expectations and leading market practices to identify weaknesses and prioritize remediation actions
- Enhance governance frameworks: redesign reporting lines, committee structures and interaction models to reinforce independence, oversight and effective challenge
- Strengthen documentation and control frameworks: implement robust policies, procedures and registers, and ensure full audit trails for decisions, monitoring activities and remediation actions
- Optimize resourcing and operating models: assess staffing levels, roles and responsibilities, and support the design of scalable target operating models aligned with your business complexity.
- Embed control functions in strategic processes: integrate compliance and internal audit into product governance, delegation models, and market expansion initiatives to ensure risks are identified ex ante
- Formalize escalation and remediation processes: design structured escalation frameworks, tracking tools and reporting dashboards to improve visibility, accountability and timely resolution of findings
- Develop tailored risk assessment methodologies: build or refine entity-level risk frameworks that reflect your specific activities, including cross-border setups and delegated structures
- Leverage technology and data analytics: deploy digital solutions to enhance monitoring, automate controls, and improve reporting quality and efficiency
- Support internal audit transformation: enhance audit methodologies, improve report quality, and ensure risk-based coverage, including dedicated reviews of compliance functions
With a combination of regulatory expertise, operational experience and technology capabilities, EY helps fund managers move beyond “tick-the-box” compliance towards robust, effective and forward-looking control environments.
Summary
On 11 May 2026, ESMA published its final report on the 2025 Common Supervisory Action (CSA) assessing the effectiveness of compliance and internal audit functions across UCITS management companies and AIFMs.
Related articles
On 4 June 2046, the CSSF published a feedback report setting out its supervisory expectations regarding the valuation of less liquid and illiquid assets by IFMs. The report provides guidance, based on the applicable regulatory framework, on the implementation and maintenance of robust valuation policies, procedures and controls for the AIFs and UCITS managed by IFMs.
ELTIF’s moment: why Europe’s long‑term fund is becoming a strategic must‑have
For most of its first decade, the European Long‑Term Investment Fund (ELTIF) looked like a good idea trapped in a tight suit: a retail‑friendly wrapper for private markets but constrained by rigid portfolio rules and an unhelpful approach to liquidity. That chapter has now definitely closed.
How tax incentives are accelerating digital transformation in fund management
How tax incentives are accelerating digital transformation in fund management
Private credit’s liquidity reckoning: the real economy’s favorite financier meets market reality
Private credit has become one of Europe’s most important conduits of funding to the real economy, providing companies with loans, structuring bespoke facilities for growth and acquisition, and financing assets that rarely fit a public-market template.
Luxembourg’s fund industry has rarely lacked scale or sophistication. A world of persistent inflation surprises, fragmented liquidity, and geopolitics‑driven price gaps is colliding with supervisory expectations more and more focused on demonstrable risk governance.
CSSF 2026: Why operational resilience is the new supervisory standard
The CSSF has set out its supervisory priority agenda for 2026, signalling a year of intensified scrutiny for fund managers operating in Europe’s largest cross‑border fund domicile and pointing to a clear regulatory direction: supervision is moving decisively from policy design to operational reality.