CySEC Circular C795: ESMA's 2026 review of risk management at UCITS ManCos and AIFMs

On 3 July 2026 ESMA launched a common supervisory action (CSA) on the risk management function of UCITS management companies and alternative investment fund managers (AIFMs). National supervisors will carry it out with ESMA during 2026 and 2027, using a common assessment framework that sets the scope, method, supervisory expectations and timeline. ESMA plans to publish a final report on the results in 2028.

The aim is to test how firms comply with the key risk provisions of the UCITS and AIFMD frameworks. Supervisors will look at three areas: how the risk management function is governed and organised; how risks are identified, measured and monitored; and how risk information reaches senior management and governing bodies. ESMA gives market, credit, liquidity, counterparty and operational risk as examples of the material risks involved.

CySEC relayed the CSA in Circular C795 of 12 August 2026. According to published summaries, the circular is addressed to UCITS management companies, internally managed UCITS, AIFMs and internally managed AIFs. CySEC plans a targeted thematic review in late 2026 and early 2027, through on-site inspections, desk-based reviews or both, covering a representative sample of Cyprus fund managers.

Before that work starts, CySEC asks firms to check that their risk management arrangements remain appropriate, effective and proportionate to their activities. The CSA itself creates no new obligations; it tests how firms apply the existing ones.

For UCITS management companies, Article 12 of Commission Directive 2010/43/EU requires a permanent risk management function that is hierarchically and functionally independent from operating units. National law may allow a derogation only where it is appropriate and proportionate to the nature, scale and complexity of the business, and the firm must then show safeguards against conflicts of interest. The function implements the risk policy, ensures compliance with each fund's risk limit system, including the statutory limits on global exposure and counterparty risk, and reports regularly to the board and senior management on risk levels, limit breaches and the adequacy of the risk process. It must have the authority and access to information it needs.

For AIFMs, Article 15 of the AIFM Directive requires risk management to be functionally and hierarchically separated from operating units, including portfolio management, and risk systems to be reviewed at least once a year. Delegated Regulation (EU) No 231/2013 adds detail on the permanent risk function and its independence. In Cyprus these rules sit in the UCITS Law 78(I)/2012 and the AIFM Law 56(I)/2013; see our study note on AIFM risk and liquidity management.

A practical self-assessment can follow ESMA's three areas. On governance: is the risk function independent of portfolio management in its reporting line and pay, with enough people, expertise and systems for every fund, including cross-border and delegated mandates? On measurement: do limits, stress tests and liquidity monitoring match each fund's actual strategy, and are breaches escalated and recorded?

On reporting: do the board and senior management receive regular reports comparing risk levels with each fund's agreed risk profile, with limit breaches and remedial action, and do the minutes show that the board challenged them? Smaller firms relying on a proportionality derogation should be able to explain why it is justified and which safeguards protect the function's independence. Keeping this evidence in one place will make an on-site or desk-based review easier.