Delegated Regulation on EU code of conduct for issuer-sponsored research published in Official Journal
On 4 September 2026, Commission Delegated Regulation (EU) 2026/1092 was published in the Official Journal of the European Union.
The Delegated Regulation sets out regulatory technical standards (RTS) on establishing an EU code of conduct for issuer-sponsored research under MIFID II. It is based on the ESMA final report containing draft RTS, which was submitted to the European Commission in October 2025. The resulting RTS were subsequently adopted in May 2026. The Delegated Regulation entered into force on 7 September 2026, three days following its publication in the Official Journal.
EBA, EIOPA and ESMA propose amendments to bilateral margin requirements
On 3 August 2026, the European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) published a final report on draft Regulatory Technical Standards (RTS), proposing to simplify the bilateral margin requirements of the European Commission’s Delegated Regulation (EU) 2016/2251.
The proposed amendments aim to simplify the bilateral margin framework for counterparties that are subject to initial margin requirements and that are below the €8 billion threshold for exchanging initial margin foreseen by the European Market Infrastructure Regulation (EMIR). The changes are intended to facilitate the phase-out of initial margin requirements for these counterparties. They also support greater consistency with the treatment applied in other jurisdictions.
In the current framework, counterparties that are below the threshold are exempt from exchanging initial margin for new uncleared over-the counter (OTC) derivative contracts but continue to exchange initial margin for existing contracts. With the proposed amendments, counterparties would no longer be required to exchange initial margin for either new or existing contracts if they are below the threshold.
The amendments respond to requests from market participants and support the ESAs’ broader objectives of simplification and burden reduction.
The Final Report has been submitted to the European Commission together with the draft RTS for endorsement. Following the Commission’s review and adoption process, the RTS will be subject to scrutiny by the European Parliament and the Council before being published in the Official Journal of the European Union.
ESMA consults on reporting framework for clearing activity at recognised third-country CCPs
On 18 August 2026, ESMA launched a consultation on a proposed annual reporting framework under EMIR for clearing activity at recognised third-country central counterparties (CCPs), aimed at improving supervisory visibility of EU firms’ exposures to such CCPs.
The consultation paper sets out ESMA’s proposed Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) under European Market Infrastructure Regulation (EMIR). The reporting obligation will apply to clearing members and clients that clear transactions through recognised third country CCPs.
The objective is to provide supervisory authorities with a structured and consistent overview of the scale, characteristics and risk profile of EU firms’ exposures to recognised third-country CCPs, contributing to the broader monitoring framework established under EMIR 3.
In line with ESMA’s simplification and burden reduction agenda, the proposal seeks to maximise the reuse of information already available through existing reporting channels and limits new requirements to the information that is not available to ESMA or competent authorities.
Once implemented, the new requirements will establish a harmonised approach to reporting clearing activity at recognised third-country CCPs.
ESMA invites stakeholders to provide feedback on the reporting framework, templates and format by 12 October 2026. Following the consultation, ESMA will assess the responses received and prepare a Final Report.
Please see under Retail Investment Strategy section 2 below for the European Commission’s call for advice to ESMA requesting technical advice to assist in developing level 2 measures implementing the retail investment strategy package.
European Commission call for advice to ESMA requesting technical advice on level 2 measures under Retail Investment Strategy package
On 24 August 2026, the European Commission published a call for advice (dated 30 July) to ESMA requesting technical advice to assist in developing level 2 measures implementing the retail investment strategy (RIS) package.
The package takes the form of a directive containing targeted amendments to a number of EU directives in the area of financial services, including the Markets in Financial Instruments Directive (MIFID II), the Solvency II Directive, the Undertakings for Collective Investment in Transferable Securities (UCITS) Directive and the Alternative Investment Fund Managers Directive (AIFMD) (the Omnibus Directive), and a regulation amending the Packaged Retail And Insurance-Based Investment Products (PRIIPs) Regulation.
A provisional agreement was reached on the RIS package on 18 December 2025 and approved by the Council of the European Union on 5 June 2026 and by the European Parliament on 23 June 2026. The adopted legislative texts are still subject to lawyer-linguists’ review, but the European Commission does not expect any substantive changes. The completion of the lawyer linguists’ work is expected at the latest in September. Final votes by the Council and the Parliament are expected in Q4, which means the publication of the RIS package in the Official Journal of the EU should occur at the latest in January 2027.
Member States will have 24 months to transpose the Omnibus Directive from the date it enters into force. They will have to apply the provisions of the legal text as from July 2029, assuming that the Omnibus Directive is published in January 2027 and that a 30-month implementation period will apply following the date of entry into force. Level 2 measures will also need to be transposed into national laws and regulations by Member States.
The European Commission is seeking ESMA’s technical advice on certain delegated acts to supplement or specify specific provisions of MIFID II, UCITS Directive and AIFMD. To simplify the adoption of the proposed Level 2 measures, ESMA is requested to group the mandates in two delegated acts, a delegated regulation and a delegated directive, for each of the sectoral legislative frameworks. ESMA must submit its advice to the European Commission by 1 October 2027.
EBA guidelines on sound management of third-party risk for non-ICT services
On 18 September 2026, the European Banking Authority (EBA) published its final guidelines on the sound management of third-party risk relating to non-ICT (Information and Communication Technology) services, replacing the EBA’s 2019 guidelines on outsourcing arrangements.
The guidelines establish a comprehensive framework for the governance, risk assessment, and oversight of third-party service providers (TPSPs) supplying non-ICT services to in-scope financial services entities, with a particular focus on services supporting “critical or important functions” (which are as defined in the EU Digital Operational Resilience Act (DORA)). The guidelines aim to harmonise the management of third-party risk and the use of TPSPs in relation to non-ICT services to a level more consistent with ICT services under DORA.
The guidelines’ application date is yet to be confirmed, but they will apply to all third-party arrangements entered into, reviewed or amended by in-scope entities from that date. In-scope entities are expected to review and amend their existing third-party arrangements to ensure they comply. For services relating to “critical and important functions”, that review must be completed within a two-year transitional period (beginning on the date the guidelines apply). Entities that fail to meet that deadline must notify their competent authority and set out a remediation plan. For arrangements supporting non-critical or non-important functions, the review and amendment of documentation may be deferred until the next renewal of the relevant arrangement.
In-scope entities include credit institutions and investment firms subject to the EU Capital Requirements Directive (CRD), third-country branches of credit institutions as defined under CRD, payment institutions and e-money institutions, Class 1 minus investment firms, Class 2 investment firms (i.e., those that don’t qualify as small and non-interconnected under the EU Investment Firms Directive), asset-referenced token issuers under the EU Markets in Crypto-Assets Regulation (MICAR) and financial institutions that qualify as creditors under the EU Mortgage Credit Directive.
The guidelines should be read in conjunction with existing guidelines on internal governance which already apply to these entities, including the EBA’s guidelines on internal governance under CRD (the final revised version of which is yet to be published).
Key requirements include:
The management body of the in-scope financial entity will retain full responsibility for all activities carried out by the TPSP and must ensure that it does not outsource services to such an extent that it becomes an “empty shell” lacking substance to remain authorised.
ESMA calls for changes to make MICA clearer, safer and ready for emerging services
On 30 September 2026, ESMA responded to the European Commission’s public consultation on the review of Markets in Crypto-Assets Regulation (MICA).
ESMA’s recommendations aim to simplify the framework while improving investor protection and addressing innovative business models, such as decentralised finance (DeFi), staking, lending and borrowing.
Enhancing investor protection
ESMA proposes new safeguards in areas where investors face risks that are not fully covered under the current framework, including:
These measures would provide clearer information on costs, risks, rewards, collateral arrangements, and potential losses before investment decisions are made.
Reinforcing supervision
ESMA recommends strengthening supervisory powers and address the risks arising from unauthorised services, online fraud and non-compliant stablecoins, by:
These measures would support faster and more consistent supervisory action across the EU, better protecting investors, and reducing opportunities for regulatory arbitrage.
Evolving towards De-Fi and improving crypto-asset classification
As crypto markets evolve and activity around decentralised finance (DeFi) and stablecoins grow, ESMA advocates for the introduction of clearer criteria for determining which activities can be considered genuinely decentralised. It also recommends creating a new regulated crypto asset service for firms that provide users with access to DeFi protocols.
To reduce uncertainty and support harmonised supervision across the EU, ESMA suggests adopting rules on how crypto-assets should be classified, including new products such as hybrid tokens. It also includes granting ESMA the ability to issue binding opinions on token classification to ensure the same products are treated consistently within the EU market.
Simplification and burden reduction
In line with the EU’s simplification and burden reduction agenda, ESMA proposes to streamline parts of the existing rules, including simplifying crypto-asset white-paper notification procedures, reducing duplicative authorisation requirements for some regulated firms, and improving the consistency of prudential requirements.
Development of an integrated European tokenised capital markets
Finally, and looking beyond the immediate MICA review, ESMA highlights the need for a framework for tokenised securities and on-chain settlement that can support the development of an integrated European tokenised capital market and facilitates cross-border activity in the future.
AMLA publishes three sets of final draft RTS under EU AML package
On 1 October 2026, the EU Anti-Money Laundering Authority (AMLA) published three sets of final draft regulatory technical standards (RTS) defining key measures companies and professionals must apply to reduce anti-money laundering and countering terrorist financing (AML/CTF) under the EU AML Regulation ((EU) 2024/1624) (AMLR).
The three final draft RTS each cover a distinct area of AML/CTF requirements for the private sector:
The final draft RTS will be submitted to the European Commission for adoption. Once adopted, they will be published in the Official Journal of the European Union and come into force 20 days later. They are expected to apply six months after they enter into force, except for specified provisions which will apply from 10 July 2029.
AMLA publishes final draft RTS on home-host supervisory cooperation
On 1 October 2026, the EU Anti-Money Laundering Authority (AMLA) published final draft regulatory technical standards (RTS) under Article 46(4) of the Sixth Anti-Money Laundering Directive (Directive (EU) 2024/1640) (AMLD 6).
The draft RTS were previously consulted on in May and establish a simple, proportionate, and efficient framework for information exchange, cross-border inquiries, and coordinated supervision. In particular, they:
The final draft RTS will be submitted to the European Commission for adoption before being published in the Official Journal of the European Union. They are expected to come into force 20 days after being published in the Official Journal and will apply from 10 July 2027.
AMLA invites stakeholders to sectoral roundtables on simplified customer due diligence
On 2 October 2026, the EU Anti-Money Laundering Authority (AMLA) invited obliged entity representatives, trade associations and other representative bodies from the financial and non-financial sectors to express their interest in participating in sectoral roundtables on the application of simplified customer due diligence. The feedback gathered will inform draft Guidelines to support clear, effective and proportionate application of simplified customer due diligence.
The meetings are expected to take place in person in Frankfurt am Main between 9 November and 2 December 2026. AMLA invites stakeholders to submit their expressions of interest by 18 October 2026.
Please see under Retail Investment Strategy section 2 above for the European Commission’s call for advice to ESMA requesting technical advice to assist in developing level 2 measures implementing the retail investment strategy package.
European Parliament adopts negotiating mandate on SFDR reform
On 10 September 2026, the Economic and Monetary Affairs Committee(ECON) announced that it had agreed that the SFDR revision should provide clearer, simpler sustainable finance disclosure rules and cut red tape and lower costs, without weakening the credibility of green investments.
The text has not been made available yet and the negotiating mandate will be announced at the start of the October plenary session. The final legislation will have to be negotiated with the Council before coming into force.
ESMA sets 2027 priorities for stronger, simpler and more integrated EU capital markets
On 28 September 2026, ESMA published its annual Work Programme for 2027.
Guided by ESMA’s multi-annual strategy for 2023–2028, the programme is marking a shift from preparation to the delivery of several major initiatives.
Growing supervisory mandates
ESMA will advance its supervision of consolidated tape providers and external reviewers of European Green Bonds, as well as process the applications and begin supervision of ESG rating providers. It will also adapt to its expanded responsibilities for benchmark administrators.
ESMA will carry out oversight activities for Critical ICT Third-Party Service Providers together with the other European Supervisory Authorities and continue monitoring and promoting compliance with the Digital Operational Resilience Act (DORA) across all of its supervisory mandates.
In 2027, ESMA will review the impact of recent reforms (EMIR 3) aimed at making EU clearing markets more resilient. The work will help ensure that EU clearing houses remain robust and reduce the EU’s dependence on certain systemically important clearing services located outside the EU.
Alongside its direct supervisory responsibilities, ESMA will enhance supervisory convergence across the EU, continuing the strong cooperation with National Competent Authorities (NCAs), including on supervision of crypto-asset service providers (CASPs) under MICA.
Delivering more efficient financial markets
Following the expected final agreement by the co-legislators on the Market Integration and Supervision Package (MISP) proposal in 2027, ESMA will prepare for the resulting changes to its mandates and responsibilities. In parallel, ESMA will be delivering other priorities supporting the Savings and Investments Union (SIU), including implementation of the European Single Access Point and the transition to T+1 settlement. ESMA will continue to enhance investor protection by supporting the implementation of the Retail Investment Strategy and promoting clear, accessible information for investors.
ESMA’s four flagship simplification initiatives on transaction reporting, funds reporting, the retail investor journey and risk-based supervision will also enter a new phase in 2027. They are intended to reduce unnecessary administrative burdens, improve the usability of regulatory data and make supervision more effective. Further details are set out in the report also published today which outlines actions undertaken in 2026 and planned for 2027 to embed simplification and burden reduction across ESMA’s regulatory and supervisory activities.
Finally, ESMA will support the implementation of key EU financial legislation by delivering technical standards and advice across its remit.
Harnessing data and technological innovation
ESMA will further enhance its data capabilities and promote innovation in the supervisory process, through the development of its Data Platform and the deployment of AI-based tools to support supervision. It will also strengthen cybersecurity capabilities and advance work on crypto-assets and the impact of artificial intelligence on financial markets. Tokenisation will remain as a priority for ESMA, further expanding the work on the opportunities it can bring to the EU capital markets.
Circular C793: Liquidity Risk Management- The revised framework introduced by the amending Directive (EU) 2024/927
On 6 August 2026, CySEC issued Circular C793 (the ‘Circular’), drawing the attention to the Fund Managers and Self-Managed Funds, about significant amendments introduced to the European regulatory framework in relation to liquidity risk management and liquidity management tools
In particular, CySEC draws attention to the amendments introduced by Directive (EU) 2024/927, which amended Directive 2011/61/EU on Alternative Investment Fund Managers and Directive 2009/65/EC on UCITS, in relation to liquidity risk management (among others).
CySEC also draws the attention of Cyprus Investment Fund Managers (‘CyIFMs’) to the ESMA Guidelines on liquidity management tools of UCITS and open-ended AIFs, as well as to the relevant Regulatory Technical Standards (‘RTSs’), which further specify the characteristics of liquidity management tools.
In May 2026, CySEC issued Circular 776 to inform the Cyprus Investment Fund Managers (‘CyIFMs’) of the ESMA Guidelines on Liquidity Management Tools (LMTs) for UCITS and open-ended AIFs and their adoption by CySEC through their incorporation into its supervisory practices and regulatory approach.
The RTS apply as of 16 April 2026. In line also with the ESMA Guidelines, UCITS and AIFs established on or after that date are expected to comply immediately, while UCITS and AIFs established before that date, benefit from the applicable transitional arrangements until 16 April 2027.
CySEC takes this opportunity to remind CyIFMs of its previous guidance relevant to Liquidity Risk Management i.e. Circulars, C403 regarding the ESMA Guidelines on Liquidity Stress Testing in UCITS and AIFs and C548 regarding Guidance on Liquidity Risk Management (‘LRM’).
CySEC expects CyIFMs and their Boards of Directors to take an active and timely role in assessing and implementing the Liquidity Risk Management requirements as amended.
In particular, CyIFMs should perform a documented gap analysis of their existing liquidity risk management frameworks, policies, procedures, fund documentation, systems and operational arrangements against the requirements of the RTS, the ESMA Guidelines and CySEC’s relevant guidance.
To this end, CyIFMs should ensure that the relevant personnel and any delegated service providers, have the necessary expertise, systems and operational capacity to support the effective implementation of the applicable liquidity management arrangements.
The Boards of Directors are expected, to exercise effective oversight over this process, ensure that appropriate actions are taken within the applicable timelines and satisfy themselves that the selection, calibration, activation and use of LMTs are suitable for the nature, scale, complexity, investment strategy, liquidity profile and redemption arrangements of each UCITS or open-ended AIF under management.
CySEC expects CyIFMs to maintain adequate records evidencing the assessments performed, decisions taken and measures implemented, and may request such evidence in the context of its supervisory activities.
Circular C794: ESMA launches a Common Supervisory Action with NCAs on CASPs’ digital operational resilience for custody
On 6 August 2026, CySEC issued Circular C794 (the ‘Circular’), to inform the Crypto Asset Service Providers (CASPs) that the European Securities and Markets Authority (“ESMA”) has launched a Common Supervisory Action for 2026 (“CSA 2026”) with national competent authorities (“NCAs”) on CASPs’ digital operational resilience for custody.
The CSA will assess the maturity of CASPs’ digital operational resilience frameworks in relation to custody activities. It will focus on risks inherent to distributed ledger technology (DLT), including governance arrangements, key and storage management, transaction controls, incident detection and response, smart contract risks, and dependencies on third-party providers.
National Competent Authorities (NCAs) will carry out the exercise on a risk-based sample of authorised CASPs. The exercise will run from the second half of 2026 to the first half of 2027.
In the context of the CSA 2026, CySEC is planning to conduct on-site visits and/or desk-based reviews on a sample of CASPs.
To ensure a minimum level of consistency in the sample across NCAs, NCAs should select only CASPs that:
The CSA will focus on the following digital operational resilience risks:
Therefore, CySEC expects CASPs to adhere to the content of this Circular as it will form part of CySEC’s supervisory review for the purposes of the CSA 2026.
Circular C795: ESMA launches a Common Supervisory Action (CSA’) with NCAs on Risk management function of UCITS management companies and AIFMs
Following the ESMA’s publication on 3 July 2026, CySEC issued Circular C795 on 12 August 2026, to inform the Cyprus Investment Fund Managers (‘CyIFMs’) that ESMA has launched the 2026 Common Supervisory Action (‘the 2026 CSA’) with National Competent Authorities (NCAs), on the risk management function of UCITS management companies and Alternative Investment Fund Managers (AIFMs) across the EU.
CySEC acknowledges the important role of the risk management function as a key component of the governance and internal control framework of CyIFMs.
In this context, CySEC will participate in the 2026 CSA and will initiate a targeted thematic review in late 2026 early 2027, comprising both on-site and/or desk-based reviews, on a representative sample of CyIFMs.
CySEC expects CyIFMs to take due note of the launch of the 2026 CSA and to consider whether their existing arrangements relating to the risk management function remain appropriate, effective and proportionate to their activities and to the UCITS and AIFs under management, in line with the applicable regulatory requirements.
Circular C796: AMLA’s Final Report regarding the draft ITSs under article 15(3) of Regulation (EU) 2024/1620
Following CySEC’s Circular C750 CySEC has issued Circular C796, on 14 August 2026, to inform Regulated Entities that the Anti-Money Laundering Authority (the ‘AMLA’) has published a Final Report on the Draft Implementing Technical Standards (the ‘ITS’) on cooperation within the AML/CFT supervisory system for the purposes of direct supervision under Article 15(3) of Regulation (EU) 2024/1620.
Please be reminded that, from 2028, AMLA will directly supervise a number of financial institutions at group level, thereby transferring their AML/CFT supervision from national supervisors to AMLA. Kindly note that the relevant Press Release and Final Report can be found here.
AMLA has also published an FAQ document addressing the questions most frequently raised in relation to the reporting package for the identification of provisionally eligible obliged entities for direct supervision.
Lastly, CySEC encourages reporting entities to consult the material already available on AMLA’s website, which includes, the reporting package on the identification of provisionally eligible obliged entities and the webinar on the identification of eligible obliged entities.
Circular C797: ESMA’s Public Statement regarding T+1 preparations in relation to Regulation (EU) No 909/2014, as amended – key deadlines and action points
Following the publication of CySEC Circular C780, in relation to the shortening of the standard securities settlement cycle in the European Union (“EU”), CySEC issued Circular C797, on 26 August 2026 (the ‘Circular’), to draw the attention of Regulated Entities to the Public Statement on T+1 preparations (hereinafter, the ‘Public Statement’) issued by the European Securities and Markets Authority (‘ESMA’).
The Public Statement sets out key deadlines and action points required to support the transition to a T+1 settlement cycle in EU financial markets.
ESMA highlights the following key implementation milestones:
Particular attention should be paid to the appropriate use of reference data and settlement instructions, including, where applicable, Standard Settlement Instructions (“SSIs”), is essential to support straight-through processing and timely settlement.
In addition, ESMA warns that insufficient preparedness for the T+1 transition could give rise to significant operational, compliance and reputational risks, including increased settlement fails, disrupted interactions with financial market infrastructures, higher implementation costs and difficulties in meeting client expectations.
Regulated Entities should take into consideration both the recommendations issued by the EU T+1 industry Committee and the amended regulatory requirements under the settlement discipline framework and should accelerate all necessary operational, technological and organisational preparations to ensure compliance with the applicable requirements within the prescribed deadlines. Early end-to-end testing will be important to identify deficiencies, address interdependencies and reduce the risk of disruption when T+1 becomes effective.
Furthermore, Regulated Entities should assess not only their own readiness but also that of all relevant parties across the trading and settlement chain, including clients, brokers, custodians, central securities depositories (CSD) participants, CSDs, central counterparties (CCPs), trading venues, vendors and outsourcing providers.
Lastly, CySEC expects Regulated Entities falling within the scope of the T+1 transition to continue prioritising their implementation programmes and allocating sufficient resources to ensure timely compliance with the forthcoming regulatory requirements and the successful transition to the T+1 settlement cycle.
Circular C798: EBA issues a Consultation Paper on draft Regulatory Technical Standards on reclassification of investment firms as credit institutions
On 2 September 2026, CySEC issued Circular C798 (the ‘Circular’), to inform the Cyprus Investment Firms (CIFs) that the European Banking Authority (EBA) launched on 25 August 2026 a Consultation Paper on draft Regulatory Technical Standards (RTS) on reclassification of investment firms as credit institutions (the ‘Consultation Paper’).
The consultation follows amendments introduced through the Capital Requirements Directive (CRD) framework and aims to revise the regulatory standards governing the assessment of whether an investment firm should be authorised as a credit institution.
Under Article 8(a) of the CRD framework, investment firms whose total assets exceed EUR 30 billion are generally required to obtain authorisation as credit institutions instead of operating under a MiFID investment firm authorisation. The draft RTS seeks to promote a more proportionate, transparent and risk-based application of these requirements.
Interested stakeholders are invited to submit comments directly to the EBA through its consultation webpage by 25 November 2026.
Circular C799: Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554
Following the publication of CySEC Circular C735 and the adoption of Joint Guidelines of the European Supervisory Authorities (‘’ESAs’’) on the estimation of aggregated annual costs and losses caused by major ICT-related incidents (the ‘Joint Guidelines’), CySEC issued Circular C799, on 8 September 2026 (the ‘Circular’), to provide Regulated Entities with additional information concerning the submission of the reporting template set out in the Joint Guidelines.
Regulated Entities that have experienced major ICT-related incidents during the relevant reporting period are required to aggregate and report to CySEC all costs and losses associated with those incidents occurred during the selected reference year, using the Report on Aggregated Annual Costs and Losses from Major ICT-Related Incidents (the “Report”).
The reference year for the estimation of aggregated annual costs and losses may be either:
The chosen reference year must be clearly stated in the Report and should be applied consistently in future estimations and reporting.
The Report should be submitted to CySEC no later than 30 June each year, following the reference year in which the major ICT-related incidents occurred. For major ICT-related incidents incurred in 2025, the Report must be submitted to CySEC by 30 September 2026.
Lastly, the Report should be submitted only through the CySEC’s Portal under the title ‘’Estimation of Aggregated Annual Costs and Losses Caused by Major ICT-Related Incidents’’.
Circular C800: AMLA’s public hearing on the draft RTSs under article 40(2) of Directive (EU) 2024/1640
On 8 September 2026, CySEC issued Circular C800 (the ‘Circular’), addressed to ASPs and Crowdfunding Service Providers to inform them that the Anti-Money Laundering Authority (the ‘AMLA’) will hold a public hearing on the draft Regulatory Technical Standards (the ‘RTS’) under Article 40(2) of Directive (EU) 2024/1640. These RTS set the methodology for the assessment of the inherent and residual risk profile of obliged entities in the non-financial sector.
Circular C801: ESMA’s Q&A regarding the interests earned from client funds deposited at
a credit institution
On 29 September 2026, CySEC issued Circular C801 (the ‘Circular’), to draw the attention of Cyprus Investment Firms (“CIFs”) to the publication of ‘ESMA_QA_2785’ (“the ESMA Q&A”), under the topic of ‘Safeguarding of Client Assets’, concerning the treatment of interest earned on client funds deposited with credit institutions.
ESMA’S position in the Q&A, as to whether MiFID II permits Investment Firms to earn interest on client funds deposited in a savings account with a credit institution is as follows:
“No. In order to protect an investor’s rights in respect of funds entrusted to a firm, Article 16 (9) of Directive 2014/65/EU of the European Parliament and of the Council (MiFID II) stipulates that an investment firm holding client funds shall make adequate arrangements to safeguard the rights of clients and prevent the investment firm’s use of client funds for its own account. The investment firms’ obligation under Article 16 (9) of MiFID II not to use clients’ funds for its own account includes the obligation for the investment firms not to retain any interest accrued from those funds (deposited in an account with a credit institution).”
In light of the publication of the ESMA Q&A, the CySEC Circular ‘ΕΓ144-2009-07’ is hereby withdrawn with immediate effect. Accordingly, as the position set out therein no longer reflects CySEC’s supervisory expectations and should not be relied upon by CIFs.
CySEC expects CIFs to review without delay their arrangements relating to interest generated on client funds held with credit institutions and to take all necessary steps to ensure compliance with Article 17(9) of Law 87(I)/2017 and the ESMA Q&A. In this regard, CIFs should be able to demonstrate that their arrangements have been appropriately assessed and documented, that clients’ rights and interests have been duly considered, and that adequate measures have been implemented to ensure compliance with the applicable client asset safeguarding requirements.
Moreover, CySEC expects CIFs’ senior management to oversee the actions taken in response to the ESMA Q&A and to ensure their timely and effective implementation and further expects the relevant control functions, including compliance officers and internal and external auditors, to duly consider these developments within the scope of their reviews and to reflect any relevant findings in their reports submitted to CySEC.
With over 25 years of experience in the financial services industry, Complyport offers unparalleled expertise in regulatory compliance, ensuring your firm stays ahead of evolving regulations.
From AML audits to risk management and regulatory reporting, Complyport provides a full spectrum of compliance services, allowing you to streamline your compliance processes and focus on your core business activities.
We provide bespoke compliance solutions that are specifically designed to meet the unique needs of your business, ensuring that all regulatory requirements are met efficiently and effectively.
We prioritise open and transparent communication, building strong relationships with our clients based on trust and mutual respect. Our commitment to excellence ensures that we deliver high-quality services with courtesy, patience, and flexibility.
Our team of seasoned professionals, including former regulators and industry experts, leads all engagements, offering deep insights and practical advice to help you manage compliance risks effectively.
Leveraging cutting-edge fintech, regtech and AI tools, Complyport enhances your compliance processes with advanced technology, ensuring accuracy, efficiency and real-time regulatory updates. Our innovative solutions empower your firm to stay compliant while maximising operational efficiency.
Providing Compliance Excellence
Successful FCA, EU and UAE Authorisations
Active Firms Receiving
Regulatory Support
FCA/PRA Skilled
Person
&
Consultancy Panel
