ESMA Final Report on Compliance and Internal Audit Functions in the Funds Sector (2025 CSA)

11 May 2026 ESMA34-1436284137-2305 ESMA - 201-203 rue de Bercy - CS 80910 - 75589 Paris Cedex 12 - France - Tel. +33 (0) 1 58 36 43 21 - www.esma.europa.eu 2 Final Report 2025 CSA on compliance and internal audit functions of fund managers

3 Table of Contents Executive Summary ...........................................................................................................4

1. Background.................................................................................................................5
2. Scope of the analysis and methodology ......................................................................5
3. Compliance with the legislative framework ..................................................................6
4. Compliance function....................................................................................................9
5. Internal audit function ................................................................................................14
6. Follow-up actions envisaged by NCAs ......................................................................18
7. ESMA views and conclusions....................................................................................20 Annex: Good and poor practices ......................................................................................22

4 Executive Summary Reasons for publication In 2025, ESMA performed a Common Supervisory Action (CSA) exercise on the establishment of effective compliance and internal audit functions in the investment management sector. The CSA’s aim was to assess, foster and enforce the adherence of supervised entities to the key provisions set out in the AIFMD and UCITS Directive and its implementing measures with relevance to the compliance and internal audit functions. This report summarises the outcomes of this exercise and ESMA views on key findings. Contents Section 1 explains the background of the exercise, Section 2 describes the scope of the analysis and methodology, while Sections 3 to 6 set out the CSA’s main findings and follow￾up actions taken/envisaged. ESMA views and conclusions on the CSA exercise are described under Section 7. Annex I contains the list of good and poor practices NCAs have identified during the exercise. Key findings The majority of NCAs assessed the overall level of compliance of their supervised entities with the relevant provisions as satisfactory. However, the CSA exercise revealed areas for improvement, that may be more pronounced in some jurisdictions. The report details several good and poor practices highlighted by NCAs in the area of compliance and internal audit functions. NCAs stated their intention to follow-up on individual cases where vulnerabilities or potential breaches were identified. ESMA also positively notes the comprehensive supervisory work performed by NCAs in line with the common CSA assessment framework, active cooperation throughout the CSA exercise and high participation rate as all 27 EU and 3 EEA NCAs performed supervisory activities under the CSA. Next Steps Building on the findings of the CSA, ESMA will continue promoting exchanges among NCAs on this topic and related follow-up supervisory actions with a view to promoting convergence.

5

1. Background
2. In 2025, ESMA performed a CSA on the compliance and internal audit functions1 of AIFMs and UCITS management companies with a view to evaluate the adherence of supervised entities with the relevant provisions and further enhancing supervisory convergence in this area. 2
3. The CSA work was conducted under a common assessment framework developed at the level of ESMA in the course of 2024, which was formally agreed in December
4. The CSA assessment framework included a common scope, coverage thresholds, methodology, supervisory expectations and timeline.
5. All 27 EU and 3 EEA NCAs participated in this CSA.
6. In the course of 2025, NCAs regularly shared knowledge and experiences as well as discussed operational questions at the level of ESMA with a view to fostering supervisory convergence on how they supervise compliance and internal audit functions.
7. All NCAs reported to ESMA on their national CSA findings by 31 December 2025.
8. Following the completion of the CSA exercise, ESMA launched a survey addressed to NCAs to assess the impact of the exercise and to take stock of follow-up actions envisaged or taken by NCAs. NCAs submitted their responses to this survey by 31 January 2026.
9. Scope of the analysis and methodology
10. To ensure supervisory convergence in relation to the sample size and the overall coverage of the CSA, the common assessment framework set out a minimum coverage threshold of supervised entities to be investigated in each jurisdiction.
11. All NCAs met the common threshold for the minimum coverage of managers agreed in the common assessment framework. 1 ESMA launches a Common Supervisory Action with NCAs on Compliance and Internal Audit Functions. 2 Articles 9-11 of the Commission Directive (EU) 2010/43/EU and Articles 60-62 of the Commission Delegated Regulation (EU) 231/2013.

6 9. NCAs followed the CSA assessment framework’s approach in relation to the selection of the sample of entities to be covered by this exercise. While they were given discretion on the selection of the sample, NCAs followed the principles below: a) Sample size: the size of the sample selected by each NCA should be proportionate to the size of the supervised market. b) Type of entities: the sample should include both UCITS management companies and AIFMs. c) Type of investors: preference should be given to entities with a retail investor base. d) Geographical location of investors: preference should be given to cases with cross-border relevance. e) Supervisory knowledge or experience indicating higher risks: preference for covering entities where NCAs have information indicating higher risks of non-compliance. 10. Most NCAs chose a desk-based review approach, complemented by on-site inspections. Several NCAs deployed sophisticated IT tools, relying on online reporting systems and secured exchange platforms for the data sharing with the entities in the scope of the exercise. Moreover, most NCAs reported little engagement with other NCAs on cases of cross-border relevance. The few NCAs that engaged in cross-border cooperation mainly exchanged information to support supervisory convergence. 11. Finally, NCAs encountered a number of challenges during the CSA, including incomplete answers or insufficient documentation and high volume of qualitative information received from their supervised entities. Many NCAs addressed gaps or unclear submissions by requesting further documentation, explanations or follow-up information from firms, including by issuing informal letters. 3. Compliance with the legislative framework 12. The CSA assessment framework covered several provisions relating to the establishment of effective compliance and internal audit functions including that those functions have adequate staffing, authority, knowledge and expertise to perform their duties under the AIFMD and UCITS Directive.

7 13. The majority of NCAs assessed the overall level of compliance of their supervised entities with the relevant provisions as satisfactory. However, the CSA exercise revealed that certain areas for improvement may be more pronounced in some jurisdictions. The relevant NCAs may therefore provide more detailed or jurisdiction-specific guidance, where appropriate. 14. Across the CSA sample, relevant policies and procedures were generally considered adequate, but their quality and practical implementation varied significantly, also depending on the size, nature and complexity of the entities. 15. The majority of NCAs reported no regulatory breaches, yet a few identified specific cases where legal obligations may have been breached (see Table 1), mostly regarding the independence of the internal audit and compliance functions and cases of incomplete reports to senior management. In those cases, NCAs reported that they planned to carry out follow-up supervisory actions. Table 1 16. While regulatory breaches were identified only by a limited number of NCAs, a large number of NCAs observed some vulnerabilities with respect to compliance and internal audit functions, such as missing or incomplete internal audit documentation, insufficiently robust compliance risk assessments, lack of structured risk-based approach to assessing and addressing compliance risks. 21 3 0 6 0 5 10 15 20 25 None Between 0-10% Between 10-20% More than 20% Number of NCAs Proportion of entities Proportion of entities where NCAs identified regulatory breaches

8 Table 2 17. It is important to note that in cases where NCAs identified such vulnerabilities they planned follow-up supervisory actions or, in the most severe cases, issued immediate corrective actions to strengthen or reorganise the relevant compliance and internal audit functions. 5 1 6 18 0 2 4 6 8 10 12 14 16 18 20 None Between 0-10% Between 10-20% More than 20% Number of NCAs Proportion of entities Proportion of entities where NCAs identified vulnerabilities

9 4. Compliance function 18. The assessment framework included the investigation of questions related to the establishment of an adequate and effective compliance function, with the appropriate policies and procedures in place and adequate resources to perform functions properly and independently. A small number of NCAs have identified breaches or vulnerabilities with respect to the independence of the compliance function, as shown in Table 3. Table 3 19. Most NCAs observed that the compliance function is generally entrusted with a broad and well-defined set of responsibilities, including monitoring regulatory developments, updating internal policies and procedures, and conducting risk-based ex-ante and ex-post compliance checks. Many NCAs highlighted the consistent role that compliance functions play in identifying non-compliance, escalating issues to senior management or the board and overseeing remediation. 20. One NCA highlighted issues relating to the interconnection of risk management and compliance functions and to what extent the compliance function should review the activities of the risk management functions. 21. With regards to the policies, procedures and measures with relevance to the compliance function, the findings of the CSA confirm that supervised entities sampled by NCAs maintain written policies and procedures covering the core responsibilities of the compliance function. There were, however, cases where policies were not 18 6 2 4 0 5 10 15 20 None Between 0-10% Between 10-20% More than 20% Number of NCAs Proportion of entities Proportion of entities where NCAs identified breaches or vulnerabilities with respect to the independence of the compliance functions

10 regularly updated or reviewed, procedures were not consistently followed, and the appropriate follow-up measures were not put in place. Several NCAs observed different degrees of granularity of policies and procedures as well as different approaches and methods in the areas covered by the compliance function. 22. Many NCAs also noted some correlation between size and maturity of the organisations and the solidity and soundness of their compliance frameworks. While in some cases larger entities or those part of a larger financial group tend to have more formalised and well-documented policies, they also often rely heavily on group￾level policies which are not always tailored to the local regulatory environment or to the specific business activities of the manager. Conversely, smaller firms often displayed more minimalistic documentation, and in some severe cases even lacked basic compliance policies. 23. With respect to remuneration, the majority of NCAs confirmed that remuneration frameworks prevent undue links to business performance and are designed to safeguard independence, in some cases through specific independent remuneration committees. 24. Most NCAs concluded that resource allocations (in terms of FTEs) were deemed appropriate. However, a few NCAs identified resource shortages, especially in some larger firms or where compliance staff split their time across multiple functions. In some cases where compliance tasks were entrusted to third parties, resource allocations within the authorised manager were well below 1 FTE, raising concerns about the adequacy of internal resources. 25. Regarding the level of expertise of the compliance function, NCAs reported that compliance officers generally have strong professional backgrounds, relevant experience and undertake regular trainings. In this context, some NCAs noted that they have a role in approving the appointment of the head of compliance. 26. Although a number of NCAs identified vulnerabilities in some compliance monitoring plans and in the internal reporting provided to senior management and the board of directors, most NCAs concluded that these elements were generally adequate (see Table 4).

11 Table 4 27. With respect to the internal reports on compliance matters, NCAs confirmed that supervised entities generally demonstrated to have put in place well-structured periodic reporting mechanism to senior management or the board. Such reports are particularly important to enable the timely identification of compliance risks, escalation and remediation of deficiencies, as well as greater transparency and better governance oversight, thereby reducing the risk of potential regulatory breaches. 28. Several NCAs identified however some vulnerabilities regarding such internal reports, namely missing elements, weak documentation or inadequate alignment with the compliance monitoring plans. In this context, some areas of improvement were observed such as the limited scope of compliance processes, the generic description of activities without specifying the aspects to be reviewed and the compliance audit plans not being fully formalised. Moreover, smaller entities tend to produce less detailed and less structured reports compared to larger ones and may rely more on oral communication rather than written reporting. 29. NCAs made different findings concerning the appropriateness of compliance monitoring plans (see Table 5). Some NCAs reported certain elements of inadequacy. One NCA noted that entities demonstrated ability to adjust their monitoring plans, however these adjustments can be sometimes informal and not uniformly documented. 20 5 1 4 0 5 10 15 20 25 None Between 0-10% Between 10-20% More than 20% Number of NCAs Proportion of entities Proportion of entities where NCAs reported inadequate internal reports from compliance functions to senior management/board

12 Table 5 30. Another NCA reported that while legally mandated topics are generally included in compliance monitoring plans, the themes are often formulated at a relatively high level. As a result, compliance controls tend to remain largely overview-oriented, limiting the assessment of specific risks and reducing the ability to provide focused, actionable recommendations. These issues highlight the need for a stronger compliance risk assessment methodology. 31. NCAs observed that the compliance planning is generally following a risk-based approach. In this context, one NCA explained that the majority of the entities implement the risk-based approach by assessing each monitored activity for inherent and residuals risks, taking into account the probability of occurrence and existing mitigation measures. Based on this assessment, entities assign a risk score to each control, define control priorities and frequencies, monitor the status of control and follow-up on recommendations. This approach allows the compliance function to prioritise areas with higher risks exposure. 32. One NCA mentioned that the scheduling of ex-post compliance controls is based on quantitative methodologies and a structured process which consists of: (1) mapping of regulatory requirements, (2) breakdown of regulatory requirements with respect to individual areas of activity and (3) evaluation of non-compliance risk. According to this NCA, there are areas for improvement in terms of the formalisation of procedures adopted, the definition of risk assessment criteria, and the interaction between the compliance and operational functions. Another NCA noted that the trigger event for escalation appears to be too high. In some cases, there was no clear overview of identified deficiencies, their follow-up actions, and root cause analysis. 15 8 1 6 0 2 4 6 8 10 12 14 16 None Between 0-10% Between 10-20% More than 20% Number of NCAs Proportion of entities Proportion of entities where NCAs reported inadequate compliance monitoring plans

13 33. Regarding follow-up and remedial measures on compliance reports, one NCA noted that UCITS managers have more standardised follow-up and corrective actions procedures, which are conducted electronically, whereas AIFMs still manage these procedures manually. Another NCA indicated that for some entities there was no sufficiently clear overview of identified deficiencies and follow-up actions, and that the root cause analysis was not sufficiently documented. 34. While some NCAs noted cases where follow-up and remedial measures on compliance reports were inadequate, the majority reported overall adequacy of processes and procedures. Table 6 Responsibilities and organisational setup 35. The CSA findings demonstrate that there are different market practices across the EU with respect to the responsibilities assigned to the compliance function and their overall organisational setup. In some Member States, supervised entities made significant use of third parties for the provision of compliance-related tasks, either by using specialised third-party providers or entities within the same group. Conversely, in other Member States, tasks undertaken in the compliance function were fully performed internally. 36. Some NCAs highlighted that where third parties were used they required structured and documented due diligence, including written and signed contracts/mandates, clear internal responsibility, regular monitoring and formalised reporting. In this context, some NCAs identified weak or insufficient oversight as a recurring issue, 16 7 1 6 0 2 4 6 8 10 12 14 16 18 None Between 0-10% Between 10-20% More than 20% Number of NCAs Proportion of entities Proportion of entities where NCAs reported inadequate follow-up and remedial measures on compliance reports

14 especially regarding Service Level Agreements (SLAs), KPIs and evidence of control execution. 37. A few NCAs noted that external providers often bring specialised compliance expertise, broader market insight and experienced staff which can be particularly beneficial to smaller managers, while other NCAs did not have such impression. 38. One NCA has specifically highlighted the issue that service providers servicing multiple entities can lead to capacity issues or errors spread across different firms. In addition, standard contracts often cover only a small number of hours, which may be insufficient in case of significant compliance risks or issues. 39. NCAs in some jurisdictions noted that the use of group entities may involve additional risks, notably insufficient tailoring to the specific local business and rules. 40. One NCA highlighted that in cases where relevant tasks are performed externally, by an entity within or outside the group, an internal person is appointed to maintain responsibility and oversight of the relevant activities. When the entity belongs to a group, the fund manager’s compliance function also cooperates with the group compliance function, either directly or through participation in a dedicated committee. However, the compliance function maintains direct access to all relevant information, even where tasks are performed externally. 41. The NCA feedback received indicated that there are divergent national practices on cases where third parties provide compliance-related tasks qualify as delegation arrangements pursuant to the AIFMD and UCITS Directive and to what extent internal resources need to be maintained in those cases. It is however important to note that managers always remain responsible for ensuring adherence to the applicable rules, also in cases where they entrust third parties with the performance of tasks related to the compliance function. 5. Internal audit function 42. The majority of NCAs reported that their supervised entities established independent internal audit functions, with sufficiently knowledgeable and experienced staff.

15 Table 7 43. Notwithstanding this, several NCAs noted that the internal audit resourcing models vary widely across entities, reflecting the heterogeneity of the business models. 44. The majority of NCAs found that there is a good level of compliance with the provisions on internal audit functions. 45. Regarding the quality of internal audit reports to senior management or the board, the majority of NCAs stated that they are overall satisfactory across most entities. However, their quality and granularity varied across the sample. In certain cases, group internal auditors produced more high-quality reports. In other cases, external persons entrusted with internal audit tasks delivered more ‘challenging’ reports compared to the internal audit teams. 46. Some NCAs reported that senior management/boards were not always in a position to demonstrate how they oversee internal audit activities and how they ensure internal audits were performed on areas relevant to the risk profile of the activities. In some cases, the role of the senior management/board was too reactive. 22 4 0 4 0 5 10 15 20 25 None Between 0-10% Between 10-20% More than 20% Number of NCAs Proportion of entities Proportion of entities where NCAs identified breaches or vulnerabilities with respect to the independence of the internal audit functions

16 Table 8 47. Most NCAs reported that follow-up mechanisms are well-established and include systematic monitoring concerning the findings. However, some NCAs observed room for improvement regarding follow-up mechanisms and remedial measures. One NCA emphasised the lack of process formalisation for providing feedback to the operational functions subject to internal audit controls. Table 9 48. In terms of planning and organisation of the internal audit function, the majority of NCAs reported that entities use risk-based methodologies and/or multi-year cycles, 19 5 2 4 0 5 10 15 20 None Between 0-10% Between 10-20% More than 20% Number of NCAs Proportion of entities Proportion of entities where NCAs reported inadequate internal audit reports from internal audit function to senior management/board 21 6 1 2 0 5 10 15 20 25 None Between 0-10% Between 10-20% More than 20% Number of NCAs Proportion of entities Proportion of entities where NCAs reported inadequate follow-up and remedial measures on internal audit reports

17 and that audit plans are regularly updated to reflect emerging risks, regulatory changes and past results. However, some NCAs identified weaknesses in risk-based planning (e.g. insufficient coverage of some key areas, risk-based models that underestimate specific risks related to the manager’s business model). 49. Other key vulnerabilities identified are the fact that audit plans sometimes lack transparency on how priorities are set and how risks are assessed, with limited detail on the methodology used. Additionally, roles and responsibilities for developing the audit plan are not always clearly documented, highlighting the need for stronger governance and clearer processes. Table 10 50. A significant number of entities rely on support from external service providers or group-level entities to support their internal audit work. 51. Several NCAs reported however that some entities assessed do not maintain an internal audit function. When challenged on the rationale for this, entities outlined that the size, scale and complexity of their business models do not require them to establish one, based on the principle of proportionality. Some NCAs observed in those cases that relevant entities often relied on alternative arrangements, either by assigning internal audit responsibilities directly to the board of directors or making use of a group-wide internal audit function. However, some NCAs noted that in the case of entities which are part of bank or insurance groups, the use of a strong, independent and well staffed group-wide internal audit function for periodic audits may actually result in a better control outcome than other type of arrangements. 16 8 0 5 0 2 4 6 8 10 12 14 16 18 None Between 0-10% Between 10-20% More than 20% Number of NCAs Proportion of entities Proportion of entities where NCAs reported inadequate internal audit plans

18 52. Where managers relied on third parties for the provision of internal audit-related tasks, some NCAs found missing or incomplete internal audit handbooks, audit charters or documentation of the internal audit plans. 53. Similar to the observation above on the compliance function, the NCA feedback indicated divergent national practices on whether arrangements with third parties concerning internal audit-related tasks qualify as delegation pursuant to the AIFMD and UCITS Directive and to what extent internal resources need to be maintained in those cases. It is important to note that managers remain responsible for ensuring adherence to the applicable rules, also in cases where they entrust third parties with the provision of tasks related to the internal audit function. 6. Follow-up actions envisaged by NCAs 54. NCAs were asked to report on the follow-up actions that they plan on taking following the CSA exercise. Table 11 55. The majority of NCAs stated their intention to follow-up on individual cases through letters or bilateral communications outlining areas of improvement, requesting remediation or additional information, and/or by organising individual meetings with managers where supervisory findings/gaps were identified. 4 3 4 19 0 2 4 6 8 10 12 14 16 18 20 None Between 0-10% Between 10-20% More than 20% Number of NCAs Proportion of entities Proportion of the entities where NCAs identified need for potential follow-up discussions

19 56. A high number of NCAs also shared their intention to engage with their national industry associations and their plans to publish national reports, taking into account the outcome of the ESMA report. Table 12 57. The majority of NCAs do not envisage enforcement action, given the overall satisfactory level of compliance and the improvements already implemented by supervised entities. 25 2 0 3 0 5 10 15 20 25 30 None Between 0-10% Between 10-30% More than 30% Number of NCAs Proportion of entities Proportion of entities where NCAs identified need for potential enforcement actions

20 7. ESMA views and conclusions 58. ESMA positively notes the comprehensive supervisory work performed by NCAs in line with the common CSA assessment framework, active cooperation throughout this exercise and high participation rate as all 27 EU and 3 EEA NCAs took part in this CSA. 59. ESMA would like to stress the importance of managers establishing and maintaining effective compliance and internal audit functions in line with the requirements set out in the AIFMD and UCITS Directive. 60. More specifically, ESMA encourages NCAs to verify that comprehensive internal control mechanisms are in place, including clear reporting lines, compulsory training programs, regularly updated risk assessments, comprehensive compliance monitoring plans, regular compliance controls and monitoring of remedial actions. NCAs should be satisfied that such mechanisms detect any risks of failure with the obligations under the AIFMD and UCITS Directive. 61. NCAs are also encouraged to verify that the appropriate written documentation and recordkeeping arrangements are put in place to enable them to review their compliance with the applicable rules (such as records/logs for monitoring breaches, conflicts of interest, related party transactions). 62. ESMA stresses, without prejudice to the principle of proportionality, the importance of ensuring that the compliance and internal audit functions have the necessary resources in terms of FTEs to perform their tasks properly and that organisational arrangements are put in place to provide for a strong role of the compliance and internal audit functions within the organisation. ESMA would also like to highlight that managers always remain responsible for ensuring that the compliance and internal audit functions operate in accordance with the applicable rules, also in cases where third parties are entrusted to perform the relevant tasks. This includes appropriate consultations of the compliance and internal audit functions before taking significant strategic decisions (e.g. entering new markets or engaging in new asset classes, set￾up of new funds, delegation of functions set out in Annex II of the UCITS Directive and Annex I of the AIFMD to third parties). 63. ESMA encourages NCAs to ensure that the compliance function has the necessary authority within the organisation, and that the method of determining the remuneration of the relevant persons involved in the compliance function does not compromise or affect their objectivity. The organisational policies and procedures of authorised entities should also ensure that there is a clearly defined escalation

21 procedure in the case of disagreements between the control functions and operational units. 64. ESMA encourages NCAs, taking into account the principle of proportionality3 , to verify that the compliance and internal audit functions operate independently from operational functions, and NCAs should be satisfied that the organisational structures of the supervised entities ensure that all key risks are assessed for compliance by individuals that have sufficient knowledge and experience in the relevant matters and are independent from operational functions. In case proportionality arguments are invoked to justify a lower level of independence, ESMA encourages NCAs to assess such cases in light of the size, type, nature, range and complexity of the compliance and internal audit functions. 65. ESMA encourages NCAs to ensure that the compliance function monitors the quality and application of the internal processes of operational units in order to minimise the risks of non-compliance with applicable requirements. Therefore, the compliance function should receive all necessary information (e.g. all periodic reports of risk management and internal audit). In cases of violation of relevant rules (e.g. investment limit breaches), the compliance function should be informed in a timely and documented manner that enables it to assess and mitigate relevant risks. 66. Finally, ESMA stresses that managers, which are subsidiaries of banking groups should be aware that the risk assessment methodologies and tools provided by the parent company can potentially lead to underestimating relevant/local risks. Managers should not just rely on the group risk assessment but develop their own risk assessment, if the group risk assessment does not gather properly the risks applicable to the business of the manager. The assessment of compliance risks should at least take into consideration the business areas, types of products, types of services, distribution channels and the categories of investors. The evaluation of the compliance risk should be taken into consideration for the establishment of the compliance monitoring plan. 67. While acknowledging the overall positive outcomes, ESMA encourages NCAs to follow up on the breaches and vulnerabilities identified in this CSA exercise to understand the reasons for the identified shortcomings and to ensure that relevant entities take effective remedial action in a timely manner. 3 considering the nature, scale and complexity of the business and the nature and range of collective portfolio management activities undertaken in the course of the business.

22 Annex: Good and poor practices4

1. Compliance function Good practices Issue Example Compliance consultation In the context of reviewing policies and procedures (e.g. as a consequence of regulatory changes, the introduction of new processes, or new products and related product governance requirements), the compliance function provides an opinion before documents are submitted to senior management or the board of directors. Dedicated IT tools The use of dedicated IT tools enabling efficient and traceable interaction between the compliance and operational functions, facilitating ex-post controls, including those carried out by NCAs. Controls Committee The establishment of an internal ‘Controls Committee’ to ensure effective cooperation between the compliance and operational functions so that compliance requirements are properly embedded in day-to-day operations. Internal reporting Internal reports from the compliance function 4 Poor practices cover both vulnerabilities and potential regulatory breaches, subject to further NCA investigation.

23 are submitted on an at least semi-annual or quarterly basis to the board of directors. Internal procedures clearly describe how deficiencies should be promptly reported, how remedial actions and their deadlines are defined, and how progresses are reported to the board of directors on a regular basis. Ad-hoc compliance reporting In addition to regular reporting, the compliance function prepares ad-hoc reports on specific topics triggered by events, news, or regulatory or market developments, with a particular focus on investor protection measures (e.g. costs, product governance, marketing, client onboarding, complaints, investment process) and subsequently requests procedural updates and enhanced monitoring of critical activities. Poor practices Issue Example Insufficient follow-up monitoring and progress updates While compliance matters were reported to the board, updates on action plan progress and follow-up monitoring were often lacking, leaving compliance gaps unresolved. Lack of clear recommendations and deadlines While deficiencies were mentioned in the compliance reports, they lacked clear recommendations or deadlines.

24 Lack of documentation Some minutes of board meetings did not adequately document compliance discussions. Insufficient focus of the group’s compliance function A UCITS manager that is part of a larger financial group used the group’s compliance function. However, the group’s compliance function had prioritised risks identified as relevant at the group level, resulting in insufficient focus on risks that are specific to the local UCITS manager. Two main issues were identified: (i) manager-specific risks were not prioritised in the annual planning and (ii) certain key areas for the manager were not been assessed at all. This included key areas such as risk management, liquidity management, valuation, and delegation. Inadequate safeguard arrangements for electronic data processing One NCA identified a failure from a supervised entity to maintain adequate internal control mechanisms, and safeguard arrangements for electronic data processing as required under Article 31 of the UCITS Directive and Article 18(1) of the AIFMD. Board documents were circulated without password-protection or authentication which might expose the entity to data breaches. Restricted access to relevant information The compliance function had restricted access to relevant information, such as employee remuneration data. Misallocation of compliance resources One entity failed to demonstrate that sufficient resources were allocated to the local compliance function, but available

25 resources were instead used to provide advice to other entities within the group. Lack of tracking non-compliance The manager failed to systematically track reports of non-compliance. Insufficient controls with relevance to investment limits Lack of coverage or responsibility of the compliance function regarding certain risks, especially limited controls with relevance to the manager’s ability to ensure compliance with investment limits. Inadequate controls Some compliance issues were missed or discovered too late by the entity, showing that the second and third lines of defence had failed to identify and prevent those issues in a timely manner. Lack of coordination between second and third lines of defence One entity lacked structural coordination between compliance monitoring and internal audit plans, creating an efficiency gap while more information sharing could strengthen the overall control framework. Undocumented and inconsistent risk assessment methodology The risk assessment methodology that guides the compliance monitoring plan was not always formally documented, and in some cases applied inconsistently.

26 2. Internal Audit function Good practices Issue Example5 Internal audit as a standing agenda item on the board agenda Some entities put internal audit reporting as a standing item of the board agenda. This results in more frequent reporting and alignment than legally required. This also ensures that the board remains consistently and actively involved in internal audit matters. Poor practices Lack of quality and clarity of internal audit reports Some internal audit reports lacked quality and clarity, often missing clear descriptions, objectives, scope, and thorough explanations of findings. As a result, senior management or the board could not reliably use these reports for taking informed decisions or effective follow-up actions. Insufficient internal audit details, missed deficiencies and weak follow-up Some internal audit engagements had overly broad themes, causing controls to lack sufficient detail. The proportionality principle was not always properly applied, as it did not adequately reflect the entity’s size and significance in the local market, regardless of its position within the wider group, and it often relied on 5 Some of the good and poor practices identified with respect to the internal audit function were quite similar to the ones above on the compliance function (and vice versa). In the interest of brevity, those are not repeatedly mentioned under the two sections.

27 group-level interpretations of certain regulatory requirements. Certain deficiencies were missed by internal audit and only found during supervisory review. Additionally, some weaknesses received neither formal recommendations nor adequate follow-up, despite supervisory attention. Group internal audit policy not applied locally Where internal audit was entrusted to a group entity, the internal audit policy of the group entity was not formally made applicable to the local entity. No internal audit coverage of compliance The compliance function was never made subject to an internal audit.