ESMA launches a Common Supervisory Action on Risk management function of UCITS management companies and AIFMs

TO : Cyprus Investment Fund Managers (‘CyIFMs’): i. Cyprus UCITS Management Companies and Internally Managed Cyprus UCITS ii. Cyprus Alternative Investment Fund Managers and Internally Managed AIFs FROM : Cyprus Securities and Exchange Commission DATE : 12 August 2026 CIRCULAR NO. : C795 SUBJECT : ESMA launches a Common Supervisory Action (‘CSA’) with NCAs on Risk management function of UCITS management companies and AIFMs

1. The Cyprus Securities and Exchange Commission (‘CySEC’) wishes, with this circular, to inform the CyIFMs that the European Securities and Markets Authority (‘ESMA’) has launched the 2026 Common Supervisory Action (‘the 2026 CSA’) with National Competent Authorities (NCAs), on the risk management function of UCITS management companies and Alternative Investment Fund Managers (AIFMs) across the EU.
2. ESMA notes in its publication that risk management is a core function of investor protection and financial stability. It ensures that material risks, such as market, credit, liquidity, counterparty, and operational risks, are properly identified, measured, monitored, and managed.
3. The focus of the 2026 CSA is on the effectiveness, independence and expertise of the risk management function. In particular, the focus areas are set as follows: • governance and organisation of the risk management function; • identification, measurement and monitoring of risks; and • reporting to senior management and governing bodies.
4. CySEC acknowledges the important role of the risk management function as a key component of the governance and internal control framework of CyIFMs. An effective risk management function contributes to the sound and prudent management of UCITS and AIFs, the identification, measurement, management and monitoring of material

risks, the protection of investors and the timely escalation of risk-related matters to senior management and the Board of Directors. 5. In this context, CySEC will participate in the 2026 CSA and will initiate a targeted thematic review in late 2026 early 2027, comprising both on-site and/or desk-based reviews, on a representative sample of CyIFMs. 6. CySEC expects CyIFMs to take due note of the launch of the 2026 CSA and to consider whether their existing arrangements relating to the risk management function remain appropriate, effective and proportionate to their activities and to the UCITS and AIFs under management, in line with the applicable regulatory requirements. Sincerely, Panikkos Vakkou Vice Chairman Cyprus Securities and Exchange Commission