ESMA has published a follow-up report on the supervision of cross-border activities of investment firms, dated 20 July 2026. It assesses what six national competent authorities have done since ESMA's 2022 peer review, which found that home-state supervisors needed to raise their game on authorising, supervising and enforcing against firms selling investment services across borders to retail clients.
Why home-state supervision is the pressure point
Under the MiFID II passport, a firm authorised in one member state can provide investment services across the EU without a separate licence in each host country. Responsibility for supervising that activity rests mainly with the firm's home regulator, not the host countries where the customers are. That design is efficient, but it concentrates the burden on a handful of home authorities whose firms sell heavily into the rest of the bloc. ESMA's work targets exactly that home-state capacity, using its supervisory-convergence tools rather than new binding requirements.
What has improved
ESMA's headline finding is that the 2022 peer review had a clear positive impact. It points to progress across four areas: more granular vetting of firms' cross-border plans at the authorisation stage, more data-driven and risk-based ongoing supervision with cross-border indicators built into risk-scoring, stronger cooperation between authorities, and enforcement action in specific cases. The six authorities reviewed were the AFM in the Netherlands, BaFin in Germany, the CNB in Czechia, the CSSF in Luxembourg, CySEC in Cyprus and the MFSA in Malta.
Where the risk still sits
The residual concern is concentrated in the jurisdictions with the largest outbound activity. ESMA singles out Germany and Cyprus, saying they would benefit from continuing close monitoring and robust supervisory or enforcement activity proportionate to the risks posed to retail investors. The scale explains the focus. ESMA cites 2024 figures showing around 370 firms across 30 states serving roughly 10.5 million retail clients cross-border, with the six in-scope jurisdictions alone accounting for about 220 firms and more than 6 million clients, close to 60 percent of the market.
Complaint data points the same way. Firms in the six jurisdictions logged 7,128 complaints tied to cross-border activity in 2024, most of them in Germany and Cyprus, with a single German firm accounting for more than 3,000. ESMA is cautious with these numbers, noting that what counts as a complaint is defined inconsistently across firms, so the figures flag where to look rather than proving misconduct.
What it means
This is a convergence follow-up, not a crackdown. ESMA is not issuing new rules or deadlines; it is holding home regulators to the standard the 2022 review set and keeping public attention on the outliers. The exercise ties into the EU's broader push on retail investor protection under the Retail Investment Strategy and the drive toward a Savings and Investments Union, where confidence in cross-border selling matters for getting more retail money into capital markets. For firms that passport, the practical signal is that home-state scrutiny of outbound retail business is tightening in practice even without a rule change, and that concentration in a few hubs keeps those authorities under ESMA's eye. Full detail is in ESMA's follow-up report.
