The European Securities and Markets Authority (ESMA) spent 2026 reviewing the supervisors of cross-border investment firms, not the firms themselves — and its July 20 follow-up report singles out Germany’s BaFin and Cyprus’s CySEC, the two home regulators of most of the EU’s cross-border contracts-for-difference (CFD) industry, as the authorities that still need to do more.

On July 20, 2026 ESMA published its Follow-up Report to the Peer Review on the supervision of cross-border activities of investment firms (ESMA42-2004696504-8471), assessing what six national competent authorities (NCAs) — AFM (Netherlands), BaFin (Germany), CNB (Czechia), CSSF (Luxembourg), CySEC (Cyprus) and MFSA (Malta) — did with the recommendations issued in the original 2022 peer review. Those six jurisdictions host 220 firms serving more than 6 million cross-border retail clients, roughly 60% of the EU/EEA total. This analysis sets out what the report found, what the supervisory chain of authority is, where enforcement has landed, and what CFD brokers should expect to be asked for next.

Methodology and sources

This analysis is built on the primary text of ESMA’s follow-up report (ESMA42-2004696504-8471, July 20, 2026) and on the underlying data set, ESMA’s Report on the 2024 cross-border provision of investment services to retail clients (ESMA35-335435667-6654, December 22, 2025). The supervisory-convergence context comes from ESMA’s Common Supervisory Action (CSA) announcement of December 2, 2025 and its public statement of February 24, 2026 on derivatives within the scope of the CFD product intervention measures (ESMA35-243228190-8024). The product-intervention parameters are taken from a live permanent national measure — the Autorité des marchés financiers (AMF) decision of August 1, 2019 — rather than from ESMA’s expired temporary decision. Jurisdictional scope is the EU/EEA; the time window is 2022 to August 2026. Enforcement figures are as reported by NCAs to the PRC and, for CySEC, run only to September 30, 2025.

What the follow-up report actually says

The follow-up is not an inspection of brokers. It is an assessment of supervisors. Under Article 34 of MiFID II, when a firm authorised in one member state provides investment services into another without a branch, supervision of that firm rests with the home NCA. That single structural fact is why a Cyprus Investment Firm serving clients in Germany, Poland or Spain answers primarily to CySEC, and why ESMA’s route to changing broker behaviour runs through CySEC rather than around it.

A peer review under Article 30 of the ESMA Regulation is a supervisory-convergence instrument, not an enforcement one. ESMA has no power to fine a CFD broker. It assesses whether an NCA’s authorisation gatekeeping, day-to-day supervision, inter-authority cooperation and use of sanctions are proportionate to the scale and risk of the activity that NCA licenses, then issues recommendations to that NCA. The 2022 review found shortcomings of differing severity at all six authorities. The follow-up, a desk-based exercise consulted with ESMA’s Investor Protection Standing Committee and Management Board before Board of Supervisors approval, asks a narrower question: has each authority closed the gap? For most areas the answer is a qualified yes, with two names attached to the qualification.

On authorisations the PRC found tangible improvement, with Czechia, Germany and Luxembourg introducing more granular assessments of applicants’ intended cross-border activities — governance, internal controls, language capabilities — and CySEC systematically incorporating cross-border elements. On ongoing supervision, all six reported enhanced data collection and most embedded cross-border indicators into risk-scoring models. On cooperation, CySEC’s average handling time for requests from other NCAs, excluding outliers, fell from 37 days in 2022 to 31 days in 2025.

The sting is in paragraph 72 and the recommendations that follow. For BaFin, the PRC noted that the volume of specific supervisory activity “appears overall contained relatively to the important volume of outgoing cross-border activities and high number of complaints”, and that this “may leave some riskier activities undetected or unaddressed”. It recommended BaFin “further scale up the volume of intrusive supervisory activities on firms active cross-border beyond annual or special audits and risk-based questions”. For CySEC, the PRC acknowledged a number of strong measures but concluded it “cannot yet conclude that CySEC is now structurally using more or stronger measures including on repeat infringers”.

How the six home supervisors compare

Jurisdiction / NCA	Cross-border retail clients (2024)	Complaints (2024)	Enforcement reported to the PRC (2022–2025)	PRC recommendation, July 20, 2026
Cyprus (CySEC)	3,566,358 (+35% vs 2022)	1,103	68 formal measures: 19 licence withdrawals, 17 suspensions, seven fines of €150,000–€1m, 25 settlements; ~600 corrective-measure demands	Analyse firms’ past supervisory history so as to “systematically take strong action against repeat infringers”
Germany (BaFin)	2,011,763	4,936 (3,179 from one firm)	Licence revoked on a CFD provider serving mainly another member state; tied-agent prohibition (2022) then licence revocation (2025); a sanction over €500,000	Scale up intrusive supervision beyond annual and special audits; examine firms with the most activity or complaints
Netherlands (AFM)	175,976	676	Two firms actioned off the 2023 ESMA data collection, one flagged for increased CFD activity in other member states	Add cross-border risk weights to supervisory guidance; represent cross-border firms in inspections
Luxembourg (CSSF)	129,092	284	22 on-site inspections covering cross-border aspects; injunction letters to entities with over 40% of EU clients outside Luxembourg; one sanction (PANC)	No new recommendation — assessed as having addressed the 2022 findings
Malta (MFSA)	117,869	117	2025 licence surrender after intensive supervisory work plus a penalty; one enforcement process ongoing from a 2023 inspection	Keep resources commensurate; authorisation staff raised 3 to 4.75 FTE, supervision 9.5 to 12 FTE
Czechia (CNB)	117,685	12	Three formal measures, all on branches under Article 35 of MiFID II; two investigations, one into firms’ use of influencers across jurisdictions	Adopt a more systematic approach for credit institutions if volumes rise

Source: ESMA Follow-up Report to the Peer Review on the supervision of cross-border activities of investment firms, ESMA42-2004696504-8471, published July 20, 2026. Client and complaint figures from ESMA35-335435667-6654. Last updated: August 13, 2026.

The table shows why the CFD sector is the implicit subject of a report that mentions contracts for difference only three times. Cyprus and Germany are the two largest outbound jurisdictions by client count, and Cyprus is where the retail CFD industry concentrated after MiFID II passporting made a single authorisation a pan-European distribution licence. The complaint asymmetry is worth reading carefully: Germany’s 4,936 complaints look alarming until 3,179 of them are traced to one firm, and ESMA itself cautions that “complaint” is defined broadly as “a statement of dissatisfaction by the client”, producing interpretational differences between firms. The PRC’s own comparison of 2022 and 2024 found complaints overall stable or decreasing in most jurisdictions.

The more interesting movement is outside the six. Between 2022 and 2024, Lithuania went from roughly 500 cross-border retail clients to over 2.5 million — attributable to a single company — with complaints rising from zero to 1,562, making it the second-largest jurisdiction in the EU by cross-border retail clients. Estonia moved from about 13,000 clients to over 138,000, Latvia from about 1,000 to over 190,000; Slovakia grew 884%, Portugal 360% and Ireland 169%. The PRC’s closing invitation is aimed squarely at those authorities: all NCAs, “including those with recent upticks in outbound cross-border volumes”, should scale supervision accordingly. A broker planning a licence move into a Baltic jurisdiction on the assumption of lighter supervision is now planning into a named ESMA priority.

“It is clear that national supervisors will remain indispensable partners, but ESMA would lead in delivering more consistent supervisory outcomes after a short transition period.”

— Verena Ross, Chair, European Securities and Markets Authority, keynote speech to the FESE Convention, June 2026 (ESMA24-450544452-2999)

Enforcement context: where the pressure actually lands

ESMA does not sanction CFD brokers. Every euro of penalty in this sector is imposed by an NCA under national law implementing MiFID II, and the follow-up report is the clearest public tally in years of what that has produced.

CySEC’s numbers are the sector’s benchmark because Cyprus licenses most of the industry. Between 2022 and September 30, 2025 it took 68 formal measures — 19 licence withdrawals, 17 suspensions, seven administrative fines between €150,000 and €1 million, 25 settlements, and six measures against owners or directors — plus corrective-measure demands in nearly 600 further cases. Against the 2018–2020 baseline of four sanctions and 16 settlements, that is a step change in volume and severity. But the PRC also recorded that the total number of formal measures “has overall reduced by at least 50% every year since 2022”, and that CySEC’s new central register tracks fines and settlements without systematically capturing a firm’s wider supervisory history. That is the specific gap the PRC wants closed, because repeat-infringer analysis is what turns a fine into a deterrent.

BaFin’s three cases are fewer but instructive in kind. The first is a CFD provider whose licence was revoked because it was offering services primarily in another member state — a direct hit on the letterbox-passporting model, where a firm authorises in one jurisdiction and books essentially all its business elsewhere. The second is an investment firm that moved cross-border distribution to a tied agent after BaFin’s 2022 prohibition, and lost its licence in 2025. The third is a sanction of over €500,000. CSSF issued injunction letters to entities with more than 40% of their EU clients outside Luxembourg plus one administrative sanction; MFSA obtained a voluntary licence surrender in 2025 after intensive supervisory work and a penalty. Three of those outcomes are licence losses rather than fines. For a cross-border CFD business the authorisation is the asset and the fine is a cost line — which is the enforcement pattern this sector should be modelling.

What this means for brokers, CASPs, fund managers and compliance teams

The follow-up report converts into concrete supervisory behaviour through two live channels. The first is the 2026 CSA on MiFID II conflicts of interest, announced on December 2, 2025 and running through 2026, which assesses how investment firms identify, prevent and manage conflicts when distributing financial instruments to retail clients. Its three declared focus areas are the impact of staff remuneration and inducements on which products are offered, the role of digital platforms in steering investors toward certain products, and how firms manage conflicts between their own profits and retail investor needs. TheIndustrySpread has covered how that sweep reaches CFD brokers but leaves prop trading untouched and how CySEC’s margin tightening intersects with it.

A CSA is a coordinated supervisory exercise, not an investigation. ESMA designs a common methodology, questionnaire and set of parameters; each NCA applies them to a sample of its own firms and reports back; ESMA publishes an aggregate findings report; individual follow-up stays national. In practice a firm in a CSA sample receives a desk-based questionnaire before anything else — typically the current conflicts-of-interest policy with its version history, the conflicts register, the remuneration policy and variable-pay scheme for client-facing and marketing staff, a description of platform design decisions affecting product prominence, affiliate and introducing-broker agreements, and management-information showing how conflicts findings reached the board. On-site work follows only for outliers. The exposure is rarely the policy itself; it is the distance between the policy and how the business actually acquires clients.

The second channel is product intervention. ESMA’s temporary CFD measures under Article 40 of MiFIR expired on July 31, 2019 and were replaced by permanent national measures that mirror them. The AMF’s decision of August 1, 2019 is representative: initial margin of 3.33% of notional for major currency pairs, 5% for listed major indices, non-major currency pairs and gold, 10% for other commodities and non-major indices, 20% for shares and anything not otherwise listed, and 50% for digital assets — plus 50% margin close-out, negative balance protection per account, a ban on monetary and non-monetary inducements, and the standardised risk warning. Those are national instruments, which is precisely why a CSA cannot alter them and why the 30:1 headline cap has held while enforcement moved offshore.

ESMA’s public statement of February 24, 2026 (ESMA35-243228190-8024) closed the most-used gap in that regime. It told firms that “the commercial name provided by firms (e.g. ‘perpetual futures’) is irrelevant for the categorisation under MiFID II”, that voluntary safeguards such as negative balance protection or “insurance funds” do not take a product outside the measures, and that mass-marketing campaigns or pop-ups telling all clients to “get started now” are inconsistent with the narrow target market these products require. Firms distributing perpetual-style crypto derivatives in the EU should assume they are distributing CFDs, with the PRIIPs Key Information Document obligation attached. For firms weighing a move outside the perimeter instead, the economics of real versus paper offshore regimes have changed as well.

“Efficiency gains linked to direct supervision are highly questionable. Costs of double-layered supervision are tremendous.”

— Gilles Roth, Minister of Finance, Luxembourg, on the Commission’s proposal to centralise supervision at ESMA, Council debate of May 5, 2026 (Agence Europe)

What is next — the forward view

Three timelines matter. The CSA runs through 2026, with NCA-level sampling under way and an aggregate ESMA findings report the usual output; on past CSAs that has arrived roughly a year after the exercise closes, placing publication in 2027. Firm-level follow-up will not wait for it.

The second is the Market Integration and Supervision Package (MISP), adopted by the European Commission on December 4, 2025 as three proposals amending 19 pieces of EU legislation (interinstitutional files 2025/0381, 2025/0382 and 2025/0383 (COD)). MISP would transfer direct supervision of certain significant cross-border entities to ESMA. The Council debate of May 5, 2026 exposed a three-way split: France, Spain, the Netherlands and Greece backing a broad scope; Luxembourg, Slovakia, Czechia and Austria arguing for a restrictive one; and Portugal, Denmark, Ireland, Italy and Finland seeking materiality criteria. Slovakia’s Ladislav Kamenický summarised the restrictive camp: “The scope of centralised supervision should be strictly limited to entities that are truly significant from an EU perspective.” Nothing is settled, and the proposals centre on trading and post-trading infrastructure and crypto-asset service providers rather than retail investment firms — but a finding that two home supervisors of a heavily cross-border retail sector should do more is exactly the evidence base a broader scope would be argued from.

The third is the Retail Investment Strategy, which the follow-up report notes may formalise ESMA’s annual cross-border data analytics — turning a discretionary collection into a standing obligation, and the change most likely to alter day-to-day reporting for brokers. TheIndustrySpread has examined how the strategy traded an inducements ban for value-for-money benchmarks. ESMA has also proposed revising the technical standards on cross-border passporting notifications under Article 34 of MiFID II and on NCA cooperation, and the fitness-and-propriety information-exchange system it built with the EBA and EIOPA carried more than 650 requests between authorities from its May 2025 go-live to December 2025.

FAQ

Is ESMA investigating CFD brokers?

No. ESMA has no direct supervisory or enforcement power over CFD brokers. The July 20, 2026 follow-up report assessed six national competent authorities — AFM, BaFin, CNB, CSSF, CySEC and MFSA — on how they supervise firms providing cross-border investment services. Separately, the 2026 Common Supervisory Action on MiFID II conflicts of interest is run by those same NCAs using a common ESMA methodology. Any inspection, questionnaire, fine or licence action a broker experiences comes from its home authority, not from Paris.

What is the difference between a peer review and a Common Supervisory Action?

A peer review under Article 30 of the ESMA Regulation assesses the supervisors: it examines whether an NCA’s authorisation, supervision, cooperation and enforcement practices are proportionate to the risks it licenses, and issues recommendations to that NCA. A Common Supervisory Action assesses the firms: ESMA sets a common questionnaire and methodology, each NCA applies it to a national sample, and ESMA publishes aggregate findings. Peer reviews change supervisory behaviour; CSAs generate evidence about market practice. The 2026 cycle is running both at once.

What documentation does a CSA questionnaire typically request?

For the 2026 conflicts-of-interest CSA, expect the current conflicts-of-interest policy with version history, the conflicts register, remuneration and variable-pay arrangements for client-facing and marketing staff, evidence of how digital platform design affects product prominence, affiliate and introducing-broker agreements, and management information showing how conflicts findings reach the board. Desk-based review comes first; on-site inspection follows for outliers. The recurring finding in this sector is a policy that has not been meaningfully revised while the client-acquisition model changed underneath it.

Do the EU leverage caps change because of this report?

No. Retail CFD leverage limits are permanent national product intervention measures adopted by each NCA after ESMA’s temporary measures under Article 40 of MiFIR expired on July 31, 2019. The AMF decision of August 1, 2019 sets initial margin at 3.33% of notional for major currency pairs, 5% for major indices and gold, 10% for other commodities and non-major indices, 20% for shares, and 50% for digital assets. Neither a peer review nor a CSA can amend them; only the NCA that adopted each measure can.

Why are Cyprus and Germany singled out?

Because that is where the volume is. In 2024, Cyprus-licensed firms served 3,566,358 cross-border retail clients and German firms 2,011,763 — together approaching half the EU/EEA total of 10.5 million. Germany also reported 4,936 cross-border complaints, though 3,179 came from a single firm. The Peer Review Committee’s conclusion was that authorities “with particularly significant outbound cross-border activities (DE and CY)” should keep pursuing their efforts with supervision and enforcement commensurate to the risk posed to retail investors.

Are perpetual futures treated as CFDs in the EU?

Generally yes. ESMA’s public statement of February 24, 2026 (ESMA35-243228190-8024) states that the commercial name is irrelevant to categorisation under MiFID II, and that a derivative giving leveraged exposure to an underlying that is not exclusively physically settled will likely fall within the CFD product intervention measures. Voluntary negative balance protection or an “insurance fund” does not remove a product from scope. Firms distributing these products to EU retail clients also owe a PRIIPs Key Information Document.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.