If you're in capital markets compliance across multiple EEA jurisdictions, ESMA's latest sanctions report likely caught your attention. Compliance officers, risk managers, and GRC leads are all asking what uneven enforcement means for their compliance programs.
The key facts: National authorities across the EEA imposed over 950 administrative sanctions and measures in 2025, a stable number compared to the past two years. Total fines reached nearly €82 million, with an increased use of settlements. Here's how to interpret these findings.
Q1: Our numbers look stable year over year. Does "stable" mean we can stand pat?
No. A stable aggregate volume doesn't indicate where enforcement risk lies for your firm. The report highlights ongoing focus on breaches of the Market Abuse Regulation and MiFID/MiFIR. If your business involves order handling, trade reporting, or market soundings, you're in areas where authorities are active.
Stability doesn't mean uniformity. ESMA notes significant differences in sanctions, fine levels, and settlement use. A flat total can mask real changes. Use the report as a guide to where your regulatory obligations might be tested, not as a sign that nothing is changing.
Q2: Germany, France, and Spain account for two-thirds of fine value. Should we only worry about those three?
No. While two-thirds of total fine value is concentrated in these jurisdictions, ESMA clarifies that limited enforcement elsewhere isn't always due to market size. Low enforcement in a Member State may reflect supervisory approach, not low risk.
Don't ignore a jurisdiction because it has few fines. ESMA is working to ensure similar breaches lead to similar outcomes across the EU. If successful, quieter jurisdictions might see changes. Build your controls to the strictest credible interpretation of the rules, not based on local enforcement history.
Q3: Can we benefit from uneven enforcement by operating where scrutiny is lighter?
Trying this is risky. Regulatory arbitrage relies on gaps remaining open. ESMA aims for similar breaches to have similar outcomes across the EU. Convergence is the goal.
Market Abuse Regulation and MiFID/MiFIR obligations apply as EU law. A lenient local enforcement history doesn't change your obligations, just the current odds of getting caught. If your controls rely on an authority not acting, you're making a risky assumption that won't hold up under scrutiny.
Q4: Settlements are up. Is that good news for firms?
Partly. Settlements can mean faster resolution and more predictable outcomes than contested processes. However, they're not used uniformly, and ESMA highlights differences in national practices.
Your breach response plan shouldn't assume settlements are available or on what terms in every jurisdiction. Map which authorities offer settlements, what they expect, and who in your organization can engage. Settlements still carry reputational weight and may affect your material disclosure analysis. Plan this process in advance.
Q5: How should we reflect this in our compliance monitoring and testing?
Shift from one-size-fits-all control testing to Control Objective Mapping, linking each control to the specific rule it supports in each jurisdiction. This helps show authorities how a control addresses an obligation, especially when interpretations vary.
Adjust your risk weighting. Use the report's focus on Market Abuse Regulation and MiFID/MiFIR to prioritize testing. Run scenario analyses on breaches under stricter enforcement regimes, considering fine exposure, remediation workload, and disclosure consequences. If your GRC platform tags obligations by jurisdiction and rule, use it to identify where you're most exposed to stricter authorities.
Q6: ESMA says enforcement shouldn't be measured only by sanctions counts. What does that mean for judging our program?
It means you should apply the same principle. ESMA notes that supervisory effectiveness depends on compliance, not just sanctions. A firm with no enforcement actions doesn't necessarily have an effective program, and one with actions isn't necessarily failing.
Measure your program with leading indicators: timely remediation of deficiencies, decreasing policy gap analysis findings, timely review of surveillance alerts, and training completion for those handling market-sensitive information. Enforcement outcomes are lagging indicators. Relying solely on them means you'll learn about failures from a regulator.
Next Steps
Start with ESMA's published sanctions report and its key findings. The underlying data is available in Excel, which you can use for your own analysis to compare jurisdictions. Review national competent authority publications for each Member State where you're active, as they contain sanction notices and settlement details. Finally, brief your legal and compliance leads together: convergence is a shared project, and your controls, escalation paths, and disclosure decisions should reflect the strictest credible interpretation across your entire footprint.
