3.4 – Effective Risk-Based Supervision of EU Financial Markets
Abstract
This article examines the key elements and practical applications of risk-based supervision in EU financial markets. Using the European Securities and Markets Authority (ESMA) Principles on risk-based supervision as its primary reference, it examines how EU supervisory authorities can allocate resources proportionately to the most significant risks while maintaining effective market oversight in a rapidly changing macroeconomic, technological and regulatory environment. The article considers the organisational and governance structures that support the risk-based approach and subsequently the lifecycle of the risk-based process, including: risk identification, risk assessment and risk prioritisation and treatment. It also explores the role of supervisory judgement, cross-border cooperation and data in promoting supervisory effectiveness and argues that a common risk-based framework strengthens investor protection, financial stability and the integrity of EU financial markets.
Information
| Type | Risk-Based Supervision; ESMA; EU Financial Markets; Supervisory Effectiveness; Investor Protection; Financial Stability; Cross-Border Cooperation; Supervisory Judgement – the work of James Monaghan, Cristina Iudice and Dounia Shita |
| Information | Journal of Financial Supervisors Academy, Volume 2, November 2026, pp. 211–225 |
| Creative Commons |   This is an open access article under the CC BY license. Journal of Financial Supervisors Academy © 2026. Licensed under CC BY 4.0. |
| Copyright | © The Authors, 2026. Published by Journal of Financial Supervisors Academy |
Introduction
In today’s financial markets, supervisors operate in an environment defined by accelerating complexity, expanding risk channels, growing interconnectedness and rapid innovation. These evolutions require supervisors to keep pace with traditional risks alongside emerging vulnerabilities and growing links among participants, products and jurisdictions. This is fundamental to ensuring efficient and resilient markets, safeguarding investors and supporting a well-functioning economy.
Alongside threats and complexities, supervisors face persistent constraints in resources, whether human, analytical, or technological. These limitations make it imperative to adopt supervisory frameworks that optimise impact rather than attempt an unrealistic and ineffective breadth of coverage.
This article seeks to address how risk-based supervision (RBS) can offer a practical and sound approach to overcome these challenges, helping supervisory authorities to best serve the public interest when safeguarding investor protection, market integrity, financial stability, and orderly market functioning.
Risk-based supervision (RBS) traditionally represents, in many fields of application, a logical and sound approach to identify, assess and prioritise those areas that require the highest attention. A meaningful and sensible approach in general, effective RBS is imperative given the complexity of supervising modern day financial markets.
In this context, the European Securities and Markets Authority (ESMA) together with the relevant National Competent Authorities (NCAs) (for the purpose of simplicity in this article – collectively referred to as the ‘EU authorities’) has recognised RBS as a cornerstone for EU securities and markets supervision. In January 2026, it published on its website common Principles on Risk-Based Supervision1 to support a supervisory framework that is consistent, proportionate, and effective across the Union.
Achieving consistent and effective risk-based approaches across EU authorities is both necessary and challenging. Supervisors of interconnected markets need to have a shared understanding of risks, and high-quality methods to prioritise work across the EU in order to prevent risks remaining unnoticed and propagating to other jurisdictions. Trust is a key component and objective in this process. Yet, each authority has traditionally developed its own approach tailored to national market specificities, capacities and practices. Advancing a consistent and sound risk-based approach is essential not only for comparability but more importantly to build a unified supervisory culture and ensure effective oversight of EU financial markets.
Proportionality, while conceptually separate, is closely intertwined with RBS. It fosters supervisory expectations and interventions that are calibrated to the scale and nature of the risks posed. This avoids unnecessary burdens while preserving the robustness of regulatory safeguards. In this context, RBS supports simplification, particularly by helping EU authorities reduce cumbersome processes while boosting supervisory efficiency and value.
ESMA’s approach to RBS is not about creating additional layers of process and procedures or building elaborate supervisory frameworks, but rather, it is about making conscious, transparent choices on where attention and resources are needed most. This reflects existing supervisory practices across the EU, where prioritisation, professional judgement and a focus on the most relevant risks is prevalent.
In this context, ESMA’s principles2 on RBS offer a guiding tool to help EU authorities make existing ways of working clearer by offering a simple structure and common vocabulary for thinking about risk identification, assessment, prioritisation and treatment. As a result, ESMA’s principles3 allow EU authorities to build on established practices while strengthening the clarity and focus of their supervisory approach.
This article aims to share ESMA’s approach to RBS, based on the principles developed together with NCAs. It presents (i) the core concepts of a risk-based supervisory mindset; (ii) the structural elements that underpin the risk-based approach; (iii) different risk identification models and risk assessment methods, exploring the balance between quantitative approaches and supervisory judgement and the role of data and intelligence; (iv) how to translate risk assessments into supervisory priorities; and (v) measuring effectiveness and impact.
Risk-Based Supervisory Mindset: Core Concepts that Matter
As a starting point, ESMA’s principles4 articulate some key concepts that form the supervisory mindset necessary for effective RBS to foster robust, proportionate and forward-looking supervision.
First, RBS suggests a move from the traditional rule-based approach to a new paradigm: it looks at maximising supervisory effectiveness by focusing resources and supervisory attention on the most significant risks. This suggests an acknowledgement that “putting a cop on every corner” has become unrealistic in today’s supervisory environment and that certain degrees of risk tolerance and trade-offs are inevitable: markets are too big, too complex, entities and activities too numerous and diverse, and resources too scarce. A robust supervisory culture reflecting this consideration is the backbone of RBS that underpins the effectiveness of the approach. Tone from the top is key: senior figures in EU authorities should promote a culture that empowers staff to make informed judgements, recognise the trade‑offs inherent in supervisory decision making, and facilitate clear communication to staff, notably on acceptable risk levels.
It is also essential to recognise that RBS does not seek to eliminate all risks but instead aims to establish a reliable framework that enables EU authorities to manage and address risks appropriately. While understanding that RBS cannot address all risks at all times, it is important to note that risks emerging from unlawful and harmful practices will not be overlooked given their adverse impact on markets and investors, as well as their potential to increase the vulnerability of the financial system and undermine trust. Equally, it is essential to maintain an appropriate level of supervisory coverage over the entire risk landscape to ensure that no risk persistently flies under the radar.
Ensuring flexibility and agility is another crucial consideration. Naturally, RBS requires a forward-looking attitude, as its aim is to identify and address risks before they materialise. In this context, risks are constantly evolving and EU authorities therefore need to shape their RBS approaches in such a way as to accommodate changes and adapt to emerging risks, in particular those arising from changing market structures and technological advancements. RBS is an inherently dynamic process which evolves and iterates and requires adjustments over time based on findings and learnings.
Importantly, RBS encourages a broader perspective by looking outward, fostering active engagement beyond boundaries and promoting external collaboration. As risks do not stop at borders but rather extend across sectors and countries, effective cooperation and information exchange with other authorities and regulatory bodies (both national and international) are imperative to inform the risk-based cycle. For the same reason, national and EU-wide risk assessments must inform and enrich one another.
RBS also acknowledges the heterogeneous nature of EU authorities’ mandates and the need to tailor their approach to sectoral specificities. Yet, it commonly relies on a consistent framework built around risk identification, assessment and prioritisation, which facilitates comparability and consistency across mandates.
Alongside this, it is essential to recognise that the effectiveness of RBS relies on two pivotal elements that are complementary to one another. Data plays a critical role in every stage of the risk-based cycle and accessing high quality data (both quantitative and qualitative) is thus a focal point of the process. At the same time, RBS is not intended to function as a mechanical process exclusively driven by data analysis: supervisory judgement and experience remain paramount throughout the entire cycle. Relatedly, risk treatment should remain top of mind, and time dedicated to maintaining an adequate risk-based model should not come at the detriment of actual risk mitigation activities.
Last but not least, RBS is above all an opportunity. By embracing it, EU authorities can effectively and efficiently shape their strategic direction and convey their supervisory strategy and key priorities to the public. This reflects a strong commitment to accountability and transparency.
Structure in Focus: The Foundational Elements Underpinning the Risk-based Approach
In addition to the above-mentioned supervisory mindsets, and before diving into the practical phases of RBS, ESMA’s principles5 outline the importance of two structural elements that are key to ensuring that an EU authorities’ organisational set up can support effective RBS.
Supervisory Strategy
A sound risk-based supervisory approach starts with a well-defined supervisory strategy. This strategy should align with EU authorities’ broader goals and set out the supervisory landscape, priorities, and the methods that will be used to meet those goals. These elements anchor supervisory planning, prioritisation, and decision‑making, ensuring that resources are allocated proportionately to the areas of greatest impact and potential harm.
The strategy should also drive the creation and maintenance of a clear risk tolerance or risk appetite statement. EU authorities need to understand the level of risk they are willing to accept, distinguishing between what are acceptable and unacceptable risks. Risk tolerance levels can help ensure a consistent approach across supervisory mandates, and facilitate decision making.
Ultimately, the authority’s leadership is responsible for delivering the supervisory strategy and ensuring it is effectively communicated both internally and externally.
Risk Assessment Framework
The second critical component found in ESMA’s principles6 is the need to have a well-conceived risk-assessment framework that is characterised by appropriate people, processes, tools, scales and parameters. This offers a coherent structure that allows EU authorities to conduct their risk-based exercises efficiently and effectively. To this end, a robust risk assessment framework would typically include:
- Governance arrangements with senior, experienced individuals responsible for overseeing the risk-based process, ensuring consistency and accountability.
- Common methods and risk models for a standardised approach across the authority’s supervisory work.
- Clear metrics and parameters to categorise entities, groups or sectors in terms of their supervisory importance, recognising that risk impacts vary depending on their size, scale, and complexity.
- Methods to review and measure the impact of past supervisory actions, ensuring lessons learned feed into future risk identification and assessment exercises.
- Continuous reviews and adaptations to the framework.
Having established the key concepts and mindsets needed for effective RBS and the overarching structural framework, ESMA’s principles7 further detail the different phases of RBS.
Risk Identification: Understanding What Matters
Risk identification forms the analytical core of RBS in EU financial markets. Without a structured understanding of the risks to which entities are exposed and their potential consequences, supervisory prioritisation can be an arbitrary and reactive exercise by EU authorities. Without thorough risk identification, key threats may go unnoticed causing supervisory efforts to be misallocated to the detriment of stable and orderly markets.
ESMA’s principles8 emphasise that effective supervision begins with a comprehensive, structured, and forward-looking identification of risks. This is not a one-off exercise, but a continuous process embedded within EU authorities’ supervisory cycles. The purpose is not merely to identify and catalogue risks, but to distinguish between material and non-material risks and to identify emerging vulnerabilities before they crystallise into market disruptions or investor harm. To achieve this, ESMA’s principles9 promote a combination of industry-wide and entity-based models as well as transaction and product-based approaches, as appropriate.
Industry-Wide Risk Identification
Industry-wide risk identification focuses on vulnerabilities that affect broad segments of financial markets. ESMA’s principles10 explain that this layer is essential for detecting systemic or structural risks that cannot be observed through the supervision of individual firms alone. It provides EU authorities with an understanding of the external risk environment in which firms under their supervisory responsibility operate. Examples of such risks include liquidity mismatches in investment fund markets, volatility affecting operations of market infrastructure firms or broad-based mis-selling of financial instruments arising from perverse market incentives.
Horizon scanning is a principal component of this process, allowing supervisors to anticipate how technological advancements, regulatory reforms, geopolitical shifts, and macroeconomic trends may influence risk profiles across the industry. This analysis can be supported through structured market research, collaborative workshops, and dedicated working groups focused on identifying both existing and emerging risks across the financial markets landscape.
Entity-Based Risk Identification
Entity-based risk identification shifts the analytical lens to individual supervised firms, such as investment firms, asset managers, and market infrastructures. As firms differ substantially in their business models, governance arrangements, risk management practices, and systemic relevance, a risk-based approach requires supervisors to form entity-specific risk profiles, with common parameters for comparability.
Entity based identification typically combines quantitative indicators, such as capital requirements, client asset holdings, complaints data, and transaction volumes with qualitative assessments of firms’ governance arrangements, internal controls environment, business model and overall strategic direction.
ESMA’s principles11 recognise that performing individual risk identification exercises for a wide universe of firms may in some cases not be operationally feasible or efficient for EU authorities, depending on the size of the supervised population. Consequently, more granular assessments may be focused on certain firms displaying characteristics of scale and complexity, with broader risk identification carried out on a thematic or clustered basis for the remainder.
The final output of the entity-based risk identification process should be a clearly defined list of risks applicable to entities or clusters.
Transaction and Product-Based Risk Identification
Other risk identification models target risks inherent in individual transactions and financial products. These models are particularly valuable for identifying (emerging) market‑conduct risks, potential conflicts of interest, or shortcomings in product governance arrangements.
ESMA’s principles12 emphasise that EU authorities should avoid adopting a rigid, one-size-fits-all risk-identification model. Instead, the model selected can be tailored to their organisational set-up and the particular features of their sectors and market. As such, EU authorities can draw on entity‑based (including clustering), product‑based, or transaction‑based models, selecting the approach that best fits the sector and its risk‑identification needs.
Risk Assessment: Measuring What Matters Through Probability and Impact
Identification alone is insufficient; in the second phase, risks must also be assessed in terms of their likelihood of materialisation and their potential impact on supervisory objectives. ESMA’s principles13 describe the risk assessment phase as the process of taking identified risks and understanding their criticality, using probability and impact variables to calculate (usually the product) the risk score.
Probability assessment involves evaluating how likely it is that a particular risk will materialise within a given time horizon. In the industry-wide model, the assessment of probability may include, for instance, analysing historical data to uncover the frequency of occurrence in the past to forecast its potential occurrence in the future.
Under an entity-based model, assessing probability involves the consideration of multiple factors, including overall market conditions, the quality of firms’ internal control environment and the frequency of past occurrences.
Impact assessment, by contrast, considers the severity of consequences should the risk materialise.
In an industry‑wide model, the impact assessment should consider factors such as investor protection, market functioning, and financial stability, as well as broader potential harms, including disruptions to critical operations or the creation of unfair market conditions.
When determining impact under the entity-based model, EU authorities are encouraged to consider such factors as consequences for their supervisory objectives, market functioning and the entity’s own regulatory compliance. This should take into account entities’ nature, scale and complexity as well as their dependencies, both domestically and cross-border. The latter is of particular relevance in the EU single market where materialisation may quickly propagate across borders and sectors. In this context, developing a shared understanding among EU authorities on interconnectedness and potential cross-border impacts, and respective perceptions of risk can significantly improve the quality of individual supervisors’ risk assessments.
The intersection of probability and impact forms the basis of risk ranking and prioritisation. These scores can be used for further risk ratings, using a defined scale such as High, Medium-High, Medium and Low. ESMA’s principles14 underscore that this structured approach enhances consistency in supervisory decision making, allowing EU authorities to justify why certain areas receive greater scrutiny than others.
Risk Prioritisation and Supervisory Treatment: How to Translate Risks Into Structured Actions
Once risks have been identified, assessed, and aggregated, supervisors can develop the risk prioritisation and treatment phases. This involves ranking risks and subsequently determining appropriate actions to address and mitigate them. This phase enables EU authorities to define their supervisory priorities, which will ultimately be reflected in their supervisory plans.
At this stage, senior management has a pivotal role to play in fostering a supervisory culture that ensures both a proper understanding of the authority’s risk tolerance and supervisory strategy while empowering staff to make decisions and appropriate trade-offs. This aspect is particularly important in the context of prioritisation across sectors where conflicting priorities may arise and where the steer of senior management can play an important role in supporting prioritisation across specific sectors or risks which may rank equally.
Prioritisation Framework
To maintain consistency throughout this phase and ensure its integrity, prioritisation should be directed by clearly established criteria and parameters, complemented by supervisory judgement.
ESMA’s principles15 provide a representative list of criteria and parameters that EU authorities may take into consideration for their assessments, such as:
- Severity: this criterion aims at supporting an approach that seeks to prioritise risks appearing as high-impact and high-probability. For example, high-probability, high-impact risks command immediate supervisory attention, while low-probability, low-impact risks may be monitored with minimal or ad-hoc intervention. Severity can be calculated using the impact and probability score of a risk (as for the risk assessment phase), considering both domestic and cross-border implications.
- Coverage: to ensure that all areas within its supervisory remit receive appropriate attention over time, an authority may wish to focus on certain risk areas regardless of their severity based on appropriate frequency, considering available resources and workload in relation to other risk areas.
- Emerging and New Risks: this parameter enables EU authorities to prioritise risks that address the emergence of new or innovative products, services or entities. The fundamental objective is to anticipate and mitigate potential future risks associated with nascent products and services and prevent their materialisation.
- Urgency: This criterion is designed to identify risks that require prompt and effective intervention to prevent imminent adverse outcomes.
- Strategic Direction: with this concept, the prioritisation of certain risks is decided in line with the strategic priorities of the authority and risks are prioritised according to their potential detrimental impact on the authority’s strategy and main objectives (e.g. promoting retail market participation by addressing risks like market manipulation or excessive fees).
Reprioritization
RBS is inherently a dynamic process as risks continually evolve throughout the supervisory cycle. It is therefore crucial that EU authorities establish and maintain continuous monitoring processes to ensure that the situation is properly overseen.
Agility is of the essence as new risks and events can emerge or the conditions associated with pre-existing risks can change over time requiring EU authorities to reassess the situation and ensure the timely reprioritisation of certain risks, if necessary. To facilitate this process, EU authorities are encouraged to use a wide range of information sources and to consider applying specific tools such as alert mechanisms to automate the process.
Risk Treatment
As outlined above, the risk prioritisation phase enables EU authorities to translate their priorities and corresponding timelines into supervisory work plans, while ensuring an efficient resource allocation in line with the authority’s risk tolerance and defined goals.
When establishing supervisory plans for the actual risk treatment, proper attention should be devoted to the use of tools to address the identified risks. In this regard, a right balance needs to be struck between desk-based ongoing supervision and targeted on-site inspections which will be contingent upon entities’ specific conditions, the nature of the identified risks and the overall risk environment.
Regular monitoring of the execution of supervisory work plans should be performed to assess progress and alignment with the defined objectives and anticipated timelines. Senior management information as well as agreement on and documentation of changes made to supervisory plans are key components of the system.
Evaluating Our Performance
Measuring supervisory impact is fundamental to promoting accountability and transparency in the oversight of financial markets. When supported by clear evidence, such measurement enables EU authorities to demonstrate their contribution to market integrity and stability, which reinforces trust and credibility with the public and market participants.
Despite its importance, the task of assessing supervisory impact is intrinsically complex. Determining causality between supervisory actions and market outcomes is rarely straightforward as they can be asymmetric, indirect, and highly sensitive to timing. Broader macroeconomic and geopolitical influences frequently shape market conditions in ways that obscure supervisory improvements. For example, during periods of rapid monetary tightening or heightened geopolitical uncertainty, market indicators such as bid‑ask spreads, asset‑price volatility, and breaches of firms’ internal limits may deteriorate regardless of supervisory intervention. In such circumstances, stronger oversight, such as enhanced analysis of liquidity risk may successfully prevent disorderly firm failures or forced fire‑sales, yet these ‘non‑events’ remain unseen. The very success of supervision, in preventing harm before it materialises, is often overshadowed by an adverse external environment.
Nevertheless, EU authorities should strive to measure their effectiveness by tracking changes in key firm-level metrics, such as governance quality, internal controls effectiveness, and the speed with which remediation actions are implemented, which can be a proxy for strong governance and high supervisory effectiveness.
Measuring impact in this way also supports future risk‑identification efforts by revealing how risks evolve and the extent to which mitigation measures are effective over time. This feedback loop enhances supervisory intelligence, enabling supervisors to refine their risk‑identification models so that they focus on the most relevant and meaningful risks in subsequent risk-based exercises.
Conclusion: Rethinking Risk-Based Supervision As Smart Regulation In Practice
As this article outlines, the shifting landscape in recent years has made it necessary for EU authorities to rethink how supervisory work is prioritised and delivered, ensuring that the most significant sources of harm are identified and addressed effectively.
RBS represents the practical embodiment of smart regulation within the EU supervisory framework. It offers a structured, forward-looking method to deploy supervisory resources with a focus and intensity that is aligned with the magnitude of potential harm. This not only supports robust oversight but enhances the overall effectiveness and coherence of the EU supervisory approach, particularly in a decentralised supervisory environment that has to cope with cross-border and interconnected risk elements.
ESMA’s common principles16 on RBS, for use by EU authorities, provides a structured framework for identifying, assessing, prioritising and addressing risks and supports a supervisory approach that is consistent, proportionate and effective across the Union.
This work further supports ESMA in its efforts towards regulatory simplification and burden reduction. Traditional compliance-based approaches, which rely on exhaustive and standardised checks, often generate unnecessary administrative pressure on both regulators and market participants. By contrast, risk-based methods and mindsets streamline supervisory focus and eliminate activities that do not materially contribute to mitigating risks, thereby supporting simplification without compromising the quality of supervisory outcomes.
ESMA will continue working to advance the practical implementation of effective RBS in EU authorities’ day-to-day work and to foster high-quality supervisory outcomes for market participants.
For ESMA and NCAs as supervisors, this will mean developing and maintaining a deep understanding of evolving market structures, emerging risks and entity-specific vulnerabilities. It will also involve building methods and approaches allowing for the comparability of outcomes and coordinated supervisory responses.
For market participants, a more targeted supervisory model encourages firms to understand and manage their risks proactively, incentivising improved governance, internal controls and transparency, and reinforcing firms’ accountability for their own risk profiles. At the same time, reduced emphasis on low-impact areas can lessen unnecessary administrative burdens, allowing firms to focus on substantive compliance rather than procedural formality. The clarity and predictability embedded in risk-based approaches also support more constructive and timely engagement between supervisors and firms, strengthening trust and reinforcing the shared objective of safeguarding investor protection, financial stability, and market integrity.
As financial markets and the supervisory architecture continue to evolve, RBS provides a resilient and adaptive framework capable of sustaining effective supervision, supporting the mission to build a more integrated, stable and efficient EU financial system.
Footnotes
1 European Securities and Markets Authority (ESMA), Principles on risk-based supervision (ESMA42-1710566791-6326, 9 January 2026) https://www.esma.europa.eu/document/principles-risk-based-supervision
2 ESMA, Principles on risk-based supervision (n1)
3 ESMA, Principles on risk-based supervision (n1)
4 ESMA, Principles on risk-based supervision (n1) 5
5 ESMA, Principles on risk-based supervision (n1) 8
6 ESMA, Principles on risk-based supervision (n1) 8
7 Ibid 9
8 ESMA, Principles on risk-based supervision (n1) 9
10 Ibid
11 ESMA, Principles on risk-based supervision (n1) 10
12 Ibid
13 ESMA, Principles on risk-based supervision (n1) 11
14 Ibid 12
