1. Thematic Review: Compliance & Internal Audit Functions of Management Companies of AIF & UCITS.

This review assessed the effectiveness of the second and third lines of defence of Management Companies of Alternative Investment Funds (AIFs) and UCITS (“Management Companies”).

• Key Findings: compliance monitoring plans were not supported by a clear risk assessment covering relevant business activities. In addition, deficiencies were noted in the record keeping element of deficiencies and remedial measures.  Moreover, in several cases, the internal audit plan was not always treated as a dynamic document, with limited tracking of whether planned tests were carried out or delayed.
  • Supervisory Expectations: Compliance Monitoring Plans: Management Companies should ensure that compliance officers implement a plan to assess all risks that the Management Company is exposed to.  The plan should be supported by a documented and sufficiently granular compliance risk assessment, which should form the basis for determining the scope, frequency and prioritisation of compliance monitoring and oversight activities across all operational activities.
  • Audit Plans:  Fund Managers should have a clear audit plan, irrespective of the size of the operations of the Company ensuring that high-risk areas (e.g., valuation or liquidity) are audited and eventually tracked for sufficient remediation. Although exemptions related to the establishment of a dedicated internal audit function are allowed, Fund Managers should consider outsourcing of ad-hoc internal audit reviews to cover key risk areas of the business.

2. IDD Suitability: Client Sustainability Assessment in IBIPs

Focused on the advisory sales process for Insurance-Based Investment Products (IBIPs) following the implementation of Commission Delegated Regulation (EU) 2021/1257.

• Key Findings: While most firms have updated their suitability questionnaires, the review found that the distinction between the three categories of "sustainability preferences" (as per paragraphs (a), (b), and (c) of the definition) was not always clearly communicated to retail clients.
• Supervisory Expectations:
  • Technical Training: Staff must possess the competency to explain complex ESG concepts without being misleading.
  • Periodic Assessment: For existing clients, firms are expected to identify sustainability preferences at the next scheduled suitability review rather than waiting for a client-initiated trigger.
  • Product Matching: There must be a granular "matching" process where the sustainability profile of the IBIP is mapped directly against the client's expressed preferences to prevent greenwashing at the point of sale.

3. Targeted Review: Commercial Real Estate (CRE) Lending

A deep-dive into credit risk governance and management of CRE portfolios against the backdrop of changing interest rate environments and European Banking Rules (BR/09, BR/24, BR/28) and the CRR.

• Key Findings: The review highlighted gaps in Collateral Management, Unlikeness to pay criteria, the use of forward-looking indicators for "Significant Increase in Credit Risk" (SICR) and classification of forborne loans. Some institutions lacked granular data on borrower-level cash flows, relying too heavily on historical collateral valuations.
• Supervisory Expectations:
  • Risk Appetite (RAF): Banks must establish more rigorous, board-approved limits specifically for CRE exposures, including sensitivity analysis for "Acquisition, Development and Construction" (ADC) lending.
  • Early Warning Systems (EWS): Implementation of data-driven EWS that triggers proactive management of "Unlikeliness to Pay" (UTP) indicators.
  • Collateral Management: Regular, independent revaluations are mandatory, especially for large exposures, to ensure that Loss Given Default (LGD) estimates remain accurate.
  • New BR/32 Alignment: Credit institutions are reminded of the 100% risk weight application for residential ADC exposures provided specific risk-mitigating conditions are satisfied.