The Cyprus Securities and Exchange Commission (CySEC) has informed Cyprus fund managers that European regulators are launching an EU-wide review of how investment firms manage risk, with local checks expected to begin in late 2026 or early 2027.

In a circular, CySEC told Cyprus investment fund managers that the European Securities and Markets Authority (ESMA) has launched its 2026 Common Supervisory Action, or CSA, together with national regulators across the European Union.

The review will examine the risk management functions of UCITS management companies and alternative investment fund managers (AIFMs), with CySEC taking part in the EU-wide exercise.

The regulator said the initiative was particularly relevant to Cyprus investment fund managers because it would assess whether their existing arrangements for identifying and dealing with risks are appropriate for the scale and nature of their businesses.

ESMA considers risk management a central part of protecting investors and maintaining financial stability.

It covers the way firms identify, assess, monitor and manage risks that could affect funds and investors, including market, credit, liquidity, counterparty and operational risks.

The EU review will focus on how effective, independent and suitably skilled risk management functions are, rather than simply whether firms have the relevant structures in place.

It will examine how those functions are governed and organised, how risks are identified, measured and monitored, and how information about risks is reported to senior management and the governing bodies of investment firms.

CySEC said it regarded risk management as an important part of the governance and internal control framework of Cyprus investment fund managers.

An effective risk management function, the regulator said, helps ensure that UCITS and alternative investment funds are managed in a sound and prudent manner.

It also helps firms identify, measure, manage and monitor significant risks, protect investors and ensure that concerns are brought to the attention of senior management and boards of directors in a timely manner.

The Cypriot regulator will now carry out its own review as part of the wider ESMA exercise.

The commission said it plans to begin a targeted thematic review in late 2026 or early 2027, covering a representative sample of Cyprus investment fund managers.

The review may involve on-site inspections, reviews carried out remotely using information supplied by firms, or a combination of the two.

CySEC has therefore urged Cyprus investment fund managers to assess their existing risk management arrangements before the supervisory work begins.

The regulator expects firms to consider whether their current systems remain appropriate, effective and proportionate to their activities, as well as to the UCITS and alternative investment funds they manage.

Firms are also expected to ensure that their arrangements comply with the relevant regulatory requirements.

The exercise will cover Cyprus UCITS management companies and internally managed Cyprus UCITS, as well as Cyprus alternative investment fund managers and internally managed alternative investment funds.

The initiative forms part of ESMA’s broader use of Common Supervisory Actions to promote consistent supervision across EU financial markets.

Rather than each national regulator carrying out entirely separate assessments, the approach allows regulators across the EU to examine the same issue using a common supervisory focus.

For Cyprus firms, the forthcoming review means that risk management arrangements are likely to come under closer scrutiny over the coming months.

The areas being examined extend beyond the existence of formal risk policies and include the independence and expertise of the people responsible for managing risk, how effectively risks are monitored and whether important information reaches decision-makers.

CySEC’s circular does not set out any new rules for firms, but instead draws their attention to the EU-wide supervisory exercise and asks them to assess whether their current arrangements remain suitable.

The regulator said firms should take the launch of the 2026 CSA into account when considering whether their risk management functions continue to meet applicable regulatory requirements.

The initiative comes as European regulators continue to place emphasis on strong internal controls and effective oversight within the investment fund sector, particularly where weaknesses in risk management could expose investors or financial markets to losses.

Cyprus has a sizeable investment fund sector, making the forthcoming thematic review significant for local fund managers that may be selected as part of the representative sample.